What must a company have to be CTPAT certified regarding business operations?

• A. A business office in the United States.
• B. A fully staffed corporate office in any country.
• C. A business office staffed in the United States or Canada.
• D. A regional office in Mexico.

Answer: (C)

Having a business office staffed in the United States or Canada shows a real, ongoing physical presence in North America, which CBP requires to validate a company’s role in the supply chain and to maintain security oversight. This staffed office serves as the primary point of contact for CTPAT validations, risk assessments, and the implementation of security controls across operations, ensuring the company can reliably train employees, monitor procedures, and respond to incidents. A fully staffed corporate office in any country or a regional office in Mexico wouldn’t meet this North American staffing requirement, and simply having a US-only office wouldn’t capture the necessary cross-border presence CBP expects. Therefore, having a staffed business office in the United States or Canada is the appropriate criterion.