TAPA and C-TPAT are the two transit security standards buyers ask about most, and they cover different risks. TAPA sets audited facility and trucking controls against cargo theft. C-TPAT is a voluntary US Customs and Border Protection program for supply chain security at the border. Which matters depends on what you ship and where.
Security questionnaires and logistics providers' certifications increasingly describe the same controls, yet the two frameworks are often cited without clarity about what they cover. A provider may hold either, both, or neither.
What Does TAPA Require?
Audited security controls against cargo theft. TAPA is an industry association whose standards address theft of high-value, theft-attractive goods, a category that squarely includes IT equipment.
The Facility Security Requirements standard covers warehouses and storage locations: perimeter security, access control, intrusion detection, CCTV coverage and retention, alarm response, and personnel screening. It is graded into levels, with A the most stringent and C the baseline.
The Trucking Security Requirements standard covers goods in motion: driver vetting, vehicle security specifications, route planning, prohibitions on unattended stops, communication protocols, and tracking.
There is also a parallel standard addressing air cargo and one addressing parking security, which matters more than it sounds — a large share of cargo theft occurs from vehicles parked at unsecured locations.
For a relocation, TSR is generally the more relevant of the two, with FSR mattering where equipment will be stored between sites. Certification is audited by approved auditors rather than self-declared, which is what gives it evidentiary value.
What Does C-TPAT Require?
C-TPAT is a voluntary US Customs and Border Protection program addressing supply chain security in the context of international trade, aimed at preventing the supply chain from being used to move contraband, weapons, or people.
Participants commit to security criteria spanning business partner screening, container and conveyance security, physical access controls, personnel security, procedural security, and security training, and submit to CBP validation.
The benefits are customs-facing: reduced inspection rates, priority processing, shorter border wait times, and access to expedited programs. For international shipments, that translates into more predictable transit times — which for a migration with a fixed cutover window is a schedule benefit rather than merely a compliance one.
Other jurisdictions run comparable programs under the World Customs Organization SAFE Framework, and many have mutual recognition arrangements with C-TPAT.
C-TPAT is only relevant if goods cross a US border. For a purely domestic relocation it does not apply, and a provider offering it as evidence of security posture for domestic work is offering the wrong credential.
Which Standard Is Relevant to Your Move?
For a domestic relocation of high-value equipment, TAPA TSR is the credential that speaks to the actual risk, which is theft.
For an international move, C-TPAT or its equivalent matters for border predictability, and TAPA still matters for the theft exposure. They are complementary rather than alternatives.
For a move involving stored equipment — staging, temporary storage between sites, or equipment awaiting disposition — TAPA FSR addresses the facility, and storage is where a great deal of loss actually occurs.
Neither certification is a substitute for the diligence appropriate to your own regulatory obligations. Neither addresses data protection specifically, and a TAPA-certified carrier is not thereby demonstrating anything about how they handle media.
How Do You Verify a Certification Claim?
Certifications get cited loosely, and the details determine whether the claim means anything.
Confirm which standard and which level. TAPA level C is a meaningfully lower bar than level A, and "TAPA certified" without a level is an incomplete statement.
Confirm scope. A provider may hold certification for certain facilities or certain operations and not others. The relevant question is whether it covers the operation handling your shipment.
Confirm currency, with an expiry date, and verify with the certifying body rather than accepting a document. Certifications lapse.
Confirm whether it extends to subcontractors. Providers routinely subcontract freight, and a certified provider brokering to an uncertified carrier has handed your shipment outside the controls you were relying on. This is the most consequential question and the one least often asked.
When Should You Require Certification?
Certification requirements add cost and narrow the pool of available providers, so requiring them should follow from the exposure rather than from a general preference for more security.
The case is strong for shipments of high aggregate value, equipment that is scarce or long-lead such that theft creates a schedule impact well beyond the replacement cost, moves through regions with elevated cargo theft rates, and equipment carrying sensitive data where physical loss becomes a disclosure event.
Where certification is not warranted, the underlying controls may still be worth specifying directly in the contract — vetted drivers, no unattended stops, GPS tracking, defined routes, and continuous custody. The controls are what reduce the risk. The certification is evidence that somebody independent has verified them.