Crosswalk

WCO SAFE (2025 edition)

Sector and trade programmes.

Where the corpus maps to WCO SAFE (2025 edition): World Customs Organization Framework of Standards to Secure and Facilitate Global Trade.

Canonical citation

Standard ID: WCO SAFE Framework
Current version: 2025 edition
Publication date: 2025-06
Topic: World Customs Organization Framework of Standards to Secure and Facilitate Global Trade
Upstream check location: https://www.wcoomd.org/-/media/wco/public/global/pdf/topics/facilitation/instruments-and-tools/tools/safe-package/safe-framework-2025_en.pdf (opens in a new tab)
Last verified (UTC): 2026-07-11

Mapped control areas, 7

Control areas from the reverse crosswalk

The Reverse Framework Control Crosswalk Matrix answers which documents address a given control identifier or family. It names this programme in its combined section "CTPAT MSC and BASC v6 (trade and supply-chain security)". The table is that whole section, the same one the CTPAT (2020) instrument page shows.

CTPAT MSC domain	Library documents	Alignment type
Corporate security and security training	BASC Information Security Policy, BASC IT and Information Security Responsibilities, Security Awareness and Training Standard	Contractual requirement
Personnel security	Personnel Security Screening Standard	Contractual requirement
Physical security and physical access controls	Physical Security of IT Infrastructure Standard	Contractual requirement
Procedural and cargo security	US CTPAT Minimum Security Criteria Controls Register, Trade and Supply-Chain Continuity Controls Annex	Contractual requirement
Business partner security	Supplier Security and Privacy Assurance Standard, Supplier Security Questionnaire, Supplier Due Diligence Procedure	Contractual requirement
Information technology security	US CTPAT IT and Cybersecurity Compliance Controls Register, UK AEO-S IT and Cybersecurity Requirements, Information Security Policy, Logging and Monitoring Standard	Contractual requirement
Compliance with associated programmes (PIP, AEO, AEO-S, NEEC, OEA, WCO SAFE)	Supply Chain Security Programme Alignment Matrix, Canada PIP IT and Cybersecurity Compliance Controls Register, UK AEO IT Self-Assessment Procedure	Contractual requirement

Coverage, 6 domains

Coverage by domain

From the GRC Library Compliance Alignment Matrix; the main crosswalk table's document counts land here.

Governance, 5 documents

Governance Library CharterPillar II (Customs-to-Business Partnerships)
Records Retention and Destruction StandardAnnex IV B (Satisfactory System for Management of Commercial Records)
Continuous Assurance and Improvement FrameworkAnnex IV M (Measurement, Analyses and Improvement)
Metrics, Monitoring and Performance Reporting FrameworkAnnex IV M (Measurement, Analyses and Improvement)
Data Retention ScheduleAnnex IV B (Satisfactory System for Management of Commercial Records)

Risk, 1 document

Third-Party and Supply Chain Risk StandardPillar II Standard 1 (Partnership), Annex IV K (Trading Partner Security)

Compliance, 11 documents

BASC IT and Information Security ResponsibilitiesPillar II Standard 2 (Security), Annex IV F (Information Exchange, Access and Confidentiality)
UK AEO-S IT and Cybersecurity RequirementsPillar II Standard 2 (Security), Annex IV F (Information Exchange, Access and Confidentiality)
Legal and Regulatory Compliance PolicyAnnex IV A (Demonstrated Compliance with Customs Requirements)
BASC Programme Overview AnnexPillar II (Customs-to-Business Partnerships)
Logistics Sector GRC Requirements AnnexPillar II (Customs-to-Business Partnerships)
BASC Information Security PolicyPillar II Standard 2 (Security), Annex IV F (Information Exchange, Access and Confidentiality)
UK AEO IT Self-Assessment ProcedureAnnex IV F (Information Exchange, Access and Confidentiality)
US CTPAT IT and Cybersecurity Compliance Controls RegisterAnnex IV F (Information Exchange, Access and Confidentiality)
US CTPAT Minimum Security Criteria Controls RegisterPillar II (Customs-to-Business Partnerships)
Canada PIP IT and Cybersecurity Compliance Controls RegisterAnnex IV F (Information Exchange, Access and Confidentiality)
Trade Compliance Programme Gap Assessment TemplateAnnex IV M (Measurement, Analyses and Improvement)

