Supply Chain Security Guidelines

Starbucks Coffee Company • P.O. Box 34067 • Seattle, WA 98124-1067

Supply Chain Security Guidelines
Page | 2

Statement of Support
Our mission is to inspire and nurture the human spirit – one person, one cup, and one
neighborhood at a time. Everything we do is through the lens of humanity – from our commitment
to the highest quality coffee in the world, to the way we engage responsibly with our customers
and our communities. At Starbucks, we have always believed in the importance of building a greatand enduring company that is people, planet, and profit positive.
Starbucks is committed to the safety and security of its partners, customers, and physical assets.
Our participation in the Customs Trade Partnership Against Terrorism, or CTPAT, is a demonstrationof that commitment. CTPAT is a government/private sector initiative designed to strengthen the
security of the international supply chain and U.S. border security. CTPAT offers the unique
opportunity to take a proactive role to ensure a secure global supply chain.
Starbucks has been a member of the CTPAT the program since 2004. We are proud to be certified
as Tier III and to play our role in enhancing the security of goods moving through our international
supply chain. This includes the validation of strong company and business partner security
programs and practices that protect the supply chain from criminal activities such as drugtrafficking, terrorism, human smuggling, and illegal contraband.
Security is everyone’s responsibility. At Starbucks, all employees and business partners (including
contractors, service providers, and visitors) are expected to adhere to the CTPAT security policies
and procedures that are in place at each of our facilities. Thank you for your assistance,cooperation, and ongoing partnership.

Carolyn Kavanagh-Saini
director, Global Supply Chain Security & Compliance
Cheryl Steele
CSO, vice president, Global Security & Resilience© 2003, 2005, 2008, 2010, 2017, 2021 Starbucks Coffee Company. All rights reserved.

January 2023

Starbucks Coffee Company • P.O. Box 34067 • Seattle, WA 98124-1067

Supply Chain Security Guidelines
Page | 3

Introduction
These guidelines are intended to provide the global supply chain partners of Starbucks withrequirements and best practices to develop a firm foundation of supply chain security practices.
Starbucks works with multiple security authoritative programs and their mandates, to ensure that
our supply chain partners meet these basic security requirements.
These authoritative programs include:
•
•
•
•
•

U.S. Customs and Border Protection: Customs-Trade Partnership Against Terrorism(“CTPAT”).
The European Commission: Authorized Economic Operator (“AEO”)
Canada Border Services Agency: Partners in Protection (“PIP”)
Food and Drug Administration: Food Defense Programs
Transported Asset Protection Association (“TAPA”)

Starbucks will verify our supply chain partners are complying with these requirements byrequesting suppliers, third-party logistic providers, manufacturing, and distribution facilities
complete a Supply Chain Security Risk Assessment on a regular basis.
Starbucks is committed to these authoritative programs through ensuring our supply chain partners
meet these requirements. It is our expectation supply chain partners take appropriate corrective
actions necessary to develop a robust security program as demonstrated in the following pages ofthe supply chain security guidelines.

© 2003, 2005, 2008, 2010, 2017, 2021 Starbucks Coffee Company. All rights reserved.

January 2023

Starbucks Coffee Company • P.O. Box 34067 • Seattle, WA 98124-1067

Supply Chain Security Guidelines
Page | 4

Table of ContentsStatement of Support ......................................................................................................................... 2
Introduction .............................................................................................................................................3
Business Partner Requirements ...................................................................................................... 5
Transportation Security ..................................................................................................................... 6
Physical Access Controls.................................................................................................................... 9
Physical Security ................................................................................................................................. 10
Personnel Security............................................................................................................................... 11
Procedural Security .............................................................................................................................12
Security Education, Training & Awareness ................................................................................14
Cybersecurity & Information Technology Security.................................................................15
Cargo Tracing in Route ......................................................................................................................16
Audits & Assessments ........................................................................................................................ 17© 2003, 2005, 2008, 2010, 2017, 2021 Starbucks Coffee Company. All rights reserved.

January 2023

Starbucks Coffee Company • P.O. Box 34067 • Seattle, WA 98124-1067

Supply Chain Security Guidelines
Page | 5

Business Partner Requirements
Supply chain partners must ensure business partners develop security processes andprocedures consistent with CTPAT or a foreign industry partnership program to enhance
the integrity of the shipment at point of origin.

