In CTPAT, how should threats be communicated between parties?

• A. Threat information should never be shared.
• B. Establish clear policies for communicating how to share information about threats.
• C. Only annual threat reports are allowed.
• D. Threat sharing is optional.

Answer: (B)

Clear policies for communicating threat information ensure that everyone involved knows what to share, when to share it, and how to share it securely. In CTPAT, timely and secure exchange of threat information across the supply chain is essential to identify risks early and coordinate effective mitigations. Formal policies lay out the process, channels, and formats for sharing, define who initiates and who receives information, and set rules for protecting sensitive data. They should specify what counts as a threat indicator, how information is validated, the approved communication methods (such as secure portals or encrypted channels), the frequency of updates, and the escalation path for urgent actions. This structured approach helps ensure information is accurate, actionable, and delivered quickly, enabling partners to implement appropriate countermeasures across origin, transit, and destination points. Threat information sharing is a collaborative security practice, not something to be delayed or treated as optional or limited to annual reports.