Which individuals should have authorized access under CTPAT access control measures?

• A. External consultants
• B. Visitors with appropriate authorization
• C. Facility employees, contractors, and visitors with appropriate authorization
• D. Facility employees

Answer: (C)

Access to secure areas must be restricted to individuals who have a legitimate business need and have been formally authorized. This means there should be a clear process to issue credentials, monitor who has access, and revoke it when someone’s need or authorization ends. The most appropriate choice reflects all the groups that typically require controlled access: facility employees, contractors, and visitors who have appropriate authorization. This covers the ongoing workforce (employees), the workers brought in to perform specific tasks (contractors), and guests who may need access for short periods (visitors), all under authorization and proper oversight.

External consultants can be included if they have authorization, but limiting access to them alone would omit employees and contractors who also need access. Limiting to only employees or only visitors would similarly omit other necessary groups. So, including facility employees, contractors, and authorized visitors aligns with the practice of granting access only to those with a legitimate need and proper authorization.