Starbucks Requirements:
All supply chain partners and the third parties with whom they conduct business must have, at aminimum, the following security processes in place:
1.
2.
3.
4.
5.

6.

Provide a verifiable list, upon request, of all facilities and/or sub-contractors which will
be used to manufacture and transport goods to Starbucks.
Transportation, warehousing, and logistics providers ensure that their sub- contractors
are also in compliance with minimum security requirements.
Subject to verification of compliance with CTPAT or a foreign industry partnershipprogram by Starbucks or designate at supply chain partner’s expense.
If business partner is eligible, CTPAT or a foreign industry partnership program
certification status should be verified.
If business partner is not eligible for CTPAT or a foreign industry partnership program,
there must be a demonstration of meeting CTPAT or a foreign industry
partnership/security program criteria (as outlined in this document) via
written/electronic confirmation.
Security processes and procedures consistent with this outlined document CTPAT or aforeign industry partnership/security program (AEO, TAPA, PIP etc.)

Best Practices:••

Business partner’s internal requirements, such as financial soundness, capability ofmeeting contractual security requirements, and the ability to identify and correct
security deficiencies as needed, should be addressed by the supply chain partner.
Business partners, who have obtained a certification in a supply chain security program
being administered by foreign Customs Administration, the Department of Homeland
Security or other applicable governing body, should indicate their status ofparticipation to Starbucks.

© 2003, 2005, 2008, 2010, 2017, 2021 Starbucks Coffee Company. All rights reserved.

January 2023

Starbucks Coffee Company • P.O. Box 34067 • Seattle, WA 98124-1067

Supply Chain Security Guidelines
Page | 6

Transportation Security
Container and Conveyance (tractor/trailer) integrity procedures must be maintained toprotect against the introduction of unauthorized material and/or persons.

Starbucks Requirements
All supply chain partners and the third parties with whom they conduct business must have, at aminimum, the following container and/or conveyance security measures in place:1.

Container Inspection:• Written procedures to verify the physical integrity of the container structure prior to
stuffing, to include the reliability of the locking mechanisms of the doors that meetor exceed the requirements outlined below.
• A seven-point inspection process is completed on all containers:° Front wall
° Left side
° Right side
° Interior floor° Ceiling/Roof° Inside/outside doors° Outside/Undercarriage• Acceptance of the container indicates inspection has occurred with satisfactory
results.
Please refer to CTPAT 7-Point Container Inspection Checklist

2.

Tractor & Trailer Inspection:• Tractor and trailer inspections are systematic and are completed upon entering anddeparting from the truck yard and at the last point of loading prior to reaching acountry border or a Starbucks facility.
• Highway carriers visually inspect all empty trailers, to include the interior of thetrailer, at the truck yard and at the point of loading, if possible.
• Inspection points for all tractor/trailers include:° Bumpers/Tires/Rims° Engine° Tires° Floor (Tractor)° Fuel Tanks° Interior Cab Compartments/Sleeper° Air Tanks° Drive Shafts° Fifth Wheel© 2003, 2005, 2008, 2010, 2017, 2021 Starbucks Coffee Company. All rights reserved.

January 2023

Starbucks Coffee Company • P.O. Box 34067 • Seattle, WA 98124-1067

Supply Chain Security Guidelines
Page | 7•° Outside/Undercarriage° Outside/Inside Doors° Floor (Trailer)° Side Walls° Front Wall
° Ceiling/Roof° Refrigeration Unit (when applicable)° Exhaust
Acceptance of the container indicates inspection has occurred with satisfactory
results.
Please refer to CTPAT 17-Point Inspection Checklist

3.

Security Seals:• A high security seal that meets or exceeds PAS ISO 17712 is affixed to allcontainers/trailers at the location where stuffing occurs.
• Written procedures exist that stipulate how seals are controlled and affixed toloaded containers/trailers.
• Only designated employees distribute container seals.
• Seal number is noted on all related shipping documentation.
• Seal information is verified by each of the parties that handle the container/trailer.
• At each transfer of custody in the entire supply chain the following steps mustoccur:° Verify that the seal is intact, and whether it exhibits evidence of tampering
along the route.
° Verify that the seal number and location of the seal is the same as stated by
the shipper on the shipping documents.
° If the seal is removed in-transit, for any reason including by government
officials, a second seal must be placed on the container/trailer and the sealchange must be documented.
 Properly document the original and second seal numbers
 Immediately communicate this information to the appropriate
party:- US Shipments: Starbucks Global Transportation Operations
via email at cargosecurity@starbucks.com- Non-US Shipments: Destination warehouse

4.

