CVS Pharmacy C-TPAT Requirements For Product Suppliers To Our Product Suppliers: CVS Pharmacy, Inc. (CVS) is committed to ensuring supply chain security within a framework consistent with Customs-Trade Partnership Against Terrorism (C-TPAT) guidelines and in a prudent, equitable, and vigilant manner. The information included herein titled, CVS/Pharmacy C-TPAT Requirements for Product Suppliers, provides security criteria necessary for our product suppliers to help secure the supply chain. These minimum security criteria are designed for foreign manufacturers to institute effective security practices to mitigate the risk of loss, theft, and contraband smuggling that could potentially introduce terrorists and implements of terrorism into the global supply chain. In order to align our security program with CBP, C-TPAT, and industry standards, we are requesting that you also align your security program accordingly as stated in the enclosed document. Please sign the Agreement to Strengthen Supply Chain Security Consistent with C-TPAT Guidelines located on the last page of this document and return within 7 business days. If you should have any questions, please contact Cheryl Martin, Director of Customs Compliance, at Cheryl.Martin@CVSCarmark.com or 401-770-6265. More information on C-TPAT Security Criteria for Foreign Manufacturers is found at www.cbp.gov. Sincerely, Luis Mercado Vice President of Inventory CVS/pharmacy, Inc. cc: Gregory F. Froton, Jr., Vice President of General Merchandising & International Sourcing 1 of 5
C-TPAT Security Criteria C-TPAT Importer Security Criteria The importer (CVS) must conduct a comprehensive assessment of their international supply chains based upon the importer C-TPAT security criteria. Where an importer outsources or contracts elements of their supply chain, such as a foreign facility, conveyance, domestic warehouse, or other elements, the importer must work with these business partners to ensure that pertinent security measures are in place and adhered to throughout their supply chain. The supply chain for C-TPAT purposes is defined from point of origin (manufacturer/supplier/vendor) through to point of distribution. C-TPAT recognizes the complexity of international supply chains and endorses the application and implementation of security measures based upon risk analysis. Therefore, the program allows for flexibility and the customization of security plans based on the member s business model. C-TPAT Manufacturer Security Criteria Business Partner Requirement: Foreign manufactures must have written and verifiable processes for the selection of business partners including, carriers, other manufacturers, product suppliers and vendors (parts and raw material suppliers, etc.), and develop and implement a sound plan to enhance security procedures. These are general recommendations that should be followed on a case-by-case basis depending on the company's size and structure and may not be applicable to all. The company s written security procedures should addresses the following: Physical Security: All buildings should be constructed of materials, which resist unlawful entry and protect against outside intrusion. Physical security should include: Adequate locking devices for external and internal doors, windows, gates, and fences. Segregation and marking of international, domestic, high-value, and dangerous cargo within the warehouse by a safe, caged, or otherwise fenced-in area. Adequate lighting provided inside and outside the facility to include parking areas. Separate parking area for private vehicles separate from the shipping, loading dock, and cargo areas. Having internal/external communications systems in place to contact internal security personnel or local law enforcement police. Access Controls: Unauthorized access to the shipping, loading dock and cargo areas should be prohibited. Controls should include: The positive identification of all employees, visitors and vendors. Procedures for challenging unauthorized/unidentified persons. Container Inspection: Procedures must be in place to verify the physical integrity of the container structure prior to stuffing, to include the reliability of the locking mechanisms of the doors. A seven-point inspection process is recommended for all containers: front wall, left side, right side, floor, ceiling/roof, inside/outside doors, outside/undercarriage. Container Seals: Written procedures must stipulate how seals are to be controlled and affixed to loaded containers to include procedures for recognizing and reporting compromised seals and/or containers to US Customs and Border Protection or the appropriate foreign authority. Only designated employees should distribute container seals for integrity purposes. 2 of 5
Container Storage: Containers must be stored in a secure area to prevent unauthorized access and/or manipulation. Procedures must be in place for reporting and neutralizing unauthorized entry into containers or container storage areas. Procedural Security: Measures for the handling of incoming and outgoing goods should include the protection against the introduction, exchange, or loss of any legal or illegal material. Security controls should include: Having a designated security officer to supervise the introduction/removal of cargo. Properly marked, weighed, counted, and documented products. Procedures for verifying seals on containers, trailers, and railcars. Procedures for detecting and reporting shortages and overages. Procedures for tracking the timely movement of incoming and outgoing goods. Proper storage of empty and full containers to prevent unauthorized access. Procedures to notify Customs and other law enforcement agencies in cases where anomalies or illegal activities are