Which of the following is included in Procedural Security under CTPAT?

• A. Documented SOPs, clear processes, separation of duties, verification steps, and accountability.
• B. Ongoing training to recognize threats and properly respond to incidents, with periodic refreshers.
• C. A plan and procedures to respond to emergencies, minimize disruption, and resume operations quickly.
• D. Protecting shipment data with access controls, encryption, secure networks, and regular patching.

Answer: (A)

Procedural Security is about having formal, repeatable ways to carry out security tasks, with clear documentation and assigned responsibilities. Documented standard operating procedures provide the exact steps to follow, ensuring consistency across all operations. Clear processes map out how activities flow, leaving little room for ad hoc or inconsistent actions. Separation of duties prevents unilateral control by one person, reducing the risk of errors or misuse. Verification steps add checks that catch issues before they become problems, and accountability assigns responsibility so there is a traceable owner for each task. Together, these elements create an auditable, controlled framework for how security work is performed.

The other options describe related but distinct areas: ongoing training focuses on preparing people to recognize threats and respond, which is more about personnel readiness; a plan to respond to emergencies and resume operations is about contingency and emergency response planning; protecting shipment data with controls and patching pertains to information security and cyber hygiene.