Storage Requirements:• Containers and trailers are to be stored in a secure area to prevent unauthorizedaccess and/or manipulation.
• Procedures are in place for reporting and neutralizing unauthorized entry into
containers/trailers or their storage areas.

© 2003, 2005, 2008, 2010, 2017, 2021 Starbucks Coffee Company. All rights reserved.

January 2023

Starbucks Coffee Company • P.O. Box 34067 • Seattle, WA 98124-1067

Supply Chain Security Guidelines
Page | 8

1.

Less-than Truck Load (LTL):• LTL carriers use a high security padlock or similarly appropriate locking
device when picking up local freight.
• LTL carriers ensure strict controls to limit the access to keys or
combinations that can open these padlocks.
• After the freight from the pickup and delivery run is sorted, consolidated
and loaded onto a line haul carrier destined to the cross the border into
the U.S. and other borders, the trailer is sealed with a high security seal
which meets or exceeds the current PAS ISO 17712 standard for highsecurity seals.
• In LTL or Pickup and Delivery (P&D) operations that do not use consolidation
hubs to sort or consolidate freight prior to crossing the U.S.border andother borders, the importer and/or highway carrier use ISO 17712 highsecurity seals for the trailer at each stop, and to cross the border.
• Container/trailer seal information is verified by each of the parties that
handle the container.
• Written procedures exist that stipulate how seals or high security
padlocks are controlled and affixed to loaded containers/trailers
and are maintained at the terminal/local level as outlined above.

Best Practices
•

•
•
•
•

It is recognized that even though a carrier may not “exercise control” over the loading oftrailers and the contents of the cargo, highway carriers must be vigilant to help ensurethat the merchandise is legitimate and that there is no loading of contraband at theloading dock/manufacturing facility.
Training in conveyance searches should be adopted as part of thecompany’s on-the-job training program.
Seal-control procedures should be briefed to all drivers and there should be amechanism to ensure that these procedures are understood and are being followed.
In the LTL and non-LTL environment, procedures should also exist for recognizing andreporting compromised seals and/or trailers to U.S. Customs and Border Protection,
when appropriate, or the appropriate foreign authority.

© 2003, 2005, 2008, 2010, 2017, 2021 Starbucks Coffee Company. All rights reserved.

January 2023

Starbucks Coffee Company • P.O. Box 34067 • Seattle, WA 98124-1067

Supply Chain Security Guidelines
Page | 9

Physical Access Controls
Access controls will be in place to prevent unauthorized entry to facilities, maintaincontrol of employees and visitors, and protect company assets.

Starbucks Requirements
All supply chain partners and the third parties with whom they conduct business must have, at aminimum, the following physical access controls to prevent unauthorized access:
1.
2.
3.
4.

Employee identification system with written procedures for issuance, removal, andchanging of access.
Visitor monitoring system, including requirement of presentation of photo
identification, maintenance of a log, and escorts of all visitors.
Written procedures for addressing the entry of unauthorized personnel around thisfacility, including production, storage, shipping/receiving and cargo areas.
Drivers delivering or receiving cargo and mail must be positively identified before cargo
or mail is received or released.

Best Practices••

Employees should only be given access to those secure areas needed for the
performance of their duties.
Restricted areas are clearly identified with signage and security.

© 2003, 2005, 2008, 2010, 2017, 2021 Starbucks Coffee Company. All rights reserved.

January 2023

Starbucks Coffee Company • P.O. Box 34067 • Seattle, WA 98124-1067

Supply Chain Security Guidelines
Page | 10

Physical Security
Cargo handling and storage facilities must have physical barriers and deterrents that
guard against unauthorized access.

Starbucks Requirements
All supply chain partners and the third parties with whom they conduct business should have, at aminimum, the following physical security measures to protect against outside intrusion:
1.

Perimeter deterrents such as fencing and manned or monitored gates.

2.

No private parking near cargo handling/storage areas.

