; (2) at the time of initial application and annually thereafter, including in advance of any recertification or revalidation, submit an international supply chain security profile, which shall identify how such entity meets the minimum security criteria of the CTPAT program established by the Commissioner and how such entity will maintain and enhance internal policies, procedures, and practices related to international supply chain security; and (3) meet any specific requirements for eligible entities, as established by the Commissioner. (c) Minimum security criteria The Commissioner shall establish minimum security criteria for participants in the CTPAT program, review such minimum security criteria not less than once every two years, and update such minimum security criteria as necessary. Such minimum security criteria shall seek to address security vulnerabilities in the international supply chain. (d) Additional and updated criteria The Commissioner may establish additional and updated security criteria for individual CTPAT program participants, categories of CTPAT program participants, or particular entity types to meet in order to address a security vulnerability in the international supply chain. (e) Consultation When establishing or updating security criteria in accordance with subsection (c), and when establishing new or updated security criteria in accordance subsection (d), the Commissioner shall consult with CTPAT program participants and other interested parties, and shall— (1) conduct a cost benefit analysis of such proposed new or updated security criteria, as the case may be, in consultation with the Commercial Customs Operations Advisory Committee established under section 109 of the Trade Facilitation and Trade Enforcement Act of 2015 ( Public Law 114–125 ; 19 U.S.C. 4316 ); (2) determine operational feasibility and, where appropriate, provide best practices for meeting such new or updated security criteria to CTPAT program participants specific to their entity type