Security, 31 documents

Information Security PolicyPillar II Standard 2 (Security), Annex IV F (Information Exchange, Access and Confidentiality)
Identity and Access Management PolicyPillar II Standard 2 (Security), Annex IV F (Information Exchange, Access and Confidentiality)
Encryption and Key Management PolicyPillar II Standard 2 (Security), Annex IV F (Information Exchange, Access and Confidentiality)
Logging and Monitoring StandardPillar II Standard 2 (Security), Annex IV F (Information Exchange, Access and Confidentiality)
Data Classification and Handling StandardPillar II Standard 2 (Security), Annex IV F (Information Exchange, Access and Confidentiality)
Privileged Access Management StandardPillar II Standard 2 (Security), Annex IV F (Information Exchange, Access and Confidentiality)
Authentication and Password Management StandardPillar II Standard 2 (Security), Annex IV F (Information Exchange, Access and Confidentiality)
Security Incident Response ProcedurePillar II Standard 2 (Security), Annex IV F (Information Exchange, Access and Confidentiality)
Vulnerability Management ProcedurePillar II Standard 2 (Security), Annex IV F (Information Exchange, Access and Confidentiality)
Cryptographic Key Lifecycle Management FrameworkPillar II Standard 2 (Security), Annex IV F (Information Exchange, Access and Confidentiality)
Cryptographic Key Operations ProcedurePillar II Standard 2 (Security), Annex IV F (Information Exchange, Access and Confidentiality)
Key Escrow and Recovery ProcedurePillar II Standard 2 (Security), Annex IV F (Information Exchange, Access and Confidentiality)
Post-Quantum Cryptography Readiness RoadmapPillar II Standard 2 (Security), Annex IV F (Information Exchange, Access and Confidentiality)
Access Control ProcedurePillar II Standard 2 (Security), Annex IV F (Information Exchange, Access and Confidentiality)
Identity Management ProcedurePillar II Standard 2 (Security), Annex IV F (Information Exchange, Access and Confidentiality)
IT Onboarding and Offboarding ProcedurePillar II Standard 2 (Security), Annex IV F (Information Exchange, Access and Confidentiality)
Zero Trust Architecture FrameworkPillar II Standard 2 (Security), Annex IV F (Information Exchange, Access and Confidentiality)
Bring Your Own Device (BYOD) PolicyPillar II Standard 2 (Security), Annex IV F (Information Exchange, Access and Confidentiality)
Network Communications Security PolicyPillar II Standard 2 (Security), Annex IV F (Information Exchange, Access and Confidentiality)
Endpoint Hardening StandardPillar II Standard 2 (Security), Annex IV F (Information Exchange, Access and Confidentiality)
Email Security StandardPillar II Standard 2 (Security), Annex IV F (Information Exchange, Access and Confidentiality)
Data Loss Prevention StandardPillar II Standard 2 (Security), Annex IV F (Information Exchange, Access and Confidentiality)
SaaS Security Posture Management StandardPillar II Standard 2 (Security), Annex IV F (Information Exchange, Access and Confidentiality)
Remote Working Security StandardPillar II Standard 2 (Security), Annex IV F (Information Exchange, Access and Confidentiality)
Incident Escalation MatrixPillar II Standard 2 (Security), Annex IV F (Information Exchange, Access and Confidentiality)
Security Ticket Reporting SchemePillar II Standard 2 (Security), Annex IV F (Information Exchange, Access and Confidentiality)
Security Operations Centre Operating Model StandardPillar II Standard 2 (Security), Annex IV F (Information Exchange, Access and Confidentiality)
Penetration Testing and Red Team StandardPillar II Standard 2 (Security), Annex IV F (Information Exchange, Access and Confidentiality)
Threat Modelling StandardPillar II Standard 2 (Security), Annex IV F (Information Exchange, Access and Confidentiality)
Insider Risk Programme FrameworkPillar II Standard 2 (Security), Annex IV F (Information Exchange, Access and Confidentiality)
Acceptance Into Service PolicyPillar II Standard 2 (Security), Annex IV F (Information Exchange, Access and Confidentiality)