detected or suspected by the company. Maintaining a Factory Outbound Shipment Log designed for security guards to record outbound shipment information, as they witness the loading of containers or trailers for delivery to a freightforwarder/consolidator or ocean freight terminal. Copies of the completed log should be retained at the manufacturing / shipping facility and readily available upon request. Factory Name: Factory Address: Example of a Factory Outbound Shipment Log Factory Contact Phone : Carrier Driver Name Container / Trailer Seal (if applicable) Destination Purchase Order Item Manifest Quantity Date Loaded Time Loaded Security Guard Name The main intention of this log is to establish a verifiable internal control security procedure to document when the event occurred in the supply chain. Personnel Security: Companies should conduct employment screening and interviewing of prospective employees to include periodic background checks and application verifications. Education and Training Awareness: A security awareness program should be provided to employees including recognizing internal conspiracies, maintaining product integrity, and determining and addressing unauthorized access. These programs should encourage active employee participation in security controls. Self-Consolidation Due to potential security risks, CVS prohibits what is sometimes referred to as self-consolidation. Selfconsolidation refers to when a product supplier uses multiple factories for one or more items/purchase orders, transports an ocean freight container from one factory to another for consolidation, and books the shipment as a factory loaded CY/CY move (container yard at origin terminal to container yard at destination terminal). This has coined the term self-consolidation, since the product supplier is arranging 3 of 5
the consolidation itself, rather than more appropriately utilizing the importer s consolidator in a secure facility. If circumstances arise in the sourcing process that may involve more than one factory for one item/ purchase order, then CVS consolidator must handle the consolidation process. Any questions regarding the booking process in these instances can be directed to Debbie Wong at Yusen Logistics, and any questions regarding CVS policy can be directed to Cheryl Martin or Brian Pearce at CVS. CVS Caremark, Inc. Yusen Logistics (Hong Kong) Ltd. OCM Cheryl Martin Debbie Wong Ph: 401-770-6265 Tel: 852-3129 0282 Fax: 852-2317 4562 Brian Pearce debbie.wong@hk.yusen-logistics.com Ph : 401-770-4626 Purchase Order Terms and Conditions Language regarding C-TPAT and CVS expectation has been added to the terms and conditions of our import purchase order. We believe this carries weight in our communication of C-TPAT in a contractual document. A copy of our purchase order terms and conditions can be found at www.cvssuppliers.com. Required Business Partner Agreement Requirement CVS has also implemented a procedure that requires a company officer of a product supplier business partner to review and sign the attached agreement stating the supplier will establish procedures consistent with C-TPAT guidelines and the security recommendations that are posted on www.cbp.gov and to communicate the information to manufacturing business partners in a documented and verifiable format. A copy of the document titled, Agreement to Strengthen Supply Chain Security, is found on the next page. Required Signatory A company officer of the product supplier (i.e. the purchase order vendor of record) must sign the Agreement. Frequency The Agreement should be signed, dated, and returned to CVS within 14 days of receipt. CVS asks that you send an updated agreement to our attention if there is a change in personnel, location, internal processes / supply chain, or if there is a change to the C-TPAT program. Submission The signed Agreement is to be tendered to: CVS Caremark, Inc. Attn: Brian Pearce One CVS Drive Woonsocket, RI 02895 brian.pearce@cvscaremark.com Consequence of Default CVS reserves the right to add the agreement as a letter of credit term or use other payment leverage methods if the agreement is not tendered to CVS in a timely manner. Questions regarding these procedures may be directed to brian.pearce@cvscaremark.com 4 of 5
Agreement to Strengthen Supply Chain Security Consistent with C-TPAT Guidelines The Product Supplier agrees to develop and implement, within a framework consistent with the Customs-Trade Partnership Against Terrorism (C-TPAT) security criteria, a verifiable, documented program to enhance security procedures throughout its supply chain process, including, but not limited to, its manufacturing business partners. Where the Product Supplier does not exercise control of a production facility, transportation or distribution entity, or process in the supply chain, the Product Supplier agrees to communicate the C-TPAT security criteria to its manufacturers and transportation/distribution service providers and, where practical, condition its relationships to those entities on the acceptance and implementation of the C-TPAT security criteria. The Product Supplier agrees to communicate CVS Pharmacy, Inc. s supply chain security and C- TPAT procedures, and security criteria to its manufacturers in a documented and verifiable format that can be made available upon request, and it understands that failure to do so may jeopardize its business relationship with CVS Pharmacy, Inc. Product Supplier Name: CVS Product Supplier : Product Supplier Address; Signature (Company Officer): Date: Company Officer Title: Domestic Representative Name: Domestic Representative Telephone : Domestic Representative E-mail: Some language in this agreement is derived from publications listed at www.cbp.gov. 5 of 5