Annex 1 to the Third Resolution of Modifications to the General Rules for Foreign Trade for 2023, published on July 25, 2023 — SHCP — MX

6 OFFICIAL GAZETTE Thursday, August 3, 2023

ANNEX 1 to the Third Resolution of Modifications to the General Rules for Foreign Trade for 2023,
published on July 25, 2023.

A seal with the National Coat of Arms appears at the margin, which reads: United Mexican States.- TREASURY.- Ministry of Finance and Public Credit.- Tax Administration Service.

FIRST MODIFICATION TO ANNEX 1 OF THE GENERAL RULES FOR FOREIGN TRADE FOR 2023

Formats and Models for Foreign Trade

Content
I. ...
II. Foreign Trade Formats.
A. to C. ...
D. Declarations.
E. Formats.
F. Applications.

Indicative References

Format Name | Authority before which it is presented | Submission Method --- | --- | --- A. to C. ... | ... | ...

D. Declarations

Declaration Name | Authority before which it is presented | Submission Method --- | --- | --- D1. ... | ... | ...
D2. Customs declaration for passengers coming from abroad (Spanish and English). | Customs | Free writing D3. Declaration of money leaving with passengers (Spanish and English). | Customs | Free writing D4. to D9. ... | ... | ...

E. Formats

Format Name | Authority before which it is presented | Submission Method --- | --- | --- E1. and E2. ... | ... | ...
E3. Company Profile. | AGACE | Digital Window
E4. Customs Broker Profile. | AGACE | Digital Window E5. Land Auto Transporter Profile. | AGACE | Digital Window E6. Courier and Parcel Service Profile. | AGACE | Digital Window

Thursday, August 3, 2023 OFFICIAL GAZETTE 7

F. Applications

Application Name | Authority before which it is presented | Submission Method --- | --- | --- F1. and F2. ... | ... | ...
F3. Application for Registration in the Company Certification Scheme. | AGACE | Free writing / Digital Window F3.1 and F3.2 ... | ... | ...
F3.3 Procedure guide to obtain Registration in the Company Certification Scheme in the Authorized Economic Operator modality under the headings of Import and/or Export; Holding Company; Aircraft; SECIIT; Textile; Strategic Fiscalized Premises and Logistics Outsourcing. | AGACE | Free writing F3.4 Procedure guide to obtain Registration in the Company Certification Scheme, Certified Commercial Partner modality, headings: land auto-transporter, customs broker, railway transport, industrial parks, fiscalized premises, and courier and parcel service. | AGACE | Digital Window F4. and F5. ... | ... | ...

III. ...

Indicative References

Model Name | Authority before which it is presented | Submission Method --- | --- | --- M1.1. to M1.11. ... | ... | ...
I. ...
II. Foreign Trade Formats:
...

D2.

12 OFFICIAL GAZETTE Thursday, August 3, 2023

D3.

Thursday, August 3, 2023 OFFICIAL GAZETTE 13

E3.
Company Profile.

Receipt Acknowledgment
First Time: Renewal:
Addition:
Modification:
The data provided will replace the data provided when you requested your authorization.

General Information.
The objective of this Profile is to ensure that companies implement security practices and processes that secure their supply chain to mitigate the risk of contamination of their merchandise with illicit products.

Companies interested in obtaining their inscription in the Registration in the Company Certification Scheme in the Authorized Economic Operator modality under the headings of Importer and/or Exporter, Holding Company, Aircraft, SECIIT, Textile and Logistics Outsourcing referred to in rule 7.1.4., must demonstrate that they have documented and verifiable processes required in this document according to the model or business design they have established based on risk management, seeking during the implementation of minimum security standards the application of an analysis culture that supports preventive and reactive decision-making against threats and/or risk circumstances in accordance with the values, mission, vision, codes of ethics and conduct of the company itself.

Filling Instructions:
1. You must fill out one Profile for each of the facilities that operate under the same RFC (Taxpayer Registration Code), where they carry out manufacturing processes of foreign trade products and, if applicable, those related facilities such as: industrial and/or manufacturing plants, warehouses, distribution centers, consolidation, among others. This information must match what is stated in your Application for Registration in the Company Certification Scheme.
2. Detail how the company complies with or exceeds what is established in each of the subsections as indicated.
3. The format of this document is divided into two sections, as detailed below:
1. Standard.
Description of the standard
1.1 Sub-standard.
Description of the sub-standard
Response. Explanatory Notes.
Describe and/or attach... a) Points to highlight...

Installation Data.
A Company Profile must be filled out for each of the facilities that belong to and operate under the same RFC and that carry out manufacturing processes of foreign trade products and, if applicable, those related facilities such as: industrial and/or manufacturing plants, warehouses, distribution centers, consolidation, etc.

Installation Information. Company Profile Number:
RFC Name and/or Business Name:
Name and/or Denomination of the
Installation
Type of Installation
Street Number and/or exterior letter Number and/or interior letter Neighborhood Postal Code Municipality/Delegation Federal Entity Age of the plant (years of operation):
Predominant activity of the plant:
Products that it manufactures or handles in this plant:
(As applicable)
No. of average monthly shipments (EXP):
(By transport means)
No. of average monthly shipments (IMP):
(By transport means)
No. of total employees of this installation:
Installation surface (m2):

Certifications in security programs: (Indicate if this installation has a certification from any of the following programs) CTPAT Yes No Level: Pre-Applicant: Applicant: Certified: Certified/Validated:
CTPAT Account number (8 digits):
Manufacturer Identification Code (MID): Date of last visit to this installation:
Authorized Economic Operator from other countries (AEO):
Yes No Program: Registration:
Other supply chain security programs:
Yes No Program: Registration:
Certifications: (Indicate if you have certifications that you consider impact your supply chain process, for example: ISO 9000; Reliable Logistics Processes, among others) Name: Category: Validity:
Name: Category: Validity:

Supply Chain Security Planning.
The company must develop documented policies and procedures to carry out an analysis that allows the identification of risks and weaknesses in its supply chain with the objective that the company's senior management implements strategies that help mitigate risk in the organization's operations. Likewise, to build a solid supply chain security program, the company must have a Security Committee that incorporates representatives from all relevant departments, forming a multifunctional team that identifies areas for opportunity and proposes continuous improvement actions throughout the supply chain and the company's installations. Similarly, the company must have designated points of contact for the Authorized Economic Operator Program, which must be involved and know the requirements of the Authorized Economic Operator, belong to the company and accredit its relationship with it, as well as respond to its supply chain security specialist (this is assigned once the company already has the Authorized Economic Operator Program). If, derived from the risk analysis, new security measures arise to be incorporated into the company, these must be included in the company's existing procedures and, if applicable, new procedures must be elaborated, which creates a more sustainable structure and emphasizes that supply chain security is everyone's responsibility.

1.1 Risk Analysis.
The company must establish measures to identify, analyze and mitigate security risks within the supply chain and its facilities. For the above, it must develop a written process to determine risks based on its organization's model (example: location of facilities, type of merchandise and country of origin, volume, clients, suppliers, routes, personnel hiring, classification and handling of documents, Information Technology, potential threats, etc.), which allows it to implement and maintain appropriate security measures. Based on the above, the company must also have a written process based on its risk analysis to select new business partners and monitor those with whom it is already working. This procedure must be updated at least once a year, so that it allows permanently identifying other risks or threats that are considered in its operation and in the supply chain, due to the result of some security incident or when they originate from changes in the company's initial conditions, as well as to identify that the policies, procedures and other control and security mechanisms are being complied with. It is important to note that the company's Security Committee must participate in the elaboration and updating of the risk analysis, as well as in the maintenance of the Authorized Economic Operator Program.

Response: Explanatory Notes:
Indicate what the sources of information used are to calibrate risks during the analysis phase.
Attach the risk matrix, as well as the documented procedure to identify risks in the supply chain and the facilities of your company, which must include at least the following points:
a) Periodicity with which it reviews and/or updates the risk analysis. b) Aspects and/or areas of the company that are incorporated into the risk analysis. c) Methodology or techniques used to carry out the risk analysis. d) Those responsible for reviewing and/or updating the risk analysis of the company. Likewise, the documented procedure to identify risks in the supply chain and its facilities, must contemplate the risk appreciation and management process, and include the following aspects:
a) Establishment of a context (cultural, political, legal, economic, geographic, social, etc.). b) Identification of risks in its supply chain and its facilities. c) Risk analysis (causes, consequences, probabilities and existing controls to determine the level of risk as high, medium and low). d) Risk evaluation (decision making to determine the risks to treat and priority for implementing the treatment). e) Risk treatment (application of alternatives to change the probability of risks occurring). f) Risk monitoring and review (monitoring of the results of the risk analysis and verification of the effectiveness of its treatment). It is suggested to use the administration, management and risk evaluation techniques according to international standards ISO 31000, ISO 31010 and ISO 28000 that, according to your business model, you must implement.

1.2 Security Policies.
The company must have a policy oriented to prevent, secure and recognize threats in the security of the supply chain and the company's installations, such as drug trafficking, money laundering, arms trafficking, human trafficking, prohibited merchandise and acts of terrorism.
To promote a security culture, companies must demonstrate their commitment to supply chain security and the Authorized Economic Operator Program through a statement highlighting the importance of protecting the flow of national and international commerce from criminal activities, established through the security policy. The senior officials or executives of the company who must endorse and sign the security policy can be the company president, the chief executive officer, the general manager or personnel with a homologous position with decision-making authority.

Response: Explanatory Notes:
State the security policy oriented to prevent, secure and recognize threats in the supply chain and company installations, indicate who is responsible for its review, signature and dissemination to employees, as well as the periodicity with which its update is carried out.
This policy must be communicated to employees through a program and/or dissemination campaign.
The security policy must be signed by a senior official of the company and be displayed in various areas of the company, including the company website, posters in key areas of the company (reception, shipments, receipts, warehouse, etc.), and as part of the company's initial and reinforcement training.

1.3 Internal Audits in the Supply Chain.
In addition to routine monitoring in control and security, it is necessary to schedule and carry out periodic audits, which allow evaluating all processes in terms of security in the supply chain in a more critical and profound way, as well as guaranteeing that its employees follow the company's security procedures. Audits must be carried out by the company's Security Committee, establish a documented procedure, as well as a program or calendar for their realization. Although it is necessary that audits are focused on supply chain security and based on the evaluation, review and execution of minimum security standards, their focus must be adjusted to the size of the organization, risk level, business model and variations between installations. Audits can be general or focus on specific areas or processes according to their work program. The objective of an internal audit focused on the Authorized Economic Operator Program is to verify and guarantee that employees follow the company's security procedures. The review process does not have to be complex, however, the formats and records used for the application of such reviews must evidence that the application and execution of the evaluated processes were validated, in addition to the follow-up and closure of preventive, corrective and improvement actions identified. The senior management of the organization must review the results of the audits, and undertake the corrective or preventive actions required. The audit process must guarantee that the necessary information is collected to allow management to make this evaluation. The review must be documented, in addition to which the company's Security Committee must provide and register periodic updates on the progress or results of any audit, exercise or validation.

Response: Explanatory Notes:
Describe the documented procedure to carry out an internal audit focused on security in the supply chain, ensure you include the following points:
a) Indicate how the company carries out the programming or calendarization to carry out an internal audit in terms of security in the supply chain. b) Indicate who participates in them, and the records that are effectuated from them, as well as the periodicity with which they are carried out. c) Indicate how the company's management verifies the result of the audits in terms of security, how it carries out and/or implements preventive, corrective and improvement actions, in addition to the follow-up and closure of the same. d) The formats used during internal audits must be properly filled out, and through them, evidence that the procedures and security measures are being put into practice.

1.4 Contingency and/or Emergency Plans.
There must be a documented contingency and/or emergency plan, this plan must address crisis management, security recovery plans and the resumption of work to ensure business continuity in the event of a situation that affects the normal development of the activities and foreign trade operations of the company in its supply chain. A crisis or contingency may include the interruption of the transmission and exchange of commercial data due to a cyberattack, a fire, the kidnapping of a transport driver by armed individuals, (a customs closure, a bomb threat, the detection of suspicious packages, the cut of electrical power, the theft and/or damage of merchandise, threats or extortion, blockades or road closures, among others). Such plans must be communicated to personnel through periodic training, as well as carrying out tests, practical exercises and annual simulations of the contingency and emergency plans to verify their effectiveness, from which it must maintain a duly filled out and signed record (for example: result reports, minutes or reports, which must be backed up by video recordings, photographs, etc., that demonstrate their execution). The contingency and/or emergency plan must be updated as necessary, based on changes in operations and the organization's risk level.

Response: Explanatory Notes:
Attach the documented contingency and/or emergency procedure or plan, to ensure business continuity in case of an emergency or security situation, that affects the normal development of the company's foreign trade activities.
This procedure must include, in an enumerative but not limiting manner, the following:
a) What situations it contemplates, describing the plan of action and steps to be followed in case of crisis, as well as the tasks that personnel have assigned during the handling of such contingencies. b) What mechanisms it uses to disseminate and ensure that these plans are effective. c) Contemplate the programming and carrying out of tests, practical exercises and annual simulations and how they are documented (for example: result reports, minutes or reports, which must be accompanied by video recordings, photographs, etc., that demonstrate their execution).

Physical Security.
The company must have established mechanisms and documented processes to prevent, detect, or deter the entry of unauthorized personnel into the facilities. All sensitive areas of the company must have physical barriers, control elements, and deterrents against unauthorized access.

2.1 Facilities.
Facilities must be constructed with materials capable of resisting unauthorized access. Periodic documented inspections must be carried out to maintain the integrity of structures, and in case any irregularity is detected, the corresponding repair must be made, for example: result reports, minutes, or reports, which must be accompanied by video recordings, photographs, etc., that demonstrate their execution. Likewise, territorial limits, as well as various accesses, internal routes, and the location of buildings, must be fully identified. Response: Explanatory Notes:
Indicate the predominant materials with which the installation is constructed (for example: metal structure and sheet walls, brick walls, concrete, cyclone mesh, among others), and indicate how the review and maintenance of structural integrity is carried out.
Indicate the personnel or area responsible for carrying out inspection, maintenance, and damage repair tasks for the facilities.
Attach a distribution or architectural plan of the complex, where the limits of the installations, access routes, emergency exits, location of buildings, critical areas, parking lots, and boundaries can be identified.

2.2 Accesses at doors and booths.
The entrance or exit doors for vehicles and/or personnel must be attended, controlled, watched, and/or supervised. The number of access doors must be kept to the minimum necessary. Access to sensitive areas must be restricted according to the job description or assigned tasks.
Response: Explanatory Notes:
Indicate how many doors and/or accesses exist in the installations, as well as the operating hours of each, and indicate how they are monitored (if there is assigned personnel, indicate the quantity).
Detail if there are blocked and/or permanently closed doors and/or accesses.
Describe how you ensure that access to sensitive areas is restricted according to the job description or assigned tasks (include the type of records and controls you use).

2.3 Perimeter Walls.
Perimeter walls and/or peripheral barriers must be installed to secure the parameters of the company's facilities, based on a risk analysis. Fences, interior barriers, or a mechanism to identify and segregate international cargo, as well as high-value and dangerous cargo, must be used. These must be inspected regularly and keep a record of the review with the aim of ensuring their integrity and identifying damage, which must be repaired as soon as possible by the personnel designated for these tasks. Storage areas, high-value, dangerous, and/or restricted-access areas must be clearly identified and monitored to prevent unauthorized entries. Response: Explanatory Notes:
Describe the type of fence, peripheral barrier, and/or walls that the company has, make sure to include the following points:
a) Specify which areas are segregated. b) Point out their characteristics (material, dimensions, etc.). c) In case of not having walls, justify the reason in detail. d) Frequency with which the integrity of the perimeter walls is verified and the records that are kept with the aim of ensuring their integrity and identifying damage, which must be repaired as soon as possible. e) Indicate the personnel or area responsible for carrying out inspection and damage repair tasks. Describe how the cargo destined for foreign countries, dangerous material, and high-value material is segregated; make sure to include the following points:
a) Indicate how you separate national merchandise and foreign trade merchandise, and if it is additionally identified (for example: different packaging, labels, packing, among others). b) Identify and point out restricted-access areas (dangerous merchandise, high value, confidential, etc.). The procedure for inspecting perimeter walls could include:
a) Responsible personnel to carry out the process. b) How and how often inspections of fences, perimeter walls, and/or peripheral walls and buildings are carried out. c) How the inspection record is kept. d) Who is responsible for verifying that repairs and/or modifications comply with technical specifications and necessary security requirements.

2.4 Parking Lots.
Access to the facility parking lots must be controlled and monitored by security personnel or designated for this task. Private vehicles (of employees, visitors, suppliers, contractors, among others) must be prohibited from parking within the merchandise handling and storage areas, as well as in adjacent areas. Response: Explanatory Notes:
Describe the procedure for controlling and monitoring parking lots, make sure to include the following points:
a) Those responsible for controlling and monitoring access to parking lots. b) Identification of parking lots (specify if the visitor and employee parking is separated from the storage and merchandise handling areas). c) How vehicle entry and exit to the facilities is controlled. Indicate the records made for parking control, existing control mechanisms (for example: badges, card readers, lanyards, etc.), how they are assigned, and the responsible area for doing so. d) Policies or mechanisms to not allow private vehicles into the merchandise storage and handling areas.

2.5 Key and Lock Device Control.
Windows, doors, as well as interior and exterior fences, according to their risk analysis, must be secured with locking devices. The company must have a documented procedure for the handling and control of keys and/or locking devices for interior areas considered critical. Likewise, they must keep a record and establish signed responsibility letters by persons who have keys or authorized access according to their level of responsibility and work within their work area. Response: Explanatory Notes:
Indicate if all doors, windows, interior and exterior entrances have closing or security mechanisms.
Attach the documented procedure for the handling and control of keys and/or locking devices, make sure it includes the following points:
a) Those responsible for administering and controlling key security. b) Format and/or control record for key lending. c) Treatment for loss or non-return of keys. d) Point out if there are areas where access is granted with electronic devices and/or some other access mechanism.

2.6 Lighting.
Lighting inside and outside the facilities must allow clear identification of people, material, and/or equipment located therein, including the following areas: entrances and exits, handling, loading, unloading, and storage areas for merchandise, perimeter and/or peripheral walls, interior fences, and parking areas, and must have an emergency and/or backup system in sensitive areas. Response: Explanatory Notes:
Describe the procedure for operating and maintaining the lighting system, make sure to include the following points:
a) Point out which areas are illuminated and which have a backup system (indicate if you have an auxiliary power plant or some other mechanism to supply electricity in case of any contingency). b) How do you ensure that the lighting system is appropriate in each of the company's areas, so that it allows clear identification of the personnel, material, and/or equipment located there. c) Person responsible for controlling and maintaining lighting systems. d) Maintenance and revision program (in case it coincides with another process, indicate it). The procedure may include:
a) How the lighting system is controlled. b) Operating hours. c) Identification of areas with permanent lighting.

2.7 Communication Devices.
The company must have communication devices and/or systems with the aim of contacting security personnel and/or authorities immediately in case of an emergency and security situation. Additionally, a backup system must be available and its proper functioning verified periodically.
Response: Explanatory Notes:
Describe the procedure that personnel must perform to contact the company's security personnel or, in their case, the corresponding authority in case of any security incident.
Indicate if operational and administrative personnel have or dispose of devices (landline phones, mobile phones, alert and/or emergency buttons, etc.) to communicate with security personnel and/or whoever corresponds (these must be accessible to users to have a prompt reaction).
Indicate what type of communication devices the company's security personnel uses (landline phones, cell phones, radios, alarm system, etc.).
Describe the procedure for controlling and maintaining communication devices, make sure to include the following points:
a) Policies for assigning mobile communication devices. b) Maintenance or replacement program for fixed and mobile communication devices. c) Indicate if you have backup communication devices, in case the permanent system fails, and, if applicable, describe them briefly.
The procedure may include:
a) Person responsible for the good functioning and maintenance of communication devices. b) Verification and maintenance record of the devices. c) Method of assigning communication devices.

2.8 Alarm Systems, Closed-Circuit Television, and Video Surveillance.
Alarm systems, closed-circuit television, video surveillance, and security technologies must be used to watch, notify, or deter unauthorized access and prohibited activities in the facilities and other considered sensitive areas, notify the corresponding area, and also be used as evidence tools in investigations derived from any security incident. These security systems and technologies must be placed according to a prior risk analysis, in such a way that areas involving the handling, loading, unloading, and storage of merchandise, raw materials, and packaging materials are kept under watch and monitored, security inspections of cargo vehicles, as well as the access of personnel, visitors, suppliers, passenger and cargo vehicles, and other considered sensitive areas. These systems must allow clear identification of the area or environment being watched, be recording permanently, and keep a backup of recordings for at least one month, considering that, in case their logistics processes exceed this period, the backup maintenance period must be increased, with the aim of having the necessary elements to assign corresponding responsibilities in case of a security incident. Alarm systems, closed-circuit television, video surveillance, and security technologies must have a documented operation procedure that includes supervision of the good condition of the equipment, verification of the correct position of cameras, indicating the frequency with which backups of recordings must be made, as well as those responsible for their operation. Such system and all security technology infrastructure must have restricted access. Response: Explanatory Notes:
Mention the documented procedure indicating the functioning of the external alarm central or sensors, and if applicable, describe the following points:
a) Indicate if all doors and windows have alarm sensors, as well as areas where motion sensors are available. b) Procedure to follow in case an alarm is activated.
Describe the documented procedure for the operation of alarm systems, closed-circuit television, video surveillance, and security technologies (this must be reviewed and updated annually and according to the risk analysis or circumstances), make sure to include the following points:
a) Indicate the number of security cameras of the alarm and closed-circuit television and video surveillance systems installed, and their location by area (Detail if it covers loading and unloading zones, including entry and exit points of the facilities, to cover the movement of vehicles and individuals, and where the inspection indicated in sub-standard 7.2 takes place). Attach a layout or map of the distribution of security cameras. b) Point out the location of alarm systems, closed-circuit television, video surveillance, and security technologies, where monitors are located, who reviews them, as well as operating hours, and if applicable, if there are remote monitoring stations. All security technology infrastructure must be physically protected against unauthorized access. c) Periodic and random reviews of recordings must be carried out. Indicate how they review them (randomly, every week, special events, restricted areas, etc.), who is the designated personnel, and how management gets involved in the reviews. The results of the reviews must be documented to include corrective actions for audit purposes. d) Indicate for how long these recordings are kept (must be at least one month). e) Alarm systems, closed-circuit television, video surveillance, and security technologies must have an alternative energy source that allows them to continue functioning in case of unexpected loss of direct power. For this reason, indicate if alarm systems, closed-circuit television, video surveillance, and security technologies are backed up by an electrical power plant or some other mechanism to supply electricity, guaranteeing their functioning. These systems should have an alarm/notification function, indicating a failure condition in functioning and/or recording, point out if your systems have this function. f) Indicate if, in addition to alarm systems, closed-circuit television, and video surveillance, you use any other type of technology to strengthen the security measures already in place. g) Describe the procedure implemented to regularly test and inspect alarm systems, closed-circuit television, video surveillance, and security technologies and ensure their good functioning. The results of inspections and functioning tests must be documented, as well as necessary corrective actions (these must be implemented as soon as possible). Additionally, the documented results of these inspections must be kept for a sufficient time for audit purposes. h) Indicate if the alarm provider and alarm, closed-circuit television, and video surveillance systems have access to security cameras, if they are in charge of monitoring them, how access is controlled, and who is responsible for said monitoring.

Physical Access Controls.
Physical access controls are mechanisms or procedures that prevent and impede unauthorized entry into the facilities, maintain control over the entry of employees, visitors, and suppliers, and also protect the company's assets.
Access controls must include the identification of all employees, visitors, and suppliers at all entry points. Likewise, records must be kept and mechanisms or documented procedures for entering the facilities must be constantly evaluated, being the basis for starting to integrate security as one of the primary functions within any company.

3.1 Security Personnel.
The company must have security and surveillance personnel. This personnel plays an important role in the physical protection of the facilities and merchandise during its transport, handling, and safeguarding within the company, as well as for controlling the entry and exit of all persons to the property. Security personnel must have a documented procedure to carry out their functions and have full knowledge of mechanisms and procedures in emergency situations, detection of unauthorized persons, or any security incident in the facility. Management must periodically verify compliance with procedures, policies, and functions through internal audits with the objective of verifying their correct execution. Response: Explanatory Notes:
Describe the documented procedure for the operation of security personnel and make sure to include the following points:
a) Indicate the number of security personnel working in the company. b) Point out the positions and/or functions of the personnel and operating hours. c) In case of hiring an external service, provide general data of the company (RFC, Legal Name, Address), and specify the number of employed personnel, operational details, records, and reports they use to perform their functions. d) In case of having armed personnel, describe the procedure for the control and safeguarding of weapons.

3.2 Employee Identification.
There must be an employee identification system for access to the facilities. Employees should only have access to those areas they need to perform their functions. Management or the company's security personnel must adequately control the delivery and return of badges, ID cards, and/or employee identification credentials. Procedures for the delivery, return, and change of access devices (for example, keys, badges, and/or credentials, proximity cards, etc.) must be documented. Access to sensitive areas must be restricted according to the job description or assigned tasks. Response: Explanatory Notes:
Describe the procedure for employee identification and make sure to include the following points:
a) Identification mechanisms (badge and/or photo credential, access control, biometrics, proximity cards, etc.). b) Indicate if employees use uniforms, how they are assigned (by position, area, functions, etc.) and withdrawn (if applicable). c) Indicate how contracted personnel by a business partner, working within the facilities (contractors, subcontractors, in-house services, sub-maquila, etc.) is identified. Describe how the company delivers, changes, and withdraws employee identifications and access controls and make sure to include the responsible areas for authorizing and administering them. Indicate how you ensure that access to sensitive areas is restricted according to the job description or assigned tasks (include the type of records and controls you use). Attach the documented procedure for the control of identifications.

3.3 Visitor and Supplier Identification.
To have access to the facilities, visitors and suppliers must present official identification with a photograph for documentation upon arrival and a record must be kept. All visitors and suppliers must receive a temporary identification, must be accompanied by company personnel during their stay in the facilities, and ensure that the visitor/supplier always wears the provisional identification provided in a visible place. This procedure must be documented. Response: Explanatory Notes:
Describe the procedure for controlling access of visitors and suppliers, make sure to include the following points:
a) Point out what records are kept (personal forms for each visit, logbooks, among others). b) The visitor and supplier record must include the following:

Date of the visit.
Name of the visitor.
Photo identification number (official documents such as: driver's license, passport, INE, etc.).
Time of entry and exit.
In the case of vehicular access, the format must include the data of the private or cargo vehicle (model, license plate, trailer number, etc.).
c) Indicate who is the person responsible for accompanying the visitor and/or supplier and if there are restricted areas for their entry.

3.4 Procedure for identification and removal of unauthorized persons or vehicles.
The company must have documented procedures that specify how to identify, confront, or report unauthorized or unidentified persons and/or vehicles; this procedure must be communicated to responsible personnel through training. The training must be documented.
Response: Explanatory Notes:
Attach the documented procedure to identify, confront, or report unauthorized or unidentified persons and/or vehicles.
The procedure must include:
a) Responsible personnel. b) Designate a person or area responsible for being informed of security incidents. c) Instructions on how to confront and address unidentified personnel. d) Indicate in which cases the corresponding authorities must be reported to. e) How security incidents and measures taken in each case are recorded.

3.5 Courier and package deliveries.
Courier and package deliveries intended for company personnel must be examined upon arrival and departure, before being distributed to the corresponding areas and destinations. Likewise, the company must have a documented procedure for the receipt and review of courier and package deliveries, which must be communicated to responsible personnel through training. The training must be documented. Response: Explanatory Notes:
Describe the procedure for the receipt and review of courier and package deliveries and ensure you include the following:
a) Personnel in charge of carrying out the procedure. b) Indicate how the personnel or supplier of the courier and package delivery service is identified (indicate if an additional procedure to the supplier access procedure is required). c) Indicate how the review of the courier and/or packages is carried out, what mechanism is used, the records kept, and in case, the incidents detected. d) Describe the characteristics or elements to determine which courier and/or package deliveries are suspicious. e) Indicate what action is taken in the event of detecting suspicious courier and/or packages.

Commercial partners.
The company must have written and verifiable procedures for the selection and contracting of new commercial partners and monitoring of partners already working with them, such as: carriers (long-haul, cross-border or transfer, Ex Works, subcontracted, etc.) for the transport and/or distribution of merchandise subject to foreign trade, customs brokers, logistics outsourcing providers (3PL/4PL), warehouses, sub-maquiladora companies, manufacturers, sellers, suppliers of national and foreign parts and raw materials, direct and indirect, suppliers of cleaning services, private security, personnel hiring, high-security seal suppliers, collection and recycling, suppliers of systems and Information Technologies, among others), and according to their risk analysis, require them to comply with security measures to strengthen the international supply chain. The risk analysis carried out by the company regarding its commercial partners (clients and suppliers) must include risks related to the identification of activities related to money laundering and terrorist financing. Additionally, the company must have a documented social compliance policy and program among its employees and commercial partners that, at a minimum, addresses how the company guarantees that national and imported goods, inputs, or merchandise for Mexico for the manufacture of its final product were not extracted, produced, or manufactured, totally or partially, with prohibited forms of labor, that is, forced or compulsory labor, including forced or compulsory child labor under Article 23.6 of the USMCA and the Agreement establishing the merchandise whose importation is subject to regulation by the Secretariat of Labor and Social Welfare, published in the DOF on February 17, 2023.

4.1 Selection criteria.
There must be documented procedures for the selection, follow-up, and renewal of commercial relationships with business associates or suppliers, which include interviews, reference verification, evaluation methods, and use of provided information. The information derived from the investigation and/or evaluation of business associates and/or suppliers must be documented and integrated into a file (physical or electronic). The procedure for the selection of commercial partners must include indicators to detect clients or suppliers that may not be legitimate or with unlocated addresses, as well as investigations, reviews, or evaluations of said partners for the identification and control of activities related to money laundering and terrorist financing. If the investigation and/or evaluation of any commercial partner leads to substantial doubts about the veracity of their operations or services, the company must avoid contracting them and, if applicable, notify its security specialist or Authorized Economic Operator Program contact and the corresponding authority about its suspicions. Response: Explanatory Notes:
Attach the documented procedure for the selection and contracting of new commercial partners and monitoring of partners already working with them; this includes any type of supplier that has a commercial relationship with the company and, if applicable, with the service outsourcing company, in its supply chain (it is in the next sub-standard where it is requested to differentiate those at risk in its supply chain), ensure you include the following points:
a) What information is required from its commercial partner. b) What aspects are reviewed and investigated. c) Indicators to identify clients or suppliers that may not be legitimate (payments above the standard rate, in cash; having little knowledge of the merchandise to be shipped; being evasive; minimal contact information (cell phone, contact points, emails, among others); recently created companies or businesses without commercial history, etc.) or with unlocated addresses. This point refers to indicating all those alerts to determine that a commercial partner is not reliable and thus, conduct a deeper investigation and evaluate whether to work with them.

d) Indicate if it maintains a physical or electronic file of each of its commercial partners, as well as the information it must contain. e) Indicate how the services of its commercial partner are evaluated and what points are reviewed.
The file must include at a minimum the following:
a) Company data (name, RFC, activity, etc.). b) Legal representative data. c) Proof of address. d) Commercial references (if applicable). e) Contracts, agreements, and/or confidentiality agreements and security policies. f) If applicable, certificate or certification number in the security programs to which it belongs.

4.2 Security requirements.
The company must have a documented procedure in which, according to its risk analysis, it requests additional security requirements from those commercial partners that intervene in its supply chain, whether as suppliers of materials for the manufacture, packaging, or packing of merchandise subject to foreign trade, as well as from transport service providers (long-haul, cross-border or transfer, Ex Works, subcontracted, etc.) for the transport and/or distribution of merchandise subject to foreign trade, customs brokers, logistics outsourcing providers (3PL, third-party logistics or 4PL, main logistics provider), warehouses, sub-maquiladora companies, manufacturers, sellers, suppliers of national and foreign parts and raw materials, direct and indirect, suppliers of cleaning services, private security, personnel hiring, high-security seal suppliers, collection and recycling, suppliers of systems and Information Technologies, among others. The requirements must be based on the Company Profile established by the AGACE, or in case it exists, the specific Profile for each actor in the supply chain that corresponds to it. The company must request from its commercial partners the documentation that accredits and proves that they comply with the minimum security standards established in the Company Profile, either through a written declaration issued by the legal representative of the partner, agreements or contractual clauses, backed by documentation supporting compliance with the requirements established in the Authorized Economic Operator Program. In the case of the Service Outsourcing Company that has commercial partners contracted to provide customs management, storage, handling, transport, and/or distribution of merchandise subject to foreign trade services on its behalf, they must be registered in the Registry in the Certification of Companies Scheme, in the modalities of Authorized Economic Operator and Certified Commercial Partner in any of its areas or have the CTPAT Program, granted by the CBP. Likewise, the company must take into account and know the specific requirements of the Authorized Economic Operator Program that will be applicable to each of its commercial partners, based on their activity within the supply chain. In the case of the company's commercial partners that provide their services within the facilities, they must be obliged to comply with these supply chain security requirements. Response: Explanatory Notes:
Describe the procedure that indicates how it carries out the identification of commercial partners that require compliance with minimum security standards.
Ensure you include the following points:
a) A register of commercial partners that must comply with security requirements, and mention what type of providers these are (carriers for the transport and/or distribution of merchandise subject to foreign trade, warehouses, custody service, private security company, customs brokers, etc.).

b) Indicate in what documentary form (agreements, accords, contractual clauses, and/or addenda) it ensures that its commercial partners comply with security requirements. c) Indicate if there are agreements, accords, contractual clauses, and/or addenda regarding the implementation of security measures with its service providers inside its company, such as: private security, cafeteria, gardening, cleaning and maintenance services, Information Technology providers, etc. d) Indicate if it has commercial partners to whom membership in a supply chain security program is required (for example: CTPAT or any other World Customs Organization Authorized Economic Operator Program), as well as the information and documentation requested of them.

4.3 Commercial partner reviews.
The company, through the Security Committee, must carry out periodic security evaluations (as well as those derived from risk situations) of the processes and facilities of business associates based on a risk analysis to guarantee that they have the minimum security standards required by the company based on the Authorized Economic Operator Program, keep records of them, which allow verifying that the processes and security measures are being executed, as well as the corresponding follow-up. When inconsistencies are found, the company must communicate them to its partner and/or supplier and provide a justified period to address the observations or areas for opportunity identified or, otherwise, have the necessary measures to sanction it. Carrying out security evaluations of commercial partners is important to guarantee that there is a solid and functioning security program; that is why, in addition to a documented procedure, there must be a program or calendar for the execution of said security reviews or evaluations, prioritizing partners that are more critical according to their risk analysis. If a member is not evaluated and the company does not know if the processes and facilities of its commercial partners function correctly, it puts its supply chain at risk. Response: Explanatory Notes:
Describe the procedure to carry out evaluations for the verification of security requirements (processes and facilities) of its commercial partners; ensure you include the following points:
a) Periodicity with which it visits the commercial partner (these must be at least once a year and derived from risk situations). b) Program or calendar for the execution of security reviews. c) Record or report of the verification, and in case, the corresponding follow-up. d) The verification format(s) must be duly filled out, placing the date, name, and position of those participating in the review, signatures, etc.

e) Indicate what action measures are taken in case commercial partners do not comply with the established security requirements.
In case of having commercial partners with CTPAT certification or another supply chain security certification program, indicate the periodicity with which its status is reviewed, how it is recorded, and the actions taken in case it is detected that it is suspended and/or cancelled, according to what is established in its procedure. The procedure must include:
a) Periodicity of visits; b) Points of review in security matters; c) Report preparation; d) Feedback and agreements with the commercial partner; e) Follow-up to agreements; f) Measures in case of detection of non-compliance with requirements; g) Record of evaluations; h) Area or person responsible for carrying out this procedure.

Process security.
Control measures must be established to guarantee the integrity and security of merchandise in processes related to transport (in any of its modalities), handling, customs clearance, storage, and/or distribution of cargo throughout the supply chain. These control measures and procedures must be documented and ensure the integrity of its import and export shipments from the point of origin to their final destination.

5.1 Process mapping.
There must be a map that shows step by step the logistical process of the flow of merchandise and the required documentation through its international supply chain.
The company must take into account and include within its mapping all parties involved in its supply chain, containing those that handle import and export documentation, such as customs brokers, others that may not handle the cargo directly but may have operational control such as carriers (long-haul, cross-border or transfer, Ex Works, subcontracted, etc.), logistics outsourcing providers (3PL/4PL), storage, sub-maquiladora, national and foreign suppliers, direct and indirect, etc. If within its supply chain any part of the transport is subcontracted, it is indispensable that it be considered within its risk analysis and process mapping, since the more direct and indirect suppliers, the greater the risk involved. Response: Explanatory Notes:
Attach the document where the mapping of processes through which its import and export merchandise passes is illustrated and described, from the point of origin to the destination, with the purpose of having correctly identified each of the steps involving the manufacture and delivery of the final product. The process mapping must include, the names (RFC and corporate name) of the companies that provide services in its logistics chain.

This mapping must contain at least the following aspects:
a) Origin of:
1. Raw material.
2. Container, packaging, and/or packing.
3. Container and/or semi-trailer.
b) Delivery and/or receipt of merchandise. c) Transport of merchandise.
1. Indicate the points and areas for rest or safeguarding of cargo vehicles during the transport of merchandise subject to foreign trade (import and export), as well as the documentation generated when the cargo enters and leaves the facilities.
2. Indicate the estimated times that said vehicles remain in the rest (reposo) or safeguarding areas (company yards, exit customs, customs broker agency facilities, warehouses, exchange yards (transfer) or transport, among others).
d) Storage and/or distribution. e) Customs clearance. f) Delivery to final destination. g) Information flow related to the merchandise.
If applicable, indicate if there is a sub-manufacturing process and provide the general data of the company (Name, RFC, and address) and the SE permit in which the authorization as a sub-manufacturing company is granted, as well as the productive process they carry out.

5.2 Warehouses and distribution centers.
In case the company has warehouses and distribution centers for merchandise subject to foreign trade, outside the production and/or manufacturing facilities belonging to it, these must be subject, according to their characteristics, to what is established in this document, with the object of maintaining integrity in its supply chain. Response: Explanatory Notes:
According to the process mapping of its merchandise, if in the logistics chain of foreign trade merchandise it is considered to move to a warehouse or distribution center, these must comply with the minimum security requirements established by the AGACE. In such a way, they are obliged to fill out a Company Profile for each of these mentioned installations.

Therefore, indicate how many warehouses and/or distribution centers it uses, provide their general data (name and address), and briefly explain what activity is carried out in this installation.
Additionally, include also those warehouses and/or distribution centers that are used for national products, or fixed assets, as reference (these will not have to fill out a Company Profile).
Likewise, indicate if these belong to the company or is a service contracted through a third party. In this case, according to the supplier selection criteria mentioned regarding Commercial Partners, indicate how it ensures that they comply with the minimum security requirements (warehouses and/or distribution centers managed by a third party are not obliged to present a Company Profile).

5.3 Cargo delivery and receipt.
The company must ensure the identification of transport medium operators that carry out the delivery or receipt of the cargo. Likewise, the company must designate a person responsible for supervising the loading or unloading of the shipment, verifying the detailed description of the merchandise, weight, labels, marks, and quantity, comparing this information with the corresponding purchase or delivery orders. Likewise, the driver transporting the merchandise must be provided with the required documentary information for its correct transport, which includes, in an enumerative but not limiting manner, destination, route to be maintained, contact data, and/or procedure in case of any security incident or inspection by any authority, among others. When the cargo is stored overnight or during a prolonged period in the shipping area, measures must be taken to secure the cargo against unauthorized access; said area must be monitored by its alarm and closed-circuit television and video surveillance systems and have restricted access. The cargo preparation areas and the immediate surrounding areas must be inspected regularly to guarantee that these areas remain free of visible pest contamination. During the cargo loading and unloading process, the company's security area (supervisor or security guard) must be present to validate that the process is being carried out correctly, mitigate the risk of shipment contamination (prohibited, illicit merchandise, or pests), and record said review (incident reports, records, reports, etc.) as evidence that the high-security seal and/or lock was placed correctly; digital photographs must be taken at the moment of loading the vehicles. To the extent possible, these images should be sent electronically to the destination or merchandise delivery contact point for verification. Also, the personnel responsible for the shipping and/or receiving area must review the information included in import and/or export documents to identify or recognize suspicious cargo shipments. Likewise, specific training must be provided on the identification of common errors in export shipment documentation, with the objective of preventing these from resulting in security incidents or suspicious merchandise. In case of having own cargo transport, it must provide training to transport operators to review import and/or export documentation in order to identify or recognize suspicious cargo shipments, such as:
a) Originating or destined to unusual places; b) Different routes; c) Cash payments; d) Observing unusual shipping and/or receiving practices; e) Lack of information.

Response: Explanatory Notes:
Attach the documented procedure indicating the procedure for the delivery and receipt of cargo and ensure it includes the following points:
a) Method to identify transport operators. b) Documentation delivered to operators.
In addition to transport documents and customs documents (Bill of Lading, manifests, etc., which must be presented to the authority in a legible, complete, accurate, and timely manner), there must be a record accompanying the entry and exit of goods, which includes:

Date.
Driver's name.
Photo identification number (official documents such as: driver's license, passport, INE, etc.).
Address of the point of origin (location/installation) where the carrier collects the cargo destined for foreign countries.
Number of high-security seal or lock.
Entry and exit time (the cargo record must be kept secure and drivers must not have access to it).
In the case of vehicular access, the format must include the data of the cargo vehicle (model, license plate, trailer number, etc.). This record must be kept secure and drivers must not have access to it.
c) The delivery and receipt of cargo should be by appointment, whenever the company's operations allow and in a specific area or place so that it is monitored by security personnel, an employee, or closed-circuit television and video surveillance systems. d) The carrier must notify the facility of the estimated arrival time for the scheduled collection, the driver's name, and the truck number. e) Person responsible for supervising the loading or unloading of merchandise and checking the information. f) How it verifies and guarantees that the cargo preparation areas and the immediate surrounding areas remain free of visible contamination from pests. In case of identifying any type of visible pest, contamination, trash, insects, grass, weeds or tall grass, how it reports it and what actions are taken regarding it. g) Indicate who is responsible for taking digital photographs of the location and the placement of the high-security seal and/or lock, as well as of the cargo loading process, and, if applicable, how it sends them to the destination contact point or cargo delivery (including the seal and/or lock number(s)). h) Indicate how it controls or what security measures it has implemented to mitigate the risk of collusion or complicity between employees, such as the driver and the personnel in the dispatch or shipping areas, receipts, warehouse, security guards, etc. i) Indicate if it performs permanent or random reviews of the luggage of transport operators who enter its facilities to deliver or pick up cargo. In case of identifying any anomaly or having a suspicion, describe the actions it takes regarding it and how it reports to the authority. j) In high-risk areas, when feasible from an operational point of view, the land carrier should use a convoy method (e.g., a minimum of two trucks traveling together) to transport the cargo, in addition to having communication between the other cargo vehicles and the personnel responsible for the transfer of the goods. The cargo delivery and receipt procedure must include:
a) Inspection method at the company's access point. b) Designation of personnel responsible for receiving the driver and the goods upon arrival. c) Maintenance of a schedule of expected arrivals and handling of unexpected arrivals. d) Record of transport documents and customs documents accompanying the entry and exit of goods (Bill of Lading, manifests, etc., which must be presented to the authority in a timely manner), which accompany the entry and exit of goods, showing the point of origin (location/installation) where the carrier collects the cargo destined for foreign countries. e) Designate personnel responsible for supervising the cargo loading and/or unloading process. f) Weighing, counting, measuring, and marking of goods (compare with provided documentation). g) In the case of goods exit, verify if there are additional security requirements imposed by clients. h) Verification of the integrity of any lock and/or seals on the cargo loading and/or unloading (how they are used and recorded in the documents, seals or locks placed according to the procedure established in the standards and in accordance with current legal requirements). i) Identification and reporting of discrepancies. j) In the case of goods exit, indicate what documentation will be delivered to the carrier. k) Report to the corresponding department of the receipt and/or exit of the goods.
5.4 Cargo tracking procedure.
The company is responsible for monitoring and supervising the integrity of its goods throughout the supply chain, so it must have documented procedures establishing the use of technology for tracking and supervising the activities of the movement of the means of transport that transfers foreign trade cargo. For land transfers, companies must have a documented policy prohibiting unscheduled stops. The company must establish documented internal procedures or with its provider to ensure at all times the location of the carrier's vehicle in transit. These procedures must be carried out under a risk analysis that includes, by way of example and not limitation, the identification of predetermined routes, estimated delivery times between intermediate points, as well as overnight and/or rest (yards, exit customs, customs broker or customs agency facilities, freight agents, among others), which must be recorded and incorporated into the tracking process. Likewise, measures and actions to be taken in case of identifying any delay in the route due to weather conditions, traffic, route changes, or inspection by any authority or any security incident must be included. If they have contracted the services of a provider, the company must have access to the carrier's GPS monitoring system, so that it can track the movement of its shipments. If the driver makes stops during the journey, they must register them and perform inspections of the means of transport, containers, trailers, and semi-trailers used as Instruments of International Traffic, as well as of the closing devices, seals and/or locks to verify their integrity and identify signs of manipulation before resuming the trip. The supervision data and registration of all vehicles in transit carrying foreign trade goods, as well as route histories, must be preserved for one year in case the authority and/or the carrier must perform an evaluation due to a security incident or for audit purposes. Response: Explanatory Notes:
Attach the documented procedure to monitor the transfer of the cargo.
This procedure must include, among other aspects according to its operation:
a) Have GPS whose external hardware is hidden and can resist attempts to remove it, indicate the type of system implemented by the units used and, if it is a third-party or subcontracted service, describe the consultation tools available to monitor the cargo. b) Identification of predetermined routes, estimated delivery times, between intermediate points, as well as overnight and/or rest (yards, exit customs, customs broker or customs agency facilities, freight agents, among others). Once the time between assigned points has been determined, they must have a tracking process (route audit) and the corresponding records. c) In the case of geofences, within their parameters, minimum tolerances allowed for the predetermined transit route must exist or be established. d) There must be systems or procedures with instructions in case of a delay in the route (stops, route changes or diversions, mechanical failures, accidents, etc.). Likewise, drivers must notify (their supervisor and, if applicable, the sender or consignee of the cargo) of any significant delay in the route due to weather, traffic, accidents, mechanical failures, route changes, etc. And on its part, the company must independently verify the cause of said delay. e) Detail if it has a means that allows communication with the carrier during its transfer and if it has more than one form of communication. f) In case the tracking is performed by a third party, indicate who is responsible, and how it verifies that it is being carried out correctly, according to the procedures the company indicates. g) In case of having own cargo transport, GPS or equivalent technology should be used to guarantee that the trailer is also monitored and tracked. Describe how this tracking is performed. h) GPS records or route histories must be safeguarded for cases of security incidents and audits. The procedure must also include that, in case of identifying a real or concrete threat to the security of a shipment or means of transport; how the company informs its supply chain business partners that may be affected and, if applicable, the authority as appropriate, regarding this type of incidents or presumptions. Indicate if the company uses custody services for its shipments and, if applicable, indicate if there is a documented procedure for their operation in which the policies and restrictions are indicated, as well as the means of communication between the escort and the carriers (if applicable, indicate the RFC and legal name of the company providing the service).

5.5 Report of discrepancies in cargo.
There must be documented procedures to detect and report missing, surplus, prohibited merchandise or any other discrepancy in the delivery or receipt of goods, which must be investigated and resolved. It must be verified that the cargo matches what is indicated in the description declared in the packing list or the shipping document, specifying the detailed description of the goods and the data that allow their correct identification and quantification. Response: Explanatory Notes:
Attach the documented procedure to detect and report discrepancies in the delivery or receipt of goods and ensure it includes the following points:
a) Persons responsible for carrying out the review. b) Documents to be checked. c) Areas to which the information is reported.
This procedure must be applied both to the merchandise received from import; if applicable, in the review at intermediate points; as well as in the final delivery of the goods to its client.
5.6 Processing of cargo information and documentation.
The company must have documented procedures to ensure that the electronic and/or documentary information used during the movement and clearance of cargo, as well as the information received from business associates, is legible, complete, accurate, reported in time, and protected against changes, loss, or introduction of erroneous information. Likewise, forms and documentation related to import and/or export should be secured to prevent unauthorized use. Response: Explanatory Notes:
Describe the procedure for processing cargo information and documentation, ensure you include the following points:
a) Detail how it transmits relevant information and documentation regarding the transfer of its cargo with all those involved in its supply chain (indicate if it uses a specific computer control system and briefly explain its function). Likewise, detail how it validates that the provided information is legible, complete, accurate, reported in time, and protected against changes, loss, or introduction of erroneous information. b) Forms and documentation related to import and/or export must be secured to prevent unauthorized use. c) Indicate how business associates transmit information to the company and how they ensure its protection.

5.7 Inventory Management, control of packaging, container, and packing material.
The company must have documented procedures for inventory control and storage of cargo and periodic reviews and audits must be carried out to verify their correct management. Likewise, it must have a documented procedure for the control of packaging, container, and packing material of the goods, which must also include the procedure for control, dissemination, and prevention of visible pest contamination, in the case of use of wooden packing materials (such as pallets, boxes, crates, cages, reels, dunnage, chocks, supports or platforms) to stack, move, and protect the cargo throughout its entire supply chain. Response: Explanatory Notes:
Attach the documented procedure for inventory management. This must include, among other aspects according to its operation:
a) The frequency with which it carries out stock verification (periodic inventory). Indicate if there is a documented scheduled calendar to perform them. b) Indicate what is done in case of excesses and shortages in inventories. c) Indicate the treatment given to the control and handling of packaging, container, and packing material, and if applicable, of shrinkage, waste, or surplus material, which must also include the procedure for control, dissemination, and prevention of visible pest contamination, in the case of use of wooden packing materials (such as pallets, boxes, crates, cages, reels, dunnage, chocks, supports or platforms) to stack, move, and protect the cargo. This point is also focused on reducing the risk of introduction or dissemination of quarantine pests of importance to the country through packaging (imports), therefore, describe how it complies with the provisions indicated by the Secretariat of Environment and Natural Resources (SEMARNAT) and NOM-144 SEMARNAT-2017, in accordance with International Phytosanitary Standard No. 15 entitled Regulation of Wood Packaging Used in International Trade, which emanate from the Food and Agriculture Organization of the United Nations. d) Indicate how the fumigation process is carried out to kill, inactivate, sterilize, devitalize, or eliminate pests. What actions are taken in case quarantine of packing materials is required. e) Indicate the area or person responsible for carrying out this process, as well as the documentation or certificate.

