; (2) at the time of initial application and annually thereafter, including in advance of any recertification or revalidation, submit an international supply chain security profile, which shall identify how such entity meets the minimum security criteria of the C–TPAT program established by the Commissioner of U.S. Customs and Border Protection and how such entity will maintain and enhance internal policies, procedures, and practices related to international supply chain security; and (3) meet any specific requirements for eligible entities, as established by the Commissioner. (c) Minimum security criteria The Commissioner of U.S. Customs and Border Protection shall establish minimum security criteria for participants in the C–TPAT program, review such minimum security criteria not less than once each year, and update such minimum security criteria as necessary. Such minimum security criteria shall seek to address security vulnerabilities in the international supply chain. (d) Additional and updated criteria The Commissioner of U.S. Customs and Border Protection may establish additional and updated security criteria for individual C–TPAT program participants, categories of C–TPAT program participants, or particular entity types to meet in order to address a security vulnerability in the international supply chain. (e) Consultation When establishing or updating security criteria in accordance with subsection (c), and when establishing additional or updated security criteria in accordance subsection (d), the Commissioner of U.S. Customs and Border Protection shall consult with C–TPAT program participants and other interested parties, and shall— (1) conduct a cost benefit analysis of such proposed new, additional, or updated security criteria in consultation with the Commercial Customs Operations Advisory Committee established under section 109 of the Trade Facilitation and Trade Enforcement Act of 2015 ( Public Law 114–125 ; 19 U.S.C. 4316 )