Links Consulting have passed along some important information about the Trusted Trader Program. There is going to be a huge shift as both the CBP and CBSA have made more than 40 changes to the PIP and CTPAT programs.

Here is the information provided by Links Consulting

Trusted Trader Programs Update 2025:
Don’t Tell Me – Show Me

Your TTP ain’t what it used to be. CBP and CBSA made more than forty changes to the PIP and
CTPAT programs in the latest minimum-security updates. Some are minor word changes.
Others require a meaningful change in management activity by both members and their
business partners. “The current revision reflects …. the heightened risk of data breaches and
cyberattacks, the targeting of global supply chains by terrorists and criminal organizations and the risk of
agricultural contaminants entering the supply chain.”

From Policy to Proof
Traditionally, membership relied on the “tell me what you do” approach. In some cases, a
document was uploaded or a short description added, but proof of use wasn’t required. Not
anymore.

Proof of awareness and participation across all areas of the organization is now a “must”.
Procurement, logistics, operations – all must participate in risk assessment and business
continuity activities and generate reports.

IT and cybersecurity measures are greatly expanded. Password policy, multi-factor
authentication, data-breach response, and recovery must all be recorded. Many carriers will find
the social media prevention and system testing requirements challenging. Even the disposition
of digital assets such as thumb-drives, laptops, phones and smart TVs requires detailed
inventories and confirmation of data wiping.

Key program requirements strengthened in 2025

1. Governance and oversight

Expanded documentation and annual audit requirements with senior management sign-off.

2. Risk assessment and business continuity.

Detailed risk assessments and periodic reviews required as standard practice and after trigger
events such as incidents, new partners, or operational changes.
Business continuity and disaster recovery plans must be designed, implemented, and supported
by records of review.
Proof of annual reviews of all aspects of the security profile.

3. Cybersecurity and access control

Heightened password standards and mandatory multi-factor authentication policies.
Documented data-breach identification, response, recovery, and reporting plans.
Evidence that controls are implemented, tested, and maintained.

4. Training and awareness

Increased scope of topics including terrorism, smuggling, hijacking, human trafficking, and
money laundering. Increased proof of training records – CTPAT specifies that records include
date, attendees, and topics, and that training effectiveness is verified.

The bad actors are becoming more sophisticated, which means legitimate participants must
engage in more meaningful ways. Your assets could be used to smuggle contraband or engage
in activities these programs are designed to prevent — without your knowledge. Having the
right documentation ready for the agency if that occurs can mean the difference between a
short suspension and the loss of membership — and business. My daily SVI feed is full of
members are being suspended and removed every day.

These changes go beyond adding a few paragraphs to an existing policy manual.
I supported a client through the validation process with CBSA earlier this year. The policies,
procedures, and supporting framework were all in place. Proof of implementation in the form of
training records, audit files and implementation records were front and centre of the CBSA
focus. No record? – didn’t happen.

The reach across departments will require participation from teams for whom these initiatives
have been largely invisible. Operational and financial pressures over the last three years have
reduced headcount and budgets, increasing the load on remaining staff.

For fleets that joined primarily for marketing purposes, this may be the time to revisit the value
of continued participation. Can you justify the administrative burden and financial cost if you
are not moving TTP (FAST /CSA) loads? What is the return on that plaque in the lobby?
For fleets with active FAST and CSA freight lanes – maintaining that business is dependent on
meeting the MSRs. Start now, while you have the benefit of time to do a needs assessment,
gap analysis and implementation. Business relationships with non TTP partners are now
materially more burdensome.

For more information feel free to inquire with

Links Consulting

rickm@sclinksconsulting.com
www.sclinksconsulting.com