The applicant's procedures may include:
a) Warehouse only accessible to authorized personnel. b) Frequency of stock control. c) Control of incoming goods, transfers to other warehouses, permanent and temporary withdrawals. d) Actions taken if irregularities, discrepancies, losses, or thefts are identified. e) Treatment of deterioration or destruction of goods. f) Separation of various types of goods, for example, high value or dangerous.
6. Customs management.
The company must have documented procedures in which internal and operational policies are established, as well as the necessary controls for the due compliance of customs obligations.
Likewise, it must have specialized personnel and documented procedures establishing the verification of the information and documentation generated by the customs broker or, if applicable, ensure the processes performed by the customs representative.
6.1 Customs clearance management.
The company must have a documented procedure in which the criteria for the selection of a customs broker or, if applicable, a customs representative are established, who, according to national legislation, are authorized to promote the clearance of goods on behalf of others.
Response: Explanatory Notes:
Describe the selection and evaluation procedure of the customs broker or representative and ensure it includes the following points:
a) Selection criteria. b) Evaluation methods and periodicity. c) Describe the indicators with which it evaluates the service of customs brokers.
Indicate the full name and the patent and/or authorization number of the customs broker or representative authorized to promote its foreign trade operations.
6.2 Customs obligations.
The company must have a documented procedure establishing how it maintains updated control of foreign trade goods inventories as established in Article 59, fraction I of the Law and the information referred to in Annex 24, sections I and II, as applicable.
The company must have a documented procedure for compliance with customs obligations derived from foreign trade operations carried out. This must include, at least, compliance with what is established in Article 59, fractions II and III of the Law, which will allow verification of the origin and provenance of the goods, through a control that allows identifying the country of origin, the Free Trade Agreement or Commercial Agreement from which the tariff preference was applied, and the document that supports said preference, in case of applying a tariff preference according to a self-certification, having all the elements that accredit the origin of the goods, as well as the correct determination of the customs value.

These procedures regarding the origin of the goods must describe the cases in which the origin of the goods is declared and the documentation with which the origin character must be demonstrated. In the case of companies that introduce goods into the national territory under a deferral program or tariff refund program, the company must have a procedure in which it describes how it determines the payment of foreign trade taxes, according to what is provided in the Treaties of which Mexico is a party, in accordance with what is established in Article 63-A of the Law. In the case of having a development program authorized by the SE, it must have documented procedures to comply with what is required in the same, among which are inventory control, return deadlines, and restrictions regarding the change of destination of temporarily imported merchandise, among others established in Article 24 of the IMMEX Decree, as well as the Annual Report of Foreign Trade Operations referred to in Article 25 of said decree. Response: Explanatory Notes:
Attach the procedure by which it establishes how it maintains updated inventory control in terms of fraction I of Article 59 of the Law.
Attach the procedure to comply with customs obligations derived from the verification of the country of origin and the valuation of foreign trade goods in terms of fractions II and III of Article 59 of the Law.
Regarding this, for the effects of restrictions on the refund of customs duties on exported products and on customs duty deferral programs, origin only needs to be demonstrated when the imported merchandise is originating and is subsequently sent to another signatory party of the International Treaty or Commercial Agreement in question. Regarding countervailing duties, origin must be demonstrated when the tariff fraction of the imported merchandise is subject to such measures. And origin must also be demonstrated regarding merchandise imported with preferential tariff treatment under an International Treaty or Commercial Agreement of which Mexico is a party. Origin will be considered demonstrated when the company has the certificate of origin or other document provided for in the applicable provisions. Indicate if it has an IMMEX Program authorized by the SE, and if applicable, attach the procedure to comply with the obligations established in Articles 24 and 25 of the IMMEX Decree, among which are, by way of example and not limitation, the following:
a) Register where productive processes are carried out. b) Return of goods within authorized deadlines. c) Automated inventory control. d) Annual Operations Report, among others.
In case of having any other export promotion program, attach the procedure to comply with the obligations derived from it.

6.3 Customs Verification.
The company, in order to guarantee compliance with the mandate entrusted to a third party, as well as to verify the truthfulness of the information declared in its name before the competent authorities, must have documented procedures so that the personnel designated by the company periodically verify that the declarations registered in its accounting match what appears registered in the SAAI Web, and, where applicable, report to the customs authority any discrepancy in such information. The company, likewise, must have a procedure for the filing of declarations for their adequate control.

Likewise, the company must have documented procedures, in which the periodic verification of the correct tariff classification of goods subject to foreign trade and the verification of the tariff and non-tariff regulations and restrictions to which they are subject are established.

Response: Explanatory Notes:
Attach the procedure established to verify the information that appears registered in the SAAI Web, and cross-reference it with the declarations and documentation requested from the customs broker and/or customs agent.
Attach the documented procedure for the verification of the correct tariff classification and NICO. This must include, among other aspects according to its operation:
a) Method for the review and verification of the tariff classification and NICO of the goods and their corresponding tariff rates, regulations, and non-tariff restrictions. b) Maintenance of an updated file of foreign trade products. Detail which items are concentrated in it (tariff fraction, NICO, Rates, Regulations, Opinions, among others) and with what periodicity it is updated. c) The tools, systems, programs, or technical information used to classify its goods. d) Report to the corresponding areas the changes in the tariff fractions and the implications that are generated in rates and regulations; likewise, when it comes to changes in the NICO.

Security of cargo vehicles, containers, train cars, trailers, and/or semi-trailers.
The security of the means of transport (including cargo vehicles, pickup trucks, vans, or vans, among others), containers, train cars, trailers, and semi-trailers must be maintained to protect them from the introduction of unauthorized persons and/or materials. For the above, it is necessary to have documented procedures to identify, review, seal, and maintain their integrity. Likewise, the process of inspection of means of transport, containers, train cars, trailers, and semi-trailers used as Instruments of International Traffic must include an agricultural inspection procedure to look for visible pests and serious structural deficiencies. Pest contamination is defined as visible forms of animals, insects, or other invertebrates (living or dead, at any stage of the life cycle, including eggs, etc.), or any organic material of animal origin (including blood, bones, hair, meat, secretions, excretions, etc.); plants or vegetable products (including fruits, seeds, leaves, twigs, roots, bark, etc.); or other organic material, including fungi, dirt, or water; when such products are not the declared cargo within the Instruments of International Traffic.

For the above, it is necessary to have procedures to correctly seal and maintain the integrity of containers and trailers from the point of origin of the goods. A high-security seal must be applied to all containers and trailers for foreign trade shipments, which must meet or exceed the ISO 17712 Standard for high-security seals.

With the objective of maintaining supply chain security, the company must systematically inspect all cargo vehicles upon entry and exit from its facilities (domestic and international traffic), in addition to keeping a record.

7.1 Cargo Integrity and Use of Seals in Containers and Trailers.
The company must have a documented procedure where the means of transport are identified and, where applicable, the containers, train cars, and/or semi-trailers used in its international logistics chain, and indicate how their integrity is maintained.

For the above, as one of the security mechanisms, the company must use high-security padlocks or seals that meet or exceed the ISO 17712 Standard in all containers and loaded trailers that are subject to foreign trade and maintain their integrity until delivery at the final destination. For this, the company must have documented procedures to place and verify the correct application of seals, their inspection at intermediate points, final destination, and their replacement when opened by any authority. In the event of such an inspection, drivers must notify and register any unusual anomaly or structural modification found in the means of transport resulting from said review. The procedures must include the steps to follow if it is discovered that a seal is altered, manipulated, or if there is an incorrect seal number in the documentation, the communication protocols to the commercial partners involved in the supply chain, and the investigation of the security incident. These must be notified to security personnel, commercial partners that may be part of the affected supply chain, security specialist, or Authorized Economic Operator Program contact.

Likewise, it is necessary to have a documented procedure for the administration of the same, which must include the control, assignment, safeguarding, handling of discrepancies, and destruction of seals and padlocks. Regarding the supplier of the seals and/or padlocks, it must be demonstrated how these comply with the ISO 17712 Standard. The company's management or a security supervisor must perform periodic and documented audits of the high-security seals and/or padlocks; these reviews must include the verification of the inventory of stored seals and/or padlocks and the cross-check with inventory records and shipping documents. Also, supervisors of the shipping area and/or warehouse managers must periodically verify the seal numbers used in the means of transport and Instruments of International Traffic to corroborate that the information is correct.

Response: Explanatory Notes:
Detail the type of vehicles, means of transport, as well as containers and semi-trailers that the company uses for the transfer of its goods (maritime containers, dry boxes, railway containers, tanks, among others).
Indicate if the transport units, containers, and/or trailers are owned by the company or a third party.
Indicate the transport companies hired to carry out the transfer of foreign trade goods, indicating their name or corporate name, RFC, and tax domicile.
Attach the documented procedure for the placement and review of seals and/or padlocks in vehicles, means of transport, containers, train cars, trailers, and/or semi-trailers. This must include, among other aspects according to its operation:
a) Verify that the seal or padlock is intact and determine if there is evidence of improper manipulation.
In case of using a high-security padlock, (bottle type, cable, padlock, etc.), it must use the VVTT inspection method:

V- View the seal and lock mechanisms of the container (View).
V- Verify the seal number (Verify).
T- Pull the seal to ensure it is correctly placed (Tug).
T- Twist and turn the seal to ensure it has closed (Twist and Turn).

b) Review and cross-reference the documentation containing the number of the original seal or padlock and, where applicable, of the additional ones carried during the transfer of the goods.
In case of using the replacement seal and/or padlock, said number must be registered within the company's control. If altered seals and/or padlocks are identified, they must be kept to help carry out the investigation of said incident or discrepancy and, as appropriate, report the compromised seals and/or padlocks to the foreign authority. c) If the company uses cable seals, these must be placed on the two vertical bars of the container. d) Review that the closing devices, hinges, and pins are attached to the trailer or container and welded or riveted. Also, protective plates can be placed on the door hinges and/or a seal/adhesive tape can be placed on at least each side. Likewise, the correct functioning of handles, latches, and all other locking or closing mechanisms of the cargo vehicles must be verified to detect manipulations and any inconsistency before placing any sealing device. e) Indicate how they assign and replace high-security padlocks, in the case that, during the trip, it is inspected by another authority. If a seal and/or padlock breaks in transit, the cargo must be examined, the number of the replacement seal and/or padlock must be registered, and the driver must immediately notify business associates when this happens, indicate who broke it and provide the new seal number. Attach the documented procedure for the control and handling of seals and/or padlocks. This must include, among other aspects according to its operation:
a) What type of seals and/or padlocks it uses in its operations (foreign trade, transit, storage, etc.). b) Who has access and how padlocks and/or seals are safeguarded. The management of seals and/or padlocks must be restricted only to authorized personnel; stored in a safe place, have an inventory, control of their distribution, and tracking (record of seals used, as well as the receipt of new seals and/or padlocks).

c) Describe how the company's management or security supervisor participates in the audits of high-security seals and/or padlocks, the reviews they perform, the records they generate, and the actions they take in case of identifying discrepancies. Also, how supervisors of the shipping area and/or warehouse managers verify seal numbers used in means of transport and Instruments of International Traffic to corroborate that the information is correct (this process can also be included within the internal audits referred to in sub-standard 1.3 of this document). d) How discrepancies in seal and/or padlock numbers are addressed. e) Indicate who the supplier(s) is/are and how it is proven that the specifications of the seals and/or padlocks comply with the ISO 17712 Standard (attach certificate issued by the certifying company in charge of verifying compliance with the corresponding ISO).

All written procedures must be disseminated and maintained at the operational level so that they are easily accessible to employees in charge of executing the tasks described above, reviewed at least once a year, and updated as necessary.

7.2 Inspection of means of transport, containers, train cars, trailers, and semi-trailers.
There must be established procedures to verify the physical integrity of the structure of the means of transport, container, train cars, trailers, and/or semi-trailer used as Instruments of International Traffic, even the reliability of the door lock mechanisms, in order to identify natural or hidden compartments.

Inspections of means of transport or cargo vehicles, containers, and trailers (land or railway cargo) must be systematic and carried out upon entry and exit from the company and, where applicable, at the cargo loading point; and if the infrastructure allows, before arriving at the customs office for dispatch using the VVTT inspection method. A record of these inspections must be kept in an area with controlled access and carried out in a place monitored by alarm and closed-circuit television and video surveillance systems; said system must cover the inspection process in its entirety.

The documented procedure for its inspection must include, by way of example and not limitation, the following review points:

Means of Transport Trailers, Train Cars, Semi-trailers, and Containers
1. Bumper;
2. Tires;
3. Floor (Tractor);
4. Fuel tanks;
5. Cabin interior (bedroom and tool compartment);
6. Air tanks;
7. Chassis;
8. Fifth wheel area;
9. Drive shafts;
10. Exhaust pipe;
11. Engine.
1. Exterior and interior doors;
2. Side walls (left and right);
3. Inner and outer roof;
4. Front wall;
5. Internal floor;
6. Refrigeration system.

For means of transport with a trailer or integrated cargo compartment, the items indicated in the Trailers section must be added to the means of transport points.

Likewise, before loading the means of transport, containers, train cars, trailers, and semi-trailers used as Instruments of International Traffic, they must undergo agricultural and security inspections to guarantee that their structures have not been modified to hide smuggling or have been contaminated with visible agricultural pests, keep a record, and be backed by a documented procedure. If visible pest contamination is found during the inspection or transport of goods subject to foreign trade, it must be cleaned (washed, vacuumed, etc.) to eliminate said contamination. The driver must ensure before crossing that the cabin is clean and free of trash.

Response: Explanatory Notes:
Attach the documented procedure to carry out the security and agricultural inspection of means of transport, containers, trailers, and semi-trailers. This must include, among other aspects according to its operation:
a) Persons responsible for carrying out the inspection. b) Definition of the place or places where the inspection is carried out and indicate how the monitoring is performed by alarm and closed-circuit television and video surveillance systems. c) The review points for means of transport, trailers, semi-trailers, and containers for both security and quality and agricultural inspections whose purpose is to look for visible pests. d) Instructions for the driver to ensure before crossing that the cabin is clean and free of trash. Attach the established format for the inspection of means of transport or cargo vehicles, containers, train cars, trailers, and/or semi-trailers. If you use other types of cargo vehicles for the transport of your goods (vans, pickup, 3.5 tons, tankers, etc.), your procedure and inspection format must include the process and review points.

Likewise, the security and agricultural inspection format must include the following information:
a) Date of inspection; b) Time of inspection; c) Vehicle license plates (tractor and trailer); d) Container/trailer number; e) Specific areas of the cargo vehicles that were inspected; and f) Name and signature of the employee who performs the inspection and of the supervisor.

The security and agricultural inspection format of containers and Instruments of International Traffic must be part of the import and export documentation.

The documentation must be kept for one year for an investigation in case of any security incident, as well as to demonstrate continuous compliance with these inspection requirements.

Additionally, and based on risk analysis, the company should perform periodic random reviews of cargo vehicles after the transport personnel has performed security inspections to verify that they have been carried out correctly, counter internal conspiracies, and prevent security incidents. The reviews must be carried out randomly, without prior notice, so that they do not become predictable, in addition to being carried out in different places where the means of transport may be susceptible to contamination. Indicate if the repair or maintenance of transport units, containers, or trailers is carried out in the same facilities or is carried out with an external provider. Describe how it validates that the cargo vehicles, containers, trailers, and semi-trailers used as Instruments of International Traffic, that transport its goods, meet the necessary physical-mechanical conditions for their transfer and crossing, in addition to validating that they have records of this type of maintenance for at least one year.

When it is necessary to store or overnight any loaded container, trailer, and/or semi-trailer, it must be in a safe area that has perimeter barriers and is monitored by alarm and closed-circuit television systems, to prevent unauthorized access and manipulation of the merchandise, for which it must be closed with a high-security padlock according to the ISO 17712 Standard.

Response: Explanatory Notes:
Indicate if the company stores the containers, trailers, and/or semi-trailers for their subsequent dispatch, or in the case of those that are empty and how it maintains their integrity within its facilities:
a) In case of using padlocks and/or seals, for empty containers, trailers, and semi-trailers, indicate what type it uses. b) In case of using any container, trailer, and/or semi-trailer as a storage facility for raw material and/or any other type of goods, indicate how it maintains their integrity and security.

Personnel Security.
Documented procedures must be available for the registration and evaluation of people who wish to obtain employment within the company and establish methods to perform periodic verifications of current employees.

Likewise, there must be continuous training programs for personnel that disseminate the company's security policies, as well as the consequences and actions to be taken in case of any fault or security incident.

8.1 Verification of work history.
The company must have documented procedures to investigate and verify the information recorded in the curriculum, criminal records (if local legislation and company policies allow it), and applications of candidates with possible employment, in accordance with local legislation, either on its own or through an external company.

Likewise, for positions that by their sensitivity so require and affect the security of shipments that are subject to foreign trade, in accordance with its previously carried out risk analysis, stricter requirements for their hiring must be considered, which must be carried out periodically. Regarding personnel who already work in the company, periodic investigations must be carried out based on the activities and/or sensitivity of the employee's position.

All information regarding personnel must be kept in personal files, which must have restricted access.

Response: Explanatory Notes:
Describe the documented procedure for the hiring of personnel, and make sure to include the following:
a) Requirements and documentation required. b) Tests and exams requested.
Indicate the areas and/or critical positions that have been identified as risky, according to your analysis, and indicate the following:
a) Indicate what the additional requirements are for specific areas and/or jobs, such as: criminal records (if local legislation and company policies allow it), certificate of non-criminal record, socioeconomic studies, clinical studies, toxicological (drug use), etc. In its case, indicate the positions or work areas in which they are required and with what periodicity they are carried out. b) Indicate if, prior to hiring, the candidate must sign a confidentiality agreement or a similar document. In case of hiring a service agency for the hiring of personnel, indicate if this has documented procedures for the hiring of personnel and how it ensures that they comply with the same. Briefly explain what they consist of. The procedures for the hiring of personnel and contractors may include:
a) Exhaustive investigations of the work and personal background of new employees. b) Confidentiality and liability clauses in employee contracts. c) Specific requirements for critical positions.

d) Where applicable, the periodic update of the socioeconomic and physical/medical study of employees who work in critical and/or sensitive areas. e) Hiring process and requirements requested for temporary employees and contractors.
The company may consider the results of candidate background checks, as permitted by current legislation, to make hiring decisions. Background checks are not limited to identity and criminal record verification. In higher-risk areas, deeper investigations may be justified.

8.2 Procedure for employee termination.
There must be documented procedures for employee termination that include the delivery of identification and any other items provided to perform their functions (keys, uniforms, badges and/or credentials, computer equipment, passwords, tools, etc.). Furthermore, this procedure must include the deactivation in those computer systems, access systems, among others that may exist.

Response: Explanatory Notes:
Describe the procedure for employee termination, and ensure you include the following:
a) Who is responsible for carrying out and following up on this procedure. b) How the delivery of identification, uniforms, keys, and other equipment is performed and confirmed. c) Indicate the control, record, and/or format in which the delivery of material and deactivation in computer systems (if applicable) is identified and ensured (attach, if applicable). d) Specify the type of records of personnel who ended their employment relationship with the company, so that in case it was for security reasons, their service providers and/or business associates are warned.

8.3 Personnel administration.
The company must maintain an updated system, control, or database of active employees. Likewise, it must perform and keep updated the records of affiliation to social security institutions and other legal labor records.
In the case where the company has personnel contracted by its business partners and working within the facilities, it must ensure that they comply with the requirements established for the rest of its employees.

Response: Explanatory Notes:
Indicate whether the company has an updated system, control, or database, both of personnel employed directly, as well as that contracted through a service provider company, and ensure it includes, by way of example but not limitation, the following information:

a) Full name. b) Updated photograph at least every 5 years. c) Personal data (age, name, date of birth, phone number, address, CURP, social security number, blood type, allergies, etc.). d) Family ties. e) Work history. f) Illnesses. g) Medical exams. h) Training. i) Results of periodic evaluations. j) Observations. k) This personnel must be hired in accordance with current labor laws and regulations.

Information and documentation security.
There must be prevention measures to maintain the confidentiality and integrity of the information and documentation generated by the company's systems, including those used for information exchange with other members of the supply chain. Likewise, there must be comprehensive documented policies and/or procedures to protect Information Technology systems, which include measures against their misuse, as well as identifying and prioritizing actions to reduce cybersecurity risk. They could also address how a member shares information about cybersecurity threats with the government and other business partners.

9.1 Document classification and handling.
There must be procedures to classify documents according to their sensitivity and/or importance. Sensitive and important documentation must be stored in a secure area that only allows access to authorized personnel. The useful life of the documentation must be identified and procedures for its destruction must be established. The company must conduct regular reviews to verify access to information and ensure that it is not used improperly.

Response: Explanatory Notes:
Attach the documented procedure for the registration, control, and storage of printed documentation (classification and filing of documents), which must include:
a) Control register for delivery, loan, among others of documentation. b) Restricted access to the archive area. c) Storage and classification policies. d) An updated security plan that describes the measures in force regarding the protection of documents against unauthorized access, as well as against deliberate destruction or loss thereof. e) In the case of electronic or digital information, it must adhere to the security criteria of the sub-standard of 9.2 Information Technology Security.

9.2 Information Technology Security.
To protect Information Technology systems against common cybersecurity threats, a company must have sufficient protection that promotes security in Information Technology infrastructure (software and hardware) against malware (viruses, spyware, worms, trojans, etc.), baiting, phishing, and internal/external intrusions (firewalls) in the companies' computer systems. Likewise, companies must ensure that their security software is active and receives periodic updates. In the case of automated systems and computer equipment, individual accounts that require periodic password changes must be used. In order to protect the confidentiality, integrity, and availability of information, the company must have established information technology policies, procedures, and standards, which must be communicated through a training program for all employees who handle computer equipment and systems, which includes topics to prevent attacks through social engineering and all those threats to which they are exposed (malware, baiting, phishing, etc.). Companies that allow their employees to connect remotely to a network must use secure technologies, such as virtual private networks (VPN), to allow employees to access the company intranet securely when they are outside the office, as well as procedures designed to prevent unauthorized remote user access. For the above, there must be written procedures and infrastructure to protect the company against losses, theft, leakage, hacking, and/or ransomware of information; this includes the procedure for the recovery (or replacement) of Information Technology systems and/or data, as well as a system or software established to identify the abuse of Information Technology systems and detect inappropriate access and/or improper manipulation or alteration of commercial and business data, as well as a written procedure for the application of appropriate disciplinary measures to all offenders. Access to Information Technology systems must be protected against infiltration through the use of secure passwords, which include phrases or other forms of authentication. Users of said Information Technology systems must safeguard and not share their access keys or passwords. All Information Technology infrastructure must be physically protected against unauthorized access. If a data leak or other unexpected event occurs resulting in the loss of data and/or equipment, the procedures must include the recovery or replacement of Information Technology systems and/or data.

g) Systems must be protected by passwords and must be modified frequently; therefore, indicate the procedure to change them. h) Indicate if there are information security policies for their protection. i) There must be a system or software to detect and identify the abuse, intrusion, or access of unauthorized persons to its systems and/or Information Technology data (any system used by the company), as well as the abuse of policies and procedures established by the company, including improper access to internal systems, external websites, and the manipulation or alteration of commercial data by employees or contractors. j) All offenders must be subject to the application of disciplinary measures; therefore, indicate the corrective policies and/or sanctions in case of detection of any violation of Information Technology security systems and policies.

Information technology and cybersecurity policies and procedures must be reviewed annually and updated due to an attack or according to situations that may put the company's systems at risk.
Describe the security measures used to allow employees to connect remotely to a network (VPN), to allow employees to access the company intranet remotely when they are outside the office.
In case of allowing employees to use personal devices to perform the company's work, such devices must comply with the company's cybersecurity policies and procedures, security updates must be periodic, and there must be a method to access the company network securely.
Indicate if business partners have access to the company's computer systems. If so, indicate what programs they use and how they control access to them.
Indicate if the computer equipment has a backup power supply system that allows business continuity.

The procedures regarding the backup of the company's information must also include:
a) How and for how long the data is stored (data should be backed up once a week or as appropriate). b) Business continuity plan in case of incident and how to recover information. c) Frequency and location of backup copies and archived information. d) If backup copies are stored in sites alternative to the facilities where the data processing center is located. e) Tests of the validity of data recovery from backup copies.

The procedures regarding the protection of the company's information must also include:
a) An updated and documented policy for the protection of the company's computer systems against unauthorized access and deliberate destruction or loss of information. All sensitive and confidential data must be stored in an encrypted or encoded format. b) Detail if it operates with multiple systems (headquarters/sites) and how those systems are controlled. c) Who is responsible for the protection of the company's computer system (responsibility should not be limited to one person, but to several, so that each can control the actions of the rest). d) Each user's access must be assigned through individual accounts and restricted according to the job description or assigned tasks. Therefore, describe how access authorizations and access levels to computer systems are granted (access to sensitive information must be limited to personnel authorized to make modifications and use the information). Authorized access must be monitored by the area responsible for granting it, to verify or, if applicable, report that access to confidential systems is based on job requirements. e) Indicate the elements or format that passwords for access to Information Technology systems and computer equipment must have, frequency of changes, if there are other authentication methods, and who or what area provides those passwords.

f) Indicate the name of the "firewall" and anti-virus used (include licensing related matters), evidencing that this security software is active and receives periodic updates.
For the above, cybersecurity policies and procedures should include measures to prevent the use of counterfeit technological products or with incorrect licenses (software and hardware).
All computer equipment, electronic media (hard drives, cell phones, etc.), and information technology hardware containing confidential information related to the import and export process must be accounted for through periodic inventories and have such evidence.
When these technological equipment must be disposed of, there must be a documented procedure that includes how they must be formatted, disinfected, or destroyed appropriately to avoid information leakage. g) In case of employee termination, access to computer equipment, telecommunications, and network must be eliminated at the moment of the employee's separation; this includes email accounts, system access accounts, software, programs, etc. h) Measures planned to handle incidents in case the system is compromised.

Security training and awareness.
It must have a documented awareness program on threats established, designed, and updated by the Security Committee to recognize and create awareness about threats from terrorists and smugglers at each point of the supply chain. The training program must be comprehensive and cover all security requirements of the Authorized Economic Operator Program. Administrative and operational employees must know the company's established procedures to consider a risk situation and know how to report it. Specific training must be provided to employees who are in critical and/or sensitive areas determined under their risk analysis (security areas, shipments and receipts; as well as those who receive and open mail and packages, among others).

10.1 Training and awareness on threats.
The company must have a training and awareness program on supply chain security policies directed to all its employees (operational and administrative) and, additionally, make available informational material regarding the procedures established in the company to consider a situation that threatens its security and know how to report it. Likewise, specific training must be offered according to their functions to help employees maintain cargo integrity, perform container, trailer, and/or semi-trailer reviews for agricultural and security purposes, receive and review mail and packages, prevent operations with proceeds of illicit origin (money laundering, terrorism financing, etc.), how to recognize and how to report internal conspiracies, protect access controls, as well as training regarding smuggling, merchandise theft, placement of high-security seals and locks (VVTT inspection method), prevention of visible pest contamination, etc. These topics must be established as part of new employee induction and periodically maintain update programs. Update training must be performed periodically, after a security incident, and when there are changes in the company's procedures.

In addition to security training programs, an awareness program on alcohol and drug consumption must be included. Also, disseminate and train personnel on the company's cybersecurity policies, procedures, and standards (theft, leakage, hacking, and/or ransomware of information), including access to computer equipment and systems via passwords or phrases. Personnel who operate and administer security technology systems must receive training related to their operation and maintenance, including self-training through operational manuals and other methods. These topics must be established as part of new employee induction and periodically maintain update programs.

Training programs must encourage active employee participation in security controls and mechanisms, as well as maintain records of all training efforts provided by the company and the list of those who participated in them (videos, photographs, minutes, attendance lists, intranet or other system, didactic material, PowerPoint presentations, brochures, etc.). Training records must include the date of the training, the names of the attendees, the topics taught, in addition to having measures to verify that the training provided met all training objectives.

Response: Explanatory Notes:
They must have a training program on security and prevention of security incidents in the supply chain for all employees who work for the company (administrative, operational, direct or indirect). Briefly explain what the training program consists of and ensure you include the following:
a) Brief description of the topics taught in the program. b) When they are taught (induction, specific periods, due to audits, security incidents, etc.). c) Frequency of training, as well as updates and reinforcement. d) Indicate how participation in supply chain security training is documented (videos, photographs, minutes, attendance lists, intranet or other system, didactic material, PowerPoint presentations, brochures, etc.). Training records must include the date, the names of the attendees, the topics taught, in addition to having measures to verify that the training provided met all objectives of the same. e) Explain how employee participation in supply chain security issues is encouraged.

Training to perform reviews of cargo vehicles, containers, trailers, and/or semi-trailers for agricultural and security purposes must include the following topics:
a) Signs of hidden compartments; b) Smuggling hidden in natural compartments; c) Signs of pest contamination; d) Procedures to follow if something is found during a transport medium inspection or if a security incident occurs during transit; and e) Training on agricultural reviews must cover pest prevention measures, regulatory requirements applicable to wooden packaging materials in accordance with International Standard for Phytosanitary Measures No. 15, entitled Regulation of Wooden Packaging Used in International Trade, which emanate from the Food and Agriculture Organization of the United Nations and the identification of infested wood.

10.2 Awareness for transport medium operators.
The company must make known to the operators of the transport media it uses for the transfer of goods destined for foreign trade, the security policies regarding agricultural inspection procedures and security of transport media, loading and unloading, handling of security incidents, change of locks in case of inspection by other authorities, among others, that are implemented. Operators and personnel who perform agricultural and security inspections of transport media must be trained to inspect cargo vehicles for such purposes. In the case where the transport service is provided by a business partner, it must ensure that operators and/or drivers know all the security policies and procedures established.

Response: Explanatory Notes:
Describe the dissemination program on security in the supply chain focused on transport medium operators and ensure you include the following:
a) Indicate how this dissemination is carried out. b) Specify the topics covered. c) In case of using the services of a business partner for the transfer of its goods, indicate how operators are informed of the company's security policies and procedures. d) Indicate how participation in supply chain security training of transport medium operators is documented (videos, attendance lists, brochures, etc.).

The topics that must include, by way of example but not limitation, are:
a) Access and security policies at the facilities. b) Delivery-receipt of merchandise (which includes suspicious cargo shipments). c) Confidentiality of cargo information. d) Transfer instructions. e) Accident and emergency reports.

f) Instructions for the placement of high-security padlocks and/or seals in the event of inspection by other authorities, as well as the control and use of high-security seals and padlocks in transit (placement of a new one, review after an authorized stop, etc.). g) Installation and testing of security alarms and unit tracking systems, where applicable. h) Identification of authorized formats and documents to be used. i) Signs of hidden compartments. j) Concealed smuggling in natural compartments. k) Signs of pest contamination. l) Procedures to follow if something is found during an inspection of the means of transport or if a security incident occurs during transit.

Handling and investigation of incidents.
Documented procedures must exist to report and investigate security incidents in the supply chain, the actions to be taken to prevent recurrence, as well as to notify security personnel, business partners that may be part of the affected supply chain, security specialist or contact of the Authorized Economic Operator Program, and other competent authorities. The reporting and investigation procedures must include updated contact information or directory listing the names and phone numbers of personnel requiring notification. The investigation and analysis of incidents must be documented (physical and/or electronic file), as well as corrective actions to prevent them from happening again, which must be implemented as soon as possible. In the event that the company identifies that any of its foreign trade shipments are involved in a situation that puts the security of the supply chain at risk, due to suspicion of a business partner or person, it must inform security personnel, business partners that may be part of the affected supply chain, security specialist or contact of the Authorized Economic Operator Program, as well as the competent authority, and, if possible, before the border crossing, exit, or customs clearance (import and export). The procedures must include the steps to follow if it is discovered that a seal is altered, manipulated, or if there is an incorrect seal number in the documentation, the communication protocols with the business partners involved in the supply chain, and the investigation of the incident. All the aforementioned procedures must be reviewed periodically or at least once a year to ensure that the contact information and action protocols are correct.

11.1 Reporting of anomalies and/or suspicious activities.
In the event of detection of anomalies and/or suspicious activities related to the security of the supply chain and in accordance with their logistical processes (related to access control, delivery, receipt and storage of goods, security inspections of cargo vehicles and transport operators, etc.), these must be reported to security personnel, business partners that may be part of the affected supply chain, security specialist or contact of the Authorized Economic Operator Program, and other competent authorities, keeping a record of such anomalies and/or unusual activities. Response: Explanatory Notes:
Describe the procedure to report or denounce anomalies and/or suspicious activities, as well as those containing mechanisms to anonymously report problems related to security; ensure you include the following:
a) Who is responsible for reporting incidents. b) Detail how it determines and identifies with which authority to communicate in different scenarios or presumption of suspicious activities. c) Mention if it keeps a record of the reporting of these activities and/or suspicions and briefly describe what it consists of.

11.2 Investigation and analysis.
Written procedures must exist to report or denounce anomalies and/or suspicious activities, as well as for the analysis and investigation of security incidents in the supply chain to determine their cause, in addition to corrective actions to prevent them from happening again, which must be implemented as soon as possible. The information derived from this investigation must be documented and available at all times for authorities that so require. This information must include the documentation generated to carry out the foreign trade operation of the affected goods that allows identifying each of the processes through which the goods passed, up to the point where the incident was detected, and that allows recognizing the vulnerability of the chain. Response: Explanatory Notes:
Describe the documented procedure to initiate an investigation in the event of any security incident and ensure you include the following:
a) Person responsible for carrying out the investigation. b) Documentation that integrates the investigation file.
The documents to be included in the file derived from the investigation, by way of example and not limitation, may be:
a) General information of the shipment, purchase order. b) Transport request; confirmation of means of transport; identification of the transport operator (access records, exit, records of security inspections, etc.). c) Container inspection formats; exit order; delivery records. d) Videos from alarm systems, closed-circuit television, and video surveillance. e) Documentation generated for the carrier (packing list, bill of lading, instruction sheet). f) Documentation generated for business partners (description of goods, proformas, CFDI or equivalent documents, etc.) and customs authorities. g) Documentation generated by the business partner (customs declarations, manifests, tracking and inspection reports, videos if applicable, etc.). h) Tracking and monitoring report of the unit (GPS tracking).

E4.
Customs Broker Profile.
Acknowledgment of Receipt
First Time: Renewal:
Addition:
Modification:
The data you provide will replace the data you provided when you requested your authorization.
General Information.
The objective of this Profile is to ensure that the Customs Broker implements security practices and processes that help strengthen the supply chain by mitigating the risk of contamination in shipments with illicit products and likewise reducing the risk of incurring incidents during the customs clearance of goods. Customs brokers interested in obtaining the authorization referred to in rule 7.1.5. must have documented and verifiable processes. Likewise, the Customs Broker interested in the authorization must integrate the criteria required in this document into the business model or design they have established, seeking during the implementation of security standards, the application of an analysis culture that supports decision-making consistent with the values, mission, vision, codes of ethics and conduct of the Customs Broker itself. It is important to mention that the scope of the minimum security criteria required in this Profile is applicable to the essential operation performed by the Customs Broker, mainly to processes related to the customs clearance of goods. Likewise, and taking into account the variety of integrated logistical services that a Customs Broker can currently provide to its clients, certain additional criteria are contemplated to be met, specifically for customs brokers who concentrate or have holding yards and/or maneuvers for the means of transport of foreign trade goods in the same facilities where they provide their services. Filling Instructions:
1. You must fill out a Profile for each of the facilities associated with the customs office of assignment, as well as for each of the facilities associated with the additional customs offices of the customs patent. This information must coincide with what was stated in your application for Certified Customs Broker Commercial Partner.
2. Detail how the Customs Broker complies with or exceeds what is established in each of the sections as indicated.
3. The format of this document is divided into two sections, as detailed below:
1. Standard
Description of the standard
1.1 Sub-standard
Description of the sub-standard
Response Explanatory Notes
Describe and/or attach... a) Points to highlight...

4. Indicate how you comply with what is established in each of the sub-standards; therefore, you must attach the procedures in Spanish; these procedures must be characterized by describing or defining the objective the document pursues, the start and end of the process, measurement indicators, requirements, documents or formats to be used, responsible parties, among others.
5. In cases where only an explanation of the procedure is required, it must be detailed and placed in the Response field.
The field regarding the Explanatory Notes is a guide regarding the points that must be included in the Response of each sub-standard, indicating in an indicative manner those points that should not be excluded from your response.
6. Once this Customs Broker Profile has been answered, it must be attached to the Registration Application in the Enterprise Certification Scheme referred to in the first paragraph of rule 7.1.5., fraction II, subsection b).
For the purpose of verifying what was stated in the previous paragraph, the SAT through the AGACE may carry out an inspection of the facility, with the exclusive purpose of verifying what was stated in this document.
7. Any incomplete Customs Broker Profile will not be processed.
8. Any question related to the Registration Application in the Enterprise Certification Scheme and the Customs Broker Profile should be directed to the contacts appearing on the SAT Portal.
9. In the event of being authorized with the Registration in the Enterprise Certification Scheme, this format must be kept updated and notify when the circumstances under which the registration was granted have varied and as a result changes or modifications are required in the information stated and provided in this Customs Broker Profile to the authority, in accordance with what is established in rule 7.2.1., fourth paragraph, fractions I, II and VII.
10. For the renewal of the certified commercial partner, the procedure marked in rule 7.2.3. will be followed.
11. When, as a result of the inspection visit, non-compliance related to minimum security standards results, the applicant may remedy them before the issuance of the resolution established in rule 7.1.6., for which they will have a maximum period of three months counted from the notification of the non-compliances indicated.

Installation Data
A Customs Broker Profile must be filled out for each of the facilities associated with the customs office of assignment, as well as for each of the facilities associated with the additional customs offices under the customs patent.
Customs Broker Information. Customs Broker Profile Number: from:
Customs Broker Name: ____________________ Patent: ________________ Authorization:
Assignment:
_________ Assignment: ________________
Authorized Customs Offices (name):
Name and/or Denomination of the installation:
Type of Installation
(administrative offices, facilities with goods storage or transport service, etc.):
Street Number and/or exterior letter Interior Number and/or letter Neighborhood Postal Code Municipality/Delegation Federal Entity

Age of the Installation (years of operation) Predominant activity Types of services:
Performs validation of customs declarations in this installation:
No. of average monthly operations (EXP): (By means of transport, maritime, air, land, rail, etc.)
No. of average monthly operations (IMP): (By means of transport, maritime, air, land, rail, etc.)
Total number of employees at this installation: Installation Surface (m2):
Security program certifications: (Indicate if this installation has a certification from any of the following programs) Supply Chain Security Programs Yes No Program: Registration:
Certifying Body:
Certifications: (Indicate if you have certifications that you consider impact your supply chain process, for example: ISO 9000; Reliable Logistics Processes, among others) Name: Category: Validity:
Name: Category: Validity:
Name: Category: Validity:

Supply chain security planning.
The Customs Broker must elaborate policies and documented procedures to carry out an analysis that allows the identification of risks and weaknesses in its supply chain with the objective of implementing strategies that help mitigate the risk in its operations.
Likewise, to build a solid supply chain security program, the Customs Broker must have a Security Committee that incorporates representatives from all relevant departments, forming a multifunctional team that identifies areas for opportunity and proposes continuous improvement actions throughout the supply chain and the Customs Broker's installations. Similarly, the Customs Broker must have designated points of contact for the Authorized Economic Operator Program; this personnel must be involved, know the program requirements, belong to the company, and prove their relationship with it, as well as respond to their supply chain security specialist (this is assigned once the company already has the Authorized Economic Operator Program). If, as a result of the risk analysis, new security measures arise that the Customs Broker must incorporate, these must be included in the existing procedures of the Customs Broker and, if applicable, new procedures must be elaborated, which creates a more sustainable structure and emphasizes that supply chain security is everyone's responsibility.

1.1 Risk analysis.
The Customs Broker must have measures to identify, analyze, and mitigate security risks throughout the supply chain, including its installations. For the above, it must have a written and verifiable procedure to determine the risk in all its operations, based on its organization's model (example: location of installations, type of goods and country of origin, volume, clients, suppliers, routes, hiring of personnel, classification and handling of documents, Information Technologies, potential threats, etc.) that allows it to implement and maintain appropriate security measures. Based on the above, the Customs Broker must also have a written process based on its risk analysis to select new business partners and monitor those with whom it is already working. This procedure must be executed at least once a year, so that it allows permanently identifying other threats or risks considered in its operation and in the supply chain, as a result of some incident or when they originate from changes in the initial conditions of the Customs Broker's installations and processes, as well as to identify that the policies, procedures, and other control and security mechanisms are being complied with. It is important to note that the Company's Security Committee designated by the Customs Broker must participate in the elaboration and updating of the risk analysis and the maintenance of the Authorized Economic Operator Program. Response: Explanatory Notes:
Indicate what are the sources of information used to qualify risks during the analysis phase.
Attach the risk matrix, as well as the documented procedure to identify risks in its daily operations throughout the supply chain and in its installations, which must include as a minimum the following points. a) Periodicity with which it reviews and/or updates the risk analysis. b) Aspects and/or areas that the Customs Broker incorporates into the risk analysis. c) Methodology or techniques used to perform the risk analysis. d) Responsible parties for reviewing and/or updating the company's risk analysis. Likewise, the documented procedure to identify risks in the supply chain and its installations must contemplate the risk appreciation and management process, and include the following aspects:
a) Establishment of a context (cultural, political, legal, economic, geographic, social, etc.). b) Identification of risks in its supply chain and its installations. c) Risk analysis (causes, consequences, probabilities, and existing controls to determine the risk level as high, medium, and low). d) Risk evaluation (decision-making to determine the risks to treat and priority to implement treatment). e) Risk treatment (application of alternatives to change the probability of risks occurring). f) Risk monitoring and review (monitoring of risk analysis results and verification of the effectiveness of its treatment). It is suggested to use administration, management, and risk evaluation techniques according to international standards ISO 31000, ISO 31010, and ISO 28000 that, according to its business model, should be implemented.

1.2 Security policies.
The customs broker must have policies oriented to prevent, secure, and recognize threats in the security of the supply chain and installations, such as drug trafficking, money laundering, arms trafficking, human smuggling, prohibited goods, acts of terrorism, as well as in the exchange of information, reflected in the corresponding procedures. To promote a security culture, the Customs Broker must demonstrate its commitment to supply chain security and the Authorized Economic Operator Program through a statement highlighting the importance of protecting the flow of national and international commerce from criminal activities, established through the security policy. The Customs Broker must endorse and sign the security policy. Response: Explanatory Notes:
Enumerate the policies in matters of security oriented to prevent, secure, and recognize threats in the supply chain and the Customs Broker's installations, who is responsible for their review, signature, and dissemination to employees, as well as the periodicity with which its update is carried out. This policy must be communicated to employees through a program and/or dissemination campaign. The security policy must be signed by the Customs Broker and displayed in various areas of the installation, including the Customs Broker's website, posters in key areas of the installation (reception, import and/or export, human resources, etc.), and as part of initial and reinforcement training.

1.3 Internal audits in the supply chain.
In addition to routine monitoring in control and security, it is necessary to schedule and carry out audits at least once a year that allows evaluating all processes in matters of security in the supply chain in a more critical and profound way, as well as guaranteeing that its employees follow the Customs Broker's security procedures. The audits must be carried out by the Security Committee and a documented procedure must be established, as well as a program or calendar for their realization. Although it is necessary that the audits are focused on supply chain security and based on the evaluation, review, and execution of minimum security standards, their focus must be adjusted to the size of the organization, risk level, business model, and variations between installations. The objective of an internal audit focused on the Authorized Economic Operator Program is to verify and guarantee that employees follow the Customs Broker's security procedures. The review process does not have to be complex; however, the formats and records used for the application of said reviews must evidence that the application and execution of the evaluated processes were validated, in addition to the follow-up and closure of preventive, corrective, and improvement actions identified. The senior management of the organization must review the results of the audits, analyze the causes, and undertake the required corrective and/or preventive actions. The audit process must guarantee that the necessary information is collected to allow management to make this evaluation. The review must be documented, in addition to the fact that the Customs Broker's Security Committee must provide and register periodic updates on the progress or results of any audit, exercise, or validation. Response: Explanatory Notes:
Describe the documented procedure to carry out an internal audit, focused on security in the supply chain; ensure you include the following points:
a) Indicate how the scheduling or calendarization is carried out to perform an internal audit in matters of security in the supply chain, which has been implemented by the Customs Broker. b) Indicate who participates in it, and the records that are made of it, as well as the periodicity with which they are carried out. c) Indicate how the management or the Customs Broker verifies the results of the security audits, how it carries out and/or implements preventive, corrective, and improvement actions, in addition to the follow-up and closure of the same. d) The formats used during internal audits must be duly filled out, and through them, evidence that the procedures and security measures are being put into practice.

1.4 Contingency and/or Emergency Plans.
A documented contingency and/or emergency plan must exist; this plan must address crisis management, security recovery plans, and the resumption of the organization related to supply chain security and its facilities to ensure business continuity in the event of a situation affecting the normal development of activities and foreign trade operations. A crisis or contingency may include the interruption of commercial data movement due to a cyberattack, fire, kidnapping of a transport driver by armed individuals, customs closure, bomb threat, detection of suspicious packages, power outage, theft and/or damage to goods, threats or extortion, blockades or road closures, among others. Such plans must be communicated to administrative and operational staff through dissemination programs and periodic training, as well as conducting tests, practical exercises, and annual drills of the contingency and emergency plans to verify their effectiveness. Records of these must be properly filled out and signed (for example: result reports, minutes, or reports which must be supported by video recordings, photographs, etc., demonstrating their execution). The contingency and/or emergency plan must be updated as necessary, based on changes in operations and the organization's risk level. Response: Explanatory Notes:
Attach the documented procedure or contingency and/or emergency plan related to supply chain security and its facilities, to ensure business continuity in case of an emergency or security situation that affects the normal development of foreign trade activities (cancellation or suspension of patent, customs closure, foreign trade activities considered risky according to your analysis, acts of terrorism, blockades, robberies, accidents, etc.). This procedure must include, by way of example and not limitation, the following:
a) What situations it contemplates, describing the action plan and steps to be followed in case of crisis, as well as the tasks assigned to staff during the handling of such contingencies. b) What mechanisms it uses to disseminate and ensure these plans are effective. c) Contemplate the scheduling and execution of tests, practical exercises, and annual drills and how they are documented (for example: result reports, minutes, or reports, which must be accompanied by video recordings, photographs, etc., demonstrating their execution).

Physical Security.
The Customs Broker must have established mechanisms and documented processes to prevent, detect, or deter the entry of unauthorized personnel to its facilities, and in its case, yards for transport means located in the same facilities, as well as the area where sensitive information is stored. According to the Customs Broker's risk analysis, the sensitive areas identified in its facilities must have physical barriers, control elements, and deterrents against unauthorized access.
2.1 Facilities.
Facilities must be constructed with materials that can resist unauthorized access. Periodic documented inspections must be carried out to maintain the integrity of the structures, and in the event that an irregularity has been detected, the corresponding repair must be carried out as soon as possible by the personnel designated for these tasks. Likewise, territorial limits, various accesses, internal routes, and the location of buildings must be fully identified. Response: Explanatory Notes:
Indicate the predominant materials with which the facilities are constructed (for example, metal structure and sheet metal walls, brick walls, concrete, cyclone mesh, among others), and indicate how the review and maintenance of structures is carried out.
Indicate the personnel or area responsible for carrying out inspection, maintenance, and damage repair tasks for the facilities.
Attach a distribution or architectural plan of the facilities, where the limits of the facilities, access routes, emergency exits, location of buildings or offices, critical areas, parking lots, and boundaries can be identified.
2.2 Accesses at gates and booths.
The entrance or exit doors for personnel and/or vehicles of the Customs Broker's facilities or in its case, access to the yards for transport means of goods located in the same place, must be attended, controlled, watched, and/or supervised either by own personnel duly trained or by private security personnel. The number of access doors must be kept to the minimum necessary. Access to sensitive areas must be restricted according to the job description or assigned tasks. Response: Explanatory Notes:
Indicate how many doors and/or accesses exist in the facilities, as well as the operating hours of each one and indicate how they are monitored (in case of having assigned personnel, indicate the quantity).
Detail if there are blocked and/or permanently closed doors and/or accesses.
Describe how you ensure that access to sensitive areas is restricted according to the job description or assigned tasks (include the type of records and controls you use).

2.3 Perimeter Walls.
Perimeter walls and/or peripheral barriers must be installed to secure the perimeters of the Customs Broker's facilities, based on a risk analysis. In the case of having a yard for transport means of goods located in the same facilities, it must be delimited, as well as the place where any maneuver and/or handling of cargo takes place as appropriate. These must be inspected regularly and keep a record of the review with the purpose of ensuring their integrity and identifying damage, which must be repaired as soon as possible by the personnel designated for these tasks. Response: Explanatory Notes:
Describe the type of fence, peripheral barrier, and/or walls with which the Customs Broker's facilities are equipped, ensure you include the following points:
a) Indicate the characteristics of the same (material, dimensions, etc.). b) In case of not having walls, justify the reason in detail. c) Frequency with which the integrity of the perimeter walls is verified, and the records that are kept with the purpose of ensuring their integrity and identifying damage, which must be repaired as soon as possible. d) Indicate the personnel or area responsible for carrying out inspection and damage repair tasks. In case of having a yard for transport means in your facilities, describe how it is delimited. The procedure for the inspection of perimeter walls may include:
a) Personnel responsible for carrying out the process. b) How and with what frequency the inspections of fences, perimeter walls, and/or peripheral barriers and buildings are carried out. c) How the inspection record is carried out. d) Who is responsible for verifying that repairs and/or modifications meet the technical specifications and necessary security requirements.

2.4 Parking Lots.
In the case of having parking lots in the facilities, access to them must be controlled and monitored by security personnel or designated for this task. Private vehicles (of employees, visitors, suppliers, and contractors, among others) must be prohibited from parking, in their case, within the yard for transport means, as well as in adjacent areas. Response: Explanatory Notes:
Describe the procedure for the control and monitoring of parking lots, ensure you include the following points:
a) Those responsible for controlling and monitoring access to parking lots. b) Identification of parking lots (if applicable) specify if employee and visitor parking is separated from storage and goods handling areas. c) How entry and exit control of vehicles to the facilities is carried out. Indicate the records made for parking control, existing control mechanisms, for example: badges, card readers, lanyards, etc., how they are assigned and the responsible area for doing so. d) Policies or mechanisms (if applicable) to not allow the entry of private vehicles to storage and goods handling areas.
2.5 Key and Lock Device Control.
Windows, doors, as well as inner and outer fences must be secured with locking devices; these devices must be implemented based on the Customs Broker's risk analysis. Likewise, the Customs Broker must have documented procedures for the handling, storage, assignment, and control of keys in the facilities, keeping a record and establishing signed responsibility letters by persons who have keys or authorized access according to their level of responsibility and tasks within their work area. Response: Explanatory Notes:
Indicate if all doors, windows, inner and outer entrances have closing or security mechanisms.
Attach the documented procedure or procedures for the control, storage, assignment, and handling of keys and/or closing devices of the facilities, offices, and inner areas.
Ensure that these procedures include the following points:
a) Those responsible for administering and controlling key security. b) Format and/or control record for key lending. c) Treatment of loss or non-return of keys. d) Indicate if there are areas where access is with electronic devices and/or some other access mechanism.

