U.S. Customs and Border Protection (CBP) has just released a framework for how customs brokers can prepare for and respond to a worst-case scenario: a cyber attack on your data system.
The guide (PDF version here) recommends the following tips:
- Prevention and Protection
- Have a written cybersecurity policy and/or set of procedures to protect your IT system. Follow these procedures and review them frequently. Your protocols should be based on recognized industry standards, such as the National Institute of Standards and Technology (NIST) Cybersecurity Framework.
- Use firewall, antivirus and anti-spyware software, and run frequent updates. Regularly test the security of your IT infrastructure using vulnerability scans. Make sure your IT service providers have security measures in place.
- Maintain up-to-date Interconnection Security Agreements (ISA). If you’re directly transmitting data to ACE, submit an up-to-date ISA at least every three years to make sure CBP has accurate information on your systems and broker contacts, which allows for streamlined coordination during a cyber incident.
- Protect your data by frequently backing up data and storing all sensitive and confidential data in an encrypted format
- Keep backup devices physically offsite or in the cloud, and connect backup devices to a separate network
- Maintain originals of records, including records stored in electronic formats, within the customs territory of the U.S. in accordance with 19 CFR 111.
- Develop a plan for notifying stakeholders about a cybersecurity incident, which includes who to notify (CBP and Partner Government Agency [PGA] contacts), when to reach out to importer clients, systems vendors, CBP, and PGA contacts, and what information to share.
- Have a plan for how to manage supply chain risks if you don’t have system access.
- Have a process for screening new business partners and monitoring current partners.
- Have a plan to verify clients’ PGA requirements if you don’t have system access. (ACE reports and similar reporting from PGAs may help.)
- Communication: Notifying stakeholders
- Immediately notify CBP’s Office of Information Technology Security Operations Center (SOC). Be prepared to provide the SOC with details on the time of the incident, involved parties, cause, impact, whether any personally identifiable information was exposed, and any known indicators of compromise. Note: Brokers must report any breach of records relating to customs business no later than 72 hours as required until 19 CFR 111.21(b).
- Community with CBP client representatives and relevant PGAs.
- Reach out to importer clients and coordinate with CBP HQ to align messaging.
- Provide frequent status updates to CBP HQ and your PGA contacts.
- Respond: Maintain the movement of lawful cargo while mitigating risk
CBP may be able to work with brokers to implement downtime procedures in order to maintain the facilitation of lawful trade and the release of cargo while systems are down.
- Contact CBO OFO at headquarters level to request assistance and ensure your broker downtime procedures are compliant with CBP requirements.
- Provide a downtime letter documenting each entry with entry numbers and other required data.
- Be prepared to provide copies of appropriate documents for manual review.
Where appropriate and legally permissible, CBP will also work with the broker to make accommodations for post-release procedures.
- Recover: Reconnect your systems to resume business
- System safety validation: Brokers must provide evidence of system remediation before CBP will authorize reconnection to ACE.
- Retroactive data entry: Brokers must keep a full accounting of entries during cyber incidents and input that data into ACE for CBP processing.
To stay informed on trade news and other important updates, stay connected with a customs broker.
U.S. Customs and Border Protection (CBP) has announced the latest set of updates that will be coming to the ACE reporting system over the next few months.
ACE, which stands for Automated Commercial Environment, is the platform used to report imports and exports so that the government can determine admissibility.
The deployment schedule is as follows:
Ace Portal Modernization
The third and fourth phases will transition more capabilities to the modernized ACE portal, including:
- References tab updates
- Edit functionality for Account Data for All Account Types
- User access management
- Document upload/management functionality for Facilities/Foreign Trade Zones (FTZ)
- Blanket Declarations
- New account type: Vessel Agent
- Statements
- Conveyance Template Upload
- Change History
Aluminum Duty
Trade Remedy 232 for Aluminum will require a new declaration for Russian Smelt or Cast, which involves collecting five new data elements via ABI and updates to CBP internal user interfaces.
Automated Surety Interface (ASI) Seized Assets and Case Tracking System (SEACATS)
This will transition ASI-SEACATS from the Automated Commercial System (ACS) to ACE.
HTS Go-Live
The remaining HTS Admin User Interface, HTS Query and Data Conversion will be migrated.
Implement Mass Liquidation Functionality for Drawback Entry Type 47
ACE functionality will be expanded to allow for the mass liquidation of drawback entries/claims (entry type 47).
UFLPA Detentions Process Related to Forced Labor
This will create an automated process for Admissibility Reviews and Exception Requests. This will include automating the completion and issuance of the CBP 6051D and Attachment 2B. A public site for the trade to upload documentation and submit for CBP review. This new enhancement will allow CBP to track, review, and determine the final disposition from this site.
ACE Currency Exchange Rates
The ACS Currency Exchange Rates program will be implemented in ACE, giving CBP and Trade stakeholders clear concise daily exchange rates (“multipliers’) to use in converting invoice values (currency) to US Dollar value for entry summary and other purposes.
Ocean House Bill of Lading (OHBOL) Release
This enhancement will implement functionality within ACE to release ocean cargo at the lowest shipment level. A new User Interface will be provided for Container Freight Station (CFS) operators where they can view information as released at the lowest shipment level. The CFS UI will not have EDI impacts.
Enhancements to ACE Truck Manifest – Phase 4: Class of Admission
This enhancement will allow ACE Truck Manifest to infer Class of Admission (COA) based on travel documents that the Primary Inspection Process (PIP) returns for all crew members and passengers present in the conveyance at crossing. When the COA cannot be inferred by the travel document returned by PIP, the enhancement will also allow the officer examining the documents at the border to manually select the COA or create a referral.
Enhancements to ACE Truck Manifest – Phase 4: Non-Intrusive Inspection (NII) Integration Enhancements
This enhancement includes the development and integration of additional non-intrusive inspection (NII) capabilities including Artificial Intelligence (AI)/Machine Learning (ML) models for ACE Truck Manifest modernization.
Immediate Delivery
The Immediate Delivery (ID) enhancement will allow filers to transmit an ID request on an entry and the data would populate in ACE Cargo Release and Entry Summary, in line with 19 CFR 141,48(c).
Entry Summary Query Updates
This enhancement will incorporate data elements from Collections and move the query from Legacy ACE to New ACE.
Collections – Release 7*
This functionality will automate the Budget Clearing Account (BCA) process, enabling improved reconciliation of open receivables and reducing the time required to clear the BCA for CBP personnel. • This enhancement will also integrate the port collections process into ACE Collections and will enable the entry lifecycle to be contained in one system.
United States – Mexico – Canada Agreement (USMCA) – Retail Sales Indicator
This work creates a new indicator that filers will use to indicate if they are submitting a substitution claim, or a direct identification claim for Drawback provisions 56 and 70.
Broker Fee Automation
New capabilities: Broker License Application with interface to ACE, Broker Permit Application with interface to ACE, and Broker Annual Permit User Fee with interface to ACE. Deployment will commence once integration of Collections (Release 7) is complete.
To stay informed on trade news and other important updates, stay connected with a customs broker.
