Which statement best describes the role of risk-based measures in CTPAT?

• A. They prioritize resources toward lower-risk areas.
• B. They are optional practices.
• C. They prioritize resources toward higher-risk areas, while maintaining baseline security for all members.
• D. They remove all baseline security requirements.

Answer: (B)

Risk-based measures in CTPAT are enhancements that go beyond the mandatory security requirements. The program sets a baseline of security that all members must meet, and then offers optional risk-based measures as additional practices that an organization can adopt to strengthen security where risk is higher or resources permit. This is why the statement that risk-based measures are optional practices best captures their role: they are voluntary add-ons used to tailor security to a company’s risk profile, rather than mandatory changes that all members must implement. The baseline security remains in place for everyone, and the risk-based measures are optional opportunities to bolster safeguards.