2.6 Lighting.
Lighting inside and outside the facilities must allow clear identification of people, material, and/or equipment located there, including the following areas: entrances, exits, perimeter walls and/or peripheral barriers, inner fences, and parking areas if applicable. An emergency and/or backup system must be available in sensitive areas. Response: Explanatory Notes:
Describe the procedure for the operation and maintenance of the lighting system. Ensure you include the following points:
a) Indicate which areas are illuminated and which have a backup system (Indicate if you have an auxiliary power plant or some other mechanism to supply electricity in case of any contingency). b) How you ensure that the lighting system has continuity in the event of supply failure in each of the areas of the facilities, in such a way that it allows clear identification of the personnel, material, and/or equipment located there. c) Person responsible for controlling the lighting systems. d) Maintenance and review program (if it coincides with another process, indicate it). The procedure may include:
a) How the lighting system is controlled. b) Operating hours. c) Identification of areas with permanent lighting.
2.7 Alarm systems, closed-circuit television, and video surveillance systems.
Alarm systems, closed-circuit television, and video surveillance systems, and security technologies, must be used to watch, notify, or deter unauthorized accesses and prohibited activities in the facilities and other areas considered sensitive, notify the corresponding area, in addition to being used as a tool of proof in investigations derived from any security incident. These security systems and technologies must be placed according to a prior risk analysis in such a way that areas involving the access of personnel, visitors, and suppliers are watched and monitored, and in its case, the access areas for passenger vehicles and cargo vehicles and others considered sensitive. Such systems must allow clear identification of the area or environment being watched, be permanently recording, and keep a backup of recordings for at least one month, with the purpose of having the necessary elements to assign responsibilities in case of a security incident. Alarm systems, closed-circuit television, and video surveillance systems, and security technologies, must have a documented operation procedure that includes the supervision of the good condition of the equipment and the verification of the correct position of the cameras, indicating the frequency with which the backup of recordings must be performed, as well as those responsible for their operation. Such a system and all security technology infrastructure must have restricted access.

Response: Explanatory Notes:
Mention the documented procedure indicating the functioning of the external central alarm system or sensors, and in its case, describe the following points:
a) Indicate if doors and windows have alarm sensors, as well as the areas where motion sensors are available. b) Procedure to follow in case an alarm is activated. c) Indicate the personnel, responsible area, or service provider for maintenance, how failures are reported, and the records they use. Describe the documented procedure for the operation of alarm systems, closed-circuit television, and video surveillance systems, and security technologies (this must be reviewed and updated annually and according to the risk analysis or circumstances), ensure you include the following points:
a) Indicate the number of security cameras of the alarm systems, closed-circuit television, and video surveillance systems installed, technical characteristics, and their location. Detail if it covers the entry and exit points of the facilities, to cover the movement of vehicles and individuals, as well as the place of vehicle storage). Attach a layout or distribution map of the security cameras. b) Indicate the location of the alarm systems, closed-circuit television, and video surveillance systems, and security technologies, where the monitors are located, who reviews them, as well as operating hours, and in its case, if there are remote monitoring stations. All security technology infrastructure must be physically protected against unauthorized access. c) Periodic and random reviews of recordings must be carried out. Indicate how they review them (random, every week, special events, restricted areas, etc.), who is the designated personnel, and how they are involved in the reviews. The results of the reviews must be documented to include corrective actions for audit purposes.

d) Indicate for how long these recordings are kept (must be at least one month). e) Alarm systems, closed-circuit television, and video surveillance systems, and security technologies, must have an alternative energy source that allows them to continue functioning in case of unexpected loss of direct power. Therefore, indicate if the alarm systems, closed-circuit television, and video surveillance systems, and security technologies are backed up by an electrical power plant or some other mechanism to supply electricity that guarantees their functioning. These systems should have an alarm/notification function, indicating a failure condition in functioning and/or recording, indicate if your systems have such a function. f) Indicate if in addition to the alarm systems, closed-circuit television, and video surveillance systems, you use some other type of technology to strengthen the security measures you already have. g) Describe the procedure implemented to regularly test and inspect alarm systems, closed-circuit television, and video surveillance systems, and security technologies to ensure their good functioning. The results of the inspections and functioning tests must be documented, as well as necessary corrective actions (these must be implemented as soon as possible). Additionally, that the documented results of these inspections are kept for a sufficient time for audit purposes. h) Indicate if the provider of the alarm systems, closed-circuit television, and video surveillance systems, has access to the security cameras, if they are in charge of monitoring them, how access is controlled, and who is responsible for such monitoring.

Physical Access Controls.
Physical access controls are mechanisms or procedures that prevent and deter unauthorized entry to the facilities, maintain control of entry for administrative personnel and/or visitors, as well as for operators/drivers of transport means in their case, and protect the assets of the Customs Broker. Access controls must include the identification of all employees, visitors, and suppliers at all entry points. Likewise, records must be kept and the documented mechanisms or procedures for entry to the facilities must be permanently evaluated, being the basis for beginning to integrate security as one of the primary functions within them.
3.1 Security Personnel.
According to your risk analysis, the Customs Broker must have security and surveillance personnel or designated personnel. This personnel plays an important role in the physical protection of the facilities and in its case, the yard where cargo vehicles are stored, as well as for controlling the access of all people to the property. The security personnel or personnel designated for these tasks must have a documented procedure to carry out their functions and have full knowledge of the mechanisms and procedures in emergency situations, detection of unauthorized persons, or any security incident in the facility. The Customs Broker must periodically verify compliance with procedures, policies, and functions through internal audits with the objective of verifying their correct execution. Likewise, the Customs Broker must have devices and/or communication systems with the purpose of having immediate contact with security personnel and/or the corresponding authorities. Response: Explanatory Notes:
Describe the documented procedure for the operation of security personnel, and ensure you include the following points:
a) Describe the procedure that personnel must perform to contact security personnel, designated personnel, or in its case, the corresponding authority. b) Indicate what communication devices the security personnel or designated personnel uses (landlines, cell phones, radios, alarm system, etc.). c) Indicate the number of security personnel working in the Customs Broker's facilities. d) Indicate the positions and/or functions of the personnel, and operating hours. e) In case of hiring an external service, provide the general data of the company (Tax ID, legal name, and address), specify the number of employed personnel, operational details, records, and reports they use to perform their functions. f) In case of having armed personnel; describe the procedure for the control and storage of weapons.

3.2 Identification of employees, visitors, and suppliers.
There must be an identification system for employees, visitors, and suppliers for the purpose of access to the facilities. Employees should only have access to those areas they need to perform their functions. Access to sensitive areas must be restricted according to the job description or assigned tasks. Visitors and suppliers must present official identification with a photograph for documentation purposes upon arrival, and a record must be kept. All visitors and suppliers must receive a temporary identification, be accompanied by personnel working with the Customs Broker during their stay in the facilities, and ensure that the visitor/supplier always wears the provisional identification provided in a visible place. The management or security personnel of the Customs Broker must properly control the delivery and return of identification badges for employees, visitors, and suppliers, and ensure that they always wear the provided identification in a visible place. This procedure must be documented, as well as the procedures for the delivery, return, and change of access devices (for example, keys, badges, and/or credentials, proximity cards, etc.). Response: Explanatory Notes:
Attach the documented procedure for the control of identifications.
Describe the procedure for the identification of employees and ensure you include the following points:
a) Identification mechanisms (badge and/or credential with photo, uniform, access control, biometrics, proximity cards, etc.). b) Identify if employees use uniforms, how they are assigned (by position, area, functions, etc.) and withdrawn (if applicable). c) Indicate how personnel contracted by a business partner, working within the facilities (contractors, subcontractors, etc.) is identified. The procedure must also describe how the Customs Broker delivers, changes, and withdraws employee identifications and access controls and ensure you include the responsible areas for authorizing and administering them. Indicate how you ensure that access to sensitive areas is restricted according to the job description or assigned tasks (include the type of records and controls you use). Describe the procedure for the access control of visitors and suppliers, ensure you include the following points:
a) Indicate what records are kept (personal forms for each visit, logbooks, among others). b) The record of visitors and suppliers must include the following:

Date of the visit;
Name of the visitor;
Identification number with photo (official documents, such as: driver's license, passport, INE, etc.);
Entry and exit times;
In the case of vehicular access, the format must include the data of the private or cargo vehicle (model, license plate, trailer number, etc.).
c) Identify who is the person responsible for accompanying the visitor and/or supplier, and whether there are restricted areas for their entry.

3.3 Procedure for identification and removal of unauthorized persons or vehicles.
The Customs Broker must have documented procedures that specify how to identify, confront, or report unauthorized or identified persons and/or vehicles; said procedure must be communicated to responsible personnel through training. The training must be documented.
Response: Explanatory Notes:
Attach the documented procedure to identify, confront, or report unauthorized or identified persons and/or vehicles. The procedure must include:
a) Responsible personnel. b) Designate a person or area responsible for being informed of security incidents. c) Instructions for confronting and directing unidentified personnel. d) Indicate in which cases the corresponding authorities must be reported to. e) Indicate how the recording of incidents and the measures taken in each case is carried out.

3.4 Courier and package deliveries.
Courier and package deliveries intended for the Customs Broker or their personnel must be examined upon arrival and before being distributed to the corresponding areas and destinations.
Likewise, the Customs Broker must have a documented procedure for the receipt and review of courier and package deliveries, which must be communicated to responsible personnel through training. The training must be documented.
Response: Explanatory Notes:
Describe the procedure for the receipt and review of courier and package deliveries and ensure you include the following:
a) Personnel in charge of carrying out the procedure. b) Indicate how the personnel or supplier of the courier and package delivery service is identified (indicate if an additional procedure to the supplier access procedure is required). c) Indicate how the review of the courier and/or packages is carried out, what mechanism is used, the records kept, and in case of detected incidents. d) Describe the characteristics or elements to determine which courier and/or package delivery is suspicious. e) Indicate what action is taken in the case of detecting suspicious courier and/or packages.

Commercial partners.
The Customs Broker must have written and verifiable procedures for the selection and contracting of new commercial partners and monitoring of partners already working with them, such as partnerships with other customs brokers, correspondent agencies, manufacturing companies, warehouses, transport companies, clients, IT system suppliers, installation and maintenance of alarm and closed-circuit television and video surveillance systems, high-security seal suppliers, collection and recycling, companies providing document digitization services, among others, and according to their risk analysis, require them to comply with security measures to strengthen the international supply chain. The risk analysis carried out by the Customs Broker regarding its commercial partners (clients and suppliers) must include risks related to the identification of activities related to money laundering and terrorist financing. Additionally, the Customs Broker must foster a documented social compliance policy and program that, at a minimum, addresses how among its employees and commercial partners they could ensure that goods, inputs, or merchandise from Mexico for the elaboration of products or merchandise do not come from extraction, production, or manufacturing, totally or partially, with prohibited forms of labor, i.e., forced or compulsory labor, including forced or compulsory child labor, under Article 23.6 of the USMCA and the Labor and Social Security Agreement that establishes the merchandise whose importation is subject to regulation by the Secretariat of Labor and Social Welfare, published in the Official Gazette of the Federation on February 17, 2023.

4.1 Selection criteria.
There must be documented procedures for the selection, follow-up, and renewal of commercial relationships with business associates or suppliers, which include interviews, reference verification, evaluation methods, and use of provided information. The information derived from the investigation and/or evaluation of business associates and/or suppliers must be documented and integrated into a file (physical or electronic). The procedure for the selection of commercial partners must include indicators to detect clients or suppliers that may not be legitimate or with unlocated addresses, in addition to investigations, reviews, or evaluations of said partners for the identification and control of activities related to money laundering and terrorist financing. If the investigation and/or evaluation of any commercial partner leads to substantial doubts about the veracity of their operations or services, the Customs Broker must avoid contracting them and, in case, notify their security specialist or contact of the Authorized Economic Operator Program and the corresponding authority about their suspicions. The Customs Broker must have a written procedure for the identification of vulnerable activities established in Article 17, fraction XIV, as well as for compliance with the obligations established in Article 18 of the Federal Law for the Prevention and Identification of Operations with Resources of Illicit Origin (LFPIORPI). Response: Explanatory Notes:
Attach the documented procedure for the selection and contracting of new commercial partners, and monitoring of partners already working with them; this includes any type of client and supplier that has a commercial relationship with the Customs Broker and ensure you include the following points:
a) What information is required from its commercial partner. b) What aspects are reviewed and investigated (the result of the investigation must be integrated into the file). c) The indicators to identify clients or suppliers that may not be legitimate (payments above the standard rate, in cash; having little knowledge of the merchandise to be dispatched; being evasive; minimal contact information (cell phone, contact points, emails, among others); recently created companies or businesses without commercial history, etc.) or with unlocated addresses. This point refers to indicating all those alerts to determine that a commercial partner is not reliable and thus, conduct a deeper investigation and evaluate if one should work with them.

d) Indicate if you maintain a physical or electronic file of each of your commercial partners, as well as the information it must contain. e) In the case of suppliers, indicate how the services of its commercial partner are evaluated and what points are reviewed.
Likewise, the files for each of them must contain at least the documents that identify them fiscally and administratively depending on the type of relationship with the commercial partner.
Considering the following:
a) Granted mandate: It will be issued in original independent of the one delivered electronically, for each foreign trade operation carried out. b) Copy of the mandate or power of attorney of the legal representative, in case. c) Certified copy of the company's articles of incorporation (properly identified before the Public Property and Commerce Registry). d) Registration in the RFC of the importer or exporter. e) Notice of change of fiscal address, in case. f) Copy of official identification with photograph of the importer/exporter and of the legal representative, in case of being a legal entity. Attach the documented procedure to comply with the LFPIORPI, which must contain at a minimum:
a) Actions to take when any of the vulnerable activities marked in the cited Law are identified. b) Notices to the SHCP. c) Integration of files of clients susceptible to this Law.
The file must include at a minimum the following:
a) Company data (name, RFC, activity, etc.). b) Legal representative data. c) Proof of address. d) Commercial references. e) Contracts, agreements, and/or confidentiality agreements. f) Security policies. g) In case, certificate or certification number in the security programs to which it belongs.

4.2 Security requirements.
The customs broker must have a documented procedure in which, according to its risk analysis, it requests additional security requirements from those commercial partners that intervene in its supply chain such as transporters, private security companies, providers of loading and unloading services for merchandise, correspondent agencies, as well as those resulting from the analysis carried out. As well as from providers of cleaning services, cafeteria, private security, personnel contracting, high-security seal suppliers, collection and recycling, among others. The requirements must be based on the minimum security requirements established by the AGACE, or in case they exist, the specific Profile for each actor of the supply chain that corresponds to them. The Customs Broker must request from its commercial partners the documentation that accredits and proves that they comply with the minimum security standards established in the Customs Broker Profile, either through a written declaration issued by the legal representative of the partner, agreements or contractual clauses, backed by documentation that supports compliance with the requirements established in the Authorized Economic Operator Program. Likewise, the Customs Broker must take into account and know the specific requirements of the Authorized Economic Operator Program that will be applicable to each of its commercial partners, based on their activity within the supply chain. In the case of commercial partners that provide a service within the facilities of the Customs Broker, they must be obliged to comply with these supply chain security requirements. Response: Explanatory Notes:
Describe the procedure that indicates how it carries out the identification of commercial partners that require compliance with minimum standards in terms of security. Ensure you include the following points:
a) A register of commercial partners that must comply with security requirements, and mention what type of providers these are (transport, storage, custodian service, private security company, correspondent agencies, loading and unloading service for merchandise, etc.). b) Indicate in what documentary form (agreements, accords, contractual clauses and/or addenda) it ensures that its commercial partners comply with security requirements. c) Indicate if there are agreements, accords, contractual clauses and/or addenda, regarding the implementation of security measures with its service providers inside the installation, such as: private security, cafeteria, gardening, cleaning and maintenance services, IT providers, etc. d) Indicate if it has commercial partners to whom membership in a supply chain security program is required (for example: CTPAT or any other Authorized Economic Operator Program of the WCO) as well as the information and documentation requested of them.

Indicate the total annual number of customs declarations and the global value of those carried out by each of the installations from which it transmits the validation of the declarations in each of the authorized customs offices of the customs patent.
In the case of partnerships with other customs brokers, there must be a list of the clients of the certified Customs Broker that are managed by said partnership.
Indicate the total annual number of customs declarations and the global value of those managed by each of the partnerships with other customs brokers to which it belongs and indicate the following:
a) Name and denomination of the partnership. b) Customs offices through which the partnership operates. c) Complete address of the installation(s).
Describe how it ensures that the partnerships it has with other customs brokers and in which its patent is not an attachment or additional one comply with the minimum requirements in terms of security.

4.3 Commercial partner reviews.
The Customs Broker through the Security Committee must carry out periodic security evaluations (as well as derived from risk situations), of the processes and installations of business associates based on a risk analysis, to guarantee that they have minimum standards in terms of security required by the Customs Broker based on the Authorized Economic Operator Program, keep records of them, which allow verifying that the processes and security measures are being executed, as well as the corresponding follow-up. When inconsistencies are found, the Customs Broker must communicate them to its partner and/or supplier and provide a justified period established in a procedure to address the observations or areas of opportunity identified, or in case, have the necessary measures to sanction it. Carrying out security evaluations of commercial partners is important to guarantee that there is a solid and functioning security program, which is why, in addition to a documented procedure, there must be a program or calendar for the execution of said reviews or security evaluations prioritizing partners that are more critical according to its risk analysis. If a member is not evaluated and the Customs Broker does not know if the processes and installations of its commercial partners function correctly, it puts its supply chain at risk. Response: Explanatory Notes:
Describe the procedure to carry out evaluations for the verification of security requirements (processes and installations) of its commercial partners, ensure you include the following points:
a) Periodicity with which it carries out visits to the commercial partner (these must be at least once a year and derived from risk situations). b) Program or calendar for the execution of security reviews. c) Record or report of the verification and in case of the corresponding follow-up.

d) The verification format(s) must be properly filled out, placing the date, name, and position of those participating in the review, signatures, etc. e) Indicate what action measures are taken in case commercial partners do not comply with the established security requirements. f) In case of having commercial partners with CTPAT certification or another supply chain security certification program, indicate the periodicity with which its status is reviewed, how it registers it, and the actions it takes in case it is detected that it is suspended and/or cancelled according to what is established in its procedure. For partners that have said security certification (granted by an authority), it will not be necessary to carry out visits, as long as the status of the certification is valid according to what is established in its procedure. The procedure must include:
a) Points of review in terms of security. b) Preparation of reports. c) Feedback and agreements with the commercial partner. d) Follow-up to agreements. e) Measures in case of detection of non-compliance with requirements. f) Record of evaluations. g) Area or person responsible for carrying out this procedure.

Process security.
Control measures must be established to guarantee the integrity and security of processes related to the flow of information (in any of its modalities) provided by the importer/exporter, shipper, supervised facility, etc., which is used for the movement of merchandise and its foreign trade operations, ensuring at all times that this information is legible and is protected against exchange, theft, loss, or introduction of erroneous data. Likewise, there must be established procedures to prevent and detect undeclared merchandise or materials, and prevent unauthorized personnel from having access to the merchandise and to the means of transport and containers. These procedures must be documented and ensure the integrity of import and export shipments from the point of origin until their final destination.

5.1 Process mapping.
There must be a process map that describes step by step the flow of information and operational for the transfer of foreign trade merchandise throughout the supply chain, allowing having a broad vision of its operations in terms of foreign trade.
The Customs Broker must take into account and include within its mapping all parties involved in its supply chain, containing those that handle import and export documentation, others that may not handle the cargo directly, but may have operational control such as transporters (long distance, crossing or transfer, subcontracted, etc.), storage, sub-maquila, national and foreign suppliers, direct and indirect, etc. If within its supply chain any part of the transport is subcontracted, it is indispensable that it be considered within its risk analysis and its process mapping, since, the more direct and indirect suppliers, the greater the risk involved.

Response: Explanatory Notes:
Attach the document where the mapping of processes through which the flow of information and import and export merchandise passes is illustrated and described, from the point where it receives it until its delivery, with the purpose of having well identified each of the steps that involve the reception, the dispatch of the merchandise until its delivery at the final destination. This process mapping must contain at least the following aspects:

Verification of the corresponding registry.
Granted mandate.
Revalidation of the transport document in case.
Prior review before dispatch.
Tariff classification.
Capture of the customs declaration.
Compliance with regulations and non-tariff restrictions (obligation to have permits from the competent authority before presenting the merchandise for dispatch).
Generation of the COVE (in case).
Value declaration.
Determination of contributions.
Review of information transmitted to the SEA with the documentation generated from the shipment (Gloss).
Payment of contributions.
Payment of maneuvers.
Validation of the customs declaration.
Presentation of merchandise before the automated selection mechanism.
Free customs clearance.
Customs Recognition.
Procedure in case of sample taking (The importer may provide them through its Customs Broker at the time of dispatch as long as the samples contain the precints, seals, or any means that manifest that the laboratory result is preserved sterile or it can be done by the authority).
Handling and control of security means, high-security padlocks/seals, and others.
Verification of the delivery of the merchandise at the agreed destination in case.
Procedure for re-dispatch of merchandise.
Procedure for the promotion of withdrawal of an import or export.
Subdivision of the shipment.
Effective communication to customs authorities for cases that represent a risk in terms of security.
Account of expenses of the shipment.
Measurement for customer satisfaction.
Treatment for complaints.
Verification of merchandise in transport.
Consolidation of the shipment.
Formation of the electronic file of each of the customs declarations or customs documents (Article 167 of the Law).

5.2 Delivery, receipt, and discrepancies in the cargo.
The Customs Broker must supervise, according to the type of operations it carries out and based on its risk analysis, the loading or unloading of the shipment verifying the detailed description of the merchandise, weight, labels, marks, quantities, and other data that help to quantify and fully identify the merchandise by comparing said information with the corresponding invoices, bill of lading, air waybill, or packing list. Considering and derived from these reviews, the documented procedure(s) to detect and report missing, surplus, prohibited merchandise, or any other discrepancy in the delivery or receipt of the merchandise, which must be investigated and resolved. Likewise, the driver transporting the merchandise must be delivered the required documentary information for its correct transfer (for example: customs declaration, packing list, invoice, contact data, and/or procedure in case of any security incident or inspection by any authority, among others). Response: Explanatory Notes:
Attach the documented procedure in which it indicates step by step how the delivery and receipt of the cargo is carried out, indicating how it controls or what security measures it has implemented to mitigate the risk of collusion or complicity between employees, such as the driver and personnel from the dispatch areas (in case), warehouse, security guards, etc. Attach the documented procedure to detect and report discrepancies in the delivery or receipt of the merchandise and ensure it includes the following points:
a) Responsible for carrying out the review. b) Documents to compare. c) Areas to which the information is reported.
This procedure must be applied to the merchandise that is received from import, export; and in case of applying, in the review at intermediate points.

5.3 Processing of information and cargo documentation.
The Customs Broker must have documented procedures to ensure that the electronic and/or documentary information sent by their clients from their service request, during the movement and clearance of goods, as well as the information received from business associates, is legible, complete, accurate, reported in a timely manner, and protected against changes, loss, or introduction of erroneous information. The Customs Broker must have access to the information of each cargo clearance they perform, in a secure and accessible manner, in written or electronic form. Likewise, the forms and documentation related to the clearance should be secured to prevent unauthorized use. Response: Explanatory Notes:
Attach the documented procedure for the processing of information and cargo documentation. Briefly explain what it consists of. a) Detail how you receive and transmit relevant information and documentation regarding the transfer of foreign trade goods with your commercial partners (indicate if you use a specific computer control system and briefly explain its function). Also, detail how you ensure that the information provided is legible, complete, accurate, reported in a timely manner, and protected against changes, loss, or introduction of erroneous information. b) The electronic information of shipments and cargo in general must include the seal and/or lock number with which the cargo was secured and, where applicable, changes due to review by any authority. c) Indicate how business associates transmit information to the Customs Broker, and how they ensure its protection.

5.4 Inventory Management, Control of Packaging, Container, and Crating Materials.
Where applicable, documented procedures must be in place for inventory control and storage of cargo, and periodic reviews must be carried out to verify their correct management (for example, in the case of invoice subdivision or shipping documents, etc.). Likewise, where applicable, you must have a documented procedure for the control and supervision of packaging and crating materials for goods (for example, in goods labeling processes), which also includes the procedure for control, dissemination, and prevention of visible pest contamination, in the case of using wooden packaging materials (such as pallets, boxes, crates, cages, reels, dunnage, chocks, supports, or platforms) to stack, move, and protect cargo throughout its entire supply chain. Response: Explanatory Notes:
Attach the documented procedure for inventory management. This must include, among other aspects according to your operation:
a) The frequency with which you carry out stock verification (periodic inventory). Indicate if there is a documented scheduled calendar to perform them. b) Indicate what is done in the case of surpluses and shortages in inventories. c) Indicate the treatment given to the control and handling of packaging, container, and crating materials, which must also include the procedure for control, dissemination, and prevention of visible pest contamination, in the case of using wooden packaging materials (such as pallets, boxes, crates, cages, reels, dunnage, chocks, supports, or platforms) to stack, move, and protect cargo. d) This point is also focused on reducing the risk of introduction or dissemination of quarantine pests of importance to the country through packaging (imports); therefore, describe how you comply with the provisions established by the Secretariat of Environment and Natural Resources (SEMARNAT) and NOM-144 SEMARNAT-2017, in accordance with International Standard for Phytosanitary Measures No. 15, titled Regulation for Wood Packaging Material Used in International Trade, which emanate from the Food and Agriculture Organization of the United Nations. Regarding waste or leftover packaging and crating material, indicate the procedure carried out for its handling and/or destruction. The applicant's procedures may include:
a) Warehouse accessible only to authorized personnel. b) Frequency of stock control. c) Control of incoming goods, transfers to other warehouses, consolidation or deconsolidation. d) Actions taken if irregularities, discrepancies, losses, or thefts are identified. e) Treatment of deterioration or destruction of goods. f) Separation of various types of goods, for example, high-value or hazardous goods.

5.5 Internal Communication.
The Customs Broker must have communication devices and/or systems in order to have immediate contact with the personnel of the different areas responsible for carrying out the customs clearance of goods. Additionally, a backup system must be available and its proper functioning verified periodically. Response: Explanatory Notes:
Describe in detail how the Customs Broker communicates with the personnel responsible for carrying out the clearance of goods, mainly with those who have direct contact with the goods and with the means of transport (agents, dependents, classifiers, etc.), in the event of any security incident. Indicate if operational and administrative personnel have or have access to devices (radios, mobile phones, landline telephones, etc.) to communicate with each other and/or with the relevant parties. These must be accessible to users to enable a prompt response. Describe the procedure for the control and maintenance of communication devices; ensure you include the following points:
a) Policies for the assignment of mobile communication devices. b) Maintenance or replacement program for fixed and mobile communication devices. c) Indicate if you have backup communication devices in case the permanent system fails, and briefly describe them.
The procedure may include:
a) Person responsible for the proper functioning and maintenance of communication devices. b) Record of verification and maintenance of devices. c) Method of assignment of communication devices.

Customs Management.
The Customs Broker must have documented procedures, in which internal and operational policies are established, as well as the necessary controls for the proper fulfillment of customs obligations, with the objective of guaranteeing the fulfillment of the entrusted mandate.
Likewise, the Customs Broker must have specialized personnel and documented procedures that establish the verification of information and documentation generated on their behalf.

6.1 Management of Customs Clearance.
The Customs Broker must have documented procedures that detail each of the steps shown in their process mapping established in sub-standard 5.1.
Response: Explanatory Notes:
Attach the documented procedures that describe each of the points or steps contemplated in your process mapping (5.1). These procedures must include the following points:
a) Persons responsible for each procedure. b) Formats and documents used. c) Systems used. d) Supply chain actor with whom information is exchanged.
The review of these procedures that detail the operation of the customs clearance of goods must at all times coincide with the information and/or documentation provided by the client.
Mainly on the following topics:
a) Tariff classification (supporting information or technical sheets of the goods that the client sends to the Customs Broker for correct classification). b) Compliance with regulations and non-tariff restrictions. [Interaction with clients and different government departments for compliance with regulations and non-tariff restrictions (RRNA)]. c) Value declaration (The verification and confirmation of the information provided by the client will serve as support for the use of the valuation methods established in the Law). d) Payment of contributions (the exchange of information generated for the payment of contributions must be clear and precise with the client).

6.2 Control in Fiscal Premises.
The Customs Broker must have documented procedures that contemplate the control of official badges requested for personnel entering fiscal premises, such as: customs agent, dependent, etc.
Likewise, one of the customs obligations is the evaluation and certification of the customs agent figure; therefore, the Customs Broker must have a documented procedure to comply with what is established in the Law.
Response: Explanatory Notes:
Attach the documented procedure that describes the control of official badges for personnel entering fiscal premises; ensure you include the following points:
a) Procedure for requesting badges with Associations or Confederations. b) Badge use policies. c) Infractions related to the improper use of badges. d) Fines applicable to infractions related to the improper use of badges.
An updated list of requested badges, as well as those that have been canceled, must be maintained.
Describe the process that the customs agent must follow to apply evaluations and keep their certifications of activities current, such as:
a) Supervision of previous and derived acts of customs clearance. b) Preparation of the customs declaration (pedimento). c) The set of acts and formalities related to the entry of goods into the national territory and their exit from it.
The Customs Broker must have the corresponding evidence supporting the evaluations and certifications of the aforementioned topics.

Security of Cargo Vehicles, Containers, Trailers, and/or Semi-trailers.
Depending on the case, security must be maintained in means of transport, tractors, containers, trailers, and semi-trailers (including cargo vehicles such as pickup trucks, vans, or vans, among others), to protect them from the introduction of unauthorized persons and/or materials. For this reason, it is necessary to have documented procedures to identify, inspect, seal, and maintain their integrity. Likewise, the inspection process of said means of transport, containers, trailers, and semi-trailers used as Instruments of International Traffic must include a procedure for agricultural inspections to look for visible pests and serious structural deficiencies. Pest contamination is defined as visible forms of animals, insects, or other invertebrates (living or dead, at any stage of the life cycle, including eggs, etc.), or any organic material of animal origin (including blood, bones, hair, meat, secretions, excretions, etc.); plants or plant products (including fruits, seeds, leaves, twigs, roots, bark, etc.); or other organic material, including fungi, soil, or water; when such products are not the declared cargo within the Instruments of International Traffic. In the case of using high-security seals, it is necessary to have procedures to seal correctly and maintain integrity from the moment they leave your facilities. A high-security seal must be applied to all containers and trailers for foreign trade shipments, which must meet or exceed Standard ISO 17712 for high-security seals. For this reason, with the objective of maintaining supply chain security, the Customs Broker must inspect all cargo vehicles systematically upon entry and exit of their facilities (domestic and international traffic), in addition to keeping a record.

7.1 Use of Seals and/or Locks on Containers and Trailers.
The Customs Broker must have, where applicable, a documented procedure, where means of transport, containers, trailers, and/or semi-trailers and high-security seals used in the international logistics chain are identified, indicating how their integrity is maintained.
For this reason, as one of the security mechanisms, the Customs Broker, where applicable, must use locks or high-security seals that meet or exceed Standard ISO 17712 on all containers and loaded trailers that are subject to foreign trade and maintain their integrity until clearance. For this, the Customs Broker must have documented procedures to correctly place high-security seals and verify their integrity. The procedures must include the steps to follow if a seal is found to be altered, manipulated, or if there is an incorrect seal number in the documentation, the communication protocols to business associates involved in the supply chain, and the investigation of the security incident; these must be reported to security personnel, business associates who may be part of the affected supply chain, security specialist, or contact of the Authorized Economic Operator Program. Likewise, in said procedure, it is necessary for the Customs Broker to include what is related to the administration of high-security seals, which must include, control, assignment, safeguarding, handling of discrepancies, and destruction of seals and locks (the latter is mandatory whenever seals are broken in their facilities). Regarding the provider of the seals and/or locks, it must be demonstrated how these comply with Standard ISO 17712. The Customs Broker or a security supervisor must carry out periodic and documented audits of the high-security seals and/or locks; these reviews must include the verification of the inventory of stored seals and/or locks and the comparison with inventory records and shipping documents. Also, the Customs Broker must periodically verify the seal numbers used in means of transport and Instruments of International Traffic to corroborate that the information is correct. In the case of having a yard for storing cargo vehicles at the Customs Broker's facilities, empty containers must be secured with a lock and/or indicative seal, or in a secure area that is guarded and monitored by alarm systems and closed-circuit television and video surveillance. When it is necessary to store (overnight) any loaded container, trailer, and/or semi-trailer, it must be located in a secure area and monitored by alarm systems and closed-circuit television and video surveillance to prevent access and manipulation, and must be closed with a high-security lock. Response: Explanatory Notes:
Indicate if the Customs Broker has its own or third-party transport units, containers, and/or trailers.
Attach the documented procedure for the placement and review of seals and/or locks on vehicles, means of transport, containers, rail cars, trailers, and/or semi-trailers. This must include, among other aspects according to your operation:
a) Verify that the seal or lock is intact and determine if there is evidence of improper manipulation.
Use the VVTT inspection method:

V - View the seal and lock mechanisms of the container (View).
V - Verify the seal number (Verify).
T - Pull the seal to ensure it is correctly placed (Tug).
T - Twist and turn the seal to ensure (Twist and Turn).

b) Review and compare the documentation containing the number of the original seal or lock and, where applicable, any additional ones carried during the transfer of goods. In case of using a replacement seal and/or lock, that number must be registered within the Customs Broker's control. If altered seals and/or locks are identified, they must be kept to help carry out the investigation of said incident or discrepancy and, as appropriate, report the compromised seals and/or locks to the foreign authority. c) Review that closing devices, hinges, and pins are attached to the trailer or container and welded or riveted. Protective plates can also be placed on door hinges and/or a seal/adhesive tape placed on at least one side. Likewise, the correct functioning of handles, latches, and all other locking or closing mechanisms of cargo vehicles must be verified to detect manipulations and any inconsistencies before placing any sealing device. d) Indicate how high-security locks are assigned and replaced in the case that, during the route, it is inspected by another authority. If a seal and/or lock breaks in transit, the cargo must be examined, the replacement seal and/or lock number must be registered, and the driver must immediately notify business associates when this happens, indicate who broke it, and provide the new seal number. Where applicable, attach the documented procedure for the control and handling of seals and/or locks. This must include, among other aspects according to your operation:
a) Inventory of locks and/or seals. b) Who has access and how locks and/or seals are safeguarded. The management of seals and/or locks must be restricted only to authorized personnel; stored in a secure place, have an inventory, control of their distribution and tracking (record of seals used, as well as the receipt of new seals and/or locks).

c) Describe how the Customs Broker participates in audits of high-security seals and/or locks, the reviews they perform, the records they generate, and the actions they take if discrepancies are identified. Also, how dependents verify seal numbers used in means of transport and Instruments of International Traffic to corroborate that the information is correct (this process can also be included within the internal audits referred to in sub-standard 1.3 of this document). d) How discrepancies in seal and/or lock numbers are addressed. e) Record of seals and/or locks used at the time of customs recognition. In the case of lost or stolen seals and/or locks, describe the procedure followed by the Customs Broker. Indicate who the provider(s) are and how they prove that the specifications of the seals and/or locks comply with Standard ISO 17712 (attach certificate of conformity, issued by the certifying company responsible for verifying compliance with the corresponding ISO). In the case of having a yard for storing cargo vehicles at the Customs Broker's facilities, describe how you ensure the integrity of means of transport is cared for. All written procedures must be disseminated and maintained at the operational level so that they are easily accessible to employees responsible for executing the tasks described above, reviewed at least once a year, and updated as necessary.

7.2 Inspection of Means of Transport, Containers, Trailers, and Semi-trailers.
In the case of having a yard for storing means of transport, the Customs Broker must have established procedures to verify the physical integrity of the structure of the means of transport, container, trailers, and/or semi-trailer used as Instruments of International Traffic, even the reliability of the door lock mechanisms, with the purpose of identifying natural or hidden compartments. Inspections of means of transport or cargo vehicles, containers, and trailers (land cargo) must be systematic and have records of these inspections, in an access-controlled area and carried out in a place monitored by alarm systems and closed-circuit television and video surveillance; said system must cover the inspection process in its entirety. The documented procedure for its inspection must include, by way of example and not limitation, the following review points:
Means of Transport Trailers, Rail Cars, Semi-trailers, and Containers
1. Bumper;
2. Tires and rims (tractor and trailer);
3. Floor (tractor);
4. Fuel tanks;
5. Cab interior (bedroom and tool compartment);
6. Air tanks;
7. Chassis;
8. Fifth wheel area;
9. Drive axles;
10. Exhaust pipe; and
11. Engine.
1. Exterior and interior doors;
2. Side walls (left and right);
3. Interior and exterior roofs;
4. Front wall;
5. Internal floor;
6. Where applicable, the refrigeration system.
Likewise, before loading means of transport, containers, rail cars, trailers, and semi-trailers used as Instruments of International Traffic, they must undergo agricultural and security inspections to guarantee that their structures have not been modified to hide smuggling or have been contaminated with visible agricultural pests, keep a record, and be backed by a documented procedure. If visible pest contamination is found during the inspection or transport of goods subject to foreign trade, it must be cleaned (washed, vacuumed, etc.) to eliminate said contamination. Response: Explanatory Notes:
Attach the documented procedure to carry out the security and agricultural inspection of means of transport, containers, trailers, and semi-trailers.
This must include, among other aspects according to your operation:
a) Persons responsible for carrying out the inspection. b) Definition of the place(s) where the inspection is carried out and indicate how monitoring is performed by alarm systems and closed-circuit television and video surveillance. c) The review points for means of transport, trailers, semi-trailers, and containers both for security and those for quality and agricultural inspections with the purpose of looking for visible pests. Attach the established format for the inspection of means of transport or cargo vehicles, containers, rail cars, trailers, and/or semi-trailers.

Furthermore, the security and agricultural inspection format must include the following information:
a) Inspection date; b) Inspection time; c) Vehicle license plates (tractor and trailer); d) Container/trailer number; e) Specific areas of the cargo vehicles that were inspected; and f) Name of the employee performing the inspection and the supervisor.
The security and agricultural inspection formats may be signed by the supervisor to corroborate their information and become part of the import and export documentation.
The documentation must be kept for one year for investigation in the event of any security incident, as well as to demonstrate continuous compliance with these inspection requirements.
Indicate whether the repair or maintenance of transport units, containers, or trailers is performed in the same facilities or carried out with an external provider.

Personnel Security.
Documented procedures must be in place for the registration and evaluation of individuals seeking employment with the Customs Agent, and methods must be established to conduct periodic checks on current employees.
There must also be continuous training programs for administrative and operational staff, disseminating the Customs Agent's security policies, as well as the consequences and actions to be taken in the event of any security breach or incident.

8.1 Employment Background Verification.
The Customs Agent must have documented procedures to investigate and verify the information stated in the curriculum vitae, criminal records (if local legislation and company policies allow), and applications of candidates with potential for employment, in accordance with local legislation, either independently or through an external company. Similarly, for positions that, due to their sensitivity, require it and affect the security of shipments subject to foreign trade, in accordance with their previously conducted risk analysis, they must consider requesting stricter requirements for hiring and during their employment tenure, which must be carried out periodically at least once a year. Regarding personnel already working in the company, periodic investigations must be conducted based on the activities and/or sensitivity of the employee's position. All information regarding personnel must be kept in personal files, which must have restricted access.

Response: Explanatory Notes:
Describe the documented procedure for personnel hiring and ensure you include the following:
a) Requirements and documentation demanded. b) Tests and exams requested. c) Indicate the critical areas and/or positions identified as risky, according to your analysis. d) Indicate what the additional requirements are for specific areas and/or job positions, such as criminal records (if company legislation and policies allow), non-criminal record certificate, socioeconomic studies, clinical studies, toxicological (drug use) studies, etcetera. If applicable, indicate the job positions or areas where they are required and with what frequency they are carried out. e) Indicate whether, prior to hiring, the candidate must sign a confidentiality agreement or a similar document. f) In the event of hiring through a staffing agency, indicate whether it has documented procedures for personnel hiring and how it ensures they comply with the same. Briefly explain what they consist of. The procedures for personnel hiring and contractors may include:
a) Thorough investigations of the work and personal backgrounds of new employees. b) Confidentiality and liability clauses in employee contracts. c) Specific requirements for critical positions. d) If applicable, the periodic update of the socioeconomic and physical/medical study of employees working in critical and/or sensitive areas. e) Hiring process and requirements requested for temporary employees and contractors. The Customs Agent may consider the results of background checks on candidates, as permitted by current legislation, to make hiring decisions. Background checks are not limited to identity and criminal record verification. In higher-risk areas, deeper investigations may be justified.

8.2 Personnel Termination Procedure.
There must be documented procedures for personnel termination, which include the handover of identification, and any other items provided to them to perform their functions (keys, uniforms, badges and/or credentials, computer equipment, passwords, tools, etcetera). Likewise, this procedure must include termination in those systems, both computer and access, among others that may exist. Response: Explanatory Notes:
Describe the procedure for personnel termination, and ensure you include the following:
a) Who is responsible for carrying out and following up on this procedure. b) How the handover of identification, uniforms, keys, and other equipment is performed and confirmed. c) Indicate the control, record, and/or format, in which the handover of material is identified and ensured, and termination in computer systems (if applicable, attach). d) Indicate the type of records of personnel who ended their labor relationship with the Customs Agent, so that in case it was for security reasons, their service providers and/or business associates are warned.

8.3 Personnel Administration.
The Customs Agent must maintain an updated system, control, or database of active employees. Likewise, it must carry out and maintain updated records of affiliation to social security institutions and other legal labor records.
In the event that the Customs Agent has personnel hired by its business partners and working within the facilities, it must ensure that they comply with the requirements established for the rest of its employees.
Response: Explanatory Notes:
Indicate whether the Customs Agent has an updated system, control, or database, both for personnel hired directly, as well as that hired through a service provider company, and ensure it includes, by way of example but not limitation, the following points:
a) Full name. b) Updated photograph at least every five years. c) Personal data (age, name, date of birth, phone number, address, CURP, social security number, blood type, allergies, etcetera). d) Family ties. e) Work background. f) Diseases. g) Medical exams. h) Training. i) Psychometric exams. j) Toxicological exams. k) Results of periodic evaluations. l) Observations. This personnel must be hired in accordance with current labor laws and regulations.

Information and Documentation Security.
Prevention measures must exist to maintain the confidentiality and integrity of information and documentation related to foreign trade operations, including those used for information exchange with other members of the supply chain. Likewise, there must be comprehensive documented policies and/or procedures to protect Information Technology systems, including measures against misuse, as well as identifying and prioritizing actions to reduce cybersecurity risk. They may also address how a member shares information about cybersecurity threats with the government and other business partners.

9.1 Document Classification and Handling.
Procedures must exist to classify documents according to their sensitivity and/or importance. Sensitive and important documentation must be stored in a secure area that only allows access to authorized personnel. The useful life of the documentation must be identified, and procedures for its destruction must be established in accordance with the corresponding legislation. The Customs Agent must conduct reviews regularly to verify access to information and ensure that it is not used improperly. Some of the sensitive information referred to in the previous paragraph, depending on the case, may be:
a) Compilation of documentation prior to customs clearance. b) Export/import declaration. c) Packing list. d) Bill of lading (air waybill, bill of lading, and waybill) as applicable. e) Copy of documents proving compliance with non-tariff restrictions and regulations on imports issued in accordance with the corresponding laws. f) The document on the basis of which the provenance and origin of the goods are determined for the application of tariff preferences. g) The document in which the guarantee granted through a deposit made in the guarantee customs account referred to in Article 84-A of the Law is recorded, when the declared value is lower than the estimated price established by the SE. h) The weight or volume certificate issued by the certifying company authorized by the Secretariat through rules, regarding the clearance of bulk goods in maritime traffic customs, in the cases established by the Regulation. i) The information that allows identification, analysis, and control as indicated by the Secretariat through rules. j) Manifestation of the value of the goods. k) Calculation sheet for the determination of contributions, benefits, and/or accessories. l) Responsive letter (technical and MSDS safety data sheet for materials, if applicable). m) Insurance policy for the cleared goods. n) The Customs Agent must conduct reviews regularly to verify access to information and ensure that it is not used improperly.

Response: Explanatory Notes:
Attach the documented procedure for the registration, control, and storage of printed documentation (classification and filing of documents), which must include:
a) Control register for delivery, loan, among other documents. b) Restricted access to the archive area. c) Storage and classification policies. d) An updated security plan describing the measures in force regarding the protection of documents against unauthorized access, as well as against deliberate destruction or loss thereof. e) In the case of electronic or digital information, it must adhere to the security criteria of sub-standard 9.2 Information Technology Security.

9.2 Information Technology Security.
To protect Information Technology systems against common cybersecurity threats, the Customs Agent must have sufficient protection to preserve the confidentiality, integrity, availability, and auditability of the information generated as a result of the foreign trade operations it carries out with authorities, its clients, and other actors. Likewise, it must promote security in Information Technology infrastructure (software and hardware) against malware (viruses, spyware, worms, trojans, etcetera), baiting, phishing, and internal/external intrusions (firewalls) in the companies' computer systems. Likewise, companies must ensure that their security software is active and receives periodic updates. In the case of automated systems and computer equipment, individual accounts requiring periodic password changes must be used. In order to protect the confidentiality, integrity, and availability of information, the Customs Agent must have established information technology policies, procedures, and standards that must be communicated through a training program for all employees who handle computer equipment and systems, which includes topics to prevent attacks through social engineering and all those threats to which they are exposed (malware, baiting, phishing, etcetera). Customs agents that allow their employees to connect remotely to a network must use secure technologies, such as virtual private networks (VPN), to allow employees to access the company intranet securely when they are outside the office, as well as procedures designed to prevent unauthorized remote user access. For the above, there must be written procedures and infrastructure to protect the Customs Agent against loss, theft, leakage, hacking, and/or ransomware of information, this includes the procedure for the recovery (or replacement) of Information Technology systems and/or data, as well as a system or software established to identify the abuse of Information Technology Systems and detect inappropriate access and/or improper manipulation or alteration of commercial and business data, as well as a written procedure for the application of appropriate disciplinary measures to all offenders. Sensitive information must be protected through these information security policies, in addition to having backup copies. Access to Information Technology Systems must be protected against infiltration through the use of secure passwords, which include phrases or other forms of authentication. Users of said Information Technology systems must safeguard and not share their access keys or passwords. All Information Technology infrastructure must be physically protected against unauthorized access. If a data leak or other unexpected event occurs resulting in the loss of data and/or equipment, the procedures must include the recovery or replacement of Information Technology systems and/or data.

Response: Explanatory Notes:
Attach the procedure for the recovery or replacement of Information Technology systems and/or data, which includes how it backs up and ensures the security of its information, in addition to protecting it from possible losses. Ensure you include the following points:
a) Indicate the frequency with which information backups are carried out. b) Who has access to them and who authorizes the recovery of information. c) Indicate what type of tests it performs and how often, to verify the security of the network, systems, and infrastructure. d) Mention whether, to carry out this type of tests or vulnerability scans, it does so through software, a third party or provider, and if so, indicate the name or corporate name. e) In the event of finding vulnerabilities, describe the corrective actions that must be implemented. f) Indicate whether it shares information about cybersecurity threats with its business partners participating within its supply chain (for example: communications, bulletins, emails, etcetera). g) Systems must be protected under passwords and frequently modified; therefore, indicate the procedure for changing them. h) Indicate if there are information security policies for their protection. i) There must be a system or software to detect and identify the abuse, intrusion, or access of unauthorized persons to its systems and/or Information Technology data (any system used by the company), as well as the abuse of the policies and procedures established by the company, including improper access to internal systems, external websites, and the manipulation or alteration of commercial data by employees or contractors.

j) All offenders must be subject to the application of disciplinary measures; therefore, indicate the corrective policies and/or sanctions in the event of the detection of any violation of the Information Technology systems and security policies.
The Information Technology and cybersecurity policies and procedures must be reviewed annually and updated as a result of an attack or according to situations that may put the Customs Agent's systems at risk.
Describe the security measures used to allow employees to connect remotely to a network (VPN), to allow employees to access the company intranet remotely when they are outside the office.
In the event of allowing employees to use personal devices to perform company work, such devices must comply with the company's cybersecurity policies and procedures, security updates must be periodic, and there must be a method to access the company network securely. k) Indicate if business partners have access to the Customs Agent's computer systems. If so, indicate what programs they use and how they ensure control of access to them. l) Indicate if the computer equipment has a backup power supply system that allows business continuity. The procedures regarding the Customs Agent's information backup must also include at least the following:
a) How and for how long the data is stored (data should be backed up once a week or as appropriate). b) Business continuity plan in case of incident and how to recover the information. c) Frequency and location of backup copies and archived information. d) If backup copies are stored in sites alternative to the facilities where the data processing center is located. e) Tests of the validity of data recovery from backup copies.

The procedures regarding the protection of the Customs Agent's information must also include:
a) An updated and documented policy for the protection of the Customs Agent's computer systems against unauthorized access and deliberate destruction or loss of information. All sensitive and confidential data must be stored in an encrypted or ciphered format. b) Detail if it operates with multiple systems (sites/locations) and how such systems are controlled. c) Who is responsible for the protection of the Customs Agent's computer system (responsibility should not be limited to one person but to several so that each can control the actions of the rest). d) Each user's access must be assigned through individual accounts and restricted according to the job description or assigned tasks. Therefore, describe how access authorizations and access levels to computer systems are granted (access to sensitive information must be limited to personnel authorized to make modifications and use the information). Authorized access must be monitored by the area responsible for granting it, to verify or, if applicable, report that access to confidential systems is based on job requirements. e) Indicate the elements or format that passwords must have, for access to Information Technology systems and equipment methods of authentication, and who provides those passwords. f) Indicate the name of the firewall and anti-virus used (include licensing-related information), evidencing that this security software is active and receives periodic updates. For the above, cybersecurity policies and procedures should include measures to prevent the use of counterfeit products or those with incorrect licenses (software and hardware).

All computer equipment, electronic media (hard drives, cell phones, etc.) and Information Technology hardware containing confidential information related to the import and export process must be accounted for through periodic inventories and have such evidence. When these technological equipment must be discarded, there must be a documented procedure that includes how they must be formatted, disinfected, or destroyed adequately to prevent information leakage.

g) In the event of staff turnover, access to computer, telecommunications, and network equipment must be eliminated at the moment of the employee's separation; this includes email accounts, system access accounts, software, programs, etc.

h) Measures planned to handle security incidents in case the system is compromised.

Security training and awareness.
There must be a documented awareness program on threats established, designed, and updated by the Security Committee to recognize and create awareness about threats from terrorists and smugglers at each point in the supply chain. The training program must be comprehensive and cover all security requirements of the Authorized Economic Operator Program.

Administrative and operational employees must know the procedures established by the Customs Agent to consider a risk situation and know how to report it.

Specific training must be provided to employees who, due to their functions, are in direct contact with goods and/or transport means, as well as to employees who are in critical and/or sensitive areas determined under their risk analysis (security areas, shipments and receipts, if applicable, as well as those who receive and open mail and packages, among others).

10.1 Training and awareness on threats.
The Customs Agent must have a training and awareness program on supply chain security policies, directed to all its employees (operational and administrative), and additionally make available informational material regarding the procedures established by the Customs Agent to consider a situation that threatens its security and know how to report it.

These training programs must foster the active participation of employees in security controls and mechanisms; the Customs Agent must ensure that all its employees know, understand, and apply supply chain security policies, as well as keep records of all training efforts provided and the list of those who participated in them.

Likewise, and with the purpose of maintaining the integrity of operations and processes related to the customs clearance of goods, personnel must receive specific training according to their functions. The topics that must be included are the following: maintaining cargo integrity, conducting container, trailer, and/or semi-trailer reviews for agricultural and security purposes (if applicable), receipt and review of mail and packages, prevention of operations with proceeds of illicit origin (money laundering, terrorist financing, etc.), how to recognize and how to report internal conspiracies, protection of access controls, as well as training regarding smuggling, cargo theft, placement of seals, control of high-security seals (VVTT inspection method), prevention of visible contamination by pests, use of official badges, etc. These topics must be established as part of new employee onboarding and periodically maintain update programs.

Update training must be carried out periodically, after a security incident, and when there are changes in the Customs Agent's procedures.

