What type of cybersecurity policy must companies have for CTPAT?

• A. A policy focusing solely on physical security.
• B. A comprehensive written cybersecurity policy based on industry standards.
• C. No formal policy is required.
• D. A basic password policy only.

Answer: (B)

CTPAT treats cyber risk as a fundamental part of supply chain security, so a formal, written cybersecurity policy is required. This policy should be comprehensive and aligned with recognized industry standards, outlining how information assets are protected, how risk is identified and managed, and how controls are implemented across the organization. It should cover governance, incident response, access management, data protection, vendor risk, training, and ongoing monitoring to ensure consistent security practices.

A policy that focuses only on physical security or a minimal policy like a basic password rule does not address the broader cyber risk landscape or governance and oversight. There is also no allowance for having no formal policy, since a documented approach is essential for verifying and sustaining security measures.