To  address the potential security risks posed by the millions of containers  that arrive in the United States each year, CBP has implemented a  layered security strategy of related initiatives and programs that focus  CBP’s limited resources on potentially high-risk cargo bound for the  United States while allowing other cargo to proceed without unduly  disrupting commerce. Container Security Initiative. In response to a requirement in the SAFE Port  Act to scan 100 percent of U.S.-bound cargo containers, CBP established  SFI. Customs-Trade Partnership Against Terrorism. Through C-TPAT, CBP officials work  with member private companies to review the security of their supply  chains to ensure their security practices meet CBP’s minimum security  criteria. In return, C-TPAT members receive various benefits, such as  reduced scrutiny of their shipments. CBP Has Made Substantial Progress in Enhancing Cargo Security, but Some Challenges Remain

Our prior work has shown that CBP has made substantial progress in  implementing various initiatives and programs that, collectively, have  enhanced cargo security, but some challenges remain. Examples of  progress and challenges in the areas of (1) using information for  improving targeting and risk assessment of cargo shipments, (2)  partnerships with foreign governments, and (3) partnerships with the  trade industry are discussed below. CBP’s Efforts to Improve Targeting and Risk Assessments of Cargo Shipments

In January 2015, we found, among other things, that CBP did not have  accurate data on the number and disposition of each high-risk maritime  cargo shipment scheduled to arrive in the United States. Further, our analyses found that CBP’s data  overstated the number of high-risk shipments, including those that  appeared not to be resolved (examined or waived) in accordance with  CBP policy. We  recommended, among other things, that CBP define waiver categories  and disseminate policy on issuing waivers for high-risk shipments. DHS  concurred with our recommendations and, in December 2015, CBP  issued a new policy, National Security Cargo Targeting Procedures, that  includes criteria for waiving mandatory examinations of high-risk  shipments (referred to as exceptions). In addition, CBP developed a new process for  recording waivers and issued a memorandum to targeting units on how to  apply the new procedures. Specifically, we found that CBP had not regularly assessed foreign  ports for risks to cargo under the CSI program since 2005. We recommended that DHS periodically assess the supply  chain security risks from all foreign ports that ship cargo to the United  States and use the results of these risk assessments to inform any future  expansion of CSI to additional locations and determine whether changes  need to be made to existing CSI ports and make adjustments as  appropriate and feasible. DHS concurred with our recommendation and,  in response, CBP developed a CSI Port Risk Matrix and Port Priority  Map. According to CBP, these tools are to be  updated yearly and, if necessary, can be updated more frequently based  on significant changes, emerging threats, and intelligence. Senior DHS and CBP officials acknowledged that  most, if not all foreign ports, would not be able to meet the July 2012  target date for scanning all U.S.-bound cargo, and DHS would need to  issue extensions to such ports to allow the continued flow of commerce in  order to remain in compliance with relevant statutory requirements. In May of 2012, 2014, and 2016, the Secretary of Homeland Security  authorized a 2-year extension of the deadline for implementing the 100  percent scanning requirement for U.S. bound cargo before it is loaded  onto vessels at foreign seaports. However, we found challenges with the  technology CBP used to help ensure that validation information is  consistently collected, documented, and uniformly applied to decisions  regarding the awarding of benefits to C-TPAT members, and that CBP  lacked a systematic process to ensure that members take appropriate  actions in response to security validation findings. We made recommendations  to CBP to strengthen C-TPAT program management and oversight. CBP has since implemented these  recommendations by, for example, creating an automated platform to  track and capture the content and communication between CBP and C- TPAT members to ensure that C-TPAT validation report  recommendations are implemented and identifying analytical tools and  data for trend analysis to better assess C-TPAT’s impact on the supply  chain. Appendix I: Description of CBP’s Layered Security Strategy for Maritime Cargo Shipments

This appendix describes the key initiatives and programs related to U.S.  Customs and Border Protection’s (CBP) strategy for ensuring the security  of maritime cargo.
Why GAO Did This Study

The U.S. economy is dependent on the expeditious flow of millions of tons of cargo each day through the global supply chain—the flow of goods from manufacturers to retailers. Criminal or terrorist attacks using cargo shipments can cause disruptions to the supply chain and can limit global economic growth and productivity. Within DHS, CBP has responsibility for administering maritime cargo security measures and reducing the vulnerabilities associated with the supply chain. CBP has developed a layered security strategy that focuses its limited resources on targeting and examining high-risk cargo shipments that could pose a risk while allowing other cargo shipments to proceed without unduly disrupting commerce arriving in the United States.
This statement discusses the progress and challenges associated with CBP's implementation of initiatives and programs responsible for enhancing the security of the global supply chain. The statement is based on reports and testimonies GAO issued from April 2008 through January 2015 related to maritime cargo security—with selected updates on how DHS has responded to GAO's prior recommendations.

What GAO Found

The Department of Homeland Security (DHS) and U.S. Customs and Border Protection (CBP) have made substantial progress in implementing initiatives and programs that, collectively, have enhanced cargo security, but some challenges remain. Examples of progress and challenges are discussed below.
Risk Assessments of Cargo Shipments . In January 2015, GAO found that CBP did not have accurate data on the number and disposition of each high-risk shipment scheduled to arrive in the United States. Specifically, CBP's data overstated the number of high-risk shipments, including those that appeared not to be examined or waived in accordance with CBP policy. CBP officers inconsistently applied criteria to make some waiver decisions and incorrectly documented waiver reasons. GAO recommended that CBP define waiver categories and disseminate policy on issuing waivers. In response, CBP issued a new policy that includes criteria for waiving examinations of high-risk shipments and developed a new process for recording waivers and issued a memorandum.
Partnerships with Foreign Governments. In September 2013, GAO reported that CBP had not regularly assessed foreign ports for risks to cargo since 2005. GAO recommended that DHS periodically assess the security risks from ports that ship cargo to the United States and use the results to inform whether changes need to be made to Container Security Initiative (CSI) ports. DHS concurred with the recommendation and CBP has since developed a port risk matrix and priority map to be used to help assess whether changes need to be made to CSI ports. These tools are to be updated yearly and can be updated more frequently based on significant changes, emerging threats, and intelligence. These tools should assist CBP in ensuring it is allocating its resources to provide the greatest coverage of U.S.-bound high-risk cargo.
In October 2009, GAO reported challenges to scanning 100 percent of U.S.- bound cargo at foreign ports. DHS officials acknowledged that most, if not all foreign ports, would not be able to meet the July 2012 target date for scanning all U.S.-bound cargo, and DHS would need to issue extensions to allow the continued flow of commerce and remain in compliance with statutory requirements. Although the Secretary of Homeland Security has issued three 2-year extensions for implementing the 100 percent scanning mandate, which have extended the deadline to July 2018, DHS has not yet identified a viable solution to meet the requirement.
Partnerships with the Trade Industry. Through the Customs-Trade Partnership Against Terrorism (C-TPAT) program, CBP officials work with member companies to validate the security of their supply chains in exchange for benefits, such as reduced scrutiny of their shipments. In April 2008, GAO found, among other things, that CBP lacked a systematic process to ensure that members take appropriate actions in response to security validations. GAO recommended that CBP document key data elements needed to track compliance. CBP has since implemented a process to ensure that C-TPAT validation report recommendations are implemented. GAO is currently reviewing the C-TPAT program, to include an assessment of CBP's ability to meet its security validation responsibilities.

What GAO Recommends

In prior reports, GAO has made recommendations to DHS to strengthen various maritime cargo security programs. DHS generally concurred with the recommendations and has taken actions, or has actions under way, to address many of these recommendations.