In addition to security training programs, an awareness program on alcohol and drug consumption must be included. Also, disseminate and train personnel on the Customs Agent's cybersecurity policies, procedures, and standards (theft, leakage, hacking, and/or information kidnapping), including access to computer equipment and systems via passwords or phrases. Personnel who operate and administer security technology systems must receive training related to their operation and maintenance, including self-training through operational manuals and other methods. These topics must be established as part of new employee onboarding and periodically maintain update programs.

Training programs must foster the active participation of employees in security controls and mechanisms, as well as keep records of all training efforts provided by the Customs Agent and the list of those who participated in them (videos, photographs, minutes, attendance lists, intranet or other system, didactic material, PowerPoint presentations, brochures, etc.). Training records must include the date of the training, the names of the attendees, the topics taught, in addition to having measures to verify that the training provided met all training objectives.

Response: Explanatory Notes:
Must have a training program on security and prevention of security incidents in the supply chain for all employees working for the Customs Agent (administrative, operational, direct or indirect). Briefly explain what the training program consists of and ensure to include the following:
a) Brief description of the topics taught in the program. b) When they are taught (Onboarding, specific periods, derived from audits, security incidents, etc.). c) Frequency of training, as well as updates and reinforcement. d) Indicate how participation in supply chain security training is documented (videos, photographs, minutes, attendance lists, intranet or other system, didactic material, PowerPoint presentations, brochures, etc.). Training records must include the date, the names of the attendees, the topics taught, in addition to having measures to verify that the training provided met all objectives of the same. e) Explain how employee participation in security matters is fostered.

Training on agricultural reviews must cover pest prevention measures, regulatory requirements applicable to wooden packaging materials, in accordance with International Standard for Phytosanitary Measures No. 15 entitled Regulation of Wood Packaging Used in International Trade, which emanate from the Food and Agriculture Organization of the United Nations and the identification of infested wood.

Handling and investigation of incidents.
There must be documented procedures to report and investigate security incidents in the supply chain and the actions to be taken to prevent their recurrence, as well as to notify security personnel, business partners that may be part of the affected supply chain, security specialist or Authorized Economic Operator Program contact, and other competent authorities. Reporting and investigation procedures must include updated contact information or directory listing the names and phone numbers of personnel requiring notification. The investigation and analysis of incidents must be documented (physical and/or electronic file), as well as corrective actions to prevent them from happening again, which must be implemented as soon as possible.

In the case where the Customs Agent identifies that any foreign trade shipment is involved in a situation that puts the supply chain security at risk, due to suspicion of a business partner or person, they must inform the competent authority, business partners that may be part of the affected supply chain, security specialist or Authorized Economic Operator Program contact, as well as the competent authority, and, if possible, before the border crossing, exit, or customs clearance (import and export). Procedures must include the steps to follow if a seal is found to be altered, manipulated, or if there is an incorrect seal number in the documentation, the communication protocols to involved business partners in the supply chain, and the investigation of the incident. All the aforementioned procedures must be reviewed periodically or at least once a year to ensure that contact information and action protocols are correct.

11.1 Reporting of anomalies and/or suspicious activities.
In case of detection of anomalies and/or suspicious activities related to supply chain security and in accordance with their logistical processes (related to access control, delivery, receipt, and storage of goods, security inspections of cargo vehicles and transport operators, etc.), these must be reported to security personnel, business partners that may be part of the affected supply chain, security specialist or Authorized Economic Operator Program contact, and other competent authorities, keeping a record of such anomalies and/or unusual activities.

Response: Explanatory Notes:
Describe the procedure to denounce or report anomalies and/or suspicious activities, as well as mechanisms to anonymously report problems related to security; ensure to include the following:
a) Who is responsible for reporting security incidents. b) Detail how it determines and identifies with which authority to communicate in different scenarios or presumption of suspicious activities. c) Mention if it keeps a record of the reporting of these activities and/or suspicions and briefly describe what it consists of.

11.2 Investigation and analysis.
There must be written procedures to denounce or report anomalies and/or suspicious activities, the analysis and investigation of security incidents in the supply chain to determine their cause, in addition to corrective actions to prevent them from happening again, which must be implemented as soon as possible. The information derived from this investigation must be documented and available at all times for authorities that so require.

This information and documentation generated to carry out the foreign trade operation of the affected goods must be included in a file with the purpose of identifying each of the processes through which that operation went until the point where the incidence was detected and allowing recognition of the vulnerability of the chain.

Response: Explanatory Notes:
Describe the documented procedure to initiate an investigation in case of any security incident, and ensure to include the following:
a) Person responsible for carrying out the investigation. b) Documentation that integrates the investigation file of the foreign trade operation.
The documents to be included in the file derived from the investigation, by way of example and not limitation, may be:
a) General information of the shipment, purchase order. b) Transport request; confirmation of transport means; identification of the transport operator (access records, exit, security inspection records, etc.). c) Container Inspection Formats; exit order; delivery records. d) Videos from alarm systems, closed-circuit television, and video surveillance. e) Documentation generated for the carrier (packing list, bill of lading, instruction sheet). f) Documentation generated for business partners (description of goods, proformas, invoices, etc.). g) Documentation generated by business partners (customs declarations, manifests, tracking and inspection reports, videos if applicable, etc.).

E5.
Profile of the Land Auto Carrier.
Acknowledgment of Receipt
First Time: Renewal:
Addition:
Modification:
The data provided will replace the data provided when requesting authorization.

General Information.
The objective of this Profile is to ensure that the land auto carrier implements security practices and processes that ensure its supply chain, mitigating the risk of contamination of its vehicles with illicit products, as well as loss, theft, and/or any other factor that could compromise the security of the supply chain.

Land auto carriers interested in obtaining the authorization referred to in rule 7.1.5. must have documented and verifiable processes.

Likewise, the transport company interested in the aforementioned authorization must integrate the criteria required in this document into the business model or design it has established, seeking during the implementation of security standards the application of an analysis culture that supports decision-making in accordance with the values, mission, vision, codes of ethics, and conduct of the company itself.

As an example of the points or topics requested of interested parties during the filling of this document, which require analysis to identify risks affecting the supply chain, and in turn help detect their treatment, are the following: points of origin and destination, routes, facilities, volume of operations, yard security, previous security incidents, interaction with business partners, among others.

Filling Instructions:
1. You must fill out a Land Auto Transport Profile of the main facility, as well as each of the main facilities where vehicles are used and safeguarded for the transfer of foreign trade goods. In the case of yards and/or branches that are also under the same RFC, a Profile must be developed for each of them, following strictly what is established in sub-standard 7.3. of this document. This information must coincide with what is stated in your Certified Commercial Partner application.
2. Detail how the company complies with or exceeds what is established in each of the numerals as indicated.
3. The format of this document is divided into two sections, as detailed below:
1. Standard.
Description of the standard
1.1 Sub-standard.
Description of the sub-standard
Response. Explanatory Notes.
Describe and/or attach... a) Points to highlight...

4. Indicate how you comply with what is established in each of the sub-standards; therefore, you must attach the procedures in Spanish. These procedures must be characterized by describing or defining the objective the document pursues, the start and end of the process, measurement indicators, requirements, documents or formats to be used, responsible parties, among others.
5. In cases where only an explanation of the procedure is required, it must be detailed and placed in the Response field.
The field regarding Explanatory Notes is a guide regarding the points that must be included in the Response of each sub-standard, indicating in an indicative manner those points that should not be excluded from your response.
6. Once this Land Auto Carrier Profile is answered, it must be attached to the Application for inscription in the Certified Commercial Partner registry referred to in the first paragraph of rule 7.1.5., fraction I, subsection b).
7. For the purpose of verifying what is stated in the previous paragraph, the SAT through the AGACE may conduct an inspection of the facility indicated here, with the exclusive purpose of verifying what is stated in this document.
8. Any incomplete Land Auto Carrier Profile will not be processed.
9. Any question relative to the Certified Commercial Partner Application and the Land Auto Carrier Profile should be directed to the contacts appearing on the SAT Portal.
10. In the case of being authorized as a Certified Commercial Partner, this format must be kept updated and notify when the circumstances under which the registration was granted have varied and derived from these changes or modifications in the information stated and provided in this Land Auto Carrier Profile to the authority are required, in accordance with what is established in rule 7.2.1., fourth paragraph, fractions I, II, and VII.
11. When derived from the inspection visit, non-compliance related to minimum security standards results, the applicant may remedy them before the issuance of the resolution established in rule 7.1.6., for which they will have a maximum period of three months counted from the notification of the indicated non-compliances.

Facility Data.
A Land Auto Carrier Profile of the main facility must be filled out, as well as each of the main facilities where vehicles are used and safeguarded for the transfer of foreign trade goods. And in case of yards and/or branches that are also under the same RFC, a Profile must be developed for each of them, as well as strictly following what is established in sub-standard 7.3. of this document. This information must coincide with what is stated in your Certified Commercial Partner application.

Facility Information. Land Auto Carrier Profile Number: from:
RFC: Name and/or Business Name:
Name and/or Denomination of the
Facility
Type of Facility:
Street: Number and/or exterior letter Number and/or interior letter Neighborhood: Postal Code: Municipality/Delegation: Federal Entity:
Age of the Facility (years of operation):
Predominant activity (Transfer / Long
Distance):

Type of service (General/Specialized
Cargo):
Average number of monthly shipments
(EXP):
(Long distance and/or crossing)
Average number of monthly shipments
(IMP):
(Long distance and/or crossing)
Total number of employees at this facility: Facility Surface Area (m 2 ):
Total number of yards and/or branches (owned and/or subleased) that are enabled and used for the storage of transport means:
Certifications in security programs: (Indicate if this facility has a certification from any of the following programs) CTPAT: Yes No Level: Pre-Applicant: Applicant: Certified: Certified/ Validated:
CTPAT Account number (Eight digits):
Date of last visit at this facility:
Authorized Economic Operator from other countries (AEO) Yes No Program: Registry:
Other Supply Chain Security Programs
Yes No Program: Registry:
Certifications: (Indicate if you have certifications that you consider impact your supply chain process, for example: ISO 9000; Reliable Logistics Processes, among others) Name: Category: Validity:
Name: Category: Validity:
Name: Category: Validity:

Supply Chain Security Planning.
The carrier company must develop documented policies and procedures to carry out risk management that allows for the identification, analysis, evaluation, and treatment of risks and weaknesses in its supply chain and facilities, with the objective that the company's senior management implements strategies that help mitigate and deter such risks and thereby contribute elements that strengthen supply chain security. Likewise, to build a solid supply chain security program, the company must have a Security Committee that incorporates representatives from all relevant departments, forming a multifunctional team that identifies areas for opportunity and proposes continuous improvement actions throughout the company's supply chain and facilities. Similarly, the company must have designated points of contact for the Authorized Economic Operator Program; this personnel must be involved, know the requirements of the Authorized Economic Operator Program, belong to the company and prove their relationship with it, as well as respond to their supply chain security specialist (this is assigned once the company already has the Authorized Economic Operator Program). If, as a result of the risk analysis, new security measures arise to be incorporated within the company, these must be included in the company's existing procedures and, where applicable, new procedures must be drafted, which creates a more sustainable structure and emphasizes that supply chain security is everyone's responsibility.

1.1 Risk Analysis.
The carrier company must establish measures to identify, analyze, and mitigate security risks throughout the supply chain, including its facilities. For this reason, it must develop a written procedure in which risks are determined based on its organization's model (e.g., volume, units, yards, routes, potential threats, etc.), which allows it to implement and maintain appropriate security measures. Based on the above, the company must also have a written process based on its risk analysis to select new business partners and monitor those with whom it is already working. This procedure must be carried out at least once a year, so that it allows identifying other risks or threats in the operation that may arise from the result of an incident or that originate from changes in the company's initial conditions, as well as to identify whether the policies, procedures, and other control and security mechanisms are being complied with. It is important to note that the company's Security Committee must participate in the preparation and updating of the risk analysis and the maintenance of the Authorized Economic Operator Program.

Response: Explanatory Notes:
Attach the risk matrix and the documented procedure that you use to identify risks in your daily operations throughout the supply chain and its facilities (yards and/or branches, offices, boarding houses, mechanical workshops, etc.) must include as a minimum the following points:
a) Frequency with which this procedure is carried out. b) Which aspects and/or areas of the carrier company are incorporated into the risk analysis. c) Type of service:

Long haul.
Domestic and international transit.
Transfer.
Consolidated.
d) Methodology or techniques used to perform the risk analysis. e) Persons responsible for reviewing and/or updating the company's risk analysis.

Likewise, the documented procedure to identify risks in the supply chain and its facilities must contemplate the risk appreciation and management process, and include the following aspects:
a) Establishment of a context (cultural, political, legal, economic, geographic, social, etc.). b) Identification of risks in its supply chain and its facilities. c) Risk analysis (causes, consequences, probabilities, and existing controls to determine the level of risk as high, medium, and low). d) Risk evaluation (decision-making to determine the risks to be treated and priority for implementing the treatment). e) Risk treatment (application of alternatives to change the probability of risks occurring). f) Risk monitoring and review (monitoring of the results of the risk analysis and verification of the effectiveness of its treatment). It is suggested to use risk evaluation techniques according to the current international standard ISO 31000, and specifically ISO 31010, where according to its business model they must implement.

1.2 Security Policies.
Companies must have a manual of policies oriented to prevent, secure, and recognize threats to the security of the supply chain and company facilities, such as drug trafficking, arms trafficking, human smuggling, prohibited goods, and acts of terrorism.
To promote a culture of security, companies must demonstrate their commitment to supply chain security and the Authorized Economic Operator Program through a statement highlighting the importance of protecting the flow of national and international commerce from criminal activities, established through the security policy. Senior officials or executives of the company who must endorse and sign the security policy may include the company president, chief executive officer, general manager, security director, or personnel with equivalent rank with decision-making authority.

Response: Explanatory Notes:
State the security policy oriented to prevent, secure, and recognize threats in the supply chain and company facilities focused on guaranteeing the integrity of its resources (units, operators, facilities, yards and/or branches, etc.) as well as to ensure the transport of goods, property of third parties or own, and indicate who is responsible for its review, signature, and dissemination to employees, as well as the frequency with which its update is carried out.

This policy must be communicated to employees through a dissemination program and/or campaign.
The security policy must be signed by a senior official of the company and be displayed in various areas of the company, including the company website, posters in key areas of the company (reception, shipments, receipts, warehouse, etc.), and as part of initial and reinforcement training.

1.3 Internal Audits in the Supply Chain.
In addition to routine monitoring in control and security, it is necessary to schedule and carry out audits, at least once a year, that allow evaluating all processes regarding security in the supply chain in a more critical and profound way, as well as guaranteeing that its employees follow the company's security procedures. Audits must be carried out by the company's Security Committee and a documented procedure must be established, as well as a program or calendar for their execution. Although it is necessary that the audits are focused on supply chain security and based on the evaluation, review, and execution of minimum security standards, their focus must be adjusted to the size of the organization, risk level, business model, and variations between facilities. Audits can be general or focus on specific areas or processes according to their work program. The objective of an internal audit focused on the Authorized Economic Operator Program is to verify and guarantee that employees follow the company's security procedures. The review process does not have to be complex; however, the formats and records used for the application of these reviews must evidence that the application and execution of the evaluated processes were validated, in addition to the follow-up and closure of preventive, corrective, and improvement actions identified. The senior management of the organization must review the results of the audits and undertake the required corrective or preventive actions. The audit process must guarantee that the necessary information is collected to allow management to make this evaluation. The review must be documented, in addition to the fact that the company's Security Committee must provide and register periodic updates on the progress or results of any audit, exercise, or validation.

Response: Explanatory Notes:
Describe the documented procedure to carry out an internal audit, focused on security in the supply chain; ensure you include the following points:
a) Indicate how the company carries out the scheduling or calendarization to perform an internal audit, regarding security, in the supply chain. b) Indicate who participates in them, and the records that are made of them, as well as the frequency with which they are carried out. c) Indicate how the company's Management verifies the results of security audits, how it carries out and/or implements preventive, corrective, and improvement actions, in addition to the follow-up and closure of the same. d) The formats used during internal audits must be properly filled out, and through them, evidence that the security procedures and measures are being put into practice.

1.4 Contingency and/or Emergency Plans.
There must be a documented contingency and/or emergency plan; this plan must address crisis management, security recovery plans, and business resumption, to ensure business continuity, in the event of a situation that affects the normal development of the carrier company's activities and operations. A crisis or contingency may include the interruption of the transmission and exchange of commercial data due to a cyberattack, a fire, the kidnapping of a transport driver by armed individuals, a customs closure, a bomb threat, the detection of suspicious packages, a power outage, the theft and/or damage of goods, threats or extortion, blockades or road closures, and when the operator identifies that they are being watched or followed during the transport of goods, among others. Such plans must be communicated to personnel through periodic training, as well as carrying out tests, practical exercises, and annual drills of the contingency and emergency plans to verify their effectiveness, from which a properly filled-out and signed record must be maintained (for example: result reports, minutes, or reports, which must be backed up by video recordings, photographs, etc., that demonstrate their execution). The contingency and/or emergency plan must be updated as necessary, based on changes in operations and the organization's risk level.

Response: Explanatory Notes:
Attach the documented contingency and/or emergency procedure or plan, to ensure business continuity in the event of an emergency or security situation that affects the normal development of the company's foreign trade activities.
This procedure must include, by way of example and not limitation, the following:
a) What situations it contemplates, describing the action plan and steps to be followed in case of crisis, as well as the tasks that personnel have assigned during the handling of such contingencies. b) What mechanisms it uses to disseminate and ensure that these plans are effective. c) Contemplate the scheduling and carrying out of tests, practical exercises, and annual drills and how they are documented (for example: result reports, minutes, or reports, which must be accompanied by video recordings, photographs, etc., that demonstrate their execution). In the case of carrier companies of Hazardous Materials and Waste, an emergency sheet must be attached indicating the actions to be taken in case of incident or accident (leaks, spills, explosions, fires, etc.).

Physical Security.
The carrier company must have established mechanisms to prevent, detect, or deter the entry of unauthorized personnel into its administrative offices, yards (branches) and/or boarding houses where it safeguards information and means of transport (tractors), containers, trailers, or semi-trailers respectively. All sensitive areas of the company must have physical barriers, control elements, and deterrence against unauthorized access.

2.1 Facilities.
Facilities must be constructed with materials that can resist unauthorized access. Periodic documented inspections must be carried out to maintain the integrity of the structures, and in the event that an irregularity has been detected, the corresponding repair must be carried out as soon as possible by the personnel designated for these tasks. Likewise, territorial limits, as well as various accesses, internal routes, and the location of buildings must be fully identified.

Response: Explanatory Notes:
Indicate the predominant materials with which the facilities are constructed (for example, metal structure and sheet metal walls, brick walls, wood, among others) and indicate how the review and maintenance of the integrity of the structures is carried out.
Indicate the personnel or area responsible for carrying out inspection, maintenance, and repair tasks of the facilities.
Explain how the review and maintenance of the integrity of the structures is carried out.
Attach a general distribution or architectural plan, where limits, access routes, the location of offices, parking lots, critical areas, adjacent yards and/or boarding houses can be identified.

2.2 Access at Gates and Booths.
The entrance or exit doors of vehicles and/or personnel accessing the yards and/or vehicle boarding houses for cargo vehicles and administrative offices must be attended and/or supervised either by own personnel or by security personnel. The number of access doors must be kept to the minimum necessary. Access to sensitive areas must be restricted according to the job description or assigned tasks.

Response: Explanatory Notes:
Indicate how many doors and/or accesses exist in the facilities, as well as the operating hours of each, and indicate how they are monitored (In case of having assigned personnel, indicate the quantity).
Detail if there are blocked and/or permanently closed doors and/or accesses.
Describe how you ensure that access to sensitive areas is restricted according to the job description or assigned tasks (include the type of records and controls you use).

2.3 Perimeter Fences.
Perimeter fences and/or peripheral barriers must be installed to secure the company's perimeters, based on a risk analysis. The area of the yards and/or boarding houses must be delimited for cargo vehicles (tractors), trailers, and/or semi-trailers and/or containers as appropriate. These must be inspected regularly and keep a record of the review with the purpose of ensuring their integrity and identifying damage, which must be repaired as soon as possible by the personnel designated for these tasks. In the case of providing merchandise storage services, this zone must be clearly delimited, identified, and monitored according to the service required (national or international, as well as high value and dangerous) to prevent unauthorized entry.

Response: Explanatory Notes:
Describe the type of fence, peripheral barrier, and/or walls that the company has; ensure you include the following points:
a) Indicate the characteristics of the same (material, dimensions, etc.). b) In case of not having fences, justify the reason in detail. c) Frequency with which the integrity of the perimeter fences is verified, and the records that are kept with the purpose of ensuring their integrity and identifying damage, which must be repaired as soon as possible. d) Indicate the personnel or area responsible for carrying out inspection and damage repair tasks. e) Indicate how your yards are divided (briefly describe, how they separate tractors, containers, trailers, and/or semi-trailers with domestic and/or international cargo, empty, under repair and/or maintenance; cargo vehicles; workshops; offices; among others). The procedure for the inspection of perimeter fences could include:
a) Personnel responsible for carrying out the process. b) How and how often the inspections of the fences, perimeter fences, and/or peripheral barriers and buildings are carried out. c) How the inspection record is kept. d) Who is responsible for verifying that repairs and/or modifications meet the technical specifications and necessary security requirements.

2.4 Parking Lots.
Access to the parking lots of the facilities must be controlled and monitored by security personnel or designated for this task. Private vehicles (of employees, visitors, suppliers, and contractors, among others) must be prohibited from parking within the areas for handling and storage of means of transport, containers, trailers, and semi-trailers, as well as in adjacent areas.

Response: Explanatory Notes:
Describe the procedure for the control and monitoring of parking lots; ensure you include the following points:
a) Persons responsible for controlling and monitoring access to parking lots. b) Identification of parking lots (specify if employee and visitor parking is separated from means of transport, containers, trailers, semi-trailers, and merchandise handling). c) How entry and exit control of vehicles to the facilities is carried out. Indicate the records that are made for parking control and the existing control mechanisms (for example: badges, card readers, lanyards, etc.), how they are assigned, and the responsible area for doing so. d) Policies or mechanisms to not allow the entry of private vehicles to the areas for storage of means of transport and, where applicable, merchandise handling.

2.5 Key and Lock Device Control.
According to the risk analysis, windows, doors, and inner and outer fences must be secured with locking devices. The carrier company must have documented procedures for the handling, safeguarding, assignment, and control of the keys to the facilities, to the inner areas that have been considered critical, and to the cargo vehicles, designating those responsible for the administration, control, and registration of these. Likewise, a record must be kept and signed responsibility letters must be established for persons who, based on their functions, have keys or authorized access.

Response: Explanatory Notes:
Indicate if all doors, windows, inner and outer entrances have locking or security mechanisms.
Attach the documented procedure or procedures for the control, safeguarding, assignment, and handling of keys for means of transport and for facilities, offices, and inner areas.
Ensure that these procedures include the following points:
a) Persons responsible for administering and controlling key security. b) Format and/or control record for key lending. c) Treatment of loss or non-return of keys. d) Indicate if there are areas where access is gained with electronic devices and/or some other access mechanism.
In case of using padlocks that are placed on containers, trailers, and/or semi-trailers within the facilities, describe in detail the criteria for the handling, control, and safeguarding of the keys for said padlocks.

2.6 Lighting.
Lighting inside and outside the facilities must allow clear identification of people, material, and/or equipment located there, including the following areas: entrances, exits, parking or storage areas for tractors, trailers, rolling equipment, perimeter fences and/or peripheral barriers, inner fences, loading, unloading, handling, and storage of merchandise (in case of providing this service). An emergency and/or backup system must be available in sensitive areas.

Response: Explanatory Notes:
Describe the procedure for the operation and maintenance of the lighting system. Ensure you include the following points:
a) Indicate which areas are illuminated and which have a backup system (Indicate if you have an auxiliary power plant or some other mechanism to supply electricity in case of any contingency). b) How you ensure that the lighting system is appropriate in each of the company's areas, in such a way that it allows clear identification of the personnel, material, and/or equipment it covers. c) Person responsible for the control and maintenance of lighting systems. d) Maintenance and review program (in case it coincides with another process, indicate it). The procedure may include:
a) How the lighting system is controlled. b) Operating hours. c) Identification of areas with permanent lighting.

2.7 Communication Devices.
The carrier company must have devices and/or communication systems with the purpose of having immediate contact with security personnel and/or emergency and security authorities in case they are required. Additionally, a backup communication system must be available and its proper functioning must be verified periodically.

Response: Explanatory Notes:
Describe the procedure that personnel must carry out to contact security personnel or, in their case, the corresponding authority in case of any incident.
Indicate if operational and administrative personnel have or have access to devices (landlines, mobile phones, alert and/or emergency buttons), to communicate with security personnel and/or whoever corresponds (these must be accessible to users, to be able to have a prompt reaction). Indicate what communication devices the security personnel of the carrier company uses (landlines, cell phones, radios, alarm system, etc.).

Describe the procedure for the control and maintenance of communication devices, ensuring you include the following points:
a) Policies for the assignment of mobile communication devices. b) Maintenance or replacement program for fixed and mobile communication devices. c) Indicate whether you have backup communication devices in case the permanent system fails, and if so, briefly detail them. d) Indicate whether the company's operators/drivers use telephones, radios, cell phones, citizen band (CB), or any other means for internal communication and the policies for assigning them. The procedure may include:
a) Person responsible for the proper functioning and maintenance of communication devices. b) Record of verification and maintenance of the devices. c) Method of assignment of communication devices.

Response: Explanatory Notes:
Mention the documented procedure indicating the functioning of the external alarm central system or sensors, and if applicable, describe the following points:
a) Indicate whether doors and windows have alarm sensors or motion sensors. b) Procedure to follow in case an alarm is activated.

Describe the documented procedure for the operation of alarm systems, closed-circuit television, video surveillance, and security technologies (this must be reviewed and updated annually and according to the risk analysis or circumstances), ensuring you include the following points:
a) Indicate the number of cameras in the installed alarm, closed-circuit television, and video surveillance systems, their technical characteristics, and their location (detail if they cover entry and exit points of the facilities, to cover the movement of vehicles and individuals, as well as the storage location of vehicles). b) Point out the location of alarm, closed-circuit television, and video surveillance systems and security technologies, where monitors are located, who reviews them, as well as operating hours, and if applicable, if there are remote monitoring stations. All security technology infrastructure must be physically protected against unauthorized access. c) Perform periodic and random reviews of recordings. Indicate how they are reviewed (random, weekly, special events, restricted areas, etc.), who the designated personnel are, and whether management is involved in the reviews. The results of the reviews must be documented to include corrective actions for audit purposes. d) Indicate for how long these recordings are kept (must be at least one month). e) Alarm, closed-circuit television, and video surveillance systems and security technologies must have an alternative power source that allows them to continue functioning in case of an unexpected loss of direct power. Therefore, indicate whether alarm, closed-circuit television, and video surveillance systems and security technologies are backed up by an electrical power plant or some other mechanism to supply electricity, which guarantees their functioning. These systems should have an alarm/notification function, indicating a failure condition in operation and/or recording; indicate if your systems have this function. f) Indicate if, in addition to alarm, closed-circuit television, and video surveillance systems, you use any other type of technology to strengthen the security measures you already have. g) Describe the procedure implemented to regularly test and inspect alarm, closed-circuit television, and video surveillance systems and security technologies and ensure their proper functioning. The results of inspections and functional tests must be documented, as well as necessary corrective actions (these must be implemented as soon as possible). Additionally, the documented results of these inspections must be kept for a sufficient time for audit purposes. h) Indicate if the alarm provider and alarm, closed-circuit television, and video surveillance system provider has access to security cameras, if they are in charge of monitoring them, how access is controlled, and who is responsible for said monitoring.

Physical access controls.
Physical access controls are mechanisms or procedures that prevent and impede unauthorized entry to facilities (administrative offices, yards and/or parking lots for transport media, merchandise storage (if this service is provided)), likewise, they maintain control of entry for operators/drivers, administrative personnel, and/or visitors and protect the company's assets. Access controls must include the identification of all employees, visitors, and suppliers at all entry points. Likewise, records must be kept and mechanisms or documented procedures for entry into the facilities must be permanently evaluated, being the basis for beginning to integrate security as one of the primary functions within any company.

3.1 Security personnel.
The transport company must have security and surveillance personnel. This personnel plays an important role in the physical protection of facilities, yards and/or parking lots where cargo vehicles (tractors), trailers, and containers are stored, as well as for controlling the access of all persons to the property. Security personnel must have a documented procedure to carry out their functions, and have full knowledge of mechanisms and procedures in emergency situations, detection of unauthorized persons, or any incident in the facilities. Management must periodically verify compliance with procedures, policies, and functions through internal audits with the objective of verifying their correct execution.

Response: Explanatory Notes:
Describe the documented procedure for the operation of security personnel, ensuring you include the following points:
a) Indicate the number of security personnel working in the company. b) Point out the positions and/or functions of the personnel, and operating hours. c) In case of hiring an external service, specify the number of personnel employed, operational details, records, reports, etc. d) In case of having armed personnel; describe the procedure for the control and custody of weapons.

3.2 Identification of employees, visitors, and suppliers.
There must be an identification system for employees, visitors, and suppliers for the purpose of accessing facilities. Employees should only have access to those areas they need to perform their functions. Visitors and suppliers must present an official photo ID upon arrival and a record must be kept. All visitors and suppliers must receive a temporary identification and be accompanied by company personnel during their stay in the facilities, ensuring that the visitor/supplier always wears the provisional identification provided in a visible place. This procedure must be documented. Management or the company's security personnel must properly control the delivery and return of identification badges for employees, visitors, and suppliers and ensure that they always wear the provided identification in a visible place. This procedure must be documented, as well as procedures for the delivery, return, and change of access devices (for example, keys, proximity cards, etc.). Access to sensitive areas must be restricted according to the job description or assigned tasks.

Response: Explanatory Notes:
Attach the documented procedure for the control of identifications.
Describe the procedure for the identification of employees, ensuring you include the following points:
a) Identification mechanisms (photo ID, uniform, etc.). b) Indicate whether employees use uniforms, how they are assigned (by position, area, functions, etc.) and withdrawn (if applicable). c) Indicate how personnel hired by a business partner, working within the facilities (contractors, subcontractors, etc.) are identified. The procedure must also describe how the company delivers, changes, and withdraws employee identifications and access controls, ensuring you include the areas responsible for authorizing and administering them. Indicate how you ensure that access to sensitive areas is restricted according to the job description or assigned tasks (include the type of records and controls you use). Describe the procedure for the access control of visitors and suppliers, ensuring you include the following points:
a) Point out what records are kept (Personal forms for each visit, logbooks). b) The record of visitors and suppliers must include the following:

Date of the visit;
Visitor's name;
Photo identification number (official documents such as: driver's license, passport, INE, etc.);
Entry and exit time.
In the case of vehicular access, the form must include the data of the private or cargo vehicle (model, license plate, trailer number, etc.).
c) Point out who is the person responsible for accompanying the visitor and/or supplier, and if there are restricted areas for their entry.

3.3 Procedure for identification and removal of unauthorized persons or vehicles.
The company must have documented procedures specifying how to identify, confront, or report unauthorized or identified persons and/or vehicles.

Response: Explanatory Notes:
Attach the documented procedure to identify, confront, or report unauthorized or identified persons and/or vehicles.
The procedure must include:
a) Responsible personnel. b) Designate a person or area responsible for being informed of incidents. c) Instructions for confronting and directing unidentified personnel. d) Indicate in which cases the corresponding authorities must be notified. e) How the recording of incidents and measures adopted in each case is carried out.

3.4 Courier and package deliveries.
Courier and packages intended for company personnel must be examined upon arrival and before being distributed to the corresponding area. Likewise, the transport company must have a documented procedure for the receipt and review of courier and packages, which must be communicated to responsible personnel through training. The training must be documented.

Response: Explanatory Notes:
Describe the procedure for the receipt and review of courier and packages, ensuring you include the following:
a) Personnel in charge of carrying out the procedure. b) Indicate how the personnel or provider of the courier and package service is identified (indicate if an additional procedure to the supplier access procedure is required). c) Point out how packages are reviewed and/or what mechanism is used, as well as the records kept and, if applicable, incidents detected. d) Point out what action is taken in case a suspicious package is detected. e) Indicate how the inspection recording and, if applicable, the detected incidents are carried out.

Commercial partners.
The transport company must have written and verifiable procedures for the selection and contracting of new commercial partners and monitoring of partners already working with them, such as manufacturing companies, manufacturers or assemblers, parts and/or spare parts suppliers, mechanical suppliers, high-security seal suppliers, IT systems and technology suppliers, installation and maintenance of alarm, closed-circuit television, and video surveillance systems, or any other service, and according to their risk analysis, require them to comply with security measures to strengthen the international supply chain. The risk analysis carried out by the transport company regarding its commercial partners (clients and suppliers) must include risks related to the identification of activities related to money laundering and terrorism financing. Additionally, the transport company must foster a documented social compliance policy and program that, at a minimum, addresses how among its employees and commercial partners they could guarantee that goods, inputs, or merchandise imported into Mexico for the elaboration of products or merchandise do not originate from extraction, production, or manufacturing, totally or partially, using prohibited forms of labor, i.e., forced or compulsory labor, including forced or compulsory child labor, under Article 23.6 of the USMCA and the Agreement establishing the merchandise whose importation is subject to regulation by the Secretariat of Labor and Social Welfare, published in the Official Gazette of the Federation on February 17, 2023.

Response: Explanatory Notes:
Attach the documented procedure for the selection and contracting of new commercial partners and monitoring of partners already working with them (this includes any type of supplier that has a commercial relationship with your company; it is in the following sub-standard where it is requested to differentiate those at risk in your supply chain) and ensure it includes the following points:
a) What information is required from your commercial partner. b) What aspects are reviewed and investigated. c) Indicators to identify clients or suppliers who may not be legitimate or with unlocated addresses. This point refers to pointing out all those alerts to determine that a commercial partner is not reliable and thus, conduct a deeper investigation and evaluate whether to work with them. d) Indicate if you maintain a file for each of your commercial partners, as well as the information it must contain. e) Point out how the services of your commercial partner are evaluated and what points you review.

The file must include at least the following:
a) Company data (name, RFC, activity, etc.). b) Legal representative data. c) Proof of address. d) Commercial references (if applicable). e) Contracts, agreements, and/or confidentiality agreements. f) Security policies. g) If applicable, certificate or certification number in the security programs to which they belong.

4.2 Security requirements.
The transport company must have a documented procedure in which, according to its risk analysis, it requests additional security requirements from those commercial partners that intervene in its supply chain such as, subcontracted transporters, Customs Brokers, Private Security, warehouses, parking lots, companies providing Transport Media Repair services, Providers of Loading and Unloading services, cleaning service providers, private security, personnel hiring, high-security seal suppliers, collection and recycling, in addition to those resulting from the analysis performed. The requirements must be based on the Land Auto Transporter Profile established by AGACE, or if it exists, the specific Profile for each actor in the supply chain corresponding to them. The company must request from its commercial partners the documentation that certifies and proves that they comply with the minimum security standards established in this Land Auto Transporter Profile, either through a written declaration issued by the partner's legal representative, agreements, or contractual clauses backed by documentation supporting compliance with the requirements established in the Authorized Economic Operator Program. Likewise, the transport company must take into account and know the specific requirements of the Authorized Economic Operator Program that will be applicable to each of its commercial partners, based on their activity within the supply chain. In the case of the company's commercial partners that provide their services within the facilities, they must be obligated to comply with these supply chain security requirements, for example, companies providing gardening, cleaning, cafeteria services, etc.

Response: Explanatory Notes:
Describe the procedure indicating how you carry out the identification of commercial partners that require compliance with minimum security standards and how these comply with said requirements.
Ensure you include the following points:
a) A register of commercial partners that must comply with security requirements, and mention what type of providers these are (transporters, warehouses, custodian services, security company, transport media repair services, loading and unloading service, customs brokers, etc.). b) Indicate how you documentally ensure (agreements, accords, contractual clauses, and/or addenda) that your commercial partners comply with security requirements. c) Indicate if there are agreements, accords, contractual clauses, and/or addenda regarding the implementation of security measures with your service providers inside your company, such as: security guards, cleaning and maintenance services, etc.

d) Indicate whether you have business partners who are required to belong to a supply chain security program, whether certified by a foreign authority or the private sector (for example: CTPAT or any other World Customs Organization Authorized Economic Operator Program), as well as the information and documentation requested of them.

4.3 Business Partner Reviews.
The company, through the Security Committee, must conduct periodic security assessments (as well as those derived from risk situations) of the processes and facilities of business associates based on a risk analysis, to ensure they meet the minimum security standards required by the company based on the Authorized Economic Operator Program. It must maintain records of these assessments, which allow verification that security processes and measures are being executed, as well as the corresponding follow-up.

When inconsistencies are found, the transport company must communicate this to its business partner and provide a justified period to address the observations or areas for improvement identified, or otherwise implement necessary measures to sanction them.

Conducting security assessments of business partners is important to ensure that there is a solid and functioning security program. Therefore, in addition to a documented procedure, there must be a program or schedule for the execution of these security reviews or assessments, prioritizing partners that are more critical according to their risk analysis. If a member is not assessed and the company is unaware of whether the processes and facilities of its business partners are functioning correctly, it puts its supply chain at risk.

Response: Explanatory Notes:
Describe the procedure for conducting security assessments to verify the security requirements of your business partners. Ensure you include the following points:
a) The frequency with which visits to the business partner are made (these must be at least once a year and derived from risk situations). b) Record or report of the verification and, if applicable, the corresponding follow-up. c) Program or schedule for the execution of security reviews. d) The verification format(s) must be properly filled out, including the date, name, and position of those participating in the review, signatures, etc. e) Indicate what action measures are taken if business partners do not comply with the established security requirements.

If you have business partners with CTPAT certification or another supply chain security certification program, indicate the frequency with which their status is reviewed, how you record it, and the actions you take if it is detected that it is suspended and/or cancelled, in accordance with what is established in your procedure.

The procedure must include:
a) Frequency of visits. b) Security review points. c) Preparation of reports. d) Feedback and agreements with the business partner. e) Follow-up on agreements. f) Measures in case of detecting non-compliance with requirements. g) Record of assessments. h) Area or person responsible for carrying out this procedure.

Process Security.
Control measures must be established to guarantee the integrity and security of processes related to means of transport (in any of their modalities), handling and storage of foreign trade merchandise (if applicable), manufacturing companies, manufacturers or assemblers, parts and/or spare parts suppliers, mechanical suppliers, or any other service along the supply chain.

Likewise, established procedures must exist to prevent, detect, or dissuade undeclared materials or unauthorized personnel from accessing means of transport and containers. These control measures and procedures must be documented with the intention and objective of maintaining the integrity of the means of transport and the import and export shipment at all times from the point of origin to its final destination.

5.1 Process Mapping.
There must be a process map that describes step by step the operational flow for the transfer of foreign trade merchandise along the supply chain, including in an illustrative but not exhaustive manner, with respect to the service requested by the client, the following: assignment of the means of transport, container, trailer, inside and outside yards according to availability, entry into the facilities of the manufacturer, supplier, or seller, which describes the loading and unloading of merchandise, transfer with authorized routes and rest points. If any part of the transport is subcontracted within your supply chain, it is essential that it be considered within your risk analysis and process mapping, since the more direct and indirect suppliers there are, the greater the risk involved.

Likewise, the land transport company must have written procedures for the designation of operators/drivers, previously designed routes, collection of cargo, and delivery of foreign trade merchandise to the final destination; handling of documentation specific to the shipment during loading and/or unloading maneuvers or in advance; communication during the route of the shipment between intermediate or final points, its relationship with other actors in the supply chain such as logistics operators, Customs Brokers, among others, and contracting clients.

Response: Explanatory Notes:
Attach the documented procedure where you describe in detail the process mapping or operational flow of your general transport service and the type of service you provide, which includes the designation of operators/drivers, vehicles/units, previously designed routes, cargo collection and delivery, handling of documentation, communication during the operation with other actors in the supply chain, handling and storage of foreign trade merchandise (if applicable), manufacturing companies, manufacturers or assemblers, parts and/or spare parts suppliers, mechanical suppliers, or any other service including your contracting clients. With the aim of having each of the steps involved in the transportation of the merchandise until delivery at the final destination well identified.

The process mapping must include the names (RFC and legal name) of the companies that provide services to you in your logistics process.
This mapping must include, at least, the following aspects:
a) Service request. b) Assignment of Unit and container or Trailer. c) Assignment of Operator. d) Service confirmation. e) Instructions to the Transporter. f) Cargo collection.
1. Identification with the company.
2. Instruction Letters for delivery.
g) Consolidation of merchandise/Container seal (if applicable). h) Storage during waiting for shipping instructions or dispatch order. i) Transfer of merchandise to port, border, exit customs:
1. Indicate the points and areas for rest or custody of cargo vehicles during the transfer of merchandise subject to foreign trade (import and export).
2. Indicate the estimated times that said vehicles remain in the rest or custody areas (company yards, exit customs, customs broker agency facilities, warehouses, transfer yards or transport, among others).
j) Constant means of communication with the transport company and the contracting company (during the transfer and at the end of the service). k) Transfer to de-consolidation point (if applicable). l) Waiting storage. m) De-consolidation. n) Transfer to final destination.
ñ) Information flow associated with the shipment.
Administrative management process (General process of sending documentary information, and billing).

For the purposes of the administrative management and billing process, the transport company must have a documented procedure to receive and register the service request that the user will require, which must contain, at least, the service request, which includes in an illustrative but not exhaustive manner at least the following information:
a) Origin (Collection). b) Destination. c) Cargo specifications (domestic, international, hazardous, high value, etc.). d) Time and date of delivery. e) Cost per freight. f) Insurance:

Assignment of unit and operator.
Preparation and delivery of documentation:
i) Instructions to coordinate with other service providers involved in customs clearance and border crossing (customs brokers, DOT, consolidators/de-consolidators, among others). ii) Documentation required to be presented at customs. iii) Personal protective equipment, or any special request from the customs broker or customs agency. g) Guideline for loading and unloading merchandise at customs and/or with the client.

5.2 Delivery and Receipt of Cargo.
The transport company must inform the operators/drivers of the transport that carry out the delivery or receipt of foreign trade cargo of the criteria and conditions that its clients (manufacturers, suppliers, etc.) require for the handling of their cargo, as well as comply with the security guidelines that the company has to enter their facilities at the time of collection and/or delivery of foreign trade cargo. The transport company must provide its clients, prior to their delivering the shipment and before loading and unloading maneuvers are carried out in the vehicles designated for such purposes, information regarding the operators/drivers so that they can be fully identified upon arrival at their facilities. The transport company must have an updated database with detailed information about its operators/drivers.

The operator/driver must know the documents that will be delivered to them, which cover the ownership of the cargo to be transported, such as the dispatch or transfer order, as well as the instruction sheet that will precisely establish the contact data of the person to whom they must direct themselves in case of any incident, inspection by another authority, or modification of the original conditions of the shipment, routes designated by the client, among others.

Likewise, with the documentation delivered to them, they must verify at the time of loading and unloading the merchandise the number of packages and the assigned locks described in them.

Furthermore, the transport company must issue a bill of lading duly documented for each shipment, which must contain, in addition to fiscal requirements, the applicable provisions contained in the Federal Self-Transport and Auxiliary Services Regulations.

Prior to loading the merchandise, the operator must inspect the vehicle to ensure that the means of transport is free from visible contamination by pests.

Additionally, training must be provided to transport operators to review import and/or export documentation in order to identify or recognize suspicious cargo shipments, such as:
a) Originating from or destined to unusual places; b) Different routes; c) Cash payments; d) Unusual shipping and/or receiving practices; e) Lack of information.

Response: Explanatory Notes:
Attach the documented procedure in which you indicate step by step how the delivery and receipt of the cargo is carried out, including: how you assign the operator and the means of transport, how the arrival time at the companies' facilities for cargo collection and delivery is established, and how you guarantee that the means of transport is free from visible contamination by pests. If any type of visible pest, contamination, trash, insects, grass, weeds, or brush is identified, how it is reported and what actions are taken regarding it.

5.3 Cargo Tracking Procedure.
The transport company is responsible for monitoring the integrity of the means of transport, as well as the merchandise from the moment of loading until its delivery at the destination established, so it must have documented procedures that establish the use of technology for the tracking and supervision of activities of the movement of the means of transport that transfers foreign trade merchandise for land transfers.

There must be a device capable of tracking the position of the vehicles in which the merchandise is transported via GPS/Satellite Link during the time the transfer lasts, having continuous geographical coverage during the route. Said device must have the following characteristics:
a) Ensure that the device cannot be removed from the unit to which it was fixed without this being detected and authorized. b) Recognize a Geofence (deviation limit). c) Know the position of the vehicle at all times. d) The device must have a Unique Identification Number (serial number). e) When an alert is detected, the device must be able to automatically change the transmission of the vehicle's position, so that it is reported every fifteen minutes, as long as the condition that triggered the alert remains. f) The device must be autonomous in its operation; that is, it does not require energy from the vehicle during its journey.

It is required that the device have an alert scheme, at least for the following cases:
a) Device outside Geofence. b) Device exceeds immobility time. c) Vehicle exceeds time of stay in the country. d) Unauthorized removal of the device.

Likewise, the transport company should have a coupling device, sensor connector, or equivalent technology from the tractor to the trailer to ensure that the latter is also monitored and tracked, preventing said device from being removed and being able to have alerts that indicate the place, date, and time of hooking and unhooking.

Similarly, the company must establish documented procedures to ensure at all times the location of the transport vehicle in transit. These procedures must be carried out under a risk analysis that includes, in an illustrative but not exhaustive manner, the identification of predetermined routes, estimated delivery times, as well as between intermediate points, as well as overnight and/or rest (yards, pensions, exit customs, customs broker agency facilities, freight agents, authorized food stops, fuel loading, routine mechanical inspections, among others), which must be recorded and incorporated into the tracking process. Likewise, measures and actions to be taken in case of identifying any delay in the route due to weather conditions, traffic, mechanical incident, route changes, or inspection by an authority or any security incident must be included. There must be trained and authorized personnel for the permanent monitoring and/or traceability of shipments that transport foreign trade merchandise.

The monitoring, tracking, supervision, and registration data of all vehicles in transit that transport foreign trade merchandise (whether they cross into the United States of America and/or to any other country) must be preserved for one year in case the authority and/or the transport company must carry out an evaluation due to a security incident and/or for audit purposes. If you have contracted the services of a subcontracted provider for the merchandise transport service, the company must have access to the GPS monitoring system of its transporter, so that it can track the movement of its shipments.

If, as a result of monitoring and tracking, a real (or actualized) threat to the security of a shipment or means of transport is identified, the company must alert (as soon as possible) the business partners in the supply chain that may be affected and, if applicable, the authority as appropriate.

If the driver makes stops during their journey, they must register them and carry out inspections of the means of transport, containers, trailers, and semi-trailers used as Instruments of International Traffic, as well as of the closing devices, seals, and/or locks to verify their integrity and identify signs of manipulation before resuming the journey. Likewise, the driver must be able to recognize, act, and report when threats arise during the transfer of the units, such as: attempt at robbery, kidnapping, among others.

With the objective of guaranteeing that tracking and monitoring procedures are followed, in addition to supervising the correct filling of related records, management must involve itself in the surveillance and monitoring of cargo vehicles on the route, so it must participate in the periodic performance of documented random reviews of the tracking and control procedures. These random reviews must comprise the verification of the tracking records carried out by the responsible area against GPS records or route histories, to verify delivery time indicators, intermediate points, overnight and/or rest.

Response: Explanatory Notes:
Describe how you carry out the review of predetermined routes based on your risk analysis individually or collectively with your clients and how it is documented.

Likewise, the monitoring of shipments must be documented, and this record must contain the following information:
a) Name of the Operator. b) Origin and destination of the service. c) Client. d) Type of cargo. e) Records of the unit's location. f) Driver's hours of service logbook, which is a daily record containing the necessary data to know the effective driving time and determine rest in accordance with the Federal Highway Traffic Regulations.

Attach the documented procedure to perform the monitoring of vehicles or means of transport that transfer foreign trade merchandise.
The procedure must include, in an illustrative but not exhaustive manner, the following:
a) The area and person(s) responsible in the transport company for tracking and monitoring shipments. b) Indicate who are the people authorized to monitor and/or track foreign trade operations and how they have been instructed and trained to perform this work. c) Indicate by what form and/or systems they perform the monitoring of shipments. d) Have GPS whose external hardware is hidden and that can resist attempts to remove it, indicate the type of system implemented in the units you use and, if it is a third-party or subcontracted service, describe the consultation tools you have available to monitor the merchandise. e) In the case of geofences, within their parameters, minimum tolerances allowed for the predetermined transit route must exist or be established. f) Frequency to review the status of shipments and according to your risk analysis. g) Indicate the means of communication that exist with the unit operator (indicate if there is more than one way to communicate: Cell phone, tracking system, global positioning systems (GPS), fixed supervision points, etc.). h) Indicate the frequency with which clients are informed of the location of their shipments, or if they share any tracking system. i) Have systems or procedures with instructions to respond to significant route deviations and in case of any delay (stoppages, changes or diversions of route, mechanical failures, accidents, etc.) for arrival at the loading area, transfer points (exchange of boxes and semi-trailers) or final destination. Likewise, drivers must notify (to their supervisor and if applicable to the sender or consignee of the merchandise) any significant delay in the route due to weather, traffic, accidents, mechanical failures, route change, when the operator identifies that they are being observed or followed during the transfer of the merchandise, custody of units, etc. And on its part, the company must independently verify the cause of said delay.

j) The procedure must also include, in the event a real or concrete threat to the security of a shipment or means of transport is identified, how the company informs its commercial partners in the supply chain who may be affected, and, where applicable, the relevant authority, regarding these types of incidents or presumptions.

5.4 Processing of information and documentation of the cargo.

Carrier companies must have written procedures to ensure that both the electronic and/or documentary information sent by their clients starting from their service request, during the movement and transfer of the merchandise, as well as the information received by business associates, is legible, complete, accurate, reported in a timely manner, and protected against changes, loss, or the introduction of erroneous information.

Likewise, forms and documentation related to import and/or export should be secured to prevent unauthorized use.

Response: Explanatory Notes:
Attach the documented procedure for the processing of cargo documentation. Briefly explain what it consists of. a) Detail how you receive and transmit relevant information and documentation regarding the transfer of foreign trade merchandise with your commercial partners (Indicate if you use a specific computer control system and briefly explain its function). Furthermore, detail how you ensure that the provided information is legible, complete, accurate, reported in a timely manner, and protected against changes, loss, or the introduction of erroneous information. b) The electronic information of shipments and cargo in general must include the seal and/or lock number with which the cargo was secured.

Customs Management.

The carrier company must have documented procedures, in which internal and operational policies are established, as well as the necessary controls for the due compliance of customs obligations.

6.1 Customs Obligations.

For the case of carrier companies that enter fiscal or supervised premises for the transfer of foreign trade merchandise, they must have a documented procedure for obtaining the CAAT registration, in accordance with what is established in articles 1 and 20 of the Law and rule 2.4.5.

Carrier companies that have registration in the register of carrier companies for merchandise in transit, in accordance with rule 4.6.11, must have a documented procedure with the objective of complying with what is established in rule 4.6.18.

Regarding internal transits of foreign trade merchandise referred to in articles 127 of the Law and rule 4.6.11, the carrier company must have a documented procedure that guarantees notice to customs authorities caused by late arrival, stating the causes that originated the delay, the location where the means of transport is, the transit entry number, and the status of the official locks, if any (article 188 of the Regulations).