Operations, 11 documents

Production Security RequirementsPillar II Standard 2 (Security), Annex IV F (Information Exchange, Access and Confidentiality)
Network Security and Segmentation StandardPillar II Standard 2 (Security), Annex IV F (Information Exchange, Access and Confidentiality)
Cloud Security Configuration BaselinePillar II Standard 2 (Security), Annex IV F (Information Exchange, Access and Confidentiality)
Physical Security of IT Infrastructure StandardAnnex IV I (Premises Security)
Certificate Authority Management StandardPillar II Standard 2 (Security), Annex IV F (Information Exchange, Access and Confidentiality)
Change Management and Configuration Control ProcedurePillar II Standard 2 (Security), Annex IV F (Information Exchange, Access and Confidentiality)
Endpoint Management and Device Compliance ProcedurePillar II Standard 2 (Security), Annex IV F (Information Exchange, Access and Confidentiality)
Security Monitoring and Alert Management ProcedurePillar II Standard 2 (Security), Annex IV F (Information Exchange, Access and Confidentiality)
Threat Intelligence and SIEM Operations ProcedurePillar II Standard 2 (Security), Annex IV F (Information Exchange, Access and Confidentiality)
Patch Management ProcedurePillar II Standard 2 (Security), Annex IV F (Information Exchange, Access and Confidentiality)
Release Management ProcedurePillar II Standard 2 (Security), Annex IV F (Information Exchange, Access and Confidentiality)

Supply chain, 13 documents

Supplier and Cloud Governance FrameworkPillar II Standard 1 (Partnership), Pillar II Standard 2 (Security), Annex IV K (Trading Partner Security)
Supplier Security and Privacy Assurance StandardPillar II Standard 1 (Partnership), Pillar II Standard 2 (Security), Annex IV K (Trading Partner Security)
Supplier Resilience Monitoring StandardPillar II Standard 1 (Partnership), Annex IV K (Trading Partner Security)
Supplier Due Diligence ProcedurePillar II Standard 1 (Partnership), Annex IV K (Trading Partner Security)
Supplier Onboarding Security Review ProcedurePillar II Standard 1 (Partnership), Annex IV K (Trading Partner Security)
Supplier Ongoing Monitoring ProcedurePillar II Standard 1 (Partnership), Annex IV K (Trading Partner Security)
Supplier Audit ProcedurePillar II Standard 1 (Partnership), Annex IV K (Trading Partner Security)
Supplier Exit and Data Return ProcedurePillar II Standard 2 (Security), Annex IV K (Trading Partner Security)
Fourth-Party and Nth-Party Risk ProcedurePillar II Standard 1 (Partnership), Annex IV K (Trading Partner Security)
Supplier Risk Register TemplatePillar II Standard 1 (Partnership), Annex IV K (Trading Partner Security)
Supplier Offboarding Evidence TemplatePillar II Standard 2 (Security), Annex IV K (Trading Partner Security)
Supplier Security QuestionnairePillar II Standard 1 (Partnership), Annex IV K (Trading Partner Security)
Trade and Supply-Chain Continuity Controls AnnexSection VI (Trade Continuity and Resumption), Annex IV L (Crisis Management and Incident Recovery)

Corpus citations, 7

Documents naming it in their framework alignment

Generated from each document's framework alignment list in the taxonomy, through the committed alias map.

BASC Information Security PolicyCompliance
Cryptographic Key Lifecycle Management FrameworkSecurity
Encryption and Key Management PolicySecurity
Legal and Regulatory Compliance PolicyCompliance
Metrics, Monitoring and Performance Reporting FrameworkGovernance
Third-Party and Supply Chain Risk StandardRisk
UK AEO IT Self-Assessment ProcedureCompliance

Note

What this mapping is

From the GRC Library Compliance Alignment Matrix: citations are indicative, not exhaustive (the representative-citation convention), and no entry constitutes a certification, attestation, or legal opinion.

From the Reverse Framework Control Crosswalk Matrix: coverage is partial, and external control identifiers and clause numbers are referenced for navigation only; the library does not reproduce third-party control text.

From the Cross-Framework Alignment Matrix: the alignment is not an official mapping, certification claim, legal opinion, or reproduction of third-party framework content.

The standards, laws, frameworks, and programmes in the canonical citations register, mapped here or not, are listed with their current editions on the Standards & frameworks page, generated from that register.

Open the full crosswalk