C-TPAT CCTV Requirements for Indian Exporters: What CBP's Criteria Actually Say
CBP's C-TPAT Minimum Security Criteria (October 2021 edition, checked 14 Oct 2026) set five camera criteria, 9.12 to 9.16. Only two are "Must": cameras must cover the export process (9.13), and footage must get periodic random reviews, written up (9.15). Recording 24/7 and keeping footage 14 days after arrival are "Should".
Last checked: 14 Oct 2026
By the Mama Editorial Team, for owners whose US buyer has sent a security questionnaire or announced an audit. Not legal advice.
Verified against
- CBP, CTPAT Minimum Security Criteria – Foreign Manufacturers, October 2021 (PDF on cbp.gov), pages 32–36, criteria 9.6–9.16; page 20, criterion 5.6
- CBP, CTPAT Minimum Security Criteria – U.S. Importers, October 2021 (PDF on cbp.gov), criteria 3.4–3.7 and 9.12–9.16
- CBP, Foreign Manufacturers eligibility page (cbp.gov), last modified 1 Jun 2026
- CBP, CTPAT Mutual Recognition FAQs, July 2025 (PDF)
- CBIC, AEO India portal: MRA page (USA date of signing 22.09.2021) and AEO-T1 tier page
- CBIC/DGTS presentation, Authorised Economic Operator Scheme (PDF on bangalorecustoms.gov.in); it quotes October 2020 figures
- Checked 14 Oct 2026.
- CBP's foreign-manufacturer page still links the October 2021 PDF, uploaded 15 Feb 2023 (checked 14 Oct 2026).
The camera criteria, word for word
The 9.13–9.16 text is identical in the foreign-manufacturer and US-importer editions (compared 14 Oct 2026). "If camera systems are deployed" opens four of them: C-TPAT does not order you to install cameras. Once you have them, these apply.
| ID | What CBP's text says | Must / Should | What an auditor will ask to see |
|---|---|---|---|
| 9.7 | "Security technology should be utilized to monitor premises and prevent unauthorized access to sensitive areas" | Should | Camera layout over cargo, seal storage, IT server |
| 9.8 | Written policies on use, maintenance and protection of security technology; regular tests documented; reviewed "annually, or more frequently" | Must | A dated test log and the written policy |
| 9.10 | All security technology infrastructure, including recordings, "must be physically secured from unauthorized access" | Must | Locked NVR room or rack, who holds the key |
| 9.11 | Alternative power source so systems keep running on loss of power | Should | UPS or generator on the NVR and cameras |
| 9.12 | Cameras should monitor premises and sensitive areas; alarms on unauthorised access | Should | Coverage of the yard and stores |
| 9.13 | Cameras "must be positioned to cover key areas of facilities that pertain to the import/export process"; record at "the highest picture quality setting reasonably available" and "on a 24/7 basis" | Must (positioning); the recording settings sentence uses "should" | Views of stuffing, sealing, container inspection, truck arrival and exit |
| 9.14 | An alarm or notification for a "failure to operate/record" condition | Should | Proof that someone is alerted when a camera or disk dies |
| 9.15 | "Periodic, random reviews of the camera footage must be conducted"; results "summarized in writing", including corrective actions, kept "for a sufficient time for audit purposes" | Must | The review log itself |
| 9.16 | Footage of key export processes "should be maintained on monitored shipments" long enough for an investigation; CBP recommends "at least 14 days after a shipment has arrived at its first point of distribution" | Should | Retention setting versus your shipping lead time |
| 5.6 | "All security inspections should be performed in an area of controlled access and, if available, monitored via a CCTV system" | Should | A camera on the seven-point inspection spot |
Source: CBP Foreign Manufacturers MSC PDF above; labels from its Must/Should column.
Criterion 9.15 is the paperwork criterion. CBP lists five items for the written summary: the date of the review, the date of the footage reviewed, which camera or area, a brief description of findings, and corrective actions if warranted. CBP adds that if footage is "only reviewed for cause", "the full benefit of having cameras is not being realized".
Why these rules reach an Indian factory at all
An Indian manufacturer cannot join C-TPAT directly. CBP's eligibility page requires a foreign manufacturer to be "incorporated in Mexico or Canada" (page last modified 1 Jun 2026, checked 14 Oct 2026).
The rules arrive through your US buyer. Under criterion 3.5 of the importer criteria, a C-TPAT member that outsources parts of its supply chain "must exercise due diligence (via visits, questionnaires, etc.)" so that partners meet or exceed the Minimum Security Criteria.
CBP's guidance to importers lists three ways to check you: an onsite audit, an audit by a hired contractor, or a security questionnaire that may ask for "photographic evidence" and copies of policies. Under 3.6, weaknesses found must be fixed "in a timely manner", and CBP names "photographs taken of a newly installed security camera" as acceptable evidence.