For the purposes of what is stipulated in article 128 of the Law and rule 4.6.17, the carrier company, where applicable, must have a documented procedure that guarantees that the internal transit of the merchandise must be carried out within the maximum timeframes established in Annex 15.

For cases of destruction of merchandise provided for in article 94 of the Law and 141 of the Regulations, the carrier company must have a documented procedure by which it guarantees the delivery of notices in a clear, precise, and exact manner to the customs of destination.

Response: Explanatory Notes:
Indicate if you have the CAAT and, if so, indicate your registration number.
Attach the procedure that describes the steps to be followed for obtaining the CAAT (this procedure must include the steps to be followed to obtain the radiofrequency identification device number (transponder), in addition to including, who and how the information related to your vehicle fleet and transport operators is updated. Indicate if you have the Register to carry out the Transit of Merchandise, if affirmative, attach the following procedures:
a) Documented procedure to comply with rule 4.6.18, which must include, in an enumerative but not exhaustive manner, the following:
1. Notices to the authority, regarding changes in the information provided for obtaining the registration.
2. Integrate and maintain updated a daily automated register of service users.
3. Integration of a file for each service user.
b) Attach the documented procedure by which it guarantees notice to customs authorities caused by late arrival in accordance with article 188 of the Regulations. c) Attach the documented procedure referred to in article 128 of the Law in relation to rule 4.6.17, and if applicable, describe how you guarantee compliance with the timeframes established for transfers referred to in Annex 15.

7. Security of cargo vehicles, containers, trailers, and/or semi-trailers.

The security of means of transport, tractors, containers, trailers, and semi-trailers (including cargo vehicles, pickup truck type, van, or van, among others) must be maintained to protect them from the introduction of unauthorized persons and/or materials. For this reason, it is necessary to have documented procedures to review, seal, and maintain their integrity. Likewise, the process of inspecting said means of transport, containers, train cars, trailers, and semi-trailers used as Instruments of International Traffic, must include a procedure for agricultural inspections to look for visible pests and serious structural deficiencies. Pest contamination is defined as visible forms of animals, insects, or other invertebrates (living or dead, at any stage of the life cycle, including eggs, etc.), or any organic material of animal origin (including blood, bones, hair, meat, secretions, excretions, etc.); plants or vegetable products (including fruits, seeds, leaves, twigs, roots, bark, etc.); or other organic material, including fungi, dirt, or water; when said products are not the declared cargo within the Instruments of International Traffic.

In the event that high-security seals are used, it is necessary to have procedures to correctly seal and maintain the integrity of containers and trailers from the loading point. A high-security seal must be applied to all containers and trailers for foreign trade shipments, which must meet or exceed the ISO 17712 Standard for high-security seals.

With the objective of maintaining supply chain security, the carrier company must inspect all cargo vehicles systematically upon entry and exit from its facilities (domestic and international traffic), in addition to keeping a record.

7.1 Use of seals and/or locks in containers and trailers.

The use and placement of seals or locks on means of transport (containers, trailers, and semi-trailers) is considered a critical and necessary process to maintain the integrity of shipments that transport foreign trade merchandise. Therefore, the carrier company must document procedures that include the control, safeguarding, assignment, handling of discrepancies, replacement, and destruction of locks and seals that meet or exceed the ISO 17712 Standard.

The carrier company must have a documented procedure where the means of transport are identified, and, if applicable, the containers, train cars, and/or semi-trailers used in its international logistics chain, and indicate how their integrity is maintained.

For this reason, as one of the security mechanisms, the carrier company must use High Security locks or seals that meet or exceed the ISO 17712 Standard in all loaded containers and trailers that are subject to foreign trade and maintain their integrity until delivery at the final destination. For this, the carrier company must have documented procedures to place and verify the correct application of seals, their inspection at intermediate points, final destination, and their replacement when they are opened by any authority.

In the event of such an inspection, drivers must notify and record any anomaly or unusual structural modification found in the means of transport derived from said review. The procedures must include the steps to be followed if it is discovered that a seal is altered, manipulated, or if there is an incorrect seal number in the documentation, the communication protocols to the commercial partners involved in the supply chain, and the investigation of the security incident; these must be notified to security personnel, commercial partners who may be part of the affected supply chain, security specialist, or contact of the Authorized Economic Operator Program.

The carrier company must verify and evidence that during loading points, as well as in reviews by any authority or due to changes in the original conditions of the shipment, high-security seals or locks that meet or exceed the ISO 17712 Standard are correctly applied and placed; for the case of consolidated cargo collection and delivery operations that do not use consolidation centers to sort or consolidate the cargo before arriving at the destination, the carrier company must, at each stop and before arriving at the destination, place high-security seals on the trailer, semi-trailer, or container. The company's management or a security supervisor must perform periodic and documented audits of the high-security seals and/or locks; these reviews must include the verification of the inventory of stored seals and/or locks and the cross-check with inventory records and shipping documents.

Likewise, the company must have documented procedures that clearly describe how high-security seals will be controlled by the transporter during route transit, and that, in an enumerative but not exhaustive manner, contain the following:
a) Verify the correct placement of seals or locks in accordance with the VVTT inspection method to evidence and discard improper manipulations:

V - View the seal and lock mechanisms of the container.
V - Verify the seal number.
T - Pull the seal to ensure it is correctly placed.
T - Twist and turn the seal to ensure.
b) Review and cross-reference the documentation containing the number of the original seal or lock and the additional ones carried during the transfer of the merchandise. c) If the company uses cable seals, they must be placed on the two vertical bars of the container. d) Review that the closing devices, hinges, and pins are attached to the trailer or container, and welded or riveted. e) Consider the type of reports and records that will be made if the seal is removed, even by official authorities or due to an incident during the transfer of the cargo, considering the installation of a second seal as a replacement and its proper notification to the owner of the merchandise. f) If the company uses cable seals, they must be placed on the two vertical bars of the container. g) Review that the closing devices, hinges, and pins are attached to the trailer or container, and welded or riveted. h) Consider the type of reports and records that will be made if the seal is removed, even by official authorities or due to an incident during the transfer of the cargo, considering the installation of a second seal as a replacement and its proper notification to the owner of the merchandise.

Response: Explanatory Notes:
Describe the documented procedure for the review of seals and/or locks in vehicles, means of transport, containers, trailers, and/or semi-trailers. This must include, among other aspects according to your operation:
a) Verify that the seal or lock is intact and determine if there is evidence of improper manipulation. b) Use the VVTT inspection method. c) Review and cross-reference the documentation containing the number of the original seal or lock and, if applicable, the additional ones carried during the transfer of the merchandise. In the event of using a replacement seal and/or lock, said number must be registered within the carrier company's control. If altered seals and/or locks are identified, they must be kept to help carry out the investigation of said incident or discrepancy and, as appropriate, report the compromised seals and/or locks to the foreign authority. d) Review that the closing devices, hinges, and pins are attached to the trailer or container, and welded or riveted. Also, protective plates can be placed on the door hinges and/or a seal/adhesive tape placed on at least each side. Also, the correct functioning of handles, latches, and all other locking or closing mechanisms of the cargo vehicles must be verified to detect manipulations and any inconsistency before placing any sealing device. e) Indicate how you assign and replace high-security locks, in the event that, during the route, it is inspected by another authority. If a seal and/or lock breaks in transit, the cargo must be examined, the number of the replacement seal and/or lock must be registered, and the driver (as well as the transport company) must immediately notify business associates when this happens, indicate who broke it, and provide the new seal number. Attach the documented procedure for the control and handling of seals and/or locks. This must include, among other aspects according to your operation:
a) What type of seals and/or locks you use in your operations (foreign trade, transit, storage, etc.). b) Who has access and how locks and/or seals are safeguarded. The management of seals and/or locks must be restricted only to authorized personnel; stored in a secure place, have an inventory, control of their distribution and tracking (register of seals that are used, as well as the receipt of new seals and/or locks. c) Describe how the company's management or the security supervisor participates in the audits of high-security seals and/or locks, the reviews they perform, the records they generate, and the actions they take in the event of identifying discrepancies. Also, how the supervisors of the shipping area and/or warehouse managers verify the seal numbers used in means of transport and Instruments of International Traffic to corroborate that the information is correct (this process can also be included within the internal audits referred to in sub-standard 1.3 of this document). d) How discrepancies in seal and/or lock numbers are addressed. e) Indicate who the supplier(s) is/are and how it is proven that the specifications of the seals and/or locks comply with the ISO 17712 Standard (attach certificate issued by the certifying company responsible for verifying compliance with the corresponding ISO). All written procedures must be disseminated and maintained at the operational level so that they are easily accessible to employees responsible for executing the tasks described above, reviewed at least once a year, and updated as necessary.

7.2 Inspection of means of transport, containers, trailers, and semi-trailers.

The carrier company must have procedures to permanently carry out a review of means of transport (tractors), containers, trailers, and semi-trailers used as Instruments of International Traffic, even the reliability of the door lock mechanisms, with the purpose of identifying natural or hidden compartments, using a checklist or format that includes the main points to review. Such review must be carried out by operators/drivers or personnel designated by the company for such effect. Likewise, the physical-mechanical conditions of the means of transport must be reviewed periodically to prove their good functioning.

The inspections of means of transport or cargo vehicles, containers, and trailers must be systematic, and carried out upon entry and exit from yards or storage sites and, if applicable, at the loading point of the merchandise (contracting company); and if the infrastructure allows, before arriving at the dispatch customs using the VVTT inspection method. A record of these inspections must be kept in an area with controlled access and carried out in a place monitored by alarm systems and closed-circuit television and video surveillance systems; said system must cover the inspection system in its entirety.

The documented procedure for its inspection must include, in an enumerative but not exhaustive manner, the following review points:
Means of Transport | Containers, Trailers, and Semi-trailers
1. Bumper.
2. Tires and rims (tractor and trailer).
3. Floor (tractor).
4. Fuel tanks.
5. Interior of the cabin (bedroom, and tool compartment).
6. Air tanks.
7. Chassis.
8. Fifth wheel area.
9. Drive axles.
10. Exhaust pipe.
11. Engine.
1. Exterior and interior doors.
2. Side walls (left and right).
3. Internal and external roofs.
4. Front wall.
5. Internal floor.
6. If applicable, the refrigeration system.

Likewise, before loading means of transport, containers, train cars, trailers, and semi-trailers used as Instruments of International Traffic, they must undergo agricultural and security inspections to guarantee that their structures have not been modified to hide smuggling or that they have been contaminated with visible agricultural pests, keep a record, and be backed by a documented procedure. If visible pest contamination is found during the inspection or transport of merchandise subject to foreign trade, it must be cleaned (washed, vacuumed, etc.) to eliminate said contamination. The driver must ensure before crossing that the cabin is clean and free of trash.

Attach the format you use to carry out the inspection that meets the minimum requirements indicated in this sub-standard. If you use other types of cargo vehicles for the transport of merchandise (vans, pickups, 3.5 tons, tankers, etc.), your procedure and inspection format must include the process and review points. Likewise, the security and agricultural inspection format must include the following information:
a) Date of inspection; b) Time of inspection; c) Vehicle license plates (tractor and trailer); d) Container/trailer number; e) Specific areas of the cargo vehicles that were inspected; and f) Name of the employee who performs the inspection and the supervisor.
The security and agricultural inspection formats may be signed by the supervisor to corroborate their information and be part of the import and export documentation:
a) Regarding carrier companies of hazardous materials and waste, each vehicle must have a daily visual review log of the auto-transport unit.
The documentation must be kept for one year for an investigation in the event of any security incident, as well as to demonstrate continuous compliance with these inspection requirements.
Additionally, and based on risk analysis, the carrier company should carry out periodic random reviews of cargo vehicles to verify that they have been carried out correctly, counteract internal conspiracies, and prevent security incidents. The reviews must be carried out randomly, without prior notice, so that they do not become predictable, in addition to being carried out in different places where the means of transport may be susceptible to contamination (maneuvering yard, loading and unloading areas, after loading the unit, and on the route to the United States of America border). Description of the place(s) where the inspection is carried out and indicate if it is monitored by alarm systems and closed-circuit television and video surveillance.

Likewise, describe the procedure performed on the means of transport, cargo vehicles, trailers, semi-trailers, and/or containers used as Instruments of International Traffic, to validate that they meet the physical-mechanical conditions for daily operation on federal jurisdiction roads and bridges, in addition to validating that they have records of this type of maintenance for at least one year.

This procedure must additionally include the following:
a) Responsible personnel. b) Locations where inspections are carried out. c) In the event that any physical-mechanical condition and/or anomaly is detected that affects the proper functioning of the units, how they are reported, and what measures must be taken. d) Specify what type of record is kept.

In cases where, due to major structural modifications in the means of transport such as axles, springs, chassis modifications, and even adaptations in the cabins, among others, the owner and responsible party of the vehicle fleet must contemplate, in accordance with their risk analysis, a more exhaustive review of the vehicle in question to ensure its integrity. In this regard:
a) Indicate whether the repair or maintenance of the transport units (tractors), containers, or trailers is carried out on-site or by an external provider. b) Briefly describe how the handover-receipt of vehicles that underwent modifications such as those mentioned in the previous paragraph is carried out.

7.3 Storage of vehicles, means of transport, containers, trailers, and semi-trailers.
The transport company must maintain the integrity at all times of the means of transport (tractors, containers, trailers, and/or semi-trailers, among others) by establishing controls within its facilities. If these are empty and must be stored in parking areas, they must be secured with a lock and/or indicative seal, or, if applicable, in a secure area that is sheltered and/or monitored.

When it is necessary to store or overnight any container, trailer, and/or semi-trailer with foreign trade merchandise, it must be located in a secure area that has perimeter barriers and is monitored by alarm systems, closed-circuit television, and video surveillance, to prevent unauthorized access and manipulation of the unit and merchandise. Therefore, it must be closed with a high-security lock in accordance with ISO 17712 Standard.

If during the journey on the authorized route to the final destination, it is considered necessary to move to a facility authorized as a storage yard for vehicles, means of transport, containers, trailers, and semi-trailers, whether owned by the company or through a third party, the transport company must guarantee that these facilities meet the minimum criteria in terms of security based on this Ground Transporter Self-Assessment Profile established by AGACE, or, if applicable, another Authorized Economic Operator Program.

Answer: Explanatory Notes:
Describe how the integrity of the means of transport carrying foreign trade merchandise (boxes, containers, trailers, and/or semi-trailers) is secured.
Indicate the types of seals and/or locks used for boxes, containers, trailers, and/or semi-trailers.
Indicate how many facilities the company contemplates for the storage of vehicles, means of transport, containers, trailers, and semi-trailers, and add the following data for each of these:
a) Name or denomination of the facility. b) Full address of the facility. c) Surface area of the facility marked in m2. d) Indicate how many foreign trade shipments enter the facility (import/export). e) Number of people working in this facility. f) In case any facility has been visited by CTPAT, indicate the date the visit took place. g) Indicate in each of the facilities which one belongs to the company or is a service contracted through a third party. h) Describe how you ensure that your commercial partner providing the storage service meets the minimum requirements in terms of security.

Personnel Security.
Documented procedures must be in place for the registration and evaluation of individuals seeking employment within the transport company, and methods must be established to conduct periodic verifications of current employees.
Additionally, there must be continuous training programs for administrative and operational staff that disseminate the company's security policies, as well as the consequences and actions to be taken in case of any infractions.

8.1 Verification of work history.
The transport company must have documented procedures to investigate and verify the information stated in the curriculum, criminal records (if local legislation and company policies allow), and applications of candidates with potential for employment, in accordance with local legislation, either independently or through an external company. Similarly, for positions that, due to their sensitivity, require it and affect the security of shipments subject to foreign trade, in accordance with the risk analysis previously conducted, stricter requirements for hiring must be considered, which must be carried out periodically.

Regarding personnel already working in the company, periodic investigations must be conducted based on the activities and/or sensitivity of the employee's position.
This procedure must contemplate the creation and updating of personnel files, which must have restricted access and contain the following information, enumeratively but not limitatively:
a) Employment application. b) Updated photograph (in electronic or printed format). c) Copy of official identification. d) Copy of the current federal driver's license issued by SICT according to the type of service to be provided. e) Copy of updated proof of address. f) Copy of birth certificate. g) Registration with Social Security Institutions. h) Recommendation letters. i) Evaluations (Mandatory Toxicological Exam for operators/drivers) at least every six months. j) Hiring terms. k) Minimum mechanical knowledge exam. Similarly, for sensitive positions identified in the previously conducted risk analysis and directly affecting the security of means of transport, stricter requirements for hiring must be considered, which must be carried out periodically (e.g., Operators/drivers).

Answer: Explanatory Notes:
Describe the documented procedure for hiring personnel and ensure you include the following:
a) Requirements and documentation demanded. b) Tests and exams requested.
Indicate the areas and/or critical positions identified as risky, according to your analysis, and indicate the following:
a) Indicate what the additional requirements are for specific areas and/or work positions such as criminal records (if legislation and company policies allow), certificate of no criminal record, socioeconomic studies, clinical studies, toxicological (drug use), etc. If applicable, indicate the positions or work areas where they are required and with what frequency they are carried out. b) Indicate whether, prior to hiring, the candidate must sign a confidentiality agreement or a similar document. The procedures for hiring personnel and contractors may include:
a) Thorough investigations of the work and personal backgrounds of new employees. b) Confidentiality and liability clauses in employee contracts. c) Specific requirements for critical positions. d) If applicable, the periodic update of the socioeconomic and physical/medical study of employees working in critical and/or sensitive areas. e) Hiring process and requirements requested for temporary employees and contractors. f) Indicate the medical and toxicological exams performed on operators/drivers. g) In case of hiring a service agency for personnel hiring, indicate if it has documented procedures for hiring personnel and how you ensure they comply with the same. Briefly explain what they consist of. h) The company may consider the results of background verifications of candidates, as allowed by current legislation, to make hiring decisions. Background verifications are not limited to identity and criminal record verification. In higher-risk areas, deeper investigations may be justified.

8.2 Personnel termination procedure.
Documented procedures must exist for personnel termination, which must include the handover of identification, and any other items provided to them to perform their functions (keys, uniforms, badges and/or credentials, computer equipment, passwords, tools, etc.). Likewise, this procedure must include termination in those systems, both computer and access, among others that may exist.

Answer: Explanatory Notes:
Describe the procedure for personnel termination, and ensure you include the following:
a) Who is responsible for carrying out and following up on this procedure. b) How the handover and confirmation of identification, uniforms, keys, and other equipment is carried out. c) Indicate the control, record, and/or format, in which the handover of material is identified and secured, and termination in computer systems (if applicable, attach). d) Specify the type of records of personnel who ended their employment relationship with the transport company, so that in case it was for security reasons, their service providers and/or business associates are warned.

8.3 Personnel administration.
The transport company must maintain an updated system, control, or database of active employees. Likewise, the registration of affiliation with Social Security Institutions and other legal labor records must be carried out and kept updated.
In the case where the company has personnel hired by its commercial partners and working within the facilities, it must ensure that they meet the requirements established for the rest of its employees.

Answer: Explanatory Notes:
Indicate whether the company has an updated system, control, or database, both for personnel hired directly, and that hired through a service provider company, and ensure it includes enumeratively but not limitatively the following points:
a) Full name. b) Updated photograph at least every five years. c) Personal data (age, name, date of birth, phone number, address, CURP, social security number, blood type, allergies, etc.). d) Affiliation. e) Work history. f) Diseases. g) Medical exams. h) Training. i) Type of license and status thereof (they must have a record of transporter licenses with the corresponding validity, in order to prevent their drivers from traveling with expired licenses). j) Results of periodic evaluations. k) Observations. l) This personnel must be hired in accordance with current labor laws and regulations.

Information and Documentation Security.
Prevention measures must exist to maintain the confidentiality and integrity of information and documentation related to shipments carrying foreign trade merchandise, including those used for information exchange with other members of the supply chain. Likewise, comprehensive documented policies and/or procedures must exist to protect Information Technology systems, including measures against misuse, as well as identifying and prioritizing actions to reduce cybersecurity risk. They could also address how a member shares information about cybersecurity threats with the government and other commercial partners.

9.1 Classification and handling of documents.
Procedures must exist to classify documents according to their sensitivity and/or importance, with special emphasis on that received from their contractors where information related to routes, materials, merchandise, and/or goods being transported, instruction letters, schedules, customer and/or contact names, among others, is described. Sensitive and important documentation must be stored in a secure area that only allows access to authorized personnel. Reviews must be conducted regularly to ensure that documents are not used improperly. The useful life of documentation and/or files must be identified, and procedures for their destruction must be established. a) The company must have updated and safeguarded files of means of transport, containers, trailers, and semi-trailers, with the following:

Accreditation of ownership or legal possession of the vehicle with invoice, sales letter, customs entry document, lease contract, or document from the National Vehicle Registry.
Circulation card.
b) Current third-party liability insurance policy or guarantee fund. c) Certificate of low pollutant emissions. d) For the case of transporting hazardous materials and waste, the transport company must have an insurance policy for damage to the environment.
The above in accordance with what is stipulated in the Federal Self-Transportation and Auxiliary Services Regulation and the Regulation for the Land Transportation of Hazardous Materials and Waste.

Answer: Explanatory Notes:
Attach the documented procedure for the registration, control, and storage of printed documentation (classification and filing of documents), which must include:
a) Control register for delivery, loan, among others of documentation. b) Restricted access to the archive area. c) Storage and classification policies. d) An updated security plan describing the measures in force regarding the protection of documents against unauthorized access, as well as against deliberate destruction or loss of the same. e) In the case of electronic or digital information, it must adhere to the security criteria of sub-standard 9.2 Information Technology Security.

9.2 Information Technology Security.
To protect Information Technology systems against common cybersecurity threats, a company must have sufficient protection that promotes security in Information Technology infrastructure (software and hardware) against malware (viruses, spyware, worms, trojans, etc.), baiting, phishing, and internal/external intrusions (firewalls) in the companies' computer systems. Likewise, companies must ensure that their security software is active and receives periodic updates. In the case of automated systems and computer equipment, individual accounts requiring periodic password changes must be used. In order to protect the confidentiality, integrity, and availability of information, the company must have established information technology policies, procedures, and standards, which must be communicated through a training program for all employees handling computer equipment and systems, including topics to prevent attacks through social engineering and all those threats to which they are exposed (malware, baiting, phishing, etc.). Companies that allow their employees to connect remotely to a network must employ secure technologies, such as Virtual Private Networks (VPN), to allow employees to access the company intranet securely when outside the office, as well as procedures designed to prevent unauthorized remote user access. Therefore, written procedures and infrastructure must exist to protect the company against loss, theft, leakage, hacking, and/or ransomware of information. This includes the procedure for the recovery (or replacement) of Information Technology systems and/or data, as well as an established system to identify the abuse of Information Technology systems and detect inappropriate access and/or improper manipulation or alteration of commercial and business data, as well as a written procedure for the application of appropriate disciplinary measures to all offenders. Access to Information Technology systems must be protected against infiltration through the use of secure passwords, including phrases or other forms of authentication. Users of such Information Technology systems must safeguard and not share their access keys or passwords. All Information Technology infrastructure must be physically protected against unauthorized access.

Answer: Explanatory Notes:
Attach the procedure for the recovery or replacement of Information Technology systems and/or data, which includes how you back up and ensure the security of your information, in addition to protecting it from possible losses.
Ensure you include the following points:
a) Indicate the frequency with which backups are carried out. b) Who has access to them, and who authorizes the recovery of information. c) Indicate what type of tests you perform and how often, to verify the security of the network, systems, and infrastructure. d) Mention if, to carry out this type of tests or vulnerability scans, you do so through software, a third party, or provider, and if so, indicate the name or corporate name. e) In case vulnerabilities are found, describe the corrective actions that must be implemented. f) Indicate if you share information about cybersecurity threats with your commercial partners participating in your supply chain (for example: communications, bulletins, emails, etc.). g) Systems must be protected by passwords and changed frequently; therefore, indicate the procedure for changing them. h) Indicate if there are information security policies for their protection. i) Have a system or software to detect and identify abuse, intrusion, or access by unauthorized persons to your Information Technology systems and/or data, as well as the abuse of policies and procedures established by the company, including improper access to internal systems, external websites, and the manipulation or alteration of commercial data by employees or contractors. j) All offenders must be subject to the application of disciplinary measures; therefore, indicate the corrective policies and/or sanctions in case of detection of any violation of Information Technology systems and security policies. Information Technology and cybersecurity policies and procedures must be reviewed annually and updated due to an attack or according to situations that may put the company's systems at risk. Describe the security measures you use to allow employees to connect remotely to a network (VPN), to allow employees to access the company intranet remotely when outside the office. In case of allowing employees to use personal devices to perform company work, such devices must comply with the company's cybersecurity policies and procedures, security updates must be periodic, and there must be a method to access the company network securely. Indicate if the computer equipment has a backup power supply system that allows business continuity. The procedures regarding the backup of the transport company's information must also include:
a) How and for how long data is stored. b) Business continuity plan in case of incident and how to recover information. c) Frequency and location of backups and archived information. d) If backups are stored in sites alternative to the facilities where the data processing center is located. e) Tests of the validity of data recovery from backups.

The procedures regarding the protection of the company's information must also include:

a) An updated and documented policy for the protection of the company's computer systems against unauthorized access and deliberate destruction or loss of information. All sensitive and confidential data must be stored in an encrypted or encoded format.

b) Detail whether the company operates with multiple systems (headquarters/sites) and how these systems are controlled.

c) Who is responsible for the protection of the company's computer system (responsibility should not be limited to one person but to several so that each can monitor the actions of the others).

d) Each user's access must be assigned through individual accounts and restricted according to the job description or assigned tasks. Therefore, describe how access authorizations and levels of access to computer systems are granted (access to sensitive information must be limited to authorized personnel to modify and use the information). Authorized access must be monitored by the area responsible for granting it, to verify or, if applicable, report that access to confidential systems is based on job requirements.

e) Indicate the elements or format that passwords must have for access to Information Technology systems and computer equipment, frequency of changes, if there are other authentication methods, and who or which area provides these passwords.

f) Indicate the name of the "firewall" and anti-virus used (include licensing information), providing evidence that this security software is active and receives periodic updates.

Therefore, cybersecurity policies and procedures should include measures to prevent the use of counterfeit products or those with incorrect licenses (software and hardware).

All computer equipment, electronic media (hard drives, cell phones, etc.), and Information Technology hardware containing confidential information related to the import and export process must be accounted for through periodic inventories and have such evidence.

When these technological equipment must be disposed of, there must be a documented procedure that includes how they must be formatted, disinfected, or destroyed properly to avoid information leakage.

g) In the event of employee termination, access to computer equipment, telecommunications, and the network must be eliminated at the moment of the employee's separation; this includes email accounts, system access accounts, software, programs, etc.

h) Elimination, maintenance, or updating of user details.

i) Measures planned to handle incidents in case the system is compromised.

Security training and awareness.
The company must have a documented awareness program on threats established, designed, and updated by the Security Committee to recognize and create awareness about threats from terrorists and smugglers at each point in the supply chain. The training program must be comprehensive and cover all security requirements of the Authorized Economic Operator Program. Administrative and operational employees must know the company's established procedures to consider a risk situation and know how to report it. Specific training must be provided to operators/drivers, as well as employees in critical and/or sensitive areas determined under your risk analysis, security areas; as well as those who receive and open mail and packages, among others.

10.1 Training and awareness on threats.
The transport company must have a training and awareness program on security policies in the supply chain directed to all its employees (operational and administrative) and, additionally, make available informational material regarding the procedures established in the company to consider a situation that threatens its security and know how to report it. The company must have an additional program for its operators/drivers used for the transport of goods destined for foreign trade, which includes specific topics according to their functions that allow them to maintain the integrity of the means of transport and their cargo, handling of incidents, changing locks in case of inspection by other authorities, when the operator identifies that they are being watched or followed during the transport of goods, among others, that are implemented. Likewise, specific training must be offered according to their functions to help employees maintain the integrity of trailers and tractors for agricultural and security purposes, reception and review of mail and packages, prevention of operations with proceeds of illicit origin (money laundering, terrorist financing, etc.), how to recognize and report internal conspiracies and protect access controls, as well as training regarding smuggling, merchandise theft, placement of seals and high-security locks (VVTT inspection method), prevention of visible contamination by pests, etc. These topics must be established as part of new employee induction and periodically maintain update programs. Update training must be carried out periodically, after a security incident and when there are changes in the transport company's procedures. In addition to security training programs, an awareness program on alcohol and drug consumption must be included. Also, disseminate and train staff on the company's cybersecurity policies, procedures, and standards (theft, leakage, hacking, and/or ransomware of information), including access to computer equipment and systems via passwords or phrases. Personnel who operate and administer security technology systems must receive training related to their operation and maintenance, including self-training through operational manuals and other methods. These topics must be established as part of new employee induction and periodically maintain update programs. Update training must be carried out periodically, after a security incident and when there are changes in the company's procedures. Training programs must encourage active employee participation in security controls and mechanisms, as well as maintain records of all training efforts provided by the company, and the list of those who participated in them (videos, photographs, minutes, attendance lists, intranet or other system, didactic material, PowerPoint presentations, brochures, etc.). Records must include the date of the training, the names of the attendees, the topics taught, in addition to having measures to verify that the training
provided met all training objectives. The foregoing, in accordance with the regulation established by SICT, which establishes that permit holders have the obligation to provide their drivers with training and coaching to ensure that the provision of services is efficient, safe, and effective.

Response: Explanatory Notes:
The company must have a training program on security and prevention in the supply chain for all employees (administrative and operational). Briefly explain what it consists of and ensure you include the following:
a) Brief description of the topics taught in the program. b) When they are taught (induction, specific periods, etc.). c) Frequency of training and, if applicable, updates. d) Indicate how participation in supply chain security training is documented (videos, photographs, minutes, attendance lists, intranet or other system, didactic material, PowerPoint presentations, brochures, etc.). Training records must include the date of the training, the names of the attendees, the topics taught, in addition to having measures to verify that the training provided met all the objectives of the same. e) Explain how employee participation in security matters is encouraged. The topics that must be included, by way of example and not limitation:
a) Access and security policies at the facilities. b) Delivery-receipt of merchandise. c) Confidentiality of cargo information. d) Transport instructions. e) Accident and emergency reports. f) Instructions for placing locks and/or seals in case of inspection by other authorities. g) Installation and testing of security alarms and unit tracking, when applicable. h) Identification of authorized formats and documents to be used.

Training to perform the review of cargo vehicles, containers, trailers, and/or semi-trailers for agricultural and security purposes must include the following topics:
a) Signs of hidden compartments; b) Smuggling hidden in natural compartments; c) Signs of pest contamination; d) Procedures to follow if something is found during an inspection of the means of transport or if a security incident occurs during transit; e) Agricultural review training must cover pest prevention measures, regulatory requirements applicable to wooden packaging materials, and the identification of infested wood. Operators and personnel who perform agricultural and security inspections of means of transport must be trained to inspect cargo vehicles for such purposes; therefore, describe how you comply with the provisions established by the Secretariat of Environment and Natural Resources (SEMARNAT) and NOM-144 SEMARNAT-2017, in accordance with International Standards for Phytosanitary Measures No. 15, entitled: Regulation of wooden packaging used in International Trade, which emanate from the Food and Agriculture Organization of the United Nations, and the identification of infested wood.

Handling and investigation of incidents.
There must be documented procedures to report and investigate incidents in the supply chain and the actions to be taken to prevent their recurrence, as well as to notify security personnel, business partners who may be part of the affected supply chain, security specialist or Authorized Economic Operator Program contact, and other competent authorities. Reporting and investigation procedures must include updated contact information or directory listing the names and phone numbers of personnel requiring notification. The investigation and analysis of incidents must be documented (physical and/or electronic file), as well as corrective actions to prevent them from happening again, which must be implemented as soon as possible. In the case where the strategic fiscalized facility identifies that any foreign trade shipment is involved in a situation that puts the security of the supply chain at risk, due to suspicion of a business partner or person, it must inform security personnel, business partners who may be part of the affected supply chain, security specialist or Authorized Economic Operator Program contact, as well as the competent authority, and, if possible, before the border crossing, exit, or customs clearance (import and export). Procedures must include the steps to follow if it is discovered that a seal is altered, manipulated, or there is an incorrect seal number in the documentation, the communication protocols to business partners involved in the supply chain, and the investigation of the incident. All the aforementioned procedures must be reviewed periodically or at least once a year to ensure that contact information and action protocols are correct.

Response: Explanatory Notes:
Describe the procedure to denounce or report anomalies and/or suspicious activities, as well as those containing mechanisms to anonymously report problems related to security; ensure you include the following:
a) Who is responsible for reporting incidents. b) Detail how you determine and identify with which authority to communicate in different scenarios or presumption of suspicious activities. c) Mention if you keep a record of the reporting of these activities and/or suspicions and briefly describe what it consists of.

11.2 Investigation and analysis.
There must be written procedures to denounce or report anomalies and/or suspicious activities, as well as for the analysis and investigation of security incidents in the supply chain to determine their cause, in addition to corrective actions to prevent them from happening again, which must be implemented as soon as possible. The information derived from this investigation must be documented and available at all times for authorities that so require. This information and documentation generated to carry out foreign trade operations must be included in a file for the purpose of allowing the identification of each of the processes the means of transport went through, up to the point where the incidence was detected, and allowing the recognition of the vulnerability of the chain.

Response: Explanatory Notes:
Describe the documented procedure to initiate an investigation, in the event of any security incident, and ensure you include the following:
a) Responsible for carrying out the investigation. b) Documentation that integrates the investigation file. c) Information related to the operator(s)/driver(s), vehicles (tractors), containers, trailers, and/or semi-trailers, merchandise, and routes.
The documents to be included in the file derived from the investigation, by way of example and not limitation, may be:
a) General information of the shipment, Purchase Order. b) Transport request; Confirmation of means of transport; Identification of transport operator (Access records, etc.). c) Container Inspection Formats; Exit order; delivery records. d) Videos from alarm systems, closed-circuit television, and video surveillance. e) Documentation generated for the carrier (Packing list, Bill of Lading, instruction sheet). f) Documentation generated for business partners (Description of merchandise, Proformas, invoices, etc.). g) Documentation generated by the business partner (Customs declarations, Manifests, Tracking and inspection reports, videos if applicable, etc.). h) Tracking and monitoring report of the unit (GPS Tracking).

E6.
Courier and Package Profile.
Acknowledgment of Receipt
First Time: Renewal:
Addition:
Modification:
The data you provide will replace the data you provided when you requested your authorization.
General Information
The objective of this Profile is to ensure that courier and package companies have security practices and processes implemented in their facilities, focused on strengthening the supply chain and mitigating the risk of contamination of shipments with illicit products.
Courier and package companies interested in obtaining the authorization referred to in Rule 7.1.5. must demonstrate that they have documented and verifiable processes; likewise, they must integrate the criteria required in this document according to the business model or design they have established, seeking during the implementation of security standards, the application of a risk analysis culture supported by decision-making in accordance with the values, mission, vision, codes of ethics, and conduct of the company itself. In the event that the courier and package company has authorization for a Fiscalized Facility or Strategic Fiscalized Facility; in addition to complying with what is provided in this document, it must accredit the requirements and guidelines established for the control, surveillance, access routes, infrastructure, equipment, and security of foreign trade merchandise established by ANAM and may prove compliance with that which coincides with what is established in this Profile. Filling Instructions:
1. You must fill out a Courier and Package Profile for each of the main facilities where you consolidate foreign trade merchandise and, if applicable, for those related facilities such as: warehouses, distribution centers, among others. The number of Profiles submitted must coincide with the facilities manifested in your application for inscription as a Certified Business Partner under the category of courier and package and with the domiciles registered with the RFC.
2. In each sub-standard, the courier and package company must detail how it complies with or exceeds what is established in each of the numerals as indicated.
3. The format of this document is divided into two sections, as detailed below:
1. Standard.
Description of the standard
1.1 Sub-standard.
Description of the sub-standard
Response: Explanatory Notes:
Describe and/or attach... a) Points to highlight...

4. Indicate how you comply with what is established in each of the sub-standards; therefore, you must attach the procedures in Spanish that, if applicable, are required, or provide a detailed explanation of what is requested in the Response field.
The section regarding Explanatory Notes is intended to be used as a guide regarding the points that must be included in the Response or in the attached procedures, as appropriate, for each sub-standard, indicating in an indicative manner those points that should not be excluded from your response.
5. Once this Courier and Package Profile is answered, you must attach it to the Registration Application in the Business Certification Scheme, Certified Business Partner modality referred to in the first paragraph of Rule 7.1.5., first paragraph, fraction VI, subsection e).
For the purpose of verifying what is manifested in the previous paragraph, SAT through AGACE may conduct an inspection of the facility, exclusively for the purpose of verifying what is manifested in this document.
6. Any incomplete Courier and Package Profile will not be processed.
7. Any question relative to the Inscription Application and the Courier and Package Profile, direct it to the contacts that appear on the SAT Portal.
8. In the event of being authorized as a Certified Business Partner, this format must be kept updated, and notify when the circumstances under which the registration was granted have varied and as a result changes or modifications are required in the information stated and provided in this Courier and Package Profile to the authority in accordance with what is established in Rule 7.2.1., fourth paragraph, fractions I, II, and VII.
9. When, as a result of the inspection visit, non-compliances related to minimum security standards result, the applicant may remedy them before the issuance of the resolution established in Rule 7.1.6., for which it will have a maximum period of three months counted from the notification of the stated non-compliances.
Installation Data
A Courier and Package Profile must be filled out for each of the cargo consolidation facilities that handle merchandise subject to foreign trade, if applicable, for those related facilities such as: warehouses, distribution centers, consolidation, etc.
Installation Information
Courier and Package Profile Number:
from
RFC
Name and/or Business Name
Name and/or Denomination of the Installation
Type of Installation
Street Number and/or exterior letter
Number and/or interior letter
Neighborhood
Postal Code
Municipality/Delegation
Federative Entity
Age of the installation (years of operation):
Activity performed in the installation:
Preponderant products handled in the installation of the courier and package company:
(As applicable)
Average number of monthly shipments (EXP): (By maritime, air, land, rail, etc. transport) Average number of monthly shipments (IMP): (By maritime, air, land, rail, etc. transport) Total number of employees at this installation:
Surface area of the installation (m2):

Certifications in security programs: (Indicate if this facility holds a certification from any of the following programs) CTPAT Yes No Level: Pre-Applicant: Applicant: Certified: Certified/Validated:
CTPAT Account number (8 digits): Date of last visit to this facility:
Authorized Economic Operator from other countries (AEO) Yes No Program: Registration:
Other Supply Chain Security Programs Yes No Program: Registration:
Certifications: (Indicate if you hold certifications that you consider impact your supply chain process, for example: ISO 9000; Reliable Logistics Processes, among others) Name: Category: Validity:
Name: Category: Validity:
Name: Category: Validity:
Name: Category: Validity:

Supply Chain Security Planning.
The courier and package company must develop documented policies and procedures to carry out an analysis that allows it to identify risks and weaknesses in its supply chain with the objective that the company's senior management implements strategies that help mitigate risk in the organization's operations. Likewise, to build a solid supply chain security program, the company must have a Security Committee that incorporates representatives from all relevant departments, forming a multifunctional team that identifies areas for opportunity and proposes continuous improvement actions throughout the supply chain and the company's facilities. Similarly, the company must have designated points of contact for the Authorized Economic Operator Program, which must be involved and aware of the Authorized Economic Operator requirements, belong to the company and prove its relationship with it, as well as respond to its supply chain security specialist (this is assigned once the company already has the Authorized Economic Operator Program). If, as a result of the risk analysis, new security measures arise to be incorporated into the company, these must be included in the company's existing procedures and, if applicable, new procedures must be drafted, which creates a more sustainable structure and emphasizes that supply chain security is everyone's responsibility.

1.1 Risk Analysis.
The courier and package company must establish measures to identify, analyze, and mitigate security risks that could result in alterations to foreign trade merchandise during its handling, guarding, custody, and transport in its supply chain and facilities, under the guideline of a documented procedure. This analysis must be based on the organization's model (e.g., facility locations, type of merchandise, volume and country of origin, clients, suppliers, routes, information leakage, personnel hiring, classification and handling of documents, Information Technologies, potential threats, etc.), so that it allows implementing and maintaining appropriate security measures. Based on the above, the company must also have a written process based on its risk analysis to select new business partners and monitor those with whom it is already working. This procedure must be updated at least once a year, so that it allows permanently identifying new threats or risks considered in the operation, as a result of some security incident or that originate from changes in initial conditions, as well as to identify that the policies, procedures, control mechanisms, and security are being complied with. It is important to note that the company's Security Committee must participate in the drafting and updating of the risk analysis, as well as in the maintenance of the Authorized Economic Operator Program.

Response: Explanatory Notes:
Indicate which are the sources of information used to qualify risks during the analysis phase.
Attach the risk matrix, as well as the documented procedure to identify risks in the supply chain and the facilities of your company, make sure to include the following points:
a) Indicate the periodicity with which you review and/or update the risk analysis. b) Indicate which aspects and/or areas of the company are incorporated into the risk analysis. c) Describe the methodology or techniques used to perform the risk analysis. d) Mention who are the responsible for reviewing updating the risk analysis. Likewise, the documented procedure to identify risks in the supply chain and its facilities, must contemplate the process of risk appreciation and management, and include the following aspects:
a) The context (cultural, political, legal, economic, geographic, social, etc.) of the installation. b) Identify risks in your supply chain and your facilities. c) Risk analysis (causes, consequences, probabilities and existing controls to determine the level of risk as high, medium and low). d) Risk evaluation (decision making to determine the risks to treat and priority for implement the treatment). e) Risk treatment (application of alternatives to change the probability that risks occur). f) Risk monitoring and review (monitoring of the results of the risk analysis and verification of the efficacy of its treatment). It is suggested to use the techniques of Administration, management and evaluation of risks according to international standards ISO 31000, ISO 31010 and ISO 28000 that according to your business model, should implement.

1.2 Security Policies.
The courier and package company must have a policy oriented towards preventing, securing, and recognizing threats to the security of the supply chain and company facilities, such as drug trafficking, money laundering, arms trafficking, human trafficking, prohibited goods, acts of terrorism. To promote a culture of security, companies must demonstrate their commitment to supply chain security and the Authorized Economic Operator Program through a statement highlighting the importance of protecting the flow of national and international commerce from criminal activities, established through the security policy. The senior officials or executives of the company who must endorse and sign the security policy can be the company president, the chief executive officer, the general manager, the security director, or personnel with a comparable position with decision-making authority.

Response: Explanatory Notes:
Enunciate the security policy oriented towards preventing, securing and recognizing threats in the supply chain and facilities, of the company, indicate who is the responsible for its review, signature and dissemination to employees, as well as the periodicity with which its update is carried out. This policy must be communicated to employees through a program and/or dissemination campaign. The security policy must be signed by a senior official of the company and be displayed in various areas of the company, including the company website, posters in key areas of the company (reception, shipments, receipts, warehouse, etc.), and as part of the initial training and of reinforcement of the company.

1.3 Internal Audits in the Supply Chain.
In addition to routine monitoring in control and security, it is necessary to schedule and carry out audits at least once a year, under the guidelines of a documented procedure that allows evaluating all processes regarding security in the supply chain and its facilities in a more critical and deep manner, as well as guaranteeing that its employees follow the company's security procedures. The audits must be carried out by the company's Security Committee, establish a documented procedure, as well as a program or calendar for their realization. Although it is necessary that the audits are focused on supply chain security and based on the evaluation, review, and execution of minimum standards in terms of security, their focus must be adjusted to the size of the organization, level of risks, business model, and variations between facilities. Audits can be general or focus on specific areas or processes according to their work program. The objective of an internal audit focused on the Authorized Economic Operator Program is to verify and guarantee that employees follow the company's security procedures. The review process does not have to be complex; however, the formats and records used for the application of these reviews must evidence that the application and execution of the evaluated processes were validated, in addition to the corresponding follow-up of identified observations. Senior management must review the audit results, analyze causes, and undertake corrective or preventive actions required. The review process must guarantee that the necessary information is collected to allow management to perform this evaluation. The review must be documented, in addition to the fact that the points of contact of the courier and package company must provide and register periodic updates on the progress or results of any audit, exercise, or validation.

Response: Explanatory Notes:
Describe the documented procedure to carry out an internal audit, focused on security in the supply chain, make sure to include the following points:
a) Indicate how the courier and package company carries out the scheduling or calendarization to perform an internal audit, in terms of security in the supply chain. b) Indicate who participates in them, and the records that are generated, as well as the periodicity with which they are carried out. c) Indicate how the company's management verifies the result of the audits in terms of security of the supply chain and how it carries out and/or implements preventive, corrective, and improvement actions in addition to the follow-up and closure of the same. d) The formats used during internal audits must be properly filled out, and through them, evidence that the procedures and security measures are being put into practice.

1.4 Contingency and/or Emergency Plans related to Supply Chain Security.
There must be a documented contingency and/or emergency plan; this plan must address crisis management, security recovery plans, and business resumption to ensure business continuity in case of affectation to the normal development of the activities and foreign trade operations of the company in its supply chain (during the transport, handling, storage, and custody of foreign trade merchandise according to its logistics process. A crisis or contingency can include the interruption of commercial data movement due to a cyberattack, a fire, the kidnapping of a transport driver by armed individuals, customs closure, a bomb threat, the detection of suspicious packages, power outage, theft and/or damage to merchandise, threats or extortion, blockages or road closures, among others). The courier and package company must communicate these plans to personnel through periodic training, as well as carry out tests, practical exercises, and annual simulations of the contingency and emergency plans to verify their effectiveness, from which a properly filled-out and signed record must be maintained (for example: result reports, minutes or reports, which must be backed up by video recordings, photographs, etc., that demonstrate their execution). The contingency and/or emergency plan must be updated as necessary, based on changes in operations and the organization's risk level.

Response: Explanatory Notes:
Attach the documented contingency and/or emergency procedure or plan, to ensure business continuity in case of an emergency or security situation, that affects the normal development of the foreign trade activities of the courier and package company.
This procedure must include, by way of example and not limitation, the following:
a) What situations it contemplates, describing the plan of action and steps to be followed in case of crisis, as well as the tasks that personnel have assigned during the handling of such contingencies. b) What mechanisms it uses to guarantee that the plan of business continuity is effective. c) Contemplate the scheduling and carrying out of annual simulations and how they are documented (for example: result reports, minutes or reports, which must be accompanied by video recordings, photographs, etc., that demonstrate their execution).

Physical Security.
The courier and package company must have established mechanisms and documented processes to prevent, detect, or dissuade unauthorized personnel from entering the facilities. All sensitive areas of the company must have physical barriers, control elements, and dissuasion against unauthorized access.

2.1 Facilities.
Facilities must be constructed with materials that can resist unauthorized access. Periodic documented inspections must be carried out to maintain the integrity of the structures and in case an irregularity has been detected, carry out the corresponding repair as soon as possible by the personnel designated for these tasks. Likewise, territorial limits, as well as various accesses, internal routes, and the location of buildings must be fully identified.

Response: Explanatory Notes:
Indicate the predominant materials with which the installation is constructed (for example, metal structure and sheet metal walls, brick walls, wood, among others), and indicate how the review and maintenance of the integrity of the structures is carried out.
Indicate the personnel or area responsible for carrying out the tasks of inspection, maintenance, and repair of damages to the facilities.
Attach a distribution or architectural plan of the whole, where the limits of the facilities can be identified, access routes, emergency exits, location of the buildings, critical areas, parking lots, and boundaries.

2.2 Access at Doors and Booths.
Entry or exit doors for personnel and/or vehicles must be attended, controlled, watched, and/or supervised. The number of access doors must be kept to the minimum necessary. Access to sensitive areas must be restricted according to the job description or assigned tasks.

Response: Explanatory Notes:
Indicate how many doors and/or accesses exist in the facilities, as well as the operating hours of each one, and indicate how they are monitored (in case of having assigned security personnel, indicate the quantity).
Detail if there are doors and/or accesses blocked, or permanently closed and their location.
Describe how you ensure that access to sensitive areas is restricted according to the job description or assigned tasks (include the type of records and controls you use).

2.3 Perimeter Fences.
Perimeter fences and/or peripheral barriers must be installed to secure the perimeters of the courier and package company's facilities, based on a risk analysis. Fences, interior barriers, or a mechanism to identify and segregate international cargo, as well as high-value and dangerous cargo, must be used. These must be inspected regularly and carry a record of the review with the purpose of ensuring their integrity and identifying damages, which must be repaired as soon as possible by the personnel designated for these tasks. Storage areas, high-value, dangerous, and/or restricted-access areas must be clearly identified and monitored to prevent unauthorized entry.

Response: Explanatory Notes:
Describe the type of peripheral barrier and/or fences with which the installation is equipped, make sure to include the following points:
a) Describe which areas are segregated. b) Indicate their characteristics (material, dimensions, etc.). c) In case of not having fences, justify detailedly the reason. d) Periodicity with which the integrity of the perimeter fences is verified, and the records that are carried out with the purpose of ensuring their integrity and identifying damages, which must be repaired as soon as possible. Indicate the personnel or area responsible for carrying out the tasks of inspection and repair of damages. Describe how the cargo destined for foreign countries, dangerous material, and high-value cargo is segregated; make sure to include the following points:
a) Indicate how you separate national merchandise and foreign trade merchandise, and if it is additionally identified (for example: different packaging; labels; packaging, among others). b) Identify and indicate restricted access areas (dangerous goods, high value, confidential, etc.). The procedure for the inspection of perimeter fences could include:
a) Personnel responsible for carrying out the review. b) How and how often the inspections of fences, perimeter fences and/or peripheral barriers and buildings are carried out. c) How the inspection record is kept. d) Who is responsible for verifying that the repairs and/or modifications meet the technical specifications and necessary security requirements.

2.4 Parking Lots.
Access to the facilities' parking lots must be controlled and monitored by security personnel or designated for this task. Private vehicles (of employees, visitors, suppliers, and contractors, among others) must be prohibited from parking within the merchandise handling and storage areas, as well as in adjacent areas.

Response: Explanatory Notes:
Describe the procedure for the control and monitoring of the parking lots, make sure to include the following points:
a) Responsible for controlling and monitoring access to the parking lots. b) Identification of the parking lots (specify if the visitor parking is separated from the storage and merchandise handling areas). c) How entry and exit control of vehicles to the facilities is carried out, indicate the records that are made for parking control, the existing control mechanisms (for example: badges, card readers, lanyards, etc.), how they are assigned and the area responsible for doing so. d) Policies or mechanisms to not allow the entry of private vehicles to the storage and handling merchandise areas.

2.5 Key and Lock Device Control.
Windows, doors, and interior and exterior fences, according to their risk analysis, must be secured with locking devices. The company must have a documented procedure for the handling and control of keys and/or locking devices for interior areas that have been considered critical.
Likewise, they must keep a record and establish control through signed responsibility letters by persons who have keys or authorized access according to their level of responsibility and tasks within their work area.

Response: Explanatory Notes:
Indicate if all doors, windows, interior and exterior entrances have closing or security mechanisms.
Attach the documented procedures for the handling, and control of keys and/or locking devices, make sure that it includes the following points:
a) Responsible for administering and controlling the security of the keys. b) Format and/or control record for the loan of keys. c) Treatment of loss or non-return of keys. d) Indicate if there are areas in which access is with electronic devices and/or any other access mechanism.

