How CTPAT and OEA Can Change the Way You Evaluate an Industrial Site

Why supply chain security should be evaluated before signing the lease—not after operations begin.

For many years, industrial site selection focused on factors such as location, rent per square meter, workforce availability and utility capacity. If the numbers worked, the property was considered a good fit. That approach was often enough when supply chain security relied mainly on procedures and internal controls. Today, however, with tighter customs oversight across North America and the relocation of supply chains, that equation is no longer sufficient.

For companies involved in importing or exporting, a facility must do more than operate efficiently. It must also be designed—or capable of being adapted—to support the physical and operational controls required by programs such as CTPAT (Customs Trade Partnership Against Terrorism), administered by U.S. Customs and Border Protection (CBP), and Mexico’s OEA (Authorized Economic Operator) program, administered by SAT.

The question is no longer simply, “How much is the rent?” It is also, “Can this property support the security model our supply chain requires without creating unsustainable additional costs?”

Why Facility Design Matters for CTPAT/OEA Compliance

CTPAT and OEA are not simply sets of policies to file away. They represent risk management frameworks that customs authorities evaluate against the physical reality of the facility: fencing, access points, yards, loading docks, lighting, video surveillance and internal flows. When a company applies for or renews its certification, the auditor does not only review the procedures manual—it also evaluates whether the building can actually support what those procedures require.

If the selected property lacks the right layout, space, or legal flexibility to accommodate those controls, the company may end up compensating for the building’s limitations with costly manual procedures that are more vulnerable to human error. Security then becomes a reactive expense that could have been addressed earlier during the site selection and lease negotiation process.

Location Is Also Part of the Risk

The assessment does not end at the industrial park’s perimeter fence. The surrounding environment can create external vulnerabilities that undermine the security measures inside the facility. Every supply chain manager should ask: What happens to cargo security once the truck leaves the gate?

The surrounding logistics environment can shape cargo exposure during the first miles of transit:

Property Design Can Make Security Controls Easier—or More Difficult

The facility layout provides the physical foundation for security. A well-designed industrial property makes it possible to apply a Security by Design approach, creating successive layers of protection from the outside perimeter to the interior of the facility.

The following table shows how CTPAT/OEA security criteria translate into specific physical requirements for the property:

Sources: CTPAT/OEA criteria and their physical application to industrial facilities.

How CTPAT/OEA Requirements Can Increase Industrial Property Costs 

Two buildings in the same industrial park may look nearly identical on paper: similar size, comparable clear height and similar base rent. But when evaluated against CTPAT/OEA requirements, the difference in required upgrades can amount to hundreds of thousands of dollars.

The following table illustrates how those differences can affect a Site Selection decision:

 Source: Prodensa analysis based on illustrative cost estimates.  

The lowest rent does not always mean the lowest total cost of occupancy (TCO). If retrofit CAPEX is amortized over the lease term, Building B may ultimately cost more per square meter than Building A. And that does not include recurring security OPEX.

As an illustrative reference, two 24/7 security posts can represent $120,000 to $200,000 per month, in addition to CCTV monitoring, maintenance and industrial park fees. A property with poorly designed access points may require more guards per shift throughout the entire lease term.

Existing Building vs. Build-to-Suit: What Changes?

The question is not which option is “better,” but rather how important design flexibility is for your operation.

• Existing Building: Offers a faster startup, typically 3 to 6 months, but comes with inherited physical limitations that may require costly security retrofits and negotiations with the landlord.
• Build-to-Suit: Allows security requirements to be incorporated from the architectural design stage, supporting built-in compliance and spreading CAPEX over a long-term lease, although execution usually takes longer, around 12 to 24 months.

Comparison of Both Models and Their Security and Contract Implications

 Source: Prodensa analysis.  

The decision is not simply about which option is “better,” but about how critical design flexibility is to your security model and how quickly the operation needs to launch. An existing building may be the right choice if the property was already designed with strong security standards and only minor retrofits are required. A Build-to-Suit (BTS) may make more sense when the security layout is a strategic requirement and the project timeline allows for a longer development period.  

Security and Operations Should Be Evaluated Together

A financially attractive real estate decision can create daily operational friction that reduces productivity and compromises compliance. Security controls should not become obstacles—they should work with the operation, not against it.

Common areas of friction include:

 The rule is simple: security controls should support the operation, not work against it. 

• Red Flags to Review During Site Selection

During the due diligence of industrial properties, certain conditions may indicate that implementing CTPAT/OEA requirements could become disproportionately expensive.

Identifying one of these red flags does not automatically disqualify the property. It means the site may require more rigorous cost analysis, specific lease negotiations or a mitigation plan before signing.

Site Selection Red Flags and Their Potential Risks

• Security Also Impacts CAPEX, OPEX, and the Startup Schedule

Treating CTPAT and OEA as purely customs-related requirements overlooks the financial reality of industrial development. Security directly affects three key business variables:

• CAPEX. The amount depends on the condition of the infrastructure at the time the lease is signed. Typical pre-startup investments may include perimeter wall reinforcement, civil works for security booths, IP video surveillance with analytics and backup servers, and access-control equipment such as turnstiles, impact barriers, RFID, biometrics, and license plate recognition (LPR).

• OPEX. The physical configuration of the property determines recurring fixed costs. Poorly designed access points can require more guards per shift, while CCTV systems, electric fencing, automated gates, and common area maintenance (CAM) fees add ongoing operating expenses.

• Startup schedule. Facility upgrades can delay the launch date. Specialized equipment may involve 8–16 week lead times, exterior work may require municipal construction permits, and the validation audit can only be scheduled once the facility is complete and operating under defined procedures. Delays in physical infrastructure can postpone certification and delay access to expedited border-processing benefits.

• Who Should Participate in This Evaluation?

Leaving site selection exclusively in the hands of Real Estate teams or external real estate advisors can create costly blind spots. Real estate professionals are typically focused on rent negotiations, NNN lease terms, and commercial conditions, but they may not necessarily cover the technical requirements associated with CTPAT/OEA.

The evaluation should therefore be multidisciplinary:

 Source: Prodensa analysis.  

The earlier these teams evaluate the site together, the fewer surprises are likely to emerge after the lease is signed.

Supply Chain Security Starts with the Site

International supply chain security is not an administrative layer that can simply be added once a facility is built and operating. It is a discipline that begins with selecting the right site and building.

 As cross-border agility and operational resilience become increasingly important to competitiveness, traditional site selection criteria—rent, workforce, and location—must expand to include a property's ability to meet CTPAT and OEA security requirements. This means integrating security into real estate due diligence, evaluating total cost of ownership (TCO), including retrofit CAPEX and ongoing security OPEX, negotiating protective lease provisions such as tenant improvement allowances (TIA), perimeter modification rights, and restoration clauses, and assessing external security risks. By addressing these factors early, companies can avoid unexpected costs and delays while establishing operations with infrastructure designed to protect supply chains and support international trade. 

Ultimately, a Site Selection decision is also a supply chain security decision. And security decisions should be made before signing the lease—not after operations begin.

• CTPAT: The Customs Trade Partnership Against Terrorism, a U.S. Customs and Border Protection program designed to strengthen supply chain security through risk-based controls.

• MSC (Minimum Security Criteria): The physical and operational security requirements used to evaluate areas such as access control, perimeter protection, cargo handling, CCTV, and trailer management. 

• TCO (Total Cost of Occupancy): The full cost of occupying a facility, including rent, required upgrades, security CAPEX, recurring OPEX, and other operating expenses—not just the base lease rate. 

• Build-to-Suit (BTS): An industrial facility designed and developed around a company’s specific operational and security requirements, allowing CTPAT/OEA considerations to be incorporated from the design stage.

Why should CTPAT/OEA be considered during Site Selection?

Because many security requirements depend on the physical characteristics of the property, including access points, perimeter controls, yards, CCTV coverage, and cargo-handling areas.

What facility features matter most for CTPAT/OEA readiness?

Key elements include controlled access, secure perimeter fencing, trailer segregation, inspection areas, lighting, CCTV, and internal separation of sensitive operations.

Is Build-to-Suit better than an existing building for CTPAT/OEA?

Not necessarily. Existing buildings can offer faster startup, while Build-to-Suit provides greater design flexibility to integrate security requirements from the beginning.

Who should evaluate CTPAT/OEA requirements before signing a lease?

The process should involve Real Estate, Trade Compliance, Corporate Security, IT, Operations, Engineering, Project Management, and EHS so security, cost, and operational needs are evaluated together.

• CTPAT/OEA readiness should begin with Site Selection. Many security requirements depend on the property itself, not only on procedures implemented after startup. 
• The lowest rent may not deliver the lowest total cost. Security retrofits and recurring OPEX can significantly change the economics of a facility. 
• Security should support operations, not create friction. Yard design, loading areas, access control, and inspection spaces should work with daily workflows. 
• Existing buildings and Build-to-Suit projects require different security strategies. The right choice depends on startup urgency, retrofit needs, and the importance of design flexibility. 
• A Site Selection decision is also a supply chain security decision. Evaluating CTPAT/OEA requirements before signing can reduce unexpected costs, delays, and operational risk.

Notice: The content of this blog is developed by Prodensa for informational and educational purposes regarding nearshoring, foreign trade, human capital, and manufacturing in Mexico. Although we strive to keep the information accurate and up to date, laws and regulations may change. This material is not a substitute for specialized professional advice. Prodensa is not responsible for decisions made based on this content without appropriate professional consultation.