Criterion 3.4 offers a shortcut. Certification in an AEO programme under a mutual recognition arrangement with the US is "acceptable proof" for business partners. CBIC's AEO India portal dates the US MRA to 22 September 2021 (checked 14 Oct 2026); CBP's July 2025 MRA FAQ also lists India. CBP's 3.4 guidance assumes a foreign AEO certificate "will include the security component".
India's AEO tiers do not all include a security assessment. In the CBIC/DGTS presentation, the "Safety and Security" block (premises, cargo, conveyance, personnel security) is marked "NA" for AEO-T1 and required for T2 and T3, while a site plan showing "security features (CCTV camera etc.)" is required for every tier. CBIC's AEO India portal lists "International MRA Facilitation" as a T2 benefit, not on its T1 page (checked 14 Oct 2026).
The 14-day advice, in Indian shipping days
Criterion 9.16 counts 14 days from arrival at the buyer's first point of distribution, where the container is first opened after US Customs, not from sealing. So the footage of your stuffing and sealing has to survive the whole voyage plus 14 days.
Worked example. Assume 30 days from sealing at an Indian plant to the buyer's first distribution centre (check your real lane), four cameras on the dock and inspection area, each at an assumed 4 Mbps (H.265, 4 MP), and an assumed ₹2,300 per TB of surveillance disk, the figure used in our retention guide.
| Retention setting (days) | Covers C-TPAT 9.16 for this lane? | Disk for 4 dock cameras (TB) | Disk cost (₹, assumed) |
|---|---|---|---|
| 30 (a common setting) | No: footage gone before the container is opened | 5.2 | ~12,000 |
| 45 (30 transit + 14 + 1 day margin) | Just | 7.8 | ~17,900 |
| 60 (slow lanes, transhipment) | Yes, with margin | 10.4 | ~23,800 |
The arithmetic: 4 Mbps × 86,400 seconds is 43.2 GB per camera per day, or 172.8 GB a day for four cameras. Only the dock cameras need the long setting. Our days-per-4TB table gives the figure for other bitrates.
What breaks in a factory
- Power cuts. An NVR on raw mains reboots and loses the loading hour: criterion 9.11 (backup power, "Should") turning into a 9.15 finding.
- Dock lights at night. Criterion 9.6 makes lighting at entrances, cargo areas and fence lines a "Must". Night stuffing under one lamp gives unreviewable footage.
- Dust and moved cameras. CBP's own 9.8 guidance says to check that lenses "are clean and lenses are focused" and that cameras "remain in the proper position".
- Silent disk failure. A dead disk still shows live view. Criterion 9.14 asks for a failure-to-record alert.
- Overwrite settings. An NVR set to overwrite when full keeps whatever the disk allows, not what your shipping lane needs.
What cameras cannot prove
A camera cannot confirm that the seal number matches the bill of lading; criterion 6.7 makes that a person's VVTT check (view, verify, tug, twist). It cannot see inside sealed cartons. And it cannot replace the written 9.15 review: unreviewed footage is not a control. A clip used in an Indian court also needs a Section 63 certificate.
The dock cameras also film your workers. Under India's DPDP rules, a worker notice is the clean way to handle that; see the worker CCTV notice template.
What to ask your buyer and your installer
- Buyer: which edition of the criteria do you audit against, and does an Indian AEO-T2 certificate replace your questionnaire?
- Buyer: how many days from our sealing to your first distribution point?
- Installer: can the NVR keep dock cameras longer than the rest, and email someone when a camera stops recording?
- Installer: what keeps the NVR and dock cameras running through a power cut?
For the wider set of Indian rules, start from the factory CCTV compliance checklist.
The same dock and shop-floor cameras can do production work too. Mama reads existing cameras over RTSP/ONVIF and sends the owner a short morning note on where machines stood idle the day before; it watches machines and flows, not individuals. Leave an email or phone in the form below.
FAQ
Is C-TPAT mandatory for Indian exporters? No. C-TPAT is a voluntary US programme, and direct membership for foreign manufacturers is limited to firms incorporated in Mexico or Canada (CBP, checked 14 Oct 2026). In practice your US buyer, if it is a member, must check you against the criteria under criterion 3.5.
How long should CCTV footage be kept for C-TPAT? CBP recommends at least 14 days after the shipment arrives at its first point of distribution (criterion 9.16, a "Should"). For an Indian ocean shipment, that means transit time plus 14 days, often 45 days or more.
Does C-TPAT require 24/7 recording? No: the 24/7 line in criterion 9.13 is a "should". The "Must" is positioning cameras over the key export areas.