2.6 Lighting.
Lighting inside and outside the facilities must allow clear identification of people, material, and/or equipment located there, including the following areas:
entrances and exits, handling, loading, unloading, and storage areas of merchandise, perimeter and/or peripheral fences, interior fences, and parking areas, and must have an emergency and/or backup system in sensitive areas.

Response: Explanatory Notes:
Describe the procedure for the operation and maintenance of the lighting system, make sure to include the following points:
a) Indicate which areas are illuminated and which have a backup system (indicate if you have an auxiliary power plant or any other mechanism to supply electricity in case of any contingency). b) How you ensure that the lighting system is appropriate in each of the areas of the company in such a way that it allows clear identification of the personnel, material, and/or equipment located there. The procedure may include:
a) How the lighting system is controlled. b) Operating hours. c) Identification of areas with permanent lighting.

2.7 Communication Devices.
The courier and package company must have communication devices and/or systems with the purpose of contacting security personnel and/or emergency and security authorities as required. Additionally, it must have a backup system and verify its proper functioning periodically.

Response: Explanatory Notes:
Describe the procedure that personnel must perform to contact the company's security personnel or, if applicable, the corresponding authority in case of any security incident.
Indicate if operational and administrative personnel have or dispose of devices (landline phones, mobile phones, alert buttons and/or emergency, etc.) to communicate with security personnel and/or whoever corresponds (these must be accessible to users, to be able to have a prompt reaction). Indicate what type of communication devices the security personnel in the company uses (landline phones, cell phones, radios, alarm system, etc.).

Describe the procedure for the control and maintenance of communication devices, ensuring you include the following points:
a) Policies for the assignment of mobile communication devices. b) Maintenance or replacement program for fixed and mobile communication devices. c) Indicate whether you have backup communication devices in case the permanent system fails, and if so, briefly detail them.
The procedure may include:
a) Person responsible for the proper functioning and maintenance of communication devices. b) Verification and maintenance records of the devices. c) Method of assignment of communication devices.

2.8 Alarm systems, closed-circuit television, and video surveillance.
Alarm systems, closed-circuit television, video surveillance, and security technologies must be used to monitor, notify, or deter unauthorized access and prohibited activities in facilities and other considered sensitive areas, notify the corresponding area, and also be used as evidence in investigations derived from any security incident. These security systems and technologies must be installed according to a prior risk analysis so that areas involving the handling, loading, unloading, and storage of goods, security inspections of cargo vehicles, as well as the access of personnel, visitors, suppliers, passenger and cargo vehicles, and other considered sensitive areas are permanently and uninterruptedly monitored, supervised, and overseen, in accordance with what is established for this effect by ANAM and simultaneous operation with the customs office or area in question. This applies in cases where courier and package companies are located within a supervised facility and/or outside of it. These systems must allow clear identification of the area or environment being monitored and maintain a backup of recordings for at least one month, considering that if your logistical processes exceed this period, the backup retention period must be increased, in order to have the necessary elements to assign corresponding responsibilities in case of a security incident. The courier and package company must have a documented operational procedure. For alarm systems, closed-circuit television, video surveillance, and security technologies, this must include supervision of the equipment's good condition, verification of the correct position of cameras, indication of the frequency with which recordings must be backed up for at least sixty days in accordance with Rule 2.3.8, for those with authorized supervised and strategic supervised facilities; for other cases, the recording period must be at least thirty days, as well as those responsible for their operation. These systems and all security technology infrastructure must have restricted access. Response: Explanatory Notes:
Mention the documented procedure indicating the functioning of the external central alarm system or sensors, and if applicable, describe the following points:
a) Indicate if doors and windows have alarm sensors, as well as the areas where motion sensors are available. b) Procedure to follow in case an alarm is activated. c) Indicate the personnel or area responsible for maintenance, how failures are reported, and the records they use.

Describe the documented procedure for the operation of alarm systems, closed-circuit television, video surveillance, and security technologies (this must be reviewed and updated annually and according to the risk analysis or circumstances), ensuring you include the following points:
a) Indicate the number of security cameras installed in the alarm, closed-circuit television, and video surveillance systems, and their location by area (detail if it covers loading and unloading zones, including entry and exit points of the facilities, to cover the movement of vehicles and individuals, and where the inspection mentioned in sub-standard 7.2 is carried out). Attach a layout or map of the security camera distribution. b) Indicate the location of the alarm, closed-circuit television, and video surveillance systems and security technologies, where the monitors are located, who reviews them, as well as operating hours, and if applicable, if there are remote monitoring stations. All security technology infrastructure must be physically protected against unauthorized access. c) Periodic and random reviews of recordings must be conducted. Indicate how they are reviewed (random, weekly, special events, restricted areas, etc.), who the designated personnel are, and how management is involved in the reviews. The results of the reviews must be documented to include corrective actions for audit purposes. d) Indicate for how long these recordings are kept (must be at least one month). e) Alarm, closed-circuit television, and video surveillance systems and security technologies must have an alternative power source that allows them to continue functioning in case of unexpected loss of direct power. Therefore, indicate if the closed-circuit television, video surveillance, and security technology systems are backed up by an electrical power plant or some other mechanism to supply electricity, guaranteeing their operation. These systems should have an alarm/notification function indicating a failure in operation and/or recording; indicate if your systems have this function.

f) Indicate if, in addition to alarm, closed-circuit television, and video surveillance systems, you use any other type of technology to strengthen the security measures already in place. g) Describe the procedure implemented to regularly test and inspect alarm, closed-circuit television, and video surveillance systems and security technologies and ensure their proper functioning. The results of the inspections and functional tests must be documented, as well as necessary corrective actions (these must be implemented as soon as possible). Additionally, the documented results of these inspections must be kept for a sufficient time for audit purposes. h) Indicate if the provider of the alarm, closed-circuit television, and video surveillance systems has access to the security cameras, if they are in charge of monitoring them, how access is controlled, and who is responsible for said monitoring.

Physical access controls.
Physical access controls are mechanisms or procedures that prevent and prohibit unauthorized entry to facilities, maintain control of the entry of employees and visitors, and protect the company's assets.
Access controls must include the identification of all employees, visitors, and suppliers at all entry points. Likewise, records must be maintained and the documented mechanisms or procedures for entry into the facilities must be permanently evaluated, serving as the basis for beginning to integrate security as one of the primary functions within any company.

3.1 Security personnel.
The courier and package company must have security and surveillance personnel. This personnel plays an important role in the physical protection of the facilities and goods during their transport, handling, and storage within the company, as well as for controlling the entry and exit of all persons to the premises. Security personnel must have a documented procedure to carry out their functions and have full knowledge of the mechanisms and procedures in emergency situations, detection of unauthorized persons, or any incident in the facility. Management must periodically verify compliance with procedures, policies, and functions through internal audits with the objective of verifying their correct execution. Response: Explanatory Notes:
Describe the documented procedure for the operation of security personnel and ensure you include the following points:
a) Indicate the number of security personnel working in the company. b) Indicate the positions and/or functions of the personnel and operating hours. c) In case of hiring an external service, provide general data of the company (Tax ID/RFC, legal name, address), and specify the number of personnel employed, operational details, records, and reports they use to perform their functions. d) In case of having armed personnel, describe the procedure for the control and storage of weapons.

3.2 Employee identification.
Management or the company's security personnel must properly control the delivery and return of badges, ID cards, and/or employee identification credentials. Procedures for the delivery, return, and change of access devices (for example, keys, badges, and/or proximity cards, etc.) must be documented. Access to sensitive areas must be restricted according to the job description or assigned tasks. Response: Explanatory Notes:
Describe the procedure for employee identification and ensure you include the following points:
a) Identification mechanisms (badge and/or photo ID, biometrics, proximity cards, etc.). b) Indicate if employees use uniforms, how they are assigned (by position, area, functions, etc.) and withdrawn (if applicable). c) Indicate how personnel hired by a business partner, working within the facilities (contractors, subcontractors, in-house services, personnel from cargo handling companies, etc.) are identified. The procedure must also describe how the company delivers, changes, and withdraws employee identification and access controls, and ensure you include the areas responsible for authorizing and administering them. Indicate how you ensure that access to sensitive areas is restricted according to the job description or assigned tasks (include the type of records and controls you use). Attach the documented procedure for the control of identifications.

3.3 Visitor and supplier identification.
To access the facilities, visitors and suppliers must present official identification with a photo for documentation purposes upon arrival, and a record must be kept. All visitors and suppliers must receive a temporary identification, be accompanied by company personnel during their stay in the facilities, and ensure that the visitor/supplier always wears the provisional identification provided in a visible place. This procedure must be documented. Response: Explanatory Notes:
Describe the procedure for visitor and supplier access control, ensuring you include the following points:
a) Indicate what records are kept (personal forms for each visit, logbooks, among others). b) The visitor and supplier record must include the following:

Date of the visit.
Name of the visitor.
Identification number with photo (official documents such as: driver's license, passport, INE, etc.).
Time of entry and exit.
In the case of vehicular access, the format must include the data of the private or cargo vehicle (model, license plate, trailer number, etc.).
c) Indicate who is the person responsible for accompanying the visitor and/or supplier and if there are restricted areas for their entry.

3.4 Procedure for identification and removal of unauthorized persons or vehicles.
The courier and package company must have documented procedures specifying how to identify, confront, or report unauthorized or identified persons and/or vehicles; this procedure must be communicated to responsible personnel through training. The training must be documented.
Response: Explanatory Notes:
Attach the documented procedure to identify, confront, or report unauthorized or identified persons and/or vehicles.
The procedure must include:
a) Responsible personnel. b) Designate a person or area responsible for being informed of security incidents. c) Instructions for confronting and addressing unidentified personnel. d) Indicate in which cases the corresponding authorities must be notified. e) How security incidents are recorded and the measures adopted in each case.

3.5 Courier and package deliveries.
Courier and package deliveries intended for company personnel must be examined upon arrival and departure, before being distributed to the corresponding areas and destinations. Likewise, the company must have a documented procedure for the receipt and review of courier and packages, which must be communicated to responsible personnel through training. The training must be documented. Response: Explanatory Notes:
Describe the procedure for the receipt and review of courier and packages, ensuring you include the following:
a) Personnel in charge of carrying out the procedure. b) Indicate how the personnel or service provider of the courier and package service is identified (indicate if an additional procedure to the supplier access procedure is required). c) Indicate how the review of courier and/or packages is carried out, what mechanism is used, the records kept, and if applicable, incidents detected. d) Describe the characteristics or elements to determine what courier and/or packages are suspicious. e) Indicate what action is taken in case of detecting suspicious courier and/or packages.

Business partners.
The courier and package company must have written and verifiable procedures for the selection and contracting of new business partners and monitoring of partners already working with them, such as: transporters, service providers such as cleaning, security, personnel hiring, installation and maintenance of alarm, closed-circuit television, and video surveillance systems, IT systems and technology providers, high-security seal providers, providers of loading, unloading, storage, and cargo handling services, contractors, airlines, among others, and according to their risk analysis, require them to comply with security measures to strengthen the international supply chain. The risk analysis carried out by the courier and package company regarding its business partners (clients and suppliers) must include risks related to the identification of activities related to money laundering and terrorist financing. Additionally, the courier and package company must foster a documented social compliance policy and program that, at a minimum, addresses how its employees and business partners could guarantee that goods, inputs, or merchandise imported into Mexico for the manufacture of products or merchandise do not originate from extraction, production, or manufacturing, totally or partially, using prohibited forms of labor, that is, forced or compulsory labor, including forced or compulsory child labor under Article 23.6 of the USMCA and the Agreement establishing the merchandise whose importation is subject to regulation by the Secretariat of Labor and Social Welfare, published in the Official Gazette of the Federation on February 17, 2023.

4.1 Selection criteria.
There must be documented procedures for the selection, follow-up, or renewal of commercial relationships with business associates or suppliers, which include interviews, reference verification, evaluation methods, and use of provided information. The information derived from the investigation and/or evaluation of business associates and/or suppliers must be documented and integrated into a file (physical or electronic). The procedure for the selection of business partners must include indicators to detect clients or suppliers that may not be legitimate or with unlocated addresses. If the investigation and/or evaluation of any business partner leads to substantial doubts about the veracity of their operations or services, the company must avoid hiring them and, if applicable, notify its security specialist or contact of the Authorized Economic Operator Program and the corresponding authority about its suspicions. Response: Explanatory Notes:
Attach the information collected for the selection and contracting of new business partners and monitoring of partners already working with them; this comprises any type of commercial relationship your company has with them, and ensure you include the following points:
a) What information is required from your business partner. b) What aspects are reviewed and investigated. c) Indicators to identify clients or suppliers that may not be legitimate (payments above standard rate, in cash; having little knowledge of the merchandise to be sent; being evasive; minimal contact information (cell phone, contact points, emails, among others); recently created companies or businesses without commercial history, etc.) or with unlocated addresses. This point refers to indicating all those alerts to determine that a business partner is not reliable, thus conducting a deeper investigation and evaluating whether to work with them. d) Indicate if you maintain a physical or electronic file for each of your business partners, as well as the information it must contain. e) Indicate how the services of your business partner are evaluated and what points you review.

The file must include at least the following:
a) Company data (name, Tax ID/RFC, activity, etc.). b) Legal representative data. c) Proof of address. d) Commercial references (if applicable). e) Contracts, agreements, and/or confidentiality agreements, security policies. f) If applicable, certificate or certification number in the security programs to which they belong.

4.2 Security requirements.
The courier and package company must have a documented procedure in which, according to its risk analysis, it requests additional security requirements from those business partners that intervene in its supply chain, such as: the services it provides as courier and package, as well as service providers such as cleaning, security, personnel hiring, installation and maintenance of alarm, closed-circuit television, and video surveillance systems, IT systems and technology providers, high-security seal providers, providers of loading, unloading, storage, and cargo handling services, contractors, airlines, among others. The requirements must be based on the Courier and Package Profile established by AGACE, or in case it exists, the specific Profile for each actor in the supply chain corresponding to them. The courier and package company must request from its business partners documentation that accredits and proves that they comply with the minimum security standards established in this Courier and Package Profile, either through a written statement issued by the legal representative of the partner, agreements or contractual clauses, or backup with documentation supporting compliance with the requirements established in another Authorized Economic Operator Program. Likewise, the company must take into account and know the specific requirements of the Authorized Economic Operator Program that will be applicable to each of its business partners, based on their activity within the supply chain. In the case of the company's business partners that provide their services within the facilities, they must be obligated to comply with these supply chain security requirements. Response: Explanatory Notes:
Describe the procedure indicating how you carry out the identification of business partners that require compliance with minimum security standards. Ensure you include the following points:
a) A register of business partners that must comply with security requirements, and mention what type of providers these are (transporters, warehouses, security companies, customs brokers, companies authorized to provide loading, unloading, and cargo handling services, etc.). b) Indicate in what documentary form (agreements, accords, contractual clauses and/or addenda) you ensure that your business partners comply with security requirements.

c) Indicate whether there are agreements, contracts, contractual clauses, and/or addenda regarding the implementation of security measures with your service providers within your company, such as customs brokers, private security guards, cleaning services, gardening, cafeteria, maintenance, Information Technology providers, etc.

d) Indicate whether you have business partners to whom you require membership in a supply chain security program, whether certified by a foreign authority or the private sector (for example: CTPAT, or any other World Customs Organization Authorized Economic Operator Program), as well as the information and documentation requested of them.

4.3 Commercial partner reviews.
The courier and package company, through the Security Committee, must conduct periodic and risk-derived evaluations of the processes and facilities of business associates based on a risk analysis, to ensure they meet the minimum security standards required by the company based on the Authorized Economic Operator Program. It must maintain records of these evaluations, allowing verification that processes and security measures are being executed, as well as the corresponding follow-up.

When inconsistencies are found, the company must communicate this to its partner or supplier and provide a justified period to address the identified observations or areas for improvement; otherwise, it must take necessary measures to sanction them.

Conducting security evaluations of commercial partners is important to ensure that a solid security program exists and functions correctly. Therefore, in addition to a documented procedure, there must be a program or schedule for the execution of these security reviews or evaluations, prioritizing partners that are more critical according to their risk analysis. If a member is not evaluated and the company is unaware of whether the processes and facilities of its commercial partners are functioning correctly, it puts its supply chain at risk.

Response: Explanatory Notes:
Describe the procedure for conducting evaluations to verify the requirements (processes and facilities) of your commercial partners. Ensure you include the following points:

a) The frequency with which visits are made to the commercial partner (this must be at least once a year and derived from risk situations). b) Program or schedule for the execution of security reviews. c) Record or report of the verification and, if applicable, the corresponding follow-up. d) The verification format(s) must be duly completed, including the date, name, and position of those participating in the review, signatures, etc. e) Indicate what action measures are taken if commercial partners do not comply with the established security requirements.

f) If you have commercial partners with CTPAT certification or another supply chain security certification program, indicate the frequency with which their status is reviewed, how it is recorded, and the actions taken if it is detected that they are suspended and/or cancelled in accordance with what is established in your procedure.

The procedure must include:
a) Frequency of visits; b) Security review points; c) Preparation of reports; d) Feedback and agreements with the commercial partner; e) Follow-up on agreements; f) Measures in case of detecting non-compliance with requirements; g) Record of evaluations. h) Area or person responsible for carrying out this procedure.

Process Security.
Control measures must be established to guarantee the integrity and security of merchandise and related processes with transport (in any of its modalities), handling, customs clearance, storage, and/or distribution of cargo throughout the supply chain. These control measures and procedures must be documented and ensure the integrity of your import and export shipments from the point of receipt to delivery.

5.1 Process Mapping.
The courier and package company must have a map that shows step-by-step the logistical process of the flow of foreign trade merchandise and the required documentation through its international supply chain.

The company must take into account and include within its mapping all parties involved in its supply chain, including those that handle import and export documentation, such as customs brokers, others that may not handle the cargo directly but may have operational control such as carriers, freight service providers, cargo handling, unloading, storage, and maneuvering services, and airlines. If any part of the transport is subcontracted within its supply chain, it is essential that it be considered within its risk analysis and process mapping, as the more direct and indirect suppliers there are, the greater the risk involved.

Response: Explanatory Notes:
Attach the document where you illustrate and describe the process mapping through which your import and export merchandise passes, from the point of origin to its destination, in order to have clearly identified each of the steps involving the receipt, storage, handling, custody, and delivery of courier and package cargo.

The process mapping must include the names (RFC and Legal Name) of the companies providing services in your logistics chain. This mapping must contain at least the following aspects:

a) Collection, delivery, and/or receipt of foreign trade merchandise at the distribution and/or collection center(s).

b) Security in the transfer of merchandise to a fiscalized or supervised facility:

Indicate the points and areas for rest or safeguarding of cargo vehicles during the transfer of foreign trade merchandise (imports and exports), as well as the documentation generated when cargo enters and leaves the facilities.
Indicate the estimated times that said vehicles remain in rest (reposo) or safeguarding areas (company yards, exit customs, customs broker agency facilities, warehouses, transfer yards or transport, etc.).

c) Security in storage and/or distribution in a fiscalized or supervised facility. d) Security of process during customs clearance. e) Security in international transport (air, land, sea, or multimodal). f) Security in customs clearance and/or deconsolidation in the destination country. g) Delivery to final destination.

5.2 Warehouses and Distribution Centers.
If the courier and package company has external warehouses and/or distribution centers registered under the same RFC, they must be subject to the provisions of this document according to their characteristics, in order to maintain integrity in its supply chain.

Likewise, indicate if you have commercial partners that provide any warehouse, distribution center, or other services within your facilities, which must at all times comply with the minimum security standards established by the company itself.

Response: Explanatory Notes:
According to your logistical process mapping, if foreign trade merchandise is transferred or moved to another warehouse and/or alternative distribution center different from the one operated by the courier and package company, you must indicate if they are registered under your RFC, providing their general data (Name and address) and briefly explaining what activity is carried out in that or those facilities (Cross Dock, temporary warehouse, etc.).

Likewise, indicate if these belong to the company or is a service contracted through a third party and are part of a shareholder group. In this case, according to the supplier selection criteria mentioned in the Commercial Partners section of this document, indicate how you ensure compliance with minimum security requirements (warehouses administered by a third party are not required to present a Courier and Package Profile).

Facilities that have a concession or authorization for a Fiscalized Facility or Strategic Fiscalized Facility, registered under your RFC, must fill out the Profile for the corresponding modality and category for each authorized facility.

5.3 Cargo Delivery and Receipt.
The courier and package company must guarantee the supervision of the identification of operators of its own or subcontracted transport means that carry out the collection, delivery, or receipt of foreign trade merchandise within or outside its facilities, warehouses, and/or distribution centers.

Likewise, it must designate a person responsible for supervising the loading or unloading of the shipment, even in accordance with instructions received from clients for its handling and transfer. On the other hand, it must supervise, inspect, and verify through mechanisms, tools, or non-intrusive technology available to it, the integrity of the transport means and the foreign trade merchandise entering or leaving the courier and package company, checking the information described in the exchange lists received previously in accordance with the traffic or transport modality in question.

Likewise, it must guarantee that the driver transporting foreign trade merchandise, during delivery or receipt, has the required documentary information before undergoing customs clearance formalities and authorizing its exit.

The cargo preparation areas and the immediate surrounding areas must be inspected regularly to ensure that these areas remain free of visible contamination by pests.

During the cargo loading and unloading process, the company's security area (supervisor or security guard) must be present to validate that the process is being carried out correctly, mitigate the risk of shipment contamination (prohibited, illicit merchandise, or pests), and record said review (incident reports, records, reports, etc.). As evidence that the high-security seal and/or lock was placed correctly, digital photographs must be taken at the time of loading the vehicles. Whenever possible, these images should be sent electronically to the destination or delivery contact point of the merchandise for verification purposes.

Also, the personnel responsible for the shipping and/or receiving area must review the information included in import and/or export documents to identify or recognize suspicious cargo shipments. Likewise, specific training must be provided on identifying common errors in export shipment documentation, with the aim of preventing these from resulting in security incidents or suspicious merchandise.

If the company has its own cargo transport, it must provide training to transport operators to review import and/or export documentation in order to identify or recognize suspicious cargo shipments, such as:
a) Originating or destined to unusual places; b) Different routes; c) Cash payments; d) Unusual shipping and/or receiving practices; e) Lack of information.

Response: Explanatory Notes:
Attach the documented procedure for cargo delivery and receipt, including the following:
a) Inspection method at the access point to the courier and package company. b) Designation of personnel responsible for receiving the driver and merchandise upon arrival. c) Coordination of the courier and package company areas that receive exchange lists from transporters prior to their arrival and with the customs offices where customs clearance formalities are fulfilled. d) Record of the introduction to the courier and package company of merchandise with full and consolidated cargo. e) Release deadlines. f) Prior requests.

g) Services offered by the courier and package company for the movement of merchandise prior to its customs clearance. h) How it guarantees that the transport means is free of visible pest contamination; if any type of visible pest, contamination, trash, insects, grass, weeds, or hay is identified, how it is reported and what actions are taken regarding it.

Attach the documented procedure to detect and report discrepancies in the delivery or receipt of transport means carrying merchandise, and ensure it includes the following points:
a) Persons responsible for carrying out the review. b) Documents to be checked. c) Areas to which the information is reported.

5.4 Cargo Tracking Procedure.
The courier and package company is responsible for monitoring and supervising the integrity of foreign trade merchandise throughout the supply chain; therefore, it must have documented procedures that establish the use of technology for the tracking and supervision of activities (during collection; arrival at its cargo consolidation centers, storage, custody, and release of foreign trade merchandise), with the aim of guaranteeing compliance with customs clearance formalities, ensuring at all times to have the following information: bill of lading number and information, packing list, waybill, or other transport documents, as applicable, name and address of the consignee or sender, description, value, and origin of the merchandise, physical location in the facility, among others, in accordance with applicable regulations.

For the purposes of tracking units via land, the company must include in the aforementioned procedure the identification of predetermined routes, estimated times for collection and delivery at warehouses and/or distribution centers or collection points, if applicable, and intermediate points. Likewise, it must describe the measures in case of identifying delays on the route due to weather conditions, traffic, route changes, authority inspections, or security-related incidents.

Supervision data and records of all maneuvers in the courier and package company, as well as route histories, must be preserved for one year in case the authority and/or transporter must conduct an evaluation due to a security incident.

Response: Explanatory Notes:
Attach the documented procedure to monitor internal transfers in the courier and package company of complete and/or consolidated foreign trade merchandise.

This procedure must include, among other aspects according to its operation:
a) Have GPS whose external hardware is hidden and can resist attempts to remove it; indicate the type of system implemented for the units used and, if applicable, the consultation tools available to monitor the merchandise. b) Identify predetermined routes, estimated delivery times, between intermediate points and maneuvers in courier and package companies according to the transport involved. Once the time between assigned points has been determined, there must be a tracking process (route audit) and corresponding records.

There must be systems or procedures with instructions in case of a delay in the route; likewise, drivers must notify their supervisor of any significant delay on the route due to weather, traffic, accidents, mechanical failures, route changes, etc. And on its part, the company must independently verify the cause of said delay.

c) Detail if you have a means to communicate with the transporter during its transfer and if you have more than one form of communication. d) If tracking is carried out by a third party, indicate who is responsible and how it is verified that it is being carried out correctly, in accordance with the procedures the company specifies. e) If the company has its own cargo transport, GPS or equivalent technology must be used to guarantee that the trailer is also monitored and tracked. Describe how you carry out this tracking. f) GPS records or route histories must be safeguarded for security incidents and audits.

5.5 Cargo Discrepancy Report.
There must be documented procedures to detect and report missing, excess, prohibited, or any other discrepancy in the delivery or receipt of merchandise collected prior to fulfilling customs clearance formalities, with the aim of having information that aids corresponding investigations by authorized consignees and, if applicable, by competent authorities. Likewise, it must describe the measures and actions to be taken in case of identifying the transfer and handling of illicit, undeclared, and prohibited merchandise or those that by their nature put user security at risk, which could occur during the following processes: receipt, delivery, warehouse for prior inspections, consolidated, de-consolidated, transport means yards, and if applicable, according to the services offered.

Response: Explanatory Notes:
Attach the documented procedure to detect and report discrepancies in the delivery or receipt of merchandise, and ensure it includes the following points:
a) Persons responsible for carrying out the review. b) Documents to be checked. c) Areas to which the information is reported.

This procedure must be applied to consolidated merchandise located in the warehouse.

5.6 Processing of Cargo Information and Documentation.
The courier and package company must have documented procedures to ensure that electronic and/or documentary information used during the movement, storage, custody, maneuvers, and dispatch of cargo, as well as information received from business associates, is legible, complete, accurate, reported in real-time, and protected against changes, loss, or introduction of erroneous information.

Likewise, there must be documented procedures to corroborate that the information received from business associates is reported accurately and timely.

Likewise, forms and documentation related to import and/or export should be secured to prevent unauthorized use.

Response: Explanatory Notes:
Describe the procedure for processing cargo documentation, ensuring you include the following points:
a) Detail how you transmit relevant information and documentation regarding the transfer and maneuvers of cargo, as well as all parties involved in the courier and package company's supply chain. Indicate if you use a specific computer control system and briefly explain its function. Likewise, detail how you validate that the provided information is legible, complete, accurate, reported in real-time, and protected against changes, loss, or introduction of erroneous information. b) The electronic information of shipments and cargo in general must include the seal and/or lock number with which the cargo was secured. c) Indicate how business associates transmit information to the courier and package company and ensure its accuracy, for example: the use of the institutional application "Consulta Remota de Pedimentos" to corroborate the payment of contributions and/or compensatory fees for exit authorization.

5.7 Inventory Management, Control of Packaging, Container, and Packing Material.
The courier and package company must have documented procedures for inventory control and cargo storage; these must involve periodic reviews and audits to prove their correct management. Likewise, it must have a documented procedure for the control of packaging, container, and packing material of merchandise, which must also include the control, dissemination, and prevention procedure of visible pest contamination, in the case of using wooden packing materials (such as pallets, boxes, crates, cages, spools, dunnage, chocks, supports, or platforms) to stack, move, and protect cargo throughout its entire supply chain.

Response: Explanatory Notes:
Attach the documented procedure for inventory management. This must include, among other aspects according to its operation:
a) The frequency with which it carries out stock verification (periodic inventory). Indicate if there is a documented scheduled calendar to carry them out.

b) Indicate what is done in the case of surpluses and shortages in inventories. c) Specify the treatment provided for the control and handling of packaging, container, and packaging material, and, where applicable, shrinkage, waste, or leftover material, which must also include the control, dissemination, and prevention procedure for visible pest contamination, in the case of the use of wooden packaging materials (such as pallets, boxes, crates, cages, spools, dunnage, supports, or platforms) for stacking, moving, and protecting the cargo. d) This point is also focused on reducing the risk of introduction or dissemination of pests of quarantine importance to the country through packaging (imports); therefore, describe how you comply with the provisions established by the Secretariat of Environment and Natural Resources (SEMARNAT) and NOM-144-SEMARNAT-2017, in accordance with International Phytosanitary Measure No. 15 entitled Regulation of Wood Packaging Material Used in International Trade, which emanate from the Food and Agriculture Organization of the United Nations. e) Specify how the fumigation process is carried out to kill, inactivate, sterilize, desiccate, or eliminate pests. What actions do you take if quarantine of packaging materials is required? f) Indicate the area or person responsible for carrying out this process, as well as the documentation or certificates obtained. The applicant's procedures may include:
a) Warehouse accessible only to authorized personnel. b) Frequency of inventory control. c) Control of incoming goods, transfers to other warehouses, permanent and temporary withdrawals. d) Actions taken if irregularities, discrepancies, losses, or thefts are identified. e) Treatment of deterioration or destruction of goods. f) Separation of various types of goods, for example: high value or hazardous.

Customs Management.
The courier and package company must have documented procedures that establish internal and operational policies, as well as the necessary controls for the due compliance of customs obligations.
Likewise, it must have specialized personnel and documented procedures that establish the verification of information and documentation generated by the customs broker or, where applicable, ensure the processes carried out by the customs representative.

6.1 Customs Clearance Management.
The courier and package company must have a documented procedure that establishes the criteria for the selection of a customs broker or, where applicable, a customs representative, who, in accordance with national legislation, are authorized to promote the clearance of goods on behalf of others. Response: Explanatory Notes:
Describe the selection and evaluation procedure of the customs broker or customs representative and ensure it includes the following points:
a) Selection criteria. b) Evaluation methods and frequency. c) Describe the indicators with which you evaluate the service of customs brokers.
Indicate the full name and the patent and/or authorization number of the customs broker or customs representative authorized to promote your foreign trade operations.

6.2 Customs Obligations.
The courier and package company must have a documented procedure for the compliance of customs obligations arising from the foreign trade operations it carries out. This must include at least the following: the communication process with customs authorities when they are aware of the transfer and custody of values higher than those determined by the authority in accordance with Article 9 of the Law. The transmission of cargo manifests through the SEA (Digital Counter) and the established deadlines, in accordance with Article 38 of the Law Regulations and Rule 1.9.15.; notices in cases of destruction, loss, and decomposition of goods; the customs clearance process through the legal representative of the courier company whenever they do not exceed the determined amounts, the established exceptions, and the determination of payment of the global rate that corresponds. For cases where it provides the service of electronic pre-validation of data, establish how it complies with the obligations foreseen in Rule 1.8.2; the notices that must be sent to the authorities regarding explosive goods and firearms; the updating of data in the CAAT registry and its frequency. The processes for the return of goods when they are in deposit with customs; regarding the use of the generic RFC in case of global operations and the use of RFC for individual operations. In addition to the above, the courier and package company, if it has authorization as a Strategic Fiscalized Facility, Fiscal Deposit, or for manufacturing, transformation, or repair in a Fiscalized Facility, must have a documented procedure for the compliance of customs obligations arising from the foreign trade operations it handles. This must include at least the following: a) the annual guarantee that must be paid to the fiscal interest in accordance with the average value of the goods it handles; b) The identification of the physical space for the customs inspection carried out by customs authorities; c) the physical space designated for handling, storage, and custody services regarding goods that have become property of the federal treasury; d) the free storage and custody of goods in accordance with the regulations; e) process for the transfer of goods between warehouses; f) process to prove payment of revenues for being a fiscalized facility; g) regarding the authorization for goods to be subject to manufacturing, transformation, or repair, where applicable. On the other hand, it must include in the procedure, the communication process with consignees in case of destruction or loss of goods; guarantee the exchange of information through a simultaneous system containing the data indicated in Rule 2.3.8 and establish protocols related to the treatment, communication, storage, and custody of foreign trade goods under the internal transit regime. Response: Explanatory Notes:
Attach the procedure to comply with your customs obligations.

6.3 Customs Verification.
The courier and package company, in order to guarantee the compliance of the information of the operations for the customs clearance of foreign trade goods, as well as to verify the truthfulness of the information declared to the competent authorities, must have documented procedures to verify that the customs declarations it receives for its release processing from the company match what is registered in SAAI Web and, where applicable, report to the customs authority any discrepancy in said information. The company, likewise, must have a procedure for the filing of the corresponding release records. Response: Explanatory Notes:
Attach the established procedure to verify the information registered in SAAI Web, and cross-check that contributions and/or compensatory quotas had been paid prior to the release of the shipments to be subject to the formalities of customs clearance.

Security of cargo vehicles, containers, trailers, and/or semi-trailers.
The courier and package company must maintain the security of the means of transport, tractors, containers, trailers, and semi-trailers (including cargo vehicles, such as pickup trucks, vans, or vans, among others), to protect them from the introduction of unauthorized persons and/or materials. For this reason, it is necessary to have documented procedures to inspect, seal, and maintain their integrity. Likewise, the inspection process of said means of transport, tractors, containers, trailers, and semi-trailers (including cargo vehicles, such as pickup trucks, vans, or vans, among others), used as Instruments of International Traffic, must include an agricultural inspection procedure to look for visible pests and serious structural deficiencies. Pest contamination is defined as visible forms of animals, insects, or other invertebrates (living or dead, at any stage of the life cycle, including eggs, etc.), or any organic material of animal origin (including blood, bones, hair, meat, secretions, excretions, etc.); plants or plant products (including fruits, seeds, leaves, twigs, roots, bark, etc.); or other organic material, including fungi, soil, or water; when such products are not the declared cargo within the Instruments of International Traffic. In the event of using high-security seals, it is necessary to have procedures to correctly seal and maintain the integrity of containers and trailers from the moment they leave your facilities. A high-security seal must be applied to all containers and trailers for foreign trade shipments, which must comply with or exceed the ISO 17712 Standard for high-security seals. With the objective of maintaining supply chain security, the courier and package company must inspect all cargo vehicles systematically upon entry and exit from its facilities (domestic and international traffic), in addition to keeping a record.

7.1 Use of seals and/or padlocks.
The courier and package company, where applicable, must identify the means of transport of its own or subcontracted cargo that transport foreign trade goods that may be: maritime, air, national land, cross-border, railway, and/or multimodal that are subject to the placement of seals and/or padlocks that comply with or exceed the ISO 17712 Standard with the aim of guaranteeing at all times the integrity of the cargo. For this reason, as one of the security mechanisms, the fiscalized facility, where applicable, must use high-security padlocks or seals that comply with or exceed the ISO 17712 Standard on all containers and trailers loaded for foreign trade and maintain their integrity until delivery at the final destination. For this, the facility must have documented procedures to place and verify the correct application of seals, their inspection at intermediate points, final destination, and their replacement when they are opened by any authority. In the event of such an inspection, drivers must notify and register any anomaly or unusual structural modification found in the means of transport derived from said review. The procedures must include the steps to follow if it is discovered that a seal is altered, manipulated, or there is an incorrect seal number in the documentation, the communication protocols to the commercial partners involved in the supply chain, and the investigation of the security incident; these must be notified to security personnel, commercial partners who may be part of the affected supply chain, security specialist, or contact of the Authorized Economic Operator Program. Likewise, it is necessary to have a documented procedure for their administration that includes control, assignment, safeguarding, handling of discrepancies, and destruction of seals and padlocks (the latter is mandatory whenever seals are broken in your facilities). Regarding the provider of the seals and/or padlocks, it must be demonstrated how these comply with the ISO 17712 Standard. The company's management or a security supervisor must carry out periodic and documented audits of the high-security seals and/or padlocks; these reviews must include the verification of the inventory of stored seals and/or padlocks and the cross-check with inventory records and shipping documents. Also, the supervisors of the shipping area and/or warehouse managers must periodically verify the seal numbers used in the means of transport and Instruments of International Traffic to corroborate that the information is correct.

For this case, the courier and package company must have a documented procedure in which, in accordance with its risk analysis, it supervises the placement of seals and/or padlocks on the means of transport that transport foreign trade goods in accordance with its logistics process and in those traffics that require it due to their high probability of occurrence and impact of the identified risk. In it, it must evidence controls that allow accrediting that it supervises the portability of seals and/or padlocks derived from entries or exits of the strategic fiscalized facility in the means of transport. In all cases, it must use the VVTT inspection method to mitigate improper manipulations in accordance with the following:
a) V- View the seal and lock mechanisms of the container. b) V- Verify the seal number. c) T- Pull the seal to ensure it is correctly placed. d) T- Twist and turn the seal to ensure.
Response: Explanatory Notes:
List, according to your risk analysis and logistics process, the means of transport that are subject to the placement of high-security seals and/or padlocks.
Attach the documented procedure for the placement and review of seals and/or padlocks on the means of transport that transport foreign trade goods. This must include, among other aspects according to your operation:
a) Verify that the seal or padlock is intact and determine if there is evidence of improper manipulation. b) In the event of using high-security padlocks, of the bottle type, use the VVTT inspection method.

V- View the seal and lock mechanisms of the container (View).
V- Verify the seal number (Verify).
T- Pull the seal to ensure it is correctly placed (Tug).
T- Twist and turn the seal to ensure it has closed (Twist and Turn).
c) Review and cross-check the documentation containing the number of the original seal or padlock and, where applicable, the additional ones for purposes of entries or exits of the courier and package company. d) Review that the closing devices, hinges, and pins are attached to the trailer or container and welded or riveted. Also, protective plates can be placed on the door hinges and/or a seal/adhesive tape can be placed on at least each side. Also, the correct functioning of handles, latches, and all other locking or closing mechanisms of the cargo vehicles must be verified to detect manipulations and any inconsistency before placing any sealing device.

e) Indicate how you assign and replace high-security padlocks, in the case of maneuvers such as prior inspection, replacement, among others.
Where applicable, attach the documented procedure for the control and handling of seals and/or padlocks; this must include, among other aspects according to your operation:
a) What type of seals and/or padlocks you use in your operations (foreign trade, transit, storage, etc.). b) Who has access and how padlocks and/or seals are safeguarded. The management of seals and/or padlocks must be restricted only to authorized personnel; stored in a secure place, have an inventory, control of their distribution and tracking (record of seals used, as well as the receipt of new seals and/or padlocks. c) Describe how the company's management or the security supervisor participates in the audits of high-security seals and/or padlocks, the reviews they perform, the records they generate, and the actions they take in case of identifying discrepancies. Also, how the supervisors of the shipping area and/or warehouse managers verify the seal numbers used in the means of transport and Instruments of International Traffic to corroborate that the information is correct (this process can also be included within the internal audits referred to in sub-standard 1.3 of this document). d) How discrepancies in seal and/or padlock numbers are addressed. e) Indicate who the supplier(s) is/are and how it proves that the specifications of the seals and/or padlocks comply with the ISO 17712 Standard (attach certificate issued by the certifying company responsible for verifying compliance with the corresponding ISO). All written procedures must be disseminated and maintained at the operational level so that they are easily accessible to employees responsible for executing the tasks described above, reviewed at least once a year, and updated as necessary.

7.2 Inspection of means of transport, containers, trailers, and semi-trailers.
There must be established procedures to verify the physical integrity of the structure of the means of transport, container, train cars, trailers, and/or semi-trailers used as Instruments of International Traffic, that enter or leave the courier and package company in accordance with their nature, even the reliability of the door lock mechanisms, with the aim of identifying natural or hidden compartments. The inspections of the means of transport must be systematic and carried out upon entry and exit from the company, and where applicable, at the cargo loading point, using the VVTT inspection method. A record of these inspections must be kept in an area with controlled access and carried out in a place monitored by closed-circuit television and video surveillance systems; said system must cover the inspection process in its entirety. The documented procedure for its inspection must include, by way of example and not limitation, the following review points:
Means of Transport Trailers, Train Cars, Semi-trailers, and Containers
1. Bumper.
2. Tires and rims (tractor and trailer).
3. Floor (tractor).
4. Fuel tanks.
5. Cab interior (bedroom and tool compartment).
6. Air tanks.
7. Chassis.
8. Fifth wheel area.
9. Drive axles.
10. Exhaust pipe.
11. Engine.
1. Exterior and interior doors.
2. Side walls (left and right).
3. Internal and external roofs.
4. Front wall.
5. Internal Floor.
6. Where applicable, the refrigeration system.
For means of transport with a trailer or integrated cargo compartment, the points indicated in the trailers section must be added to the means of transport points.
Likewise, before loading the means of transport, containers, train cars, trailers, and semi-trailers used as Instruments of International Traffic, they must undergo agricultural and security inspections to guarantee that their structures have not been modified to hide contraband or that they have been contaminated with visible agricultural pests, keep a record, and be backed by a documented procedure. If visible pest contamination is found during the inspection or transport of foreign trade goods, it must be cleaned (washed, vacuumed, etc.) to eliminate said contamination. Response: Explanatory Notes:
Attach the documented procedure to carry out the security and agricultural inspection of the means of transport in accordance with their nature and logistics process that is dealt with in the entries and exits of the courier and package company.
This must include, among other aspects according to your operation:
a) Persons responsible for carrying out the inspection. b) Definition of the place(s) where the inspection is carried out and indicate how the monitoring is performed by alarm systems and closed-circuit television and video surveillance.

c) The security review points for means of transport, trailers, semi-trailers, containers, railway transportation, and/or multimodal, both for security and those for quality and agricultural inspections with the aim of looking for visible pests. d) Instructions for the driver to ensure that the cab is clean and free of garbage before crossing. Attach the established format for the inspection of means of transport or cargo vehicles, containers, trailers, and/or semi-trailers. If you use other types of cargo vehicles for the transport of your goods (vans, pickups, 3.5 tons, tankers, etc.), your procedure and inspection format must include the process and review points. Likewise, the security and agricultural inspection format must include the following information:
a) Date of inspection; b) Time of inspection; c) Vehicle license plates (tractor and trailer); d) Container/trailer number; e) Specific areas of the cargo vehicles that were inspected; and, f) Name and signature of the employee who performs the inspection and of the supervisor.
The security and agricultural inspection formats may be signed by the supervisor to corroborate their information and be part of the import and export documentation.
The documentation must be kept for one year for an investigation in the event of any security incident, as well as to demonstrate continuous compliance with these inspection requirements.
Additionally, and based on the risk analysis, the courier and package company should carry out periodic random reviews of cargo vehicles, after the transport personnel has carried out security inspections to verify that they have been carried out correctly, counter internal conspiracies, and prevent security incidents. The reviews must be carried out randomly, without prior notice, so that they do not become predictable, in addition to being carried out in different places where the means of transport may be susceptible to contamination.

7.3 Storage of vehicles, means of transport, containers, train cars, trailers, and semi-trailers.
In the event that the means of transport, containers, trailers, and/or semi-trailers intended to transport foreign trade goods are empty and must be stored in parking areas, they must be secured with a padlock and/or indicative seal, or, in their case, in a secure area that is guarded and/or monitored. When it is necessary to store or overnight any loaded container, trailer, and/or semi-trailer, it must be located in a secure area with physical barriers and monitored by alarm systems, closed-circuit television, and video surveillance to prevent unauthorized access and manipulation of the cargo; therefore, it must be closed with a high-security padlock in accordance with ISO 17712 Standard. When the cargo is stored overnight or for an extended period, measures must be taken to secure the cargo against unauthorized access. Response: Explanatory Notes:
Indicate whether the company stores containers, trailers, and/or semi-trailers for subsequent dispatch, or, in their case, those that are empty, and how it maintains their integrity within its facilities. a) In the event of using padlocks and/or seals, indicate what type is used. b) In the event of using any containers, trailers, and/or semi-trailers as storage for raw materials and/or any other type of goods, indicate how it maintains their integrity and security.
8. Personnel Security.
The courier and package company must have documented procedures for the registration and evaluation of individuals seeking employment within the courier and package company, and establish methods to conduct periodic verifications of current employees.
Furthermore, there must be continuous training programs for personnel that disseminate the courier and package company's security policies, as well as the consequences and actions to be considered in the event of any security breach or incident.
8.1 Verification of work history.
The courier and package company must have documented procedures to investigate and verify the information stated in the curriculum vitae, criminal records (if local legislation and company policies allow), and applications of candidates with potential for employment, in accordance with local legislation, either independently or through an external company. Similarly, for positions that require it due to their sensitivity and affect the security of shipments, in accordance with the previously conducted risk analysis, stricter requirements for hiring must be considered, which must be carried out periodically. Regarding personnel already working in the company, periodic investigations must be conducted based on the functions and/or sensitivity of the employee's position. All information regarding personnel must be kept in personal files, which must have restricted access.

Response: Explanatory Notes:
Describe the documented procedure for hiring personnel, and ensure to include the following:
a) Requirements and documentation demanded. b) Tests and exams requested.
Indicate the areas and/or critical positions identified as risky, according to your analysis, and indicate the following:
a) Indicate if there are additional requirements for specific areas and/or work positions, such as criminal records (if legislation and company policies allow), socioeconomic studies, clinical studies, toxicological (drug use) studies, etc. In their case, indicate the positions or work areas where they are required and with what frequency they are carried out. b) Indicate if, prior to hiring, the candidate must sign a confidentiality agreement or a similar document. In the event of hiring a service agency for personnel hiring, indicate if it has documented procedures for personnel hiring and how it ensures compliance with the same. Briefly explain what they consist of. The procedures for personnel hiring and contractors may include:
a) Exhaustive investigations of the work and personal backgrounds of new employees. b) Confidentiality and liability clauses in employee contracts. c) Specific requirements for critical positions. d) In their case, the periodic update of the socioeconomic and physical/medical study of employees working in critical and/or sensitive areas. e) Hiring process and requirements requested for temporary employees and contractors. The company may consider the results of background checks on candidates, as permitted by current legislation, to make hiring decisions. Background checks are not limited to identity and criminal record verification. In higher-risk areas, deeper investigations may be justified.

8.2 Procedure for personnel dismissal.
There must be documented procedures for personnel dismissal, which include the delivery of identification and any other item provided to perform their functions (keys, uniforms, badges and/or credentials, computer equipment, passwords, tools, etc.). Likewise, this procedure must include the deactivation in those computer systems and access systems, among others that may exist. Response: Explanatory Notes:
Describe the procedure for personnel dismissal and ensure to include the following:
a) Who is responsible for carrying out and following up on this procedure. b) How the delivery of identification, uniforms, keys, and other equipment is carried out and confirmed. c) Indicate the control, record, and/or format in which the delivery of material and deactivation in computer systems (in their case, attach) is identified and ensured. d) Specify the type of records of personnel who ended their employment relationship with the company, so that in case it was for security reasons, their service providers and/or business associates are warned.
8.3 Personnel administration.
The courier and package company must maintain an updated system, control, or database of active employees. Likewise, it must carry out and maintain updated records of affiliation to social security institutions and other legal labor records.
In the event that the company has personnel hired by its commercial partners and working within the facilities, it must ensure that they comply with the requirements established for the rest of its employees.
Response: Explanatory Notes:
Indicate if the courier and package company has an updated system, control, or database, both for personnel hired directly and that hired through a service provider company, and ensure it includes, among other things, the following points:
a) Full name. b) Updated photograph at least every five years. c) Personal data (age, name, date of birth, phone number, address, CURP, social security number, blood type, allergies, etc.). d) Affiliation. e) Work history. f) Diseases. g) Medical exams. h) Training. i) Psychometric exams. j) Toxicological exams. k) Results of periodic evaluations. l) Observations. This personnel must be hired in accordance with current labor laws and regulations.

Information and Documentation Security.
There must be prevention measures to maintain the confidentiality and integrity of information and documentation related to foreign trade operations, including those used for the exchange of information with other members of the supply chain. Likewise, there must be comprehensive documented policies and/or procedures to protect Information Technology systems, which include measures against misuse as well as identifying and prioritizing actions to reduce cybersecurity risk. They may also address how a member shares information about cybersecurity threats with the government and other commercial partners.
9.1 Classification and handling of documents.
There must be procedures to classify documents according to their sensitivity and/or importance. Sensitive and important documentation must be stored in a secure area that only allows access to authorized personnel. The useful life of the documentation must be identified, and procedures for its destruction must be established. The company must conduct regular reviews to verify access to information and ensure that it is not used improperly. Response: Explanatory Notes:
Attach the documented procedure for the registration, control, and storage of printed and electronic documentation (classification and filing of documents), which must include:
a) Control register for delivery, loan, among other documents. b) Restricted access to the archive area. c) Storage and classification policies. d) An updated security plan describing the measures in force regarding the protection of documents against unauthorized access, as well as against deliberate destruction or loss of the same. e) In the case of electronic or digital information, it must adhere to the security criteria of sub-standard 9.2. Information Technology Security.
9.2 Information Technology Security.
To protect Information Technology systems against common cybersecurity threats, a company must have sufficient protection that promotes security in Information Technology infrastructure (software and hardware) against malware (viruses, spyware, worms, trojans, etc.), baiting, phishing, and internal/external intrusions (firewalls) in the companies' computer systems. Likewise, companies must ensure that their security software is active and receives periodic updates. In the case of automated systems and computer equipment, individual accounts that require periodic password changes must be used. In order to protect the confidentiality, integrity, and availability of information, the courier and package company must have established information technology policies, procedures, and standards that must be communicated through a training program for all employees who handle computer equipment and systems, which includes topics to prevent attacks through social engineering and all those threats to which they are exposed (malware, baiting, phishing, etc.). Companies that allow their employees to connect remotely to a network must employ secure technologies, such as virtual private networks (VPN), to allow employees to access the company intranet securely when they are outside the office, as well as procedures designed to prevent unauthorized remote access. For the above, there must be written procedures and infrastructure to protect the company against information loss, which includes the procedure for the recovery (or replacement) of Information Technology systems and/or data, as well as a system or software established to identify the abuse of information technology systems and detect inappropriate access and/or improper manipulation or alteration of commercial and business data, as well as a written procedure for the application of appropriate disciplinary measures to all offenders. Access to Information Technology systems must be protected against infiltration through the use of secure passwords, which include phrases or other forms of authentication. Users of said Information Technology systems must safeguard and not share their access keys or passwords. All Information Technology infrastructure must be physically protected against unauthorized access. If a data leak or other unexpected event occurs resulting in the loss of data and/or equipment, the procedures must include the recovery or replacement of Information Technology systems and/or data.

Response: Explanatory Notes:
Attach the procedure for the recovery or replacement of Information Technology systems and/or data, which includes how it backs up and ensures the security of its information, in addition to protecting it from possible losses. Ensure to include the following points:
a) Specify the frequency with which backups are carried out. b) Who has access to them, and who authorizes the recovery of information. c) Indicate what type of tests it performs and how often, to verify the security of the network, systems, and infrastructure. d) Mention if, to carry out this type of tests or vulnerability scans, it does so through software, a third party, or provider, and, in their case, indicate the name or corporate name. e) In the event of finding vulnerabilities, describe the corrective actions that must be implemented. f) Indicate if it shares information about cybersecurity threats with its commercial partners participating in its supply chain (for example: press releases, bulletins, emails, etc.). g) Systems must be protected by passwords and must be modified frequently; therefore, indicate the procedure for changing them. h) Specify if there are information security policies for their protection. i) There must be a system or software to detect, identify the abuse, intrusion, or access of unauthorized persons to its systems and/or information technology data, as well as the abuse of policies and procedures established by the company, including improper access to internal systems, external websites, and the manipulation or alteration of commercial data by employees or contractors. j) All offenders must be subject to the application of disciplinary measures; therefore, indicate the corrective policies and/or sanctions in the event of the detection of any violation of Information Technology security systems and policies.

