6 U.S. Code § 963. Minimum requirements

An applicant seeking to participate in C–TPAT shall—
(1)
demonstrate a history of moving cargo in the international supply chain;
(2) conduct an assessment of its supply chain based upon security criteria established by the Secretary, acting through the Commissioner, including—
(A)
business partner requirements;
(B)
container security;
(C)
physical security and access controls;
(D)
personnel security;
(E)
procedural security;
(F)
security training and threat awareness; and
(G)
information technology security;
(3)
implement and maintain security measures and supply chain security practices meeting security criteria established by the Commissioner; and
(4)
meet all other requirements established by the Commissioner, in consultation with the Commercial Operations Advisory Committee.