3.

Buildings constructed of appropriate materials and protection of all points of accessincluding windows, gates, and fences, with locking devices.

4.

Adequate lighting, alarm systems, and monitoring.

5.

Written procedures for thorough and frequent checks of physical barriers andpreventative maintenance.

Best Practices••

Interior fencing within a cargo handling structure should be used to segregate domestic,
international, high value, and hazardous cargo.
Intrusion detection systems and video surveillance cameras should be utilized to monitor
premises and prevent unauthorized access to cargo handling and storage areas.

© 2003, 2005, 2008, 2010, 2017, 2021 Starbucks Coffee Company. All rights reserved.

January 2023

Starbucks Coffee Company • P.O. Box 34067 • Seattle, WA 98124-1067

Supply Chain Security Guidelines
Page | 11

Personnel Security
Processes must be in place to screen prospective employees and to periodically checkcurrent employees.

Starbucks Requirements
All supply chain partners and the third parties with whom they conduct business must have, at aminimum, the following personnel security procedures in place, unless prohibited by applicable
laws:
1.

Application information is verified prior to employment.

2.

Background checks and investigations are conducted for prospective employees prior
to employment and for current employees periodically.

3.

Procedures are in place for the removal of identification and access to all assets forterminated employees.

Best Practices•

Verify identity by comparing multiple forms of official identification.

© 2003, 2005, 2008, 2010, 2017, 2021 Starbucks Coffee Company. All rights reserved.

January 2023

Starbucks Coffee Company • P.O. Box 34067 • Seattle, WA 98124-1067

Supply Chain Security Guidelines
Page | 12

Procedural Security
Security measures must be in place to ensure the integrity and security of processes
relevant to the transportation, handling, and storage of cargo in the supply chain.

Starbucks Requirements
All supply chain partners and the third parties with whom they conduct business must have, at aminimum, the following procedural controls in place to ensure integrity of information:
1.

2.

Documentation Processing:•Information used in the clearing of merchandise/cargo is legible, complete,accurate and protected against the exchange, loss or introduction of erroneous
information.

•

Documentation control includes safeguarding computer access and information.

Manifesting Procedures:
•

3.

4.

Shipping and Receiving:•

Arriving cargo is reconciled against information on the cargo manifest.

•

The description, weights and quantity of cargo is verified against purchase ordelivery orders.

•Drivers delivering or receiving cargo are positively identified before cargo isreceived or released.

Cargo Discrepancies:
•

5.

6.

Shipment information provided from business partners related to description,weights and quantities is reported accurately and timely.

Shortages, overages, and other significant discrepancies or anomalies are resolved
and/or investigated appropriately.

Security Incidents•

Security incidents are resolved and/or investigated appropriately.

•

Starbucks and relevant government authorities are notified of security breach.

Investigation support – continues onto next page© 2003, 2005, 2008, 2010, 2017, 2021 Starbucks Coffee Company. All rights reserved.

January 2023

Starbucks Coffee Company • P.O. Box 34067 • Seattle, WA 98124-1067

Supply Chain Security Guidelines
Page | 13

6.

Investigation support•

Supply chain partners and the third parties with whom they do business are
obligated to cooperate with Starbucks and/or Starbucks agents during security
investigations.

•

Cooperation in investigations includes making personnel available and providing
any requested documents in a timely manner.

© 2003, 2005, 2008, 2010, 2017, 2021 Starbucks Coffee Company. All rights reserved.

January 2023

Starbucks Coffee Company • P.O. Box 34067 • Seattle, WA 98124-1067

Supply Chain Security Guidelines
Page | 14

Security Education, Training & AwarenessA threat awareness program should be established and maintained by security
personnel to recognize and foster awareness of the threat posed by terrorists andcontraband smugglers at each point in the supply chain.

Starbucks Requirements
All supply chain partners and the third parties with whom they conduct business must have, at aminimum, the following security training and threat awareness programs as they relate to theirindustry:
1.

There is a security and threat awareness program in place for employees.

2.

Verification of completion of training is documented.

3.

Employees are aware of the procedures for addressing and reporting possible threats.

4.

Shipping and receiving employees receive job-specific training for maintaining cargo
integrity, inspecting empty containers, and cargo seal management.

5.