Describe the security measures used to allow employees to connect remotely to a network (VPN), to allow employees to access the company intranet remotely when they are outside the office.
In the event of allowing employees to use personal devices to perform company work, such devices must comply with the company's cybersecurity policies and procedures, security updates must be periodic, and there must be a method to access the company network securely.
Specify if commercial partners have access to the company's computer systems. In their case, indicate what programs they use and how they ensure control over access to them.
Indicate if the computer equipment has a backup power supply system that allows business continuity.
The procedures regarding the backup of the courier and package company's information must also include:
a) How and for how long the data is stored (data should be backed up once a week or as appropriate). b) Business continuity plan in case of incident and how to recover the information. c) Frequency and location of backups and archived information. d) If backups are stored in sites alternative to the facilities where the data processing center is located. e) Tests of the validity of data recovery from backups. The procedures regarding the protection of the courier and package company's information must also include:
a) An updated and documented policy for the protection of computer systems against unauthorized access and deliberate destruction or loss of information. All sensitive and confidential data must be stored in an encrypted or encoded format. b) Detail if it operates with multiple systems (headquarters/sites) and how such systems are controlled. c) Who is responsible for the protection of the computer system (responsibility should not be limited to one person but to several so that each can control the actions of the rest).

d) Each user's access must be assigned through individual accounts and restricted according to the job description or assigned tasks. For the above, describe how access authorizations and access levels to computer systems are granted (access to sensitive information must be limited to personnel authorized to make modifications and use the information). Authorized access must be monitored by the area responsible for granting it, to verify or, in its case, report that access to confidential systems is based on job requirements. e) Indicate the elements or format that passwords for accessing Information Technology systems and computer equipment must have, frequency of changes, if there are other authentication methods, and who or what area provides those passwords. f) Indicate the name of the "firewall" and anti-virus used (include licensing-related information), evidencing that this security software is active and receives periodic updates. For the above, cybersecurity policies and procedures should include measures to prevent the use of counterfeit technological products or those with incorrect licenses (software and hardware). All computer equipment, electronic media (hard drives, cell phones, etc.), and Information Technology hardware containing confidential information related to the import and export process must be accounted for through periodic inventories and have such evidence. When these technological equipment must be disposed of, there must be a documented procedure that includes how they must be formatted, disinfected, or destroyed appropriately to avoid information leakage. g) In the event of personnel dismissal, access to computer equipment, telecommunications, and the network must be eliminated at the moment of the employee's separation; this includes email accounts, system access accounts, software, programs, etc. h) Measures planned to handle incidents in case the system is compromised.

Security training and awareness.
The company must have a threat awareness program document designed by the Security Committee to recognize and create awareness of threats from terrorists and smugglers at each point in the supply chain. The training program must be comprehensive and cover all security requirements of the Authorized Economic Operator Program. Administrative and operational employees must be aware of the established procedures of the courier and package company to identify a risk situation and know how to report it. Specific training must be provided to employees who, due to their functions, are in direct contact with goods and/or transport means, as well as to employees who are in critical and/or sensitive areas determined under their risk analysis (security areas, loading and unloading; as well as those who receive and open courier and package services, among others).

10.1 Training and awareness on threats.
The courier and package company must have a training and awareness program on security policies in the supply chain directed to all its employees, and additionally, make available informational material regarding the established procedures in the company to identify a situation that threatens its security and know how to report it. Similarly, specific training must be offered according to their functions to help employees maintain cargo integrity, perform inspections of containers, trailers, and/or semi-trailers for agricultural and security purposes, receive and inspect courier and package services, prevent operations with proceeds of illicit origin (money laundering, terrorism financing, etc.), how to recognize and report internal conspiracies, protect access controls, as well as training regarding smuggling, cargo theft, placement of high-security seals and locks (VVTT inspection method), prevention of visible contamination by pests, etc. These topics must be established as part of new employee onboarding and periodically maintain update programs. Update training must be carried out periodically, after a security incident, and when there are changes in the company's procedures. In addition to security training programs, an awareness program on alcohol and drug consumption must be included. Also, disseminate and train staff on the company's cybersecurity policies, procedures, and standards (theft, data leak, hacking, and/or information kidnapping), including access to computing equipment and systems via passwords or phrases. Personnel who operate and administer security technology systems must receive training related to their operation and maintenance, including self-training through operational manuals and other methods. These topics must be established as part of new employee onboarding and periodically maintain update programs. Training programs must encourage active employee participation in security controls and mechanisms, as well as maintain records of all training efforts provided by the company and the list of those who participated in them (videos, photographs, minutes, attendance lists, intranet or other system, didactic material, PowerPoint presentations, brochures, etc.). Training records must include the date of the training, the names of attendees, the topics taught, as well as measures to verify that the training provided met all training objectives.

Response: Explanatory Notes:
Must have a training program on security and prevention of security incidents in the supply chain for all employees working for the company (administrative, operational, direct, indirect).
Briefly explain what it consists of, and ensure to include the following:
a) Brief description of the topics taught in the program. b) When they are taught (onboarding, specific periods, resulting from audits, security incidents, etc.). c) Frequency of training, as well as updates and reinforcement. d) Indicate how participation in supply chain security training is documented (videos, photographs, minutes, attendance lists, intranet or other system, didactic material, PowerPoint presentations, brochures, etc.). Records must include the date of the training, the names of attendees, the topics taught, as well as measures to verify that the training provided met all objectives of the same. e) Explain how employee participation in security matters is encouraged. Training to perform inspections of cargo vehicles, containers, trailers, and/or semi-trailers for agricultural and security purposes must include the following topics:
a) Signs of hidden compartments. b) Smuggling hidden in natural compartments. c) Signs of pest contamination. d) Procedures to follow if something is found during a transport medium inspection or if a security incident occurs during transit. e) Agricultural review training must cover pest prevention measures, regulatory requirements applicable to wooden packaging materials in accordance with International Phytosanitary Measures Standard No. 15, titled Regulation of Wood Packaging Used in International Trade, which emanate from the Food and Agriculture Organization of the United Nations, and the identification of infested wood.

10.2 Awareness for transport medium operators.
The courier and package company must inform the operators of the transport means it uses for the transfer of goods originating from or destined for foreign trade, regarding security policies concerning agricultural and security inspection procedures of cargo loading and unloading transport means, incident management, lock changes in case of inspection by other authorities, among others, that are implemented. Operators and personnel who perform agricultural and security inspections of transport means must be trained to inspect cargo vehicles for such purposes. In the case where the transport service is provided by a business partner, the company must ensure that operators know all established security policies and procedures.

Response: Explanatory Notes:
Describe the dissemination program on security in the supply chain focused on transport medium operators and ensure to include the following:
a) Indicate how this dissemination is carried out. b) Point out the topics covered. c) In case of using the services of a business partner for the transfer of goods, indicate how operators are informed of the company's security policies and procedures. d) Indicate how participation in supply chain security training of transport medium operators is documented (videos, attendance lists, brochures, etc.). The topics that must be included, in an illustrative but not exhaustive manner, are:
a) Access and security policies at facilities. b) Delivery-receipt of goods (including suspicious cargo shipments). c) Confidentiality of cargo information. d) Transfer instructions. e) Accident and emergency reports. f) Instructions for placing high-security locks and/or seals in case of inspection by other authorities, as well as the control and use of high-security seals and locks in transit (placement of a new one, inspection after any authorized stop, etc.). g) Installation and testing of security alarms and unit tracking, where applicable. h) Identification of authorized formats and documents to be used. i) Signs of hidden compartments. j) Smuggling hidden in natural compartments. k) Signs of pest contamination. l) Procedures to follow if something is found during a transport medium inspection or if a security incident occurs during transit.

Handling and investigation of incidents.
There must be documented procedures to report and investigate security incidents in the supply chain, the actions to be taken to prevent their recurrence, as well as to notify security personnel, business partners who may be part of the affected supply chain, security specialist or Authorized Economic Operator Program contact, and other competent authorities. Reporting and investigation procedures must include updated contact information or directory listing the names and phone numbers of personnel requiring notification. The investigation and analysis of incidents must be documented (physical and/or electronic file) as well as corrective actions to prevent them from occurring again, which must be implemented as soon as possible. In the case where the courier and package company identifies that any of its foreign trade shipments is involved in a situation that puts the supply chain security at risk, due to suspicion of a business partner or person, it must inform security personnel, business partners who may be part of the affected supply chain, security specialist or Authorized Economic Operator Program contact, as well as the competent authority, and, if possible, before the border crossing, exit, or dispatch (import and export). Procedures must include the steps to follow if it is discovered that a seal is altered, manipulated, or there is an incorrect seal number in the documentation, the communication protocols to involved business partners in the supply chain, and the investigation of the incident. All the aforementioned procedures must be reviewed periodically or at least once a year to ensure that contact information and action protocols are correct.

11.1 Reporting of anomalies and/or suspicious activities.
In the event of detection of anomalies and/or suspicious activities related to supply chain security and in accordance with its logistical processes (related to access control, delivery, receipt, and storage of goods, security inspections of cargo vehicles and transport operators, etc.), these must be reported to security personnel, business partners who may be part of the affected supply chain, security specialist or Authorized Economic Operator Program contact, and other competent authorities, keeping a record of such anomalies and/or unusual activities.

Response: Explanatory Notes:
Describe the procedure to denounce or report anomalies and/or suspicious activities, as well as the mechanisms to anonymously inform about security-related problems, ensure to include the following:
a) Who is responsible for reporting incidents. b) Detail how it determines and identifies with which authority to communicate in different scenarios or presumption of suspicious activities. c) Mention if it keeps a record of reporting these activities and/or suspicions and briefly describe what it consists of.

11.2 Investigation and analysis.
There must be written procedures to denounce or report anomalies and/or suspicious activities, as well as for the analysis and investigation of security incidents in the supply chain to determine their cause, as well as corrective actions to prevent them from occurring again, which must be implemented as soon as possible. The information derived from this investigation must be documented and available at all times for authorities that require it. This information must include the documentation generated to carry out the foreign trade operation of the affected goods, which will allow identifying each of the processes the goods went through, up to the point where the incidence was detected, and allowing recognition of the supply chain's vulnerability.

Response: Explanatory Notes:
Describe the documented procedure to initiate an investigation in case of any incident occurring, and ensure to include the following:
a) Responsible for carrying out the investigation. b) Documentation that integrates the security incident investigation file.
The documents to be included in the file resulting from the investigation, in an illustrative but not exhaustive manner, may be:
a) General information of the shipment, service order. b) Transport request; confirmation of transport medium; identification of transport operator (access records, exit records, security inspection records, etc.). c) Transport medium inspection formats; exit orders; records of collection, delivery, and receipt of foreign trade goods. d) Videotapes from closed-circuit television and video surveillance systems. e) Documentation generated for the carrier (bill of lading, waybill, instruction sheet). f) Documentation generated for business partners (service order, description of goods, proformas, CFDI or equivalent documents, etc.). g) Documentation generated by business partners and customs authorities. h) Unit tracking and monitoring report (GPS tracking).

E7.
Profile of the Authorized Customs Warehouse.
Acknowledgment of Receipt
First Time: Renewal:
Addition:
Modification:
The data provided will replace the data provided when requesting authorization.
General Information
The objective of this Profile is to ensure that authorized customs warehouses have security practices and processes implemented at their facilities, focused on strengthening the supply chain and mitigating the risk of contamination of shipments with illicit products.
Authorized customs warehouses interested in obtaining the authorization referred to in Rule 7.1.5, must demonstrate that they have documented and verifiable processes; likewise, they must integrate the criteria required in this document according to the business model or design they have established, seeking during the implementation of security standards, the application of a risk analysis culture supported by decision-making in accordance with the values, mission, vision, codes of ethics, and conduct of the company itself. What is established in this Profile must be accredited independently of the requirements and provisions established for the control, surveillance, access routes, infrastructure, equipment, and security of foreign trade goods established by ANAM, to grant the Authorized Customs Warehouse authorization, and compliance with what coincides with what is established in this Profile can be proven. Filling Instructions:
1. You must fill out an Authorized Customs Warehouse Profile for each of the facilities that have a concession or authorization as an authorized customs warehouse. The number of Profiles presented must coincide with the facilities that have a concession or authorization to provide handling, storage, and custody services for foreign trade goods in accordance with articles 14 and 14-A of the Law, manifested in your application for registration as a certified business partner under the authorized customs warehouse modality, as well as indicating all domiciles registered with the RFC.
2. In each sub-standard, the authorized customs warehouse must detail how it complies with or exceeds what is established in each of the sections as indicated.
3. The format of this document is divided into two sections, as detailed below:
1. Standard.
Description of the standard
1.1 Sub-standard.
Description of the sub-standard
Response. Explanatory Notes
Describe and/or attach... a) Points to highlight...

4. Indicate how you comply with what is established in each of the sub-standards, therefore you must attach the procedures in Spanish that are required, if applicable, or provide a detailed explanation of what is requested in the Response field.
The section regarding Explanatory Notes is intended to be used as a guide regarding the points that must be included in the Response or in the attached procedures, as appropriate, of each sub-standard, indicating in an indicative manner those points that should not be excluded from your response.
5. Once this Authorized Customs Warehouse Profile is answered, you must attach it to the Application for registration in the Certified Business Partner Registry referred to in the first paragraph of Rule 7.1.5, fraction V, subsection b.
For the purpose of verifying what is stated in the previous paragraph, the SAT through the AGACE may carry out an inspection of the installation indicated here, with the exclusive purpose of verifying what is stated in this document.
6. Any incomplete Authorized Customs Warehouse Profile will not be processed.
7. Any question related to the Application for registration and the Authorized Customs Warehouse Profile should be directed to the contacts appearing on the SAT Portal.
8. In the event of being authorized as a Certified Business Partner, this format must be kept updated and notify when the circumstances under which the registration was granted have varied and as a result changes or modifications are required in the information stated and provided in this Authorized Customs Warehouse Profile to the authority in accordance with what is established in Rule 7.2.1, fourth paragraph, fractions I, II, and VII.
9. When, as a result of the inspection visit, non-compliance with minimum security standards results, the applicant may remedy them before the issuance of the resolution established in Rule 7.1.6, for which they will have a maximum period of three months counted from the notification of the indicated non-compliances.
Installation Data
An Authorized Customs Warehouse Profile must be filled out for each of the installations that belong to and operate under the concession or authorization of authorized customs warehouse and that provide handling, storage, and custody services for foreign trade goods.
Installation Information Profile Number of the Authorized Customs Warehouse: of RFC Name and/or Business Name:
Name and/or Denomination of the
Installation
Type of Installation
Street Number and/or exterior letter Number and/or interior letter Neighborhood Postal Code Municipality/Delegation Federal Entity Age of the installation (years of operation):
Activity carried out at the installation:
Preponderant products handled in the authorized customs warehouse:
(As applicable)
Avg. No. of monthly shipments
(EXP):
Avg. No. of monthly shipments
(IMP):
Total number of employees at this installation:
Installation Surface Area (M2):

Certifications in security programs: (indicate if this facility holds a certification from any of the following programs) CTPAT. Yes No Level: Pre-Applicant: Applicant: Certified: Certified/ Validated:
CTPAT. Account number (8 digits): Date of last visit to this facility:
Authorized Economic Operator from other countries (AEO) Yes No Program: Registration:
Other Supply Chain Security Programs
Yes No Program: Registration:
Certifications: (indicate if you hold certifications that you consider impact your supply chain process, for example: ISO 9000; Reliable Logistics Processes, among others) Name: Category: Validity:
Name: Category: Validity:
Name: Category: Validity:
Name: Category: Validity:

Supply Chain Security Planning.
The supervised facility must develop documented policies and procedures to carry out an analysis that allows it to identify risks and weaknesses in its supply chain with the objective of implementing strategies that help mitigate risk in the supervised facility.
Likewise, to build a solid supply chain security program, the supervised facility must have a Security Committee that incorporates representatives from all relevant departments, forming a multifunctional team that identifies areas for opportunity and proposes continuous improvement actions throughout the supply chain and facility installations. Similarly, the company must have designated points of contact for the Authorized Economic Operator Program; this personnel must be involved, know the program requirements, belong to the supervised facility, and prove their relationship with it, as well as respond to their supply chain security specialist. If, as a result of the risk analysis, new security measures arise to be incorporated into the supervised facility, these must be included in the facility's existing procedures and, where applicable, new procedures must be drafted, which creates a more sustainable structure and emphasizes that supply chain security is everyone's responsibility.

1.1 Risk Analysis.
The supervised facility must establish measures to identify, analyze, and mitigate security risks that could result in alterations of foreign trade merchandise during its handling, guarding, and custody in its supply chain and facilities. It must develop a written process to determine risks based on its organization's model (e.g., type of merchandise, volume, clients, routes, information leakage, potential threats, etc.), so that it allows it to implement and maintain appropriate security measures. Based on the above, the company must also have a written process based on its risk analysis to select new business partners and monitor partners with whom it is already working. This procedure must be updated at least once a year, so that it allows permanent identification of new threats or risks considered in the operation and supply chain, resulting from any incident or originating from changes in initial conditions, as well as to identify whether policies, procedures, control mechanisms, and security are being complied with. It is important to note that the Supervised Facility's Security Committee must participate in the drafting and updating of the risk analysis and the maintenance of the Authorized Economic Operator Program.

Response: Explanatory Notes:
Indicate what sources of information are used to qualify risks during the analysis phase.
Attach the risk matrix, as well as the documented procedure to identify risks in the supply chain and the facility's installations, which must contemplate the risk assessment and management process of the facility, including the following points:
a) State the frequency with which it reviews and, if applicable, updates the procedure and its risk matrix. b) Indicate what aspects and/or areas of the facility are incorporated into the risk analysis. c) Describe the methodology used to determine a risk analysis. d) Mention who are the responsible parties for updating the facility's risk analysis. Likewise, the documented procedure to identify risks in the supply chain and its facilities must contemplate the risk assessment and management process, and include the following aspects:
a) Establishment of a context (cultural, political, legal, economic, geographic, social, etc.). b) Indicate the risks identified in the installation and in its supply chain or logistics. c) Risk analysis of causes, consequences, probabilities, and existing controls to determine the level of risk as high, medium, and low. d) Risk evaluation (decision-making to determine the risks to be treated and priority for implementing the treatment). e) Risk treatment (application of alternatives to change the probability of risks occurring). Risk monitoring and review (monitoring of the results of the risk analysis and verification of the effectiveness of its treatment). a) Indicate the review and/or update period of the risk analysis results. It is suggested to use Risk Administration, management, and evaluation techniques in accordance with international standards ISO 31000, ISO 31010, and ISO 28000 that, according to its business model, it must implement.

1.2 Security Policies.
The supervised facility must have a policy oriented towards preventing, securing, and recognizing threats to the security of the supply chain and facility installations, such as drug trafficking, money laundering, arms trafficking, human smuggling, prohibited goods, and acts of terrorism. These policies must be reflected in the corresponding procedures and/or manuals. To promote a security culture, supervised facilities must demonstrate their commitment to supply chain security and the Authorized Economic Operator Program through a statement highlighting the importance of protecting the flow of national and international commerce from criminal activities, established through the security policy. Senior officials or executives of the supervised facility who must endorse and sign the security policy may include the facility president, chief executive officer, general manager, security director, or personnel with equivalent rank with authority to make decisions.

Response: Explanatory Notes:
State the security policy oriented towards preventing, securing, and recognizing threats in the supply chain and installations of the supervised facility, indicate who is the responsible for its review, signature, and dissemination to employees, as well as the frequency with which it is carried out its update. This policy must be communicated to employees through a program and/or dissemination campaign. The security policy must be signed by a senior official of the company and be displayed in various areas of the supervised facility, including the facility's website, posters in key areas of the company (reception, shipments, receipts, warehouse, etc.), and as part of the initial and reinforcement training of the company.

1.3 Internal Audits in the Supply Chain.
In addition to routine monitoring in control and security, it is necessary to schedule and carry out audits at least once a year, under the guidelines of a documented procedure that allows evaluating all processes regarding supply chain security and its facilities in a more critical and in-depth manner, as well as guaranteeing that employees follow the facility's security procedures. Audits must be carried out by the facility's Security Committee; a documented procedure must be established, as well as a program or calendar for their execution. Although it is necessary that audits are focused on supply chain security and based on the evaluation, review, and execution of minimum security standards, their focus must be adjusted to the size of the organization, risk, business model, and variations between installations. Audits can be general or focus on specific areas or processes according to their work program. The objective of an internal audit focused on the Authorized Economic Operator Program is to verify and guarantee that employees follow the company's security procedures. The review process does not have to be complex; however, the formats and records used for the application of these reviews must evidence that the application and execution of the evaluated processes were validated, in addition to the corresponding follow-up of identified observations. Senior management must review the audit results, analyze causes, and undertake required corrective or preventive actions. The audit process must guarantee that the necessary information is collected to allow management to perform this evaluation. The review must be documented, in addition to the fact that the Supervised Facility's Security Committee must provide and register periodic updates on the progress or results of any audit, exercise, or validation.

Response: Explanatory Notes:
Describe the documented procedure to carry out an internal audit, focused on security in the supply chain, ensure you include the following points:
a) State how the facility carries out the scheduling or calendarization to perform an internal audit, in matters of security in the supply chain. b) Indicate who participates in them, and the records that are generated, as well as the frequency with which they are carried out. c) Indicate how the management of the supervised facility verifies the result of the audits in matters of security and how it performs and/or implements actions preventive, corrective, and improvement, in addition to the follow-up and closure of the same. d) The formats used during internal audits must be duly filled out, and through them, evidence that the procedures and security measures are being put into practice.

1.4 Contingency and/or Emergency Plans related to Supply Chain Security.
There must be a documented contingency and/or emergency plan; this plan must address crisis management, security recovery plans, and business resumption, to ensure business continuity in case a situation affects the normal development of activities and foreign trade operations in the installations and during the transfer, handling, storage, and custody of foreign trade merchandise according to its logistics process in the supply chain. A crisis or contingency may include the interruption of commercial data movement due to a cyberattack, a fire, the kidnapping of a transport driver by armed individuals, a bomb threat, the detection of suspicious packages, power outages, theft and/or damage to merchandise, threats or extortion, among others). Such plans must be communicated to personnel through periodic training, as well as conducting tests, practical exercises, or annual drills of the contingency and emergency plans to verify their effectiveness, from which it must maintain a duly filled out and signed record (for example: result reports, minutes, or reports, which must be backed by video recordings, photographs, etc.), demonstrating their execution. The contingency and/or emergency plan must be updated as necessary, based on changes in operations and the organization's risk level.

Response: Explanatory Notes:
Attach the documented contingency and/or emergency procedure or plan, to ensure business continuity in case of an emergency or security situation that affects the normal development of foreign trade activities of the supervised facility.
This procedure must include, in an enumerative but not limiting manner, the following:
a) What situations it contemplates. Describing the plan of action and steps to be followed in case of crisis, as well as the tasks that personnel have assigned during the handling of such contingencies. b) What mechanisms it uses to guarantee that the business continuity plan is effective.

c) Contemplate the scheduling and execution of tests, practical exercises, and annual drills and how they are documented (for example: result reports, minutes or reports, which must be accompanied by video recordings, photographs, etc., that demonstrate their execution).

Physical Security.
The supervised facility must have established mechanisms and documented processes to prevent, detect, or deter the entry of unauthorized personnel into the facilities.
All sensitive areas of the company must have physical barriers, control elements, and deterrents against unauthorized access.
The above may be accredited through compliance with the control, surveillance, access routes, infrastructure, equipment, and security measures of the supervised facility and foreign trade merchandise established by ANAM, provided that such measures are sufficient to accredit what is established in this standard.

2.1 Installations.
Installations must be constructed with materials that can resist unauthorized access. Periodic documented inspections must be carried out to maintain the integrity of structures, and in case an irregularity has been detected, the corresponding repair must be carried out as soon as possible by the personnel designated for these tasks. Likewise, territorial limits, as well as various accesses, internal routes, and the location of buildings must be fully identified.

Response: Explanatory Notes:
Indicate the predominant materials with which the installation is constructed (for example, metal structure and sheet metal walls, brick walls, wood, among others), and indicate how the review and maintenance of the integrity of structures is carried out.
Indicate the personnel or area responsible for carrying out the tasks of inspection, maintenance, and repair of damages to the installations.
Attach a general distribution or architectural plan, where the limits of the installations, access routes, emergency exits, traffic flow, the location can be identified of buildings, critical areas, parking lots, and boundaries.

2.2 Accesses at Doors and Booths.
The entrance or exit doors of personnel and/or vehicles of the company's installations must be attended, controlled, watched, and supervised. The number of access doors must be kept to the minimum necessary. Access to sensitive areas must be restricted according to the job description or assigned tasks.

Response: Explanatory Notes:
Indicate how many doors and/or accesses exist in the installations, as well as the operating hours of each one, and indicate how they are monitored (in case of having assigned surveillance personnel, indicate the quantity).
Detail if there are doors and/or accesses blocked, or permanently closed and their location.
Describe how you ensure that access to sensitive areas is restricted according to the job description or assigned tasks (include the type of records and controls you use).

2.3 Perimeter Fences.
Perimeter fences and/or peripheral barriers must be installed to secure the perimeters of the supervised facility's installations, and particularly, the areas for storage, custody, and warehousing of foreign trade merchandise, high value, hazardous, in accordance with applicable regulations, areas with restricted access, and others determined according to its risk analysis with the object of preventing unauthorized entries. These must be inspected regularly and keep a record of the review with the purpose of ensuring their integrity and preventing or identifying damages, which must be repaired as soon as possible by the personnel designated for these tasks. The storage, high value, hazardous, and/or restricted access areas must be clearly identified and monitored to prevent unauthorized entries.

Response: Explanatory Notes:
Describe the type of peripheral barrier and/or fences with which the installation has, ensure you include the following points:
a) Specify which areas it segregates in the installation by being considered critical and/or sensitive. b) State their characteristics (material, dimensions, etc.). c) In case of not having fences, justify detailedly the reason. d) Frequency with which the integrity of the perimeter fences is verified, and the records that are carried out, with the purpose of ensuring their integrity and identifying damages, which must be repaired as soon as possible. e) Indicate the personnel or area responsible for carrying out the tasks of inspection and repair of damages. Describe how the cargo destined for foreign countries, hazardous material, and high value cargo is segregated; ensure you include the following points:
a) Indicate how it separates national merchandise and foreign trade merchandise, and if it is additionally identified (For example: different packaging; labels; packaging, among others). b) Identify and state the restricted access areas (hazardous goods, high value, confidential, etc.). The procedure for inspecting perimeter fences could include:
a) Personnel responsible for carrying out the process. b) How and with what frequency the inspections of fences, perimeter fences and/or peripheral barriers and buildings are carried out. c) How the inspection record is kept. d) Who is responsible for verifying that repairs and/or modifications comply with the technical specifications and necessary security requirements.

2.4 Parking Lots.
Access to the installations' parking lots must be controlled and monitored by security personnel or designated for this task. Private vehicles (of employees, visitors, suppliers, and contractors, among others) must be prohibited from parking within the merchandise handling and storage areas, as well as in adjacent areas.

Response: Explanatory Notes:
Describe the procedure for the control and monitoring of the parking lots, ensure you include the following points:
a) Responsible for controlling and monitoring access to the parking lots. b) Identification of the parking lots (specify if the visitor parking is separated from the storage and merchandise handling areas). c) How the entry and exit control of vehicles to the installations is carried out. Indicate the records that are made for parking control, the existing control mechanisms (for example: ticket stubs, card readers, badges, etc.), how they are assigned and the area responsible for doing so. d) Policies or mechanisms to not allow the entry of private vehicles to the storage and merchandise handling areas.

2.5 Key and Lock Device Control.
Windows, doors, and inner and outer fences, according to your risk analysis, must be secured with locking devices. The company must have a documented procedure for the handling and control of keys and/or locking devices for inner areas that have been considered critical. Likewise, a record must be kept and responsibility letters signed by persons who have keys or authorized accesses according to their level of responsibility and work within their work area.

Response: Explanatory Notes:
Attach the documented procedure or procedures for the handling, storage, assignment, control, and non-return of keys, in the installations, offices, interiors, and critical and/or sensitive areas.
Ensure that these procedures include the following points:
a) Responsible for administering and controlling the security of keys. b) Control record for key lending. c) Indicate the treatment for loss or non-return of keys. d) State if there are areas where access is granted with electronic devices and/or any other access mechanism.

2.6 Lighting.
Lighting inside and outside the facilities must allow for clear identification of personnel, materials, and/or equipment present, including the following areas:
entrances and exits, handling areas, cargo loading, unloading and storage, perimeter and/or peripheral walls, interior fences and parking areas, and must have an emergency and/or backup system in sensitive areas.
Response: Explanatory Notes:
Describe the procedure for the operation and maintenance of the lighting system. Ensure you include the following points:
a) Indicate which areas are illuminated and which have a backup system (indicate if you have an auxiliary power plant). b) How do you ensure that the lighting system is appropriate in each of the areas of the inspected premises, as well as that it has continuity in the event of power failure in each of the areas of the installation and with special emphasis on areas considered as critical and/or sensitive, so as to allow clear identification of personnel, materials and/or equipment it covers. c) Person responsible for the control and maintenance of lighting systems. d) Maintenance and inspection program (if it coincides with another process, indicate it). The procedure may include:
a) How the lighting system is controlled. b) Operating hours. c) Identification of areas with permanent lighting.
2.7 Communication devices.
The inspected premises must have communication devices and/or systems for the purpose of contacting security personnel and/or emergency and security authorities as required, in an immediate manner. Additionally, it must have a backup system and verify its proper functioning periodically. Response: Explanatory Notes:
Describe the procedure that personnel must perform to contact the company's security personnel or, if applicable, the corresponding authority in the event of any security incident.
Indicate whether operational and administrative personnel have or have access to devices (landline phones, mobile phones, alert buttons and/or emergency) to communicate with security personnel and/or whoever is appropriate (these must be accessible to users, to be able to react promptly). Indicate what communication devices the company's security personnel uses (landline phones, cell phones, radios, alarm system, etc.).

Describe the procedure for the control and maintenance of communication devices, ensure you include the following points:
a) Policies for the assignment of mobile communication devices. b) Maintenance or replacement program for fixed and mobile communication devices. c) Indicate if you have backup communication devices, in case the permanent system fails and, if applicable, detail briefly.
The procedure may include:
a) Person responsible for the proper functioning and maintenance of communication devices. b) Verification and maintenance records of the devices. c) Method of assignment of communication devices.
2.8 Alarm systems and closed-circuit television and video surveillance systems.
Alarm systems and closed-circuit television and video surveillance systems and security technologies must be used to monitor, notify or deter unauthorized access and prohibited activities in the facilities and other areas considered sensitive, notify the corresponding area, in addition to being used as evidence in investigations derived from any incident. These security systems and technologies must be placed according to a prior risk analysis and applicable regulations, in such a way as to allow clear identification of areas involving the handling, storage, custody, loading and unloading of foreign trade merchandise, security inspections of cargo vehicles, as well as the entry and exit of authorized personnel, visitors, suppliers, passenger vehicles, and other areas considered sensitive on a permanent and uninterrupted basis in accordance with their operation and the coordination established with the customs office, the DGIA or the AGCTI, as applicable. The inspected premises must have documented operating procedures for the aforementioned systems. In the case of alarm and closed-circuit television and video surveillance systems, it must include supervision of the good condition of the equipment, verification of the correct position of the cameras, maintenance for the backup of recordings for at least sixty days in accordance with rule 2.3.8, continuity in operation in the event of power supply failures, as well as those responsible for their operation. These systems must have restricted access. Response: Explanatory Notes:
Mention the documented procedure indicating the operation of the external central alarm system or sensors, and if applicable, describe the following points:
a) Indicate if all doors and windows have alarm sensors or motion sensors. b) Procedure to follow in case an alarm is activated. c) Indicate the personnel or area responsible for maintenance, how failures are reported and the records they use.
Describe the documented procedure for the operation of alarm and closed-circuit television and video surveillance systems and security technologies (this must be reviewed and updated annually and according to the risk analysis or circumstances), ensure you include the following points:

a) Indicate the number of security cameras of the alarm and closed-circuit television and video surveillance systems installed, and their location by area, (detail if it covers the entry and exit points of the facilities, to cover the movement of vehicles and individuals, as well as the place of storage of foreign trade merchandise) and where the inspection referred to in sub-standard 7.2) takes place. Attach a layout or map of the distribution of security cameras. b) Indicate the location of the closed-circuit television and video surveillance systems and security technologies, where the monitors are located, who reviews them, as well as the operating hours, and if applicable, if there are remote monitoring stations. All security technology infrastructure must be physically protected against unauthorized access. c) Periodic and random reviews of recordings must be carried out. Indicate how they review them (random, every week, special events, restricted areas, etc.), who is the designated personnel and if management is involved in the reviews. The results of the reviews must be documented to include corrective actions for audit purposes. d) Indicate for how long these recordings are kept, which must be at least 60 days. e) Alarm and closed-circuit television and video surveillance systems and security technologies must have an alternative energy source that allows them to continue functioning in the event of an unexpected loss of direct power. For the above, indicate if the alarm and closed-circuit television and video surveillance systems and security technologies are backed up by an electrical power plant, or some other mechanism to supply electrical energy, that guarantee their operation. These systems should have an alarm/notification function, which indicates a failure condition in the operation and/or recording, indicate if your systems have such a function. f) Indicate if in addition to the closed-circuit television and video surveillance system, you use any other type of technology to strengthen the security measures you already have.

g) Describe the procedure that has been implemented to regularly test and inspect the closed-circuit television and video surveillance system and security technologies and ensure their proper functioning. The results of the inspections and the operational tests must be documented, as well as the necessary corrective actions (these must be implemented as soon as possible). Additionally, that the documented results of these inspections are kept for a sufficient time for audit purposes. h) Indicate if the provider of the alarm and closed-circuit television and video surveillance systems has access to the security cameras, if they are in charge of monitoring them, how access is controlled and who is responsible for said monitoring.
3. Physical access controls.
Physical access controls are mechanisms or procedures that prevent and prevent unauthorized entry to the facilities, maintain control of the entry of employees and visitors and protect the company's assets.
Access controls must include the identification of all employees, visitors and suppliers at all entry points. Likewise, records must be kept and the documented mechanisms or procedures for entry to the facilities must be permanently evaluated, being the basis for beginning to integrate security as one of the primary functions within any company. The evaluation of what is provided in this sub-standard will be carried out in accordance with the applicable regulatory provisions for the inspected premises.
3.1 Security personnel.
The inspected premises must have security and surveillance personnel. This personnel plays an important role in the physical protection of the facilities and merchandise during its transport and handling within the company, as well as for controlling the access of all people to the property. Security personnel must have a documented procedure to carry out their functions and have full knowledge of the mechanisms and procedures in emergency situations, detection of unauthorized persons or any incident in the installation. Management must periodically verify compliance with procedures, policies and functions through internal audits with the objective of verifying their correct execution. Response: Explanatory Notes:
Describe the documented procedure for the operation of security personnel and ensure you include the following points:
a) Indicate the number of security personnel working in the company. b) Indicate the positions and/or functions of the personnel and operating hours. c) In case of hiring an external service, provide the general data of the company (Tax ID, Legal Name, address), and specify number of employees employed, operational details, records, reports, etc. d) In case of having armed personnel, describe the procedure for the control and safeguarding of weapons.

3.2 Employee identification.
There must be an employee identification system for access to the facilities. Employees should only have access to those areas they need to perform their functions. Management or security personnel of the inspected premises must adequately control the delivery and return of badges, ID cards and/or employee identification credentials. Procedures for the delivery, return and change of access devices (for example, keys, proximity cards, etc.) must be documented. Access to sensitive areas must be restricted according to the job description or assigned tasks. Response: Explanatory Notes:
Describe the procedure for employee identification and ensure you include the following points:
a) Identification mechanisms (badge and/or photo ID, access control, biometrics, proximity cards, etc.). b) Indicate if employees use uniforms, how they are assigned (by position, area, functions, etc.) and removed (if applicable). c) Indicate how personnel hired by a business partner, who works within the facilities (contractors, subcontractors, in-house services, personnel from cargo handling companies, etc.) are identified. d) Describe how the company delivers, changes and withdraws employee identification and access controls and ensure you include the responsible areas for authorizing and administering them. The procedure must also describe how the company delivers, changes and withdraws employee identification and access controls and ensure you include the areas responsible for authorizing and administering them. Indicate how you ensure that access to sensitive areas is restricted according to the job description or assigned tasks (include the type of records and controls you use).
3.3 Visitor and supplier identification.
To access the facilities, visitors and suppliers must present official photo identification for documentation upon arrival and a record must be kept. All visitors and suppliers must receive a temporary identification, be accompanied by premises personnel during their stay in the facilities and ensure that the visitor/supplier always wears the provisional identification provided in a visible place. This procedure must be documented. In the case of suppliers and users who work regularly in the premises, the company must have a physical validation system for identification badges as established by the customs office of its jurisdiction to grant entry and exit authorizations, if applicable.

Response: Explanatory Notes:
Describe the procedure for visitor and supplier access control, ensure you include the following points:
a) Indicate what records are kept (personal forms for each visit, logbooks). b) The visitor and supplier record must include the following:

Date of the visit.
Visitor's name.
Photo identification number (official documents such as: driver's license, passport, INE, etc.).
Entry and exit time.
In the case of vehicle access, the format must
include the data of the private or cargo vehicle (model, plate, trailer number, etc.). c) Indicate who is the person responsible for accompanying the visitor and/or supplier and if there are restricted areas for their entry.
3.4 Procedure for identification and removal of unauthorized persons or vehicles.
The inspected premises must have documented procedures that specify how to identify, confront or report unauthorized or identified persons and/or vehicles.
Response: Explanatory Notes:
Attach the documented procedure to identify, confront or report unauthorized or identified persons and/or vehicles.
The procedure must include:
a) Responsible personnel. b) Designate a person or area responsible for being informed of incidents. c) Instructions for confronting and directing unidentified personnel. d) Indicate in which cases it must be reported to the corresponding authorities. e) How the recording of incidents and the measures adopted in each case is carried out.

3.5 Courier and package deliveries.
Courier and package deliveries intended for premises personnel must be examined upon arrival and before being distributed to the corresponding area. Likewise, the company must have a documented procedure for the receipt and review of courier and packages, which must be communicated to the responsible personnel through training. The training must be documented. Response: Explanatory Notes:
Describe the procedure for the receipt and review of courier and packages and ensure you include the following:
a) Indicate the personnel in charge of carrying out the procedure. b) Indicate how the service provider is identified (indicate if it requires an additional procedure to the supplier access procedure). c) Indicate how the review of the courier and/or packages is carried out, what mechanism it uses, the records that are kept and, if applicable, the incidents detected. d) Describe the characteristics or elements to determine what courier and/or packages are suspicious. e) Indicate what action you take in the event of detecting suspicious courier and/or packages.
4. Business partners.
The inspected premises must have written and verifiable procedures for the selection and contracting of new business partners and monitoring of partners with whom it is already working, such as: Transporters for the transport and/or distribution of merchandise subject to foreign trade, warehouses, providers of cleaning, private security, personnel hiring, placement and maintenance of alarm and closed-circuit television and video surveillance systems, providers of Information Systems and Technologies, providers of cargo loading, unloading and maneuvering services, contractors; shipping or airline lines, among others, and according to their risk analysis, require them to comply with security measures to strengthen the international supply chain. The risk analysis that the premises carries out regarding its business partners (clients and suppliers) must include risks related to the identification of activities related to money laundering and terrorist financing. Additionally, the premises must foster a documented social compliance policy and program that, at a minimum, addresses how among its employees and business partners they could guarantee that goods, inputs or merchandise imported into Mexico for the manufacture of products or merchandise do not come from extraction, production or total or partial manufacturing, with prohibited forms of labor, that is, forced or compulsory, including forced or compulsory child labor, under article 23.6 of the USMCA and the Agreement establishing the merchandise whose importation is subject to regulation by the Ministry of Labor and Social Welfare, published in the Official Gazette on February 17, 2023.
4.1 Selection criteria.
There must be documented procedures for the selection, follow-up and renewal of commercial relationships with business associates or suppliers, which include interviews, reference verification, evaluation methods and use of the information provided. The information derived from the investigation and/or evaluation of business associates and/or suppliers must be documented and integrated into a file (physical or electronic). The procedure for the selection of business partners must include, indicators to identify clients or suppliers that may not be legitimate or with unlocated addresses, in addition to investigations, reviews or evaluations of said partners for the identification and control of activities related to money laundering and terrorist financing. If the investigation and/or evaluation of any business partner leads to substantial doubts about the veracity of their operations or services, the premises must avoid their hiring and, if applicable, notify their security specialist or Authorized Economic Operator Program contact and the corresponding authority about their suspicions.

Response: Explanatory Notes:
Attach the documented procedure for the selection and contracting of new business partners and monitoring of the partners with whom it is already working, this comprises any type of business associates, suppliers who have commercial relationship with the company and if applicable with its logistical process and with the supply chain, as well as with potential and predominant clients to hire their service frequently and/or those who have a commercial relationship with the inspected premises and ensure it includes the following points:
a) What information is required from your business partner. b) What aspects are reviewed and investigated (the result of the investigation must be integrated into the file). c) Indicators to identify clients or suppliers that may not be legitimate or with unlocated addresses. This point refers to pointing out all those alerts to determine that a business partner is not reliable and thus, carry out a deeper investigation and evaluate whether to work with them. d) Indicate if you maintain a file for each of your business partners, as well as the information it must contain. e) Indicate how you evaluate the services of your business partner and what points you review. The file must include at least the following:
a) Company data (name, Tax ID, activity, etc.). b) Legal representative data. c) Proof of address. d) Commercial references (if applicable). e) Contracts, agreements and/or confidentiality agreements and security policies. f) If applicable, certificate or certification number in the security programs to which it belongs.

4.2 Security Requirements.
The supervised facility must have a documented procedure in which, based on its risk analysis, it requests additional security requirements from those commercial partners involved in its supply chain, as well as from service providers that similarly intervene in the control, handling, transport, and/or coordination of merchandise subject to foreign trade, such as: transport, warehouses, service providers for cleaning, private security, personnel hiring, installation and maintenance of alarm and closed-circuit television and video surveillance systems, Information Technology system providers, providers of loading, unloading and handling services for merchandise, collection and recycling, contractors, among others. The requirements must be based on the Supervised Facility Profile established by the AGACE or the specific Profile for each actor in the supply chain that corresponds to them, if one exists. The supervised facility must request from its commercial partners documentation that certifies or proves that they comply with the minimum security standards established in the Supervised Facility Profile, either through a written declaration issued by the legal representative of the partner, agreements or contractual clauses with documentation that supports compliance with the requirements established in the Authorized Economic Operator Program. Similarly, the facility must take into account and know the specific requirements of the Authorized Economic Operator Program that will be applicable to each of its commercial partners, based on their activity within the supply chain. In the case of the facility's commercial partners that provide their services within the facilities, they must be obligated to comply with these supply chain security requirements. Response: Explanatory Notes:
Describe the procedure that indicates how it carries out the identification of commercial partners that require compliance with minimum standards in terms of security.
Ensure to include the following points:
a) A register of the commercial partners that must comply with security requirements, and mention what type of providers these are (transporters, warehouses, private security companies, customs brokers, companies authorized to provide loading, unloading and merchandise handling services, etc.). b) Indicate in what documentary way (agreements, accords, contractual clauses and/or addenda) it ensures that its commercial partners comply with security requirements. c) Indicate if there are agreements, contractual accords, contractual clauses and/or addenda regarding the implementation of security measures with its service providers within its company, such as: customs brokers, security guards, cleaning services, gardening, cafeteria, maintenance, Information Technology providers, etc. d) Indicate if it has commercial partners to whom it is required to belong to a supply chain security program, either by certification by a foreign authority or the private sector (for example: C-TPAT or any other Authorized Economic Operator Program) as well as the information and documentation requested of them.

4.3 Commercial Partner Reviews.
The supervised facility, through the Security Committee, must carry out periodic security evaluations (as well as those derived from risk situations) of the processes and installations of business associates based on risk to guarantee that they have the minimum security standards required by the facility, based on the Authorized Economic Operator Program, maintain records that allow verifying that the processes and security measures are being executed as well as the corresponding follow-up. When inconsistencies are found, the company must communicate this to its partner or supplier and provide a justified period to address the observations or areas for opportunity identified, or otherwise, have the necessary measures to sanction them. Carrying out security evaluations of commercial partners is important to guarantee that there is a solid and functioning security program; therefore, in addition to a documented procedure, there must be a program or schedule for the execution of these security reviews or evaluations, prioritizing partners that are more critical according to their risk analysis. If a member is not evaluated and the company does not know if the processes and installations of its commercial partners are functioning correctly, it puts its supply chain at risk. Response: Explanatory Notes:
Describe the procedure to carry out security evaluations for the verification of security processes and installations of commercial partners; ensure to include the following points:
a) Frequency with which visits to the commercial partner are made (this must be at least once a year and derived from risk situations). b) Program or schedule for the execution of security reviews. c) Record or report of the verification and, if applicable, the corresponding follow-up. d) The verification format(s) must be duly completed, placing the date, name and position of those participating in the review, signatures, etc. e) Indicate what action measures are taken in case commercial partners do not comply with the established security requirements. f) In case of having commercial partners with C-TPAT certification or another supply chain security certification program, indicate the frequency with which their status is reviewed and the actions taken in case it is detected that it is suspended and/or cancelled, in accordance with what is established in its procedure. The procedure must include:
a) Frequency of visits. b) Points of review in terms of security. c) Preparation of reports. d) Feedback and agreements with the commercial partner. e) Follow-up on agreements. f) Measures in case of detecting non-compliance with requirements. g) Record of evaluations. h) Area or person responsible for carrying out this procedure.

5. Process Security.
Control measures must be established to guarantee the integrity and security of the merchandise and of the processes related to transport (in any of its modalities), handling, customs clearance, storage of cargo, providers of loading, unloading and handling services for merchandise. These control measures and procedures must be documented and ensure maintaining the integrity of shipments entering and leaving the supervised facility from the point of receipt until delivery.
5.1 Process Mapping.
There must be a map that shows step by step the logistical process of the flow of foreign trade merchandise and the required documentation through its international supply chains.
The facility must take into account and include within its mapping all parties involved in its supply chain, which may not handle the cargo directly, but may have operational control such as transporters, handling, customs clearance, storage and providers of loading, unloading and handling services for merchandise. If within its supply chain any part of the transport is subcontracted, it is indispensable that it be considered within its risk analysis and process mapping, since the more direct and indirect providers, the greater the risk involved. Response: Explanatory Notes:
Attach the document where the mapping of processes through which the merchandise entering and leaving the supervised facility passes is illustrated and described, with the purpose of having well identified each of the steps involving the storage, custody, loading and unloading of the merchandise. This mapping must contain at least the following aspects:
a) Origin of the merchandise:
1. National or nationalized merchandise.
2. Foreign merchandise for exhibition, sale or distribution.
3. Merchandise for its elaboration, transformation or repair.
4. Merchandise whose origin or destination is the transfer to companies with SE programs.
b) Customs of clearance. c) Transfer of the merchandise. d) Indicate the points and areas for rest or safeguarding of cargo vehicles during the transfer of merchandise subject to foreign trade (import and export). e) Indicate the estimated times that said vehicles remain in the rest or safeguarding areas (company yards, exit customs, customs broker agency facilities, warehouses, transfer yards or transport, among others). f) Delivery and/or receipt of the merchandise. g) Customs Clearance. h) Delivery to the consignee. i) Information flow related to the merchandise. j) Abandonments, destruction of merchandise, among others.

5.2 Warehouses and Distribution Centers.
In case the supervised facility has commercial partners that provide some warehouse, distribution center or other services within its facilities, they must be subject, according to their characteristics, to what is established in this document, with the objective of maintaining integrity in its supply chain. Response: Explanatory Notes:
According to its logistical process mapping, if foreign trade merchandise is transferred or moved to another warehouse and/or alternative distribution center different from the one operated under its authorization or concession as a supervised facility, it must indicate if they are registered under its Tax ID (R.F.C.), providing their general data (name and address) and briefly explaining what activity is carried out in that or those facilities (cross dock, temporary warehouse, etc.). Likewise, indicate if these belong to the company or is a service contracted through a third party and/or are part of a shareholder group. In this case, in accordance with the supplier selection criteria mentioned in the section regarding Commercial Partners of this document, indicate in what way it ensures that they meet the minimum requirements in terms of security. Facilities that have a concession or authorization of Supervised Facility must coincide with the number of Profiles presented, as well as indicate all addresses that are registered under the RFC.
5.3 Delivery and Receipt of Cargo.
The supervised facility must guarantee the supervision of the identification of operators of its own or subcontracted transport means, who carry out the collection, delivery or receipt of foreign trade merchandise inside or outside its facilities, warehouses and/or distribution centers. Likewise, it must designate the responsible area to supervise the loading or unloading of the shipment, even in accordance with the instructions received from clients for its handling and transfer. On the other hand, it must supervise, inspect and verify through mechanisms, tools or non-intrusive technology that it has available, the integrity of the transport means and of the merchandise subject to foreign trade that enters or leaves the supervised facility, comparing the information described in the exchange lists received previously in accordance with the traffic or transport mode in question. Similarly, it must guarantee that the driver who transports foreign trade merchandise, during delivery or receipt, has the required documentary information before being subjected to the formalities of customs clearance and authorizing its exit. The cargo preparation areas and the immediate surrounding areas must be inspected regularly to guarantee that these areas remain free of visible contamination by pests. During the process of loading and unloading merchandise, the company's security area (supervisor or security guard) must be present to validate that the process is being carried out correctly, mitigate the risk of shipment contamination (prohibited, illicit merchandise or pests) and register said review (incident reports, records, reports, etc.). Also, the personnel responsible for the entry and exit areas of the merchandise must review the information included in the import and/or export documents to identify or recognize suspicious cargo shipments. Likewise, specific training must be provided on the identification of common errors in the documentation of export shipments, with the objective of preventing these from resulting in security incidents or suspicious merchandise.

Response: Explanatory Notes:
Attach the documented procedure in which it indicates how it carries out the delivery and receipt of cargo and ensure that the following points are included:
a) Method to identify transport operators. b) Documentation delivered to operators. c) Responsible for supervising the identification numbers of the transport means during the loading or unloading of containers, dry boxes, UDLS, railway platforms, air waybills, if applicable, in the case of consolidated merchandise, de-consolidation process and comparison of information. Inspection method at the facility access point. a) Designation of the personnel responsible for receiving the driver and the merchandise upon arrival. b) Coordination of the facility areas that receive the exchange lists from the transporters prior to their arrival and with the customs where the formalities of customs clearance are fulfilled. c) Record of the introduction to the supervised facility of consolidated merchandise. d) Release deadlines. e) Prior requests. f) Services offered by the facility for the movement of merchandise prior to its customs clearance. g) How it guarantees that the transport means is free of visible contamination by pests, in case any type of visible pest, contamination, trash, insects, grass, weeds or brush is identified, how it is reported and what actions are taken regarding it. Attach the documented procedure to detect and report discrepancies in the delivery or receipt of transport means that transport merchandise and ensure that it includes the following points:
a) Responsible for carrying out the review. b) Documents to compare. c) Areas to which the information is reported.

