ISO 17712 High-Security Seals and Seal Log Control

The bolt seal on the container doors reads 4417-AX-0921. The bill of lading says 4417-AX-0912. Nobody tampered with anything; a clerk swapped two digits when keying the shipping instructions. The box still waits for an examination, the consignee still pays for the extra moves, and the security officer still writes an incident report explaining a seal that was never broken.

A seal is a numbered piece of hardware whose value depends almost entirely on paperwork. ISO 17712 tells you whether the hardware is strong and tamper-evident; your seal log decides whether the number on the door can be trusted. Get both right and a discrepancy becomes a fifteen-minute check rather than a held container.

• What this guide covers: what ISO 17712 certifies, how the I, S and H classes are earned, the marks on a compliant seal, where the seal number must match across export documents, India's RFID e-seal rules, and the discrepancy routine.
• What it adds: a SQL reconciliation for the seal log, an e-seal data error traced from portal to port gate, an annual programme cost in dollars and rupees, and a buying and audit checklist.

What ISO 17712 certifies about a seal, and what it leaves to you

ISO 17712 certifies the seal, not the sealing. The standard classifies mechanical freight container seals by strength and tamper evidence and sets rules for marking and manufacturer practices; it expressly leaves selection, storage, accounting, application and documentation to the user.

The current text is ISO 17712:2013, the second edition, prepared by ISO/TC 104 and replacing the 2010 edition. Its scope note says the purpose of a seal, as part of a security system, is to show whether a container has been entered through its doors, and that seals work only if users "properly select, store, account for, apply, document, and attend to" them. Those user duties sit outside the standard.

• Inside the standard: seal classes, the four physical tests, marking and identification, tamper-evidence design, and the security practices a seal manufacturer must follow under its normative Annex A.
• Outside the standard: who may issue a seal, how the seal log is kept, where the seal goes on the door, how its number reaches the shipping documents and what happens when the number does not match.
• Who fills the gap in the US: CBP's CTPAT Minimum Security Criteria, which require ISO 17712 high-security seals and written seal procedures; our guide to CTPAT minimum security criteria covers the programme and the VVTT check in detail.
• Who fills the gap in India: CBIC circulars on self-sealing, which require exporters' RFID e-seals to meet ISO 17712:2013 (H) and tie each seal to a shipping bill.

ISO 17712:2013 classifies container seals as indicative, security or high-security and requires certification of physical tests and manufacturer practices, but its scope note leaