Authorised Economic Operator (AEO) Programmes - Global Standards
WCO SAFE Pillar 1 - Customs-to-Customs

Authorised Economic Operator (AEO) Programmes - Global Standards P1-S1: Advance Electronic Information

The Customs administration requires advance electronic information on cargo and conveyances in time for risk assessment to be carried out before arrival or departure.

Maintained by Gerard BlokdykVerified against the published standard Control text last updated

What else in your programme already covers this

This control maps to 131 controls across 70 other frameworks. If you already hold one of them, the evidence you collected for it is the starting point here rather than new work.

BSI IT-Grundschutz · 3 controls

  • BSI-13 Risk assessment procedures
  • BSI-15 Security categorization
  • BSI-17 Continuous monitoring strategy

ISO/IEC 23894:2023 · 3 controls

  • ISO23894-6.3 AI Risk Assessment
  • ISO23894-6.3.1 AI Risk Identification
  • ISO23894-6.3.3 AI Risk Evaluation

ISO/IEC 29134:2023 · 3 controls

  • 29134-1 Scope
  • 29134-3 Terms and definitions
  • 29134-9.1 PIA report structure

NIST SP 800-53 Rev 5 · 3 controls

Responsible Minerals Initiative (RMI) - Responsible Minerals Assurance Process · 3 controls

  • RMI-DD-2 Supply Chain Information Collection
  • RMI-SEG-2 Environmental Standards
  • RMI-SEG-3 OHS and Governance

SSAE 18 - Attestation Standards (SOC Reporting) · 3 controls

  • SSAE18-CC3.1 CC3.1 - COSO Principle 6: Risk Identification
  • SSAE18-CC3.2 CC3.2 - COSO Principle 7: Risk Analysis
  • SSAE18-SOC1-02 Risk Assessment

API 1164 · 2 controls

  • API1164-07 Remote Access
  • API1164-24 Vulnerability assessment for critical systems

EASA Part-IS - Information Security in Aviation · 2 controls

  • IS.D.OR.205 Information Security Risk Assessment
  • IS.I.OR.205 Information Security Risk Assessment

French Sapin II Law (Law No. 2016-1691) · 2 controls

  • Sapin2-Pillar3-Risk-Mapping Pillar 3 - Corruption Risk Mapping (Cartographie des Risques)
  • Sapin2-Pillar4-ThirdParty-DueDiligence Pillar 4 - Third-Party Due Diligence (Clients, Suppliers, Intermediaries, M&A)

ICAO Annex 17 - Aviation Security (AVSEC) · 2 controls

  • ICAO-ANX17-Chap2-ThreatAssessment-RiskManagement-Cyber-GASeP ICAO Annex 17 Chapter 2 - Threat Assessment + Risk Management + Cyber Threats to Critical Aviation Systems (Amendment 17/18)
  • ICAO-ANX17-Chap4-Cargo-Mail-Catering-Stores-Supplies-RegulatedAgent-KnownConsignor ICAO Annex 17 Chapter 4 - Cargo + Mail + Catering + Stores + Supplies Security + Regulated Agent + Known Consignor + Supply Chain

IEC 62443 · 2 controls

  • IEC62443-07 Personnel risk assessment
  • IEC62443-24 Vulnerability assessment for critical systems

ISO/IEC 27003:2017 · 2 controls

  • ISO27003-6.1 Actions to address risks and opportunities
  • ISO27003-8.2 Information security risk assessment

ISO/IEC 27019:2024 · 2 controls

  • ISO27019-07 Personnel risk assessment
  • ISO27019-24 Vulnerability assessment for critical systems

ISO/IEC 27557:2022 - Organisational Privacy Risk Management · 2 controls

  • 27557-4.3 Individual impact consideration
  • 27557-6.3 Privacy risk assessment

NIST Cybersecurity Framework 2.0 · 2 controls

  • NIST-CSF-GV.RM-07 Strategic opportunities (i.e., positive risks) are characterized and are included in organizational cybersecurity risk discussions
  • NIST-CSF-ID.RA-09 The authenticity and integrity of hardware and software are assessed prior to acquisition and use

NIST SP 1800-32 · 2 controls

SQF Code Edition 9 - Safe Quality Food · 2 controls

  • 2.4.4 Hazard Analysis and Risk Assessment
  • 2.7.2 Food Fraud Plan

South Korea ISMS-P · 2 controls

  • ISMSP-MS-02 Risk Management
  • ISMSP-SYS-04 Vulnerability Management

Switzerland New Federal Act on Data Protection (nFADP/nDSG, 2023) · 2 controls

  • CH-FADP-21 Data protection impact assessments
  • FADP-7 Data Protection Impact Assessment (Articles 9-10)

UAE Virtual Asset Regulatory Authority (VARA) Regulations · 2 controls

  • CRM-1 AML/CFT Compliance
  • CRM-4 Business Risk Assessment

UNESCO Recommendation on the Ethics of AI · 2 controls

  • UNESCO-AI-PA1 Ethical Impact Assessment
  • UNESCOAI-1 Principles 1-3: Proportionality, Safety, Fairness

AICPA Privacy Management Framework (PMF) · 1 control

AML/CTF Act 2006 (Australia) · 1 control

  • AMLCTF-PartA-RiskAssess ML/TF Risk Assessment

APRA CPS 230 Operational Risk Management · 1 control

  • CPS230-11 Identification, Assessment and Management of Operational Risk

APRA SPS 220 Risk Management (Superannuation) · 1 control

  • SPS220-22 Framework Enabling Strategies, Policies, Procedures and Controls

ASIS SPC.1-2009 - Organizational Resilience Standard · 1 control

  • 4.3.1 Risk Assessment and Impact Analysis

AWWA Cybersecurity Guidance for the Water Sector (American Water Works Association) · 1 control

  • AWWA-1.2 Risk Assessment

Annex 11 to EU GMP - Computerised Systems · 1 control

Bahrain PDPL · 1 control

Barbados Data Protection Act 2019 · 1 control

  • BB-DPA-20 Sections 50-60 - Registration and Responsibilities

C-TPAT - Customs-Trade Partnership Against Terrorism · 1 control

FBI CJIS Security Policy · 1 control

  • CJIS-17 Risk Assessment

FedRAMP High · 1 control

  • RA-1 Policy and Procedures

FedRAMP Moderate · 1 control

  • RA-1 Policy and Procedures

Federal Decree-Law No. 45 of 2021 on the Protection of Personal Data (UAE PDPL) · 1 control

  • UAE-PDPL-Art.18_19_20_21 Security measures, controller/processor relationship, DPIA (UAE PDPL Articles 18-21)

GDPR · 1 control

ISO 22313:2020 - Guidance on Business Continuity Management Systems · 1 control

  • ISO-22313-8.2 Business impact analysis and risk assessment

ISO 26262:2018 - Functional Safety for Road Vehicles · 1 control

  • ISO-26262-3-7 Hazard analysis and risk assessment (HARA)

ISO 27799:2025 · 1 control

  • ISO27799-06 Security management process and risk analysis

ISO/IEC 27031:2011 · 1 control

  • 27031-7.2 Resource Requirements

ISO/IEC 29147:2018 · 1 control

  • 29147-5.11 Researcher Safe Harbour and Legal Posture

Kuwait National Cybersecurity Framework · 1 control

NFPA 1600 - Standard on Continuity, Emergency, and Crisis Management · 1 control

  • NFPA1600-5.1 Risk Assessment

NIST SP 800-190 · 1 control

PDPA Singapore · 1 control

  • PDPASG-4 Children's Data, DPIA, and Privacy by Design

PDPA Thailand · 1 control

  • PDPATH-4 DPIA, Privacy by Design, Children's Data

POPIA · 1 control

  • POPIASA-4 Special Personal Information, Children, Information Quality, Documentation

Qatar DPL · 1 control

  • QATAR-7 DPO, Records, Retention, Marketing, Training

SANS Incident Handler's Handbook and PICERL Methodology · 1 control

  • PICERL-P2 Risk Assessment

SEC Climate Disclosure Rule · 1 control

  • SECCLIM-2 Risk Management: Identification, Assessment, Integration

SOC for Cybersecurity - Cybersecurity Risk Management Examination · 1 control

  • SOC-CY-DC5 Risk Assessment Process

Saudi Arabia PDPL · 1 control

  • SA-PDPL-21 Data protection impact assessments

Security of Critical Infrastructure Act 2018 (SOCI) · 1 control

  • SOCI-S30CU Vulnerability assessments

Singapore Cybersecurity Act 2018 · 1 control

  • SCA-S10 Annual Risk Assessment

Singapore Government Instruction Manual on ICT&SS Management (IM8) · 1 control

  • IM8-SEC.4 Vulnerability Management

South Korea PIPA · 1 control

  • PIPA-CPO-DPO-Privacy-Officer-PIA-Personal-Information-Impact-Assessment-Articles-31-33 Korea PIPA CPO + DPO + Privacy Officer + PIA + Personal Information Impact Assessment + Articles 31-33

TSA Pipeline Cybersecurity Directives · 1 control

  • TSAPIPE-1 Cybersecurity Implementation Plan and Coordinator

Taiwan PDPA · 1 control

  • TAIWAN-3 Data Subject Rights

Texas Data Privacy and Security Act (TDPSA) · 1 control

  • TEXASTDPSA-3 Sensitive Data, Children, Sale Notice

UK AI Regulation Framework · 1 control

  • UKAI-1 Risk-Based Approach and Pro-Innovation Principles

UK Age Appropriate Design Code (Children's Code) · 1 control

  • Standard 2 Data Protection Impact Assessments

UK FCA/PRA Operational Resilience Framework · 1 control

  • UKOPRES-3 Self-Assessment and Board Engagement

UK GDPR (UK General Data Protection Regulation) · 1 control

  • UKGDPRREG-3 Controller and Processor (Articles 24-43)

UK Modern Slavery Act 2015 · 1 control

  • s.54(5) Statement Content Requirements

UK Security and Emergency Measures Direction (SEMD) - Water Industry · 1 control

  • SEMD-SP-2 Risk Identification and Assessment

UNICEF Policy Guidance on AI for Children (2021) · 1 control

  • UNICEFAI-4 Transparency, Explanation, Adult Capacity

US Consumer Product Safety Act (CPSC) Manufacturer and Importer Duties · 1 control

  • CPSC-RA.3 Lifecycle Risk Assessment

Uruguay DPL · 1 control

  • URUGUAY-5 Database Registration with AGESIC URCDP

Vietnam PDPD · 1 control

  • VIETNAMPDP-3 Data Subject Rights

Virginia CDPA · 1 control

  • VIRGINIAVCDPA-3 Sensitive Data Consent and Children

Every mapping shown was judged rather than inferred from wording similarity, and the ones that failed review are published too. See the coverage reports and what was rejected.

Other controls in WCO SAFE Pillar 1 - Customs-to-Customs

Query this from an agent

The graph holds this control, the 131 it maps to, and the evidence behind each claim, over MCP and REST.

MCP endpointAll Authorised Economic Operator (AEO) Programmes - Global Standards controls