5.4 Merchandise Tracking Procedure.
In accordance with its risk analysis, the supervised facility must monitor the movement of foreign trade merchandise in its installation through a tracking and activity supervision diary or a technology during the arrival, storage, custody and release of foreign trade merchandise to comply with the formalities of customs clearance, guaranteeing at all times having the following information: number and information of the bill of lading, packing list, waybill or other transport documents, as applicable, name and address of the consignee or sender, description, value, origin of the merchandise and the physical location in the facility. The foregoing must be accredited in accordance with the guidelines of a documented procedure. The supervision data and registration of all maneuvers in the supervised facility must be preserved for one month in case the authority must carry out an evaluation when so required. Response Explanatory Notes:
Attach the documented procedure to monitor the transfers, internal transfers in the supervised facility of consolidated and/or de-consolidated foreign trade merchandise.
This procedure must include, among other aspects according to its operation:
a) Indicate the type of system implemented in its case, the consultation tools it has available to monitor the merchandise. b) Identification of estimated times for transfer and maneuvers in supervised facilities according to the transport in question. c) Detail the communication means it has available. d) In case the tracking is carried out by a third party, indicate who is responsible, and how it is verified that it is being carried out correctly, in accordance with the procedures that the company indicates to it.
5.5 Cargo Discrepancy Report.
There must be documented procedures to detect and report missing, surplus, prohibited merchandise or any other discrepancy in the delivery or receipt of containerized, consolidated and/or de-consolidated merchandise prior to complying with the formalities of customs clearance, with the purpose of having information that aids in the corresponding investigations by authorized consignees and, if applicable, by competent authorities. Likewise, it must describe the measures and actions to be taken in case of identifying the transfer and handling of illicit, undeclared and prohibited merchandise or those that by their nature put the safety of users at risk, which could be during the following processes: reception, delivery, warehouse for prior inspections, consolidated, de-consolidated, transport means yards and, if applicable, according to the services offered. Response: Explanatory Notes:
Attach the documented procedure to detect and report discrepancies in the delivery or receipt of merchandise and ensure that it includes the following points:
a) Responsible for carrying out the review. b) Documents to compare. c) Areas to which the information is reported.
This procedure must be applied to consolidated merchandise and located in the warehouse.
Describe and enumerate the risk areas identified in the supervised facility.

5.6 Processing of Cargo Information and Documentation.
The supervised facility must have documented procedures to ensure that the electronic and/or documentary information used during the movement, storage, custody, maneuvers and dispatch of the cargo, as well as the information received from business associates, is legible, complete, accurate, reported in real time and protected against changes, losses or introduction of erroneous information. Similarly, the forms and documentation related to import and/or export should be secured to avoid unauthorized use. Response: Explanatory Notes:
Describe the procedure for the processing of cargo documentation; ensure to include the following points:
a) Detail how it transmits and/or receives information related to the transfer and maneuvers of cargo in the supervised facility (indicate if it uses a specific computer control system and briefly explain its function). Likewise, detail how it validates that the information provided by foreign trade users, transporters, shipping lines, railway companies, among others that converge in the facility, is legible, complete, accurate, reported in real time and protected against changes, losses or introduction of erroneous information. b) The electronic information of the shipments and cargo in general must include the seal and/or lock number with which the cargo was secured. c) Indicate in what way business associates transmit information with the supervised facility and ensure its protection.
5.7 Inventory Management, Control of Packaging, Container and Packing Material.
The supervised facility must have documented procedures for automated inventory control, in accordance with its authorization to provide services for handling, storage and custody of foreign trade merchandise; likewise, they must include abandonments, destructions, among others in accordance with applicable regulations and conduct reviews periodically. Packaging, container, and packing materials, if applicable, must be controlled and supervised to prevent them from being susceptible to manipulation prior to their use, which also includes, the control, dissemination and prevention procedure of visible contamination by pests, in the case of using wooden packing materials (such as pallets, boxes, crates, cages, reels, lashing, chocks, supports or platforms) to stack the cargo, move it and protect it throughout its entire supply chain. Response: Explanatory Notes:
Attach the documented procedure for inventory management. This must include, according to its operation among other aspects, the following:
a) Mention what type of system it uses for the exchange of information with the authority for inventory purposes. b) Who is its provider. c) Indicate if it has a contingency plan in case of system failures.

d) Mention where it is physically located and who are the responsible parties for its operation. e) The frequency with which it carries out inventory verification (periodic inventory). Indicate if there is a documented scheduled calendar to carry them out. f) Indicate what is done in the case of surpluses and shortages in inventories. g) Specify the treatment provided for the control and handling of packaging, container, and shipping material, and if applicable, shrinkage, waste, or leftover material, which also includes the control, dissemination, and prevention procedure for visible pest contamination, in the case of using wooden shipping materials (such as pallets, boxes, crates, spools, dunnage, supports, or platforms) to stack, move, and protect the cargo. h) This point is also focused on reducing the risk of introduction or dissemination of quarantine pests of importance to the country through packaging (imports); therefore, describe how you comply with the provisions established by the Secretariat of Environment and Natural Resources (SEMARNAT) and NOM-144-SEMARNAT-2017, in accordance with International Standards for Phytosanitary Measures No. 15, titled "Regulation of Wood Packaging Material in International Trade," which emanate from the Food and Agriculture Organization of the United Nations. i) Specify how the fumigation process is carried out to kill, inactivate, sterilize, desiccate, or eliminate pests. What actions do you take if quarantine of the packaging materials is required? j) Indicate the area responsible for carrying out this process, as well as the documentation or certificates obtained.

The applicant's procedures may include:
a) Warehouse accessible only to authorized personnel. b) Control of incoming goods, transfers to other warehouses, consolidation or de-consolidation. c) Actions taken if irregularities, discrepancies, losses, or thefts are identified. d) Treatment of deterioration or destruction of goods. e) Separation of various types of goods, for example: high value, hazardous.

Customs Management.
The supervised facility must have documented procedures that establish internal and operational policies, as well as the necessary controls for the proper compliance of customs obligations.

6.1 Customs Obligations.
The supervised facility must have a documented procedure for compliance with customs obligations due to holding a federal authorization. This must include at least the following: a) the annual guarantee that must be paid to the tax authority based on the average value of the goods handled; b) The identification of the physical space for customs inspections carried out by customs authorities; c) the physical space designated for handling, storage, and custody services regarding goods that have become property of the federal treasury; d) the free storage and custody of goods in accordance with regulations; e) process for transferring goods between warehouses; f) process to prove payment of fees for being a supervised facility; g) regarding the authorization for goods to be subject to manufacturing, transformation, or repair, if applicable.

Furthermore, the procedure mentioned in the previous paragraph must include the communication process with consignees in the event of destruction or loss of goods, guarantee the exchange of information through a simultaneous system containing the data indicated in rule 2.3.8., and establish protocols related to the treatment, communication, storage, and custody of foreign trade goods under the internal transit regime.

Response: Explanatory Notes:
Attach the procedure to comply with your customs obligations, which must include the following:
a) The annual guarantee that must be paid to the tax authority based on the average value of the goods handled. b) The identification of the physical space for customs inspections carried out by customs authorities. c) The physical space designated for handling, storage, and custody services regarding goods that have become property of the federal treasury. d) The free storage and custody of goods in accordance with regulations. e) Process for transferring goods between warehouses. f) Process to prove payment of fees for being a supervised facility. g) The communication process with consignees in the event of destruction or loss of goods.

6.2 Customs Verification.
The supervised facility, in order to guarantee the compliance of operation information for the customs clearance of foreign trade goods, as well as to verify the truthfulness of the information declared to competent authorities, must have documented procedures to verify that the customs declarations it receives for release from the facility match what is registered in SAAI Web, and if applicable, report any discrepancy in said information to the customs authority. The facility must also have a procedure for archiving the corresponding release records and safeguarding them for at least one month.

Response: Explanatory Notes:
Attach the established procedure to verify the information registered in SAAI Web, and cross-check that contributions and/or compensatory quotas had been paid prior to the release of shipments to undergo the formalities of customs clearance.
Specify how business partners transmit information to the supervised facility and ensure its accuracy, for example: the use of the institutional application "Remote Declaration Inquiry" to corroborate the payment of contributions and/or compensatory quotas, identification of means of transport, weight, among others, for exit authorization.

Security of cargo vehicles, containers, trailers, and/or semi-trailers.
The supervised facility must contribute to users and competent authorities to maintain the security of means of transport, to protect them from the introduction of persons, illicit, prohibited, or unauthorized materials. Therefore, it is necessary to have documented procedures to inspect, seal, and maintain their integrity. Similarly, the inspection process of said means of transport, containers, train cars, trailers, and semi-trailers used as International Traffic Instruments must include an agricultural inspection procedure to look for visible pests and serious structural deficiencies. Pest contamination is defined as visible forms of animals, insects, or other invertebrates (living or dead, at any stage of the life cycle, including eggs, etc.), or any organic material of animal origin (including blood, bones, hair, meat, secretions, excretions, etc.); plants or plant products (including fruits, seeds, leaves, twigs, roots, bark, etc.); or other organic material, including fungi, soil, or water; when such products are not the declared cargo within International Traffic Instruments.

In the event of using high-security seals, it is necessary to have procedures to correctly seal and maintain the integrity of containers and trailers from the moment they leave the facility. A high-security seal must be applied to all containers and trailers for foreign trade shipments, which must comply with or exceed ISO Standard 17712 for high-security seals.

With the objective of maintaining supply chain security, the facility must systematically inspect all cargo vehicles upon entry and exit from its facilities (domestic and international traffic), in addition to keeping a record.

7.1 Use of Seals and/or Padlocks.
The supervised facility, if applicable, must identify the cargo transport means, own or subcontracted, that transport complete or consolidated foreign trade goods, which may be: maritime, air, national land, cross-border, railway, and/or multimodal, that are subject to the placement of seals and/or padlocks that comply with or exceed ISO Standard 17712, with the aim of guaranteeing the integrity of the cargo at all times.

Therefore, as one of the security mechanisms, the supervised facility, if applicable, must use high-security padlocks or seals that comply with or exceed ISO Standard 17712 on all containers and loaded trailers that are subject to foreign trade and maintain their integrity until delivery at the final destination. To this end, the facility must have documented procedures to place and verify the correct application of seals, inspect them at intermediate points, final destination, and replace them when opened by any authority. In the event of such an inspection, drivers must notify and register any unusual anomaly or structural modification found in the means of transport resulting from said review. The procedures must include the steps to follow if it is discovered that a seal is altered, manipulated, or if there is an incorrect seal number in the documentation, the communication protocols to commercial partners involved in the supply chain, and the investigation of the security incident. These must be notified to security personnel, commercial partners that may be part of the affected supply chain, security specialist, or contact of the Authorized Economic Operator Program.

Likewise, it is necessary to have a documented procedure for the administration thereof, which includes the control, assignment, safeguarding, handling of discrepancies, and destruction of seals and padlocks (the latter is mandatory whenever seals are broken within the facility). Regarding the provider of seals and/or padlocks, it must be demonstrated how these comply with ISO Standard 17712. The company management or a security supervisor must carry out periodic and documented audits of high-security seals and/or padlocks; these reviews must include the verification of the inventory of stored seals and/or padlocks and the cross-check with inventory records and shipping documents. Also, supervisors of the shipping area and/or warehouse managers must periodically verify the seal numbers used in means of transport and International Traffic Instruments to corroborate that the information is correct.

In this case, the supervised facility must have a documented procedure in which, in accordance with its risk analysis, it supervises the placement of seals and/or padlocks on means of transport carrying foreign trade goods in accordance with its logistics process and in those traffics that require it due to their high probability of occurrence and impact of the identified risk and during maneuvers in the facility. It must evidence controls that allow accrediting that it supervises the portability of seals and/or padlocks resulting from entries or exits of the supervised facility. In all cases, it must use the VVTT inspection method to mitigate improper manipulations as follows:
a) V - View the seal and lock mechanisms of the container. b) V - Verify the seal number. c) T - Pull the seal to ensure it is correctly placed. d) T - Twist and turn the seal to ensure.

Response: Explanatory Notes:
List, according to your risk analysis and logistics process, the means of transport that are subject to the placement of high-security seals and/or padlocks.
Attach the documented procedure for the supervision of placement and review of seals and/or padlocks on means of transport carrying foreign trade goods.
This must include, among other aspects according to your operation:
a) The use of seals and/or padlocks that comply with or exceed ISO Standard 17712. b) If applicable, use the VVTT inspection method.

V - View the seal and lock mechanisms of the container (View).
V - Verify the seal number (Verify).
T - Pull the seal to ensure it is correctly placed (Tug).
T - Twist and turn the seal to ensure it has closed (Twist and Turn).
c) Review and cross-check the documentation containing the original seal or padlock number for purposes of entries or exits of supervised facilities.
Review that closing devices, hinges, and pins are attached to the trailer or container and welded or riveted. Also, protective plates can be placed on door hinges and/or a seal/adhesive tape placed on at least each side. Also, the correct functioning of handles, latches, and all other locking or closing mechanisms of cargo vehicles must be verified to detect manipulations and any inconsistency before placing any sealing device. d) Indicate how you assign and replace high-security padlocks, in the case of maneuvers such as prior inspection, replacement, among others.

If applicable, attach the documented procedure for the control and handling of seals and/or padlocks; this must include, among other aspects according to your operation:
a) What type of seals and/or padlocks you use in your operations (foreign trade, transit, storage, etc.). b) Who has access and how padlocks and/or seals are safeguarded. The management of seals and/or padlocks must be restricted only to authorized personnel; stored in a secure place, have an inventory, control of their distribution and tracking (record of seals used, as well as receipt of new seals and/or padlocks). c) Describe how the facility management or security supervisor participates in audits of high-security seals and/or padlocks, the reviews they perform, the records they generate, and the actions they take in case discrepancies are identified. Also, how supervisors of the shipping area and/or warehouse managers verify seal numbers used in means of transport and International Traffic Instruments to corroborate that the information is correct (this process can also be included within the internal audits referred to in sub-standard 1.3 of this document). d) How discrepancies in seal and/or padlock numbers are addressed. e) Indicate who the supplier(s) are and how it is proven that the specifications of seals and/or padlocks comply with ISO Standard 17712 (attach certificate issued by the certifying company responsible for verifying compliance with the corresponding ISO).

All written procedures must be disseminated and maintained at the operational level so that they are easily accessible to employees responsible for executing the tasks described above, reviewed at least once a year, and updated as necessary.

7.2 Inspection of means of transport, containers, trailers, and semi-trailers.
There must be established procedures to verify the physical integrity of the structure of means of transport, containers, train cars, trailers, and/or semi-trailers used as International Traffic Instruments, entering or leaving the supervised facility according to their nature, including the reliability of the locking mechanisms therein, with the aim of identifying natural or hidden compartments.

Inspections of means of transport or cargo vehicles, containers, and trailers must be systematic and carried out upon entry and exit from the supervised facility and, if applicable, at the cargo loading point; a record of these inspections must be kept in an area with controlled access and carried out in a place monitored by alarm systems and closed-circuit television and video surveillance; said system must cover the inspection process in its entirety.

The documented procedure for its inspection must include, by way of example and not limitation, the following review points for road transport:

Means of Transport | Trailers, Train Cars, Semi-trailers, and Containers --- | ---

Bumper; | 1. Exterior and interior doors;
Tires and rims (tractor and trailer); | 2. Side walls (left and right);
Floor (tractor); | 3. Internal and external roofs;
Fuel tanks; | 4. Front wall;
Cab interior (bedroom and tool compartment); | 5. Internal floor;
Air tanks; | 6. If applicable, the refrigeration system.
Chassis; |
Fifth wheel area; |
Drive shafts; |
Exhaust pipe; and |
Engine. |

For means of transport with a trailer or integrated cargo compartment, the items indicated in the Trailers section must be added to the means of transport points.

Similarly, before loading means of transport, containers, train cars, trailers, and semi-trailers used as International Traffic Instruments, they must undergo agricultural and security inspections to guarantee that their structures have not been modified to hide contraband or have been contaminated with visible agricultural pests, keep a record, and be backed by a documented procedure. If visible pest contamination is found during the inspection or transport of foreign trade goods, it must be cleaned (washed, vacuumed, etc.) to eliminate said contamination.

Response: Explanatory Notes:
Attach the documented procedure to carry out the security and agricultural inspection of means of transport according to their nature and logistics process involved in the entries and exits of the supervised facility. This must include, among other aspects according to your operation:
a) Those responsible for carrying out the inspection. b) Definition of the location(s) where the inspection takes place and indicate how it is monitored by alarm systems and closed-circuit television and video surveillance. c) The security review points for means of transport, trailers, semi-trailers, containers, railway transport, and/or multimodal according to official provisions, both of security and those of quality and agricultural inspections, with the aim of looking for visible pests. d) Established formats for the inspection of means of transport. e) Attach the established format for the inspection of means of transport or cargo vehicles, containers, train cars, trailers, and/or semi-trailers. If you use other types of cargo vehicles for the transport of your goods (vans, pickups, 3.5 tons, tankers, etc.), your procedure and inspection format must include the process and review points.

Furthermore, the security and agricultural inspection format must include the following information:
a) Date of inspection; b) Time of inspection; c) Vehicle license plates (tractor and trailer); d) Container/trailer number; e) Specific areas of the cargo vehicles that were inspected; and, f) Name of the employee performing the inspection and the supervisor.

The security and agricultural inspection formats may be signed by the supervisor to corroborate their information and be part of the import and export documentation.
The documentation must be preserved for one year for investigation in the event of any security incident, as well as to demonstrate continuous compliance with these inspection requirements.

Additionally, and based on the risk analysis, the supervised facility should carry out periodic random reviews of cargo vehicles, after the transport personnel has performed security inspections, to verify that they have been carried out correctly, counteract internal conspiracies, and prevent security incidents. The reviews must be carried out randomly, without prior notice, so that they do not become predictable, in addition to being carried out in different places where the means of transport may be susceptible to contamination.

7.3 Storage of vehicles, means of transport, containers, train cars, trailers, and semi-trailers.
In the event that the means of transport, containers, trailers, and/or semi-trailers intended to transport foreign trade goods are empty and must be stored in parking areas, they must be secured with a lock and/or indicative seal, or, in their case, in a secure area that is guarded and/or monitored. When it is necessary to store any loaded container, trailer, and/or semi-trailer, it must be located in a secure area monitored by alarm systems and closed-circuit television and video surveillance systems, to prevent unauthorized access and manipulation of the goods; therefore, it must be closed with a high-security seal and/or lock in accordance with ISO 17712 Standard. Response: Explanatory Notes:
Indicate whether the company stores containers, trailers, and/or semi-trailers for subsequent dispatch, or in the case of those that are empty, and how it maintains their integrity within its facilities. a) In the event of using locks and/or seals, indicate what type is used. b) In the event of using any containers, trailers, and/or semi-trailers as storage for raw materials and/or any other type of goods, indicate how it maintains their integrity and security.
8. Personnel Security.
The supervised facility must have documented procedures for the registration and evaluation of persons wishing to obtain employment within the supervised facility, establishing methods to conduct periodic verifications of current employees.
Furthermore, there must be continuous training programs for administrative and operational staff in which the company's supply chain security policies, consequences, and actions to be considered in the event of any violation are disseminated.
8.1 Verification of work history.
The supervised facility must have documented procedures to investigate and verify the information recorded in the curriculum vitae, criminal records (if local legislation and company policies allow), and applications of candidates with potential for employment, in accordance with local legislation, either on its own or through an external company. Likewise, for positions that require it due to their sensitivity and affect the security of shipments, in accordance with the risk analysis previously conducted, stricter requirements for hiring must be considered, which must be carried out periodically. Regarding personnel already working in the company, periodic investigations must be conducted based on the activities and/or sensitivity of the employee's position. All information regarding personnel must be kept in personal files, which must have restricted access.

Response: Explanatory Notes:
Describe the documented procedure for hiring personnel, and ensure you include the following:
a) Requirements and documentation demanded. b) Tests and exams requested.
Indicate the areas and/or critical positions identified as risky, according to your analysis, and indicate the following:
a) Indicate if there are additional requirements for specific areas and/or work positions, such as criminal records (if legislation and company policies allow), certificate of non-criminal record, socioeconomic studies, clinical toxicological studies (drug use), etcetera. In their case, indicate the positions or work areas where they are required and with what frequency they are carried out. b) Indicate if, prior to hiring, the candidate must sign a confidentiality agreement or a similar document. In the event of hiring a service agency for personnel hiring, indicate if it has documented procedures for personnel hiring and how it ensures compliance with the same. Briefly explain what they consist of. The procedures for personnel hiring and contractors must include:
a) Exhaustive investigations of the work and personal backgrounds of new employees. b) Confidentiality and liability clauses in employee contracts. c) Specific requirements for critical positions. d) In their case, the periodic update of the socioeconomic and physical/medical study of employees working in critical and/or sensitive areas. e) Hiring process and requirements requested for temporary employees and contractors. The facility may consider the results of candidate background verifications, as permitted by current legislation, to make hiring decisions. Background verifications are not limited to identity and criminal record verification. In higher-risk areas, deeper investigations may be justified.

8.2 Procedure for personnel dismissal.
There must be documented procedures for personnel dismissal, which include the delivery of identification, and any other item provided to perform their functions (keys, uniforms, badges and/or credentials, computer equipment, passwords, tools, etcetera). Likewise, this procedure must include the deactivation in computer and access systems, among others that may exist. Response: Explanatory Notes:
Describe the procedure for personnel dismissal, and ensure you include the following:
a) Who is responsible for carrying out and following up on this procedure. b) How the delivery of identification, uniforms, keys, and other equipment is carried out and confirmed. c) Indicate the control, record, and/or format, in which the delivery of material and deactivation in computer systems (in their case, attach) is identified and ensured. d) Indicate the type of records of personnel who ended their employment relationship with the company, so that in case it was for security reasons, their service providers and/or business associates are warned.
8.3 Personnel administration.
The supervised facility must maintain an updated system, control, or database of active employees. Likewise, it must carry out and maintain updated records of affiliation to social security institutions and other legal labor records.
In the event that the company has personnel hired by its business partners and works within the facilities, it must ensure that they comply with the requirements established for the rest of its employees.
Response: Explanatory Notes:
Indicate that the facility has an updated system, control, or database, both for personnel hired directly and that hired through a service provider company, and ensure it includes, among others, the following points:
a) Full name. b) Updated photograph at least every 5 years. c) Personal data (age, name, date of birth, phone number, address, CURP, social security number, blood type, allergies, etcetera). d) Affiliation. e) Work history. f) Diseases. g) Medical exams. h) Training. i) Psychometric exams. j) Toxicological exams. k) Results of periodic evaluations. l) Observations. This personnel must be hired in accordance with current labor laws and regulations.

Information and documentation security.
There must be prevention measures to maintain the confidentiality and integrity of information and documentation related to foreign trade operations, including those used for the exchange of information with other members of the supply chain. Likewise, there must be documented policies and/or procedures to protect Information Technology systems, which include measures against misuse as well as identifying and prioritizing actions to reduce cybersecurity risk. They could also address how a member shares information about cybersecurity threats with the government and other business partners.
9.1 Classification and handling of documents.
There must be procedures to classify documents according to their sensitivity and/or importance. Sensitive and important documentation must be stored in a secure area that only allows access to authorized personnel. The useful life of the documentation must be identified and procedures for its destruction must be established. The supervised facility must conduct regular reviews to verify access to information and ensure that it is not used improperly. Response: Explanatory Notes:
Attach the documented procedure for the registration, control, and storage of printed and electronic documentation (classification and filing of documents), which must include:
a) Control register for delivery, loan, among other documents. b) Restricted access to the archive area. c) Storage and classification policies. d) An updated security plan that describes the measures in force regarding the protection of documents against unauthorized access, as well as against deliberate destruction or loss of the same. e) In the case of electronic or digital information, it must adhere to the security criteria of sub-standard 9.2. Information Technology Security.
9.2 Information Technology Security.
To protect Information Technology systems against common cybersecurity threats, a company must have sufficient protection that promotes security in Information Technology infrastructure (software and hardware) against malware (viruses, spyware, worms, trojans, etcetera), baiting, phishing, and internal/external intrusions (firewalls) in the companies' computer systems. Likewise, companies must ensure that their security software is active and receives periodic updates. In the case of automated systems and computer equipment, individual accounts that require periodic password changes must be used. In order to protect the confidentiality, integrity, and availability of information, the company must have established information technology policies, procedures, and standards that must be communicated through a training program for all employees who handle computer equipment and systems, which includes topics to prevent attacks through social engineering and all those threats to which they are exposed (malware, baiting, phishing, etcetera). Companies that allow their employees to connect remotely to a network must use secure technologies, such as virtual private networks (VPN), to allow employees to access the company intranet securely when they are outside the office, as well as procedures designed to prevent unauthorized remote user access. For the above, there must be written procedures and infrastructure to protect the company against information loss, this includes the procedure for the recovery (or replacement) of Information Technology systems and/or data, as well as a system established to identify the abuse of Information Technology systems and detect inappropriate access and/or improper manipulation or alteration of commercial and business data, as well as a written procedure for the application of appropriate disciplinary measures to all offenders. Access to Information Technology systems must be protected against infiltration through the use of secure passwords, which include phrases or other forms of authentication. Users of said Information Technology systems must safeguard and not share their access keys or passwords. All Information Technology infrastructure must be physically protected against unauthorized access. If a data leak or other unexpected event occurs resulting in the loss of data and/or equipment, the procedures must include the recovery or replacement of Information Technology systems and/or data.

Response: Explanatory Notes:
Attach the procedure for the recovery (or replacement) of Information Technology systems and/or data, which includes how it backs up and ensures the security of its information as well as protecting it from possible losses.
Ensure you include the following points:
a) Indicate the frequency with which backups are carried out. b) Who has access to them, and who authorizes the recovery of information. c) Indicate what type of tests it performs and how often, to verify the security of the network, systems, and infrastructure. d) Mention if, to carry out this type of tests or vulnerability scans, it does so through software, a third party or provider, and, in their case, indicate the name or corporate name. e) In the event of finding vulnerabilities, describe the corrective actions that must be implemented. f) Indicate if it shares information about cybersecurity threats with its business partners participating in its supply chain (for example: communications, bulletins, emails, etcetera). g) Systems must be protected under passwords and must be modified frequently; therefore, indicate the procedure for changing them. h) Indicate if there are information security policies for their protection. i) Have a system or software to detect and identify the abuse, intrusion, or access of unauthorized persons to its systems and/or Information Technology data, as well as the abuse of the policies and procedures established by the company, including improper access to internal systems, external websites, and the manipulation or alteration of commercial data by employees or contractors. j) All offenders must be subject to the application of disciplinary measures; therefore, indicate the corrective policies and/or sanctions in the event of the detection of any violation of Information Technology systems and security policies.

Information Technology and cybersecurity policies and procedures must be reviewed annually and updated as a result of an attack or according to situations that may put the company's systems at risk.
Describe the security measures used to allow employees to connect remotely to a network (VPN), to allow employees to access the company intranet remotely when they are outside the office.
In the event of allowing employees to use personal devices to perform company work, such devices must comply with the company's cybersecurity policies and procedures, security updates must be periodic, and there must be a method to securely access the company network.
Indicate if business partners have access to the company's computer systems. In their case, indicate what programs and how they ensure control of access to them.
Indicate if the computer equipment has a backup power supply system that allows business continuity.
The procedures regarding the backup of the supervised facility's information must also include at least the following:
a) How and for how long data is stored (data should be backed up once a week or as appropriate). b) Business continuity plan in case of incident and how to recover information. c) Frequency and location of backups and archived information. d) If backups are stored in sites alternative to the facilities where the Data Processing Center is located. e) Tests of the validity of data recovery from backups. The procedures regarding the protection of the supervised facility's information must also include:
a) An updated and documented policy for the protection of computer systems against unauthorized access and deliberate destruction or loss of information. All sensitive and confidential data must be stored in an encrypted or encripted format. b) Detail if it operates with multiple systems (sites/locations) and how such systems are controlled.

c) Who is responsible for the protection of the computer system (responsibility should not be limited to one person but to several so that each can control the actions of the rest). d) Each user's access must be assigned through individual accounts and restricted according to the job description or assigned tasks. Therefore, describe how access authorizations and access levels to computer systems are granted (access to sensitive information should be limited to personnel authorized to modify and use the information). Authorized access must be monitored by the area responsible for granting it, to verify or, in their case, report that access to confidential systems is based on job requirements. e) Indicate the elements or formats that passwords must have, for access to Information Technology systems and computer equipment, frequency of changes, if there are other authentication methods, and who or what area provides those passwords. f) Indicate the name of the "firewall" and anti-virus used (include licensing related), evidencing that this security software is active and receives periodic updates. For the above, cybersecurity policies and procedures should include measures to prevent the use of counterfeit products or those with incorrect licenses. All computer equipment, electronic media (hard drives, cell phones, etcetera), and Information Technology hardware containing confidential information related to the import and export process must be accounted for through periodic inventories and have such evidence. When these technological equipment must be disposed of, there must be a documented procedure that includes how they must be formatted, disinfected, or destroyed appropriately to avoid information leakage. g) In the event of personnel dismissal, access to computer equipment, telecommunications, and network must be eliminated at the moment of the employee's separation; this includes email accounts, system access accounts, software, programs, etcetera. h) Measures planned to handle incidents in case the system is compromised.

Security training and awareness.
It must have a documented awareness program on threats established, designed, and updated by the Security Committee to recognize and create awareness about threats from terrorists and smugglers at each point in the supply chain. The training program must be comprehensive and cover all security requirements of the Authorized Economic Operator Program. Employees must know the established procedures of the supervised facility to consider a risk situation and know how to report it. Specific training must be provided to employees who, due to their functions, are in direct contact with goods and/or means of transport, as well as to employees who are in critical and/or sensitive areas determined under their risk analysis, security areas, loading and unloading; as well as to those who receive and open mail and packages, among others.

10.1 Training and awareness on threats.
The supervised facility must have a training and awareness program on security policies in the supply chain directed to all its employees, and additionally, make available informational material regarding the established procedures in the company to consider a situation that threatens its security and how to report it. Training records must include the date of the training, the names of the attendees, and the topics of the training. Similarly, specific training must be offered according to their functions to help employees maintain the integrity of the cargo, perform inspections of containers, trailers, and/or semi-trailers for agricultural and security purposes, receive and review mail and packages, prevent operations with proceeds of illicit origin (money laundering, terrorism financing, etc.), how to recognize and report internal conspiracies, protect access controls, as well as training regarding smuggling, theft of goods, placement of high-security seals and locks (VVTT inspection method), prevention of visible contamination by pests, etc. These topics must be established as part of new employee onboarding and maintain periodic update programs. Update training must be carried out periodically, after a security incident, and when there are changes in the procedures of the supervised facility. In addition to security training programs, an awareness program on alcohol and drug consumption must be included. Also, disseminate and train staff on the company's cybersecurity policies and procedures, including access to computer equipment and systems via passwords or phrases; personnel who operate and administer security technology systems must receive training related to their operation and maintenance, including self-training through operational manuals and other methods. These topics must be established as part of new employee onboarding and maintain periodic update programs. Training programs must encourage active employee participation in security controls and mechanisms, as well as maintain records of all training efforts provided by the company and the list of those who participated in them (videos, photographs, minutes, attendance lists, intranet or other system, didactic material, PowerPoint presentations, brochures, etc.). Training records must include the date of the training, the names of the attendees, the topics taught, in addition to having measures to verify that the training provided met all training objectives.

Response: Explanatory Notes:
It must have a training program on security and prevention in the supply chain for all direct and indirect employees.
Briefly explain what it consists of and ensure you include the following:
a) Brief description of the topics taught in the program. b) When they are taught (Onboarding, specific periods, etc.). c) Frequency of training and, if applicable, updates. d) Indicate how participation in supply chain security training is documented (videos, photographs, minutes, attendance lists, intranet or other system, didactic material, PowerPoint presentations, brochures, etc.). Records must include the date of the training, the names of the attendees, the topics taught, in addition to having measures to verify that the training provided met all the objectives of the same. e) Explain how employee participation in security matters is encouraged. Training to perform inspections of cargo vehicles, containers, trailers, and/or semi-trailers for agricultural and security purposes must include the following topics:
a) Signs of hidden compartments. b) Smuggling hidden in natural compartments. c) Signs of pest contamination. d) Procedures to follow if something is found during an inspection of the means of transport or if a security incident occurs during transit. e) Agricultural review training must cover pest prevention measures, regulatory requirements applicable to wooden packaging materials in accordance with International Phytosanitary Measure Standard No. 15, named Regulation of wooden packaging used in International Trade, which emanate from the Food and Agriculture Organization of the United Nations, and the identification of infested wood.

10.2 Awareness for transport operators.
The supervised facility must make known to the operators of the means of transport used for the transfer of goods destined for foreign trade, the security policies regarding agricultural and security inspection procedures of means of transport, loading and unloading, incident management, change of locks in case of inspection by other authorities, among others, that are implemented. Operators and personnel who perform agricultural and security inspections of means of transport must be trained to inspect cargo vehicles for such purposes. In the case where the transport service is provided by a business partner, it must ensure that operators know all established security policies and procedures.

Response: Explanatory Notes:
Describe the dissemination program on security in the supply chain focused on transport operators and ensure you include the following:
a) Indicate how this dissemination is carried out. b) Point out the topics covered. c) In case of using the services of a business partner for the transfer of your goods, indicate how operators are informed of the company's security policies and procedures. d) Indicate how participation in supply chain security training of transport operators is documented (videos, attendance lists, brochures, etc.).

The topics that must be included, by way of example and not limitation, are:
a) Access and security policies at the facilities. b) Delivery-receipt of goods, (including suspicious cargo shipments). c) Confidentiality of cargo information. d) Transfer instructions. e) Accident and emergency reports. f) Instructions for the placement of high-security locks and/or seals in case of inspection by other authorities, as well as the control and use of high-security seals and locks in transit (placement of a new one, review after any authorized stop, etc.). g) Installation and testing of security alarms and unit tracking, when applicable. h) Identification of authorized formats and documents to be used. i) Signs of hidden compartments. j) Smuggling hidden in natural compartments. k) Signs of pest contamination. l) Procedures to follow if something is found during an inspection of the means of transport or if a security incident occurs during transit.

Handling and investigation of incidents.
There must be documented procedures to report and investigate incidents in the supply chain and the actions to be taken to prevent their recurrence, as well as to notify security personnel, business partners who may be part of the affected supply chain, security specialist or Authorized Economic Operator Program contact, and/or other competent authorities. Reporting and investigation procedures must include updated contact information or directory listing the names and phone numbers of personnel requiring notification. The investigation and analysis of incidents must be documented (physical and/or electronic file), as well as corrective actions to prevent recurrence, which must be implemented as soon as possible. In the case where the supervised facility identifies that any of its foreign trade shipments is involved in a situation that puts the security of the supply chain at risk, due to suspicion of a business partner or person, it must inform security personnel, business partners who may be part of the affected supply chain, security specialist or Authorized Economic Operator Program contact, as well as the competent authority, and, if possible, before the border crossing, exit, or dispatch (import and export). Procedures must include the steps to follow if it is discovered that a seal is altered, manipulated, or there is an incorrect seal number in the documentation, the communication protocols to involved business partners in the supply chain, and the investigation of the incident. All the aforementioned procedures must be reviewed periodically or at least once a year to ensure that contact information and action protocols are correct.

11.1 Reporting of anomalies and/or suspicious activities.
In case of detection of anomalies and/or suspicious activities related to the security of the supply chain and in accordance with its logistical processes (related to access control, delivery, receipt, and storage of goods, security inspections of cargo vehicles and transport operators, etc.), these must be notified to security personnel, business partners who may be part of the affected supply chain, security specialist or Authorized Economic Operator Program contact, and other competent authorities, keeping a record of such anomalies and/or unusual activities.

Response: Explanatory Notes:
Describe the procedure to report or report anomalies and/or suspicious activities, as well as the mechanisms to anonymously report problems related to security, ensure you include the following:
a) Who is responsible for reporting incidents. b) Detail how it determines and identifies with which authority to communicate in different scenarios or presumption of suspicious activities. c) Mention if it keeps a record of reporting anomalies and/or suspicious activities and briefly describe what it consists of.

11.2 Investigation and analysis.
There must be written procedures to report or report anomalies and/or suspicious activities, as well as for the analysis and investigation of security incidents in the supply chain to determine their cause, in addition to corrective actions to prevent recurrence, which must be implemented as soon as possible. The information derived from this investigation must be documented and available at all times for authorities that require it. This information must include the documentation generated to carry out the foreign trade operation of the affected goods that allows identifying each of the processes the goods went through until the point where the incident was detected and that allows recognizing the vulnerability of the chain.

Response: Explanatory Notes:
Describe the documented procedure to initiate an investigation in case of any security incident, and ensure you include the following:
a) Responsible for carrying out the investigation. b) Documentation that integrates the security incident file.
The documents in the file derived from the investigation must include at least the following:
a) General information of the shipment, service order. b) Transport request; confirmation of means of transport; identification of the transport operator (access records, exit records, security inspection records, etc.). c) Means of transport inspection formats; exit orders; records of collection, delivery, and receipt of foreign trade goods. d) Videos from alarm systems, closed-circuit television, and video surveillance. e) Documentation generated by and for business partners, and customs authorities. f) Unit tracking and monitoring report (GPS tracking).

E8.
Profile of the Strategic Supervised Premises.
Acknowledgment of Receipt
First Time: Renewal:
Addition:
Modification:
The data provided will replace the data provided when you requested your authorization.
General Information
The objective of this Profile is to ensure that strategic supervised premises have security practices and processes implemented at their facilities, focused on strengthening the supply chain and mitigating the risk of contamination of shipments with illicit products.
Those interested in obtaining registration in the Certified Companies registry under the Strategic Supervised Premises modality referred to in rule 7.1.4., must demonstrate that they have documented and verifiable processes; likewise, they must integrate the criteria required in this document according to the business model or design they have established, seeking during the implementation of security standards, the application of a risk analysis culture supported by decision-making in accordance with the values, mission, vision, codes of ethics, and conduct of the company itself. What is established in this Profile must be accredited independently of the requirements and guidelines established for the control, surveillance, access routes, infrastructure, equipment, and security of foreign trade goods established by ANAM to grant the Strategic Supervised Premises authorization, and its compliance can be proven with that which coincides with what is established in this Profile. Filling Instructions:
1. You must fill out a Strategic Supervised Premises Profile for each of the facilities that have authorization as a strategic supervised premise. The number of Profiles presented must coincide with the facilities that have authorization for the limited-time introduction of foreign, national, or naturalized goods to strategic supervised premises, to be subject to handling, storage, custody, exhibition, sale, distribution, manufacturing, transformation, or repair in accordance with articles 14, 14-D, and 135-A of the Law manifested in your application for registration as a certified company under the strategic supervised premise modality as well as indicate all domiciles registered with the RFC.
2. Detail how you comply with or exceed what is established in each of the sections as indicated.
3. The format of this document is divided into two sections, as detailed below:
1. Standard.
Description of the standard
1.1 Sub-standard.
Description of the sub-standard
Response. Explanatory Notes:
Describe and/or attach... a) Points to highlight...

4. Indicate how you comply with what is established in each of the sub-standards, therefore you must attach the procedures in Spanish that, if applicable, are required, or provide a detailed explanation of what is requested in the Response field.
The section regarding Explanatory Notes is intended to be used as a guide regarding the points that must be included in the Response or in the attached procedures, as appropriate, of each sub-standard, indicating in an indicative manner those points that should not be excluded from your response.
5. Once the Strategic Supervised Premises Profile is answered, you must attach it to the Application for Registration in the Company Certification Scheme referred to in the first paragraph of rule 7.1.4., fraction IV.
For the purpose of verifying what is stated in the previous paragraph, the SAT through the AGACE may carry out an inspection of the installation indicated here, with the exclusive purpose of verifying what is stated in this document.
6. Any incomplete Strategic Supervised Premises Profile will not be processed.
7. Any question related to the Application for Registration in the Company Certification Scheme and the Strategic Supervised Premises Profile, direct it to the contacts that appear on the SAT Portal.
8. In the case of being authorized with the Registration in the Company Certification Scheme, this format must be kept updated and notify when the circumstances under which the registration was granted have varied and as a result changes or modifications are required in the information provided and given in this Strategic Supervised Premises Profile to the authority in accordance with what is established in rule 7.2.1., third paragraph, fractions III and IV.
9. When as a result of the inspection visit there are non-compliances related to minimum security standards, the applicant may remedy them before the issuance of the resolution established in rule 7.1.6., for which they will have a maximum period of three months counted from the notification of the non-compliances indicated.
Installation Data
A Strategic Supervised Premises Profile must be filled out for each of the facilities that operate under the Strategic Supervised Premises authorization and that carry out handling, storage, custody, exhibition, sale, distribution, manufacturing, transformation, or repair processes of foreign trade goods. Installation Information Number of Strategic Supervised Premises Profile:
of
RFC Name and/or Business Name:
Name and/or Denomination of the Installation
Type of Installation
Street Number and/or exterior letter Number and/or interior letter Neighborhood Postal Code Municipality/Delegation Federal Entity Age of the installation (years of operation): Activity carried out in the installation:
Preponderant products handled in the Strategic Supervised Premises:
(As applicable)
Avg. number of monthly shipments (EXP):
Avg. number of monthly shipments (IMP):
Total number of employees at this installation: Installation surface (m2):

Certifications in security programs: (Indicate if this facility holds a certification from any of the following programs) CTPAT. Yes No Level: Pre-Applicant: Applicant: Certified: Certified/ Validated:
CTPAT Account number (8 digits): Date of last visit to this facility:
Authorized Economic Operator from other countries (AEO) Yes No Program: Registration:
Other Supply Chain Security Programs Yes No Program: Registration:
Certifications: (Indicate if you hold certifications that you consider impact your supply chain process, for example: ISO 9000; Reliable Logistics Processes, among others) Name: Category: Validity:
Name: Category: Validity:
Name: Category: Validity:
Name: Category: Validity:

Supply Chain Security Planning.
The Strategic Supervised Premises must develop documented policies and procedures to carry out an analysis that allows the identification of risks and weaknesses in its supply chain, with the objective that the facility's senior management implements strategies that help mitigate the facility's risk. Likewise, to build a solid supply chain security program, the facility must have a Security Committee that incorporates representatives from all relevant departments, forming a multifunctional team that identifies areas for opportunity and proposes continuous improvement actions throughout the supply chain and the company's facilities. Similarly, the company must have designated points of contact for the Authorized Economic Operator Program; this personnel must be involved and know the requirements of the Authorized Economic Operator, belong to the company and prove their relationship with it, as well as respond to their supply chain security specialist, (this is assigned once the company already has the Authorized Economic Operator Program). If, as a result of the risk analysis, new security measures arise to be incorporated within the facility, these must be included in the facility's existing procedures and, where applicable, new procedures must be drafted, which creates a more sustainable structure and emphasizes that supply chain security is everyone's responsibility.

1.1 Risk Analysis.
The Strategic Supervised Premises must establish measures to identify, analyze, and mitigate security risks that could result in alterations to foreign trade merchandise during its handling, storage, custody, and transport in its supply chain and facilities, under the guideline of a documented procedure. This analysis must be based on the organization's model (e.g., type of merchandise, volume, clients, routes, information leakage, potential threats, etc.), so as to allow the implementation and maintenance of security measures. Based on the above, the Strategic Supervised Premises must also have a written process based on its risk analysis to select new business partners and monitor those with whom it is already working. This procedure must be updated at least once a year, so as to allow the permanent identification of other risks or threats considered in its operation and in the supply chain, as a result of some security incident or when changes occur in the initial conditions of the facility, as well as to identify whether the policies, procedures, and other control and security mechanisms are being complied with. It is important to note that the facility's Security Committee must participate in the preparation and updating of the risk analysis and the maintenance of the Authorized Economic Operator Program.

Response: Explanatory Notes:
Indicate what are the sources of information used to qualify risks during the analysis phase.
Attach the risk matrix, as well as the documented procedure to identify risks in the supply chain and the facility's installations, which must include at least the following points:
a) Frequency with which it reviews and/or updates the risk analysis. b) Aspects and/or areas of the facility that are incorporated into the risk analysis. c) Methodology or techniques used to perform the risk analysis. d) Persons responsible for reviewing and/or updating the risk analysis of the facility. Likewise, the documented procedure to identify risks in the supply chain and its facilities must contemplate the risk assessment and management process, and include the following aspects:
a) Establishment of a context (cultural, political, legal, economic, geographic, social, etc.). b) Identification of risks in its supply chain and its facilities. c) Risk analysis (causes, consequences, probabilities and existing controls to determine the level of risk as high, medium and low). d) Risk evaluation (decision making to determine the risks to be treated and priority for implementing the treatment). e) Risk treatment (application of alternatives to change the probability that risks occur). It is suggested to use risk management, governance and evaluation techniques in accordance with international standards ISO 31000, ISO 31010 and ISO 28000 that, according to your business model, should be implemented.

1.2 Security Policies.
Strategic Supervised Premises must have a policy oriented towards preventing, securing, and recognizing threats to the security of the supply chain and company installations, such as drug trafficking, money laundering, arms trafficking, human trafficking, prohibited merchandise, and acts of terrorism. To promote a security culture, companies must demonstrate their commitment to supply chain security and the Authorized Economic Operator Program through a statement highlighting the importance of protecting the flow of national and international commerce from criminal activities, established through the security policy. Senior officials or executives of the company who must endorse and sign the security policy can be the facility president, chief executive officer, general manager, or personnel with equivalent rank with decision-making authority.

Response: Explanatory Notes:
State the security policy oriented towards preventing, securing and recognizing threats in the supply chain and company installations, indicate who is responsible for its review, signature and dissemination to employees, as well as the frequency with which its update is carried out. This policy must be communicated to employees through a program and/or dissemination campaign. The security policy must be signed by a senior official of the company and be displayed in various areas of the company, including the company website, posters in key areas of the facility the company (reception, shipments, receipts, warehouse, etc.), and as part of the initial and reinforcement training of the company.

1.3 Internal Audits in the Supply Chain.
In addition to routine monitoring in control and security, it is necessary to schedule and carry out periodic audits that allow evaluating all processes regarding security in the supply chain in a more critical and deep manner, as well as guaranteeing that its employees follow the facility's security procedures. Audits must be carried out by the company's Security Committee establishing a documented procedure, as well as a program or calendar for their execution. Although it is necessary that audits are focused on supply chain security and based on the evaluation, review, and execution of minimum security standards, their focus must be adjusted to the size of the organization, level of risk, business model, and variations between facilities. Audits can be general or focus on specific areas or processes according to their work program. The objective of an internal audit focused on the Authorized Economic Operator Program is to verify and guarantee that employees follow the facility's security procedures. The review process does not have to be complex; however, the formats and records used for the application of these reviews must evidence that the application and execution of the evaluated processes were validated, in addition to the corresponding follow-up of identified observations. The senior management of the organization must review the results of the audits, analyze the causes, and undertake corrective or preventive actions required. The audit process must guarantee that the necessary information is collected to allow management to perform this evaluation. The review must be documented, in addition to which the facility's Security Committee must provide and register periodic updates on the progress or results of any audit, exercise, or validation.

Response: Explanatory Notes:
Describe the documented procedure to carry out an internal audit, focused on security in the supply chain, ensure you include the following points:
a) Indicate how the company carries out the scheduling or calendarization to perform an audit on security in the supply chain. b) Indicate who participates in them, and the records that are effectuated from them, as well as the frequency with which they are carried out. c) Indicate how the senior management of the facility verifies the result of the audits on security matters, how it performs and/or implements preventive actions, corrective and improvement actions in addition to the follow-up and closure of the same. d) The formats used during internal audits must be duly filled out, and through them, evidence that the procedures and security measures are being put into practice.

1.4 Contingency and/or Emergency Plans related to Supply Chain Security.
There must be a documented contingency and/or emergency plan; this plan must address crisis management, security recovery plans, and business resumption, to ensure business continuity in the event of a situation that affects the normal development of activities and foreign trade operations of the facility in its supply chain (in the facilities and during the transport, handling, storage, and custody of foreign trade merchandise according to its logistics process). A crisis or contingency may include the interruption of the transmission and exchange of commercial data due to a cyberattack, a fire, the kidnapping of a transport driver by armed individuals, a customs closure, a bomb threat, the detection of suspicious packages, a power outage, theft and/or damage to merchandise, threats or extortion, blockades or road closures, among others). Such plans must be communicated to personnel through periodic training, as well as carrying out tests, practical exercises, and annual drills of the contingency and emergency plans to verify their effectiveness, from which a duly filled out and signed record must be maintained (for example: result reports, minutes or reports, which must be backed up by video recordings, photographs, etc., that demonstrate their execution).

Response: Explanatory Notes:
Attach the documented contingency and/or emergency procedure or plan, to ensure business continuity in case of an emergency or security situation, that affects the normal development of the facility's foreign trade activities in its supply chain (in the facilities, during the transport, handling, storage, and custody of merchandise, of foreign trade according to its logistics process).

This procedure must include, by way of illustration and not limitation, the following:
a) What situations it contemplates, describing the plan of action and steps to be followed in case of crisis, as well as the tasks that personnel have assigned during the handling of such contingencies. b) What mechanisms it uses to disseminate and ensure that these plans are effective. c) Contemplate the scheduling and carrying out of tests, practical exercises and annual drills and how they are documented (for example: result reports, minutes or reports, which must be accompanied by video recordings, photographs, etc., that demonstrate their execution).

Physical Security.
The Strategic Supervised Premises must have established mechanisms and documented processes to prevent, detect, or dissuade the entry of unauthorized personnel into the facilities. All sensitive areas of the facility must have physical barriers, control elements, and dissuasion against unauthorized access. The above may be accredited through compliance with the control, surveillance, access routes, infrastructure, equipment, and security measures of the Strategic Supervised Premises and foreign trade merchandise established by ANAM, provided that such measures are sufficient to accredit what is established in this standard.

2.1 Facilities.
Facilities must be constructed with materials that can resist unauthorized access. Periodic documented inspections must be carried out to maintain the integrity of the structures and in the event that an irregularity has been detected, the corresponding repair must be carried out as soon as possible by the personnel designated for these tasks. Likewise, the territorial limits, as well as the various accesses, internal routes, and the location of the buildings must be fully identified.

Response: Explanatory Notes:
Indicate the predominant materials with which the installation is constructed (for example, metal structure and sheet metal walls, brick walls, wood, among others), and indicate how the review and maintenance of the integrity of the structures is carried out.
Indicate the personnel or area responsible for carrying out the tasks of inspection, maintenance, and repair of damages to the facilities.
Attach a general distribution or architectural plan, where the limits of the installations, access routes, emergency exits, location of the buildings, critical areas, parking lots, and boundaries can be identified.

2.2 Accesses in Doors and Booths.
The entrance or exit doors for personnel and/or vehicles must be attended, controlled, monitored, and/or supervised. The number of access doors must be kept to the minimum necessary. Access to sensitive areas must be restricted according to the job description or assigned tasks.

Response: Explanatory Notes:
Indicate how many doors and/or accesses exist in the installations, as well as the operating hours of each one, and indicate how they are monitored (in case of having assigned personnel, indicate the quantity).
Detail if there are doors and/or accesses blocked, or permanently closed.
Describe how you ensure that access to sensitive areas is restricted according to the job description or assigned tasks (include the type of records and controls you use).