Employees are made aware of the procedures the company has in place to address athreat or security situation and how to report it.

Best Practices•

Security awareness programs should offer incentives for active employee participation.

•

Communications protocols that emphasize the importance of supplying cargo and routing
information only to known and approved parties are created.

•

Create written procedures that include notification procedures for local law enforcement
and/or customs, as necessary, when product anomalies or illegal activities are suspected or
detected•

Conduct tests to validate awareness and improve these procedures on a yearly basis.

© 2003, 2005, 2008, 2010, 2017, 2021 Starbucks Coffee Company. All rights reserved.

January 2023

Starbucks Coffee Company • P.O. Box 34067 • Seattle, WA 98124-1067

Supply Chain Security Guidelines
Page | 15

Cybersecurity & Information Technology Security
A threat awareness program should be established and maintained by security
personnel to recognize and foster awareness of the threat posed by terrorists andcontraband smugglers at each point in the supply chain.

Starbucks Requirements
All supply chain partners and the third parties with whom they conduct business must have, at aminimum, the following Information Technology (IT) procedures in place to guard against the loss
or unauthorized exchange of information:
1.

Documented control procedures for safeguarding computer access and information.

2.

Individually assigned accounts that require a periodic change of password.

3.

Information technology security policies, procedures, and requirements are provided to
employees in the form of training.

4.

Documented process for removal of system access for terminated employees.

5.

A system to identify the abuse of information technology, including improper access,tampering, or the altering of business data.

6.

All systems violators are subject to appropriate disciplinary actions for abuse.

Best Practices•

Company has system that tracks access by user.

•

Access to systems and information is given based on business need.

© 2003, 2005, 2008, 2010, 2017, 2021 Starbucks Coffee Company. All rights reserved.

January 2023

Starbucks Coffee Company • P.O. Box 34067 • Seattle, WA 98124-1067

Supply Chain Security Guidelines
Page | 16

Cargo Tracing in RouteHighway Carriers must ensure that conveyance and trailer integrity is maintained while
the conveyance is en route transporting cargo to and within the U.S. and other borders
by utilizing a tracking and monitoring activity log or equivalent technology.

Starbucks Requirements
All supply chain partners and the third parties with whom they conduct business must ensure thatthey and their business partners have, at a minimum, the following cargo tracing measures in place:
1.

2.

3.

Highway carriers ensure that conveyance and trailer integrity is maintained while theconveyance is en route transporting cargo by utilizing a tracking and monitoring activity
log or equivalent technology. If driver logs are utilized, they must reflect that trailer
integrity was verified.
Highway carrier management performs a documented, periodic, and unannounced
verification process to ensure the logs are maintained and conveyance tracking, andmonitoring procedures are being followed and enforced.
During Department of Transportation Inspections (DOT) or other physical inspections
on the conveyance as required by state, local or federal law, drivers report anddocument any anomalies or unusual structural modifications found on the conveyance.

Best Practices•••

Predetermined routes should be identified.
Procedures should consist of random route checks along with documenting transit
details such as; verifying the length of time between the loading point and the trailer
pickup, the U.S. and other borders, and the deliver destinations during peak and nonpeak times.
Drivers should notify the dispatcher of any route delays due to weather, traffic and/or
rerouting.

© 2003, 2005, 2008, 2010, 2017, 2021 Starbucks Coffee Company. All rights reserved.

January 2023

Starbucks Coffee Company • P.O. Box 34067 • Seattle, WA 98124-1067

Supply Chain Security Guidelines
Page | 17

Audits & Assessments
Periodic reviews of business partners, processes and facilities should be conducted toassess, mitigate risk, and maintain security standards.

Starbucks Requirements
Audits allow an organization to collaborate in real-time directly with its own security programs or
supply chain partners. Audits may be completed internally by the business, or an external security
auditor may be hired to complete the inspection. A security audit must:
1.
2.
3.
4.

Establish firm audit/inspection procedures in writing as to what needs to be inspected
and how often.
Cover areas of documented policies and essential procedures of the security program(as listed in this document).
Use checklists to ensure audits and inspections are done correctly
Proactively use audit/inspection results to close gaps, improve efficiency and mitigate
risk.

© 2003, 2005, 2008, 2010, 2017, 2021 Starbucks Coffee Company. All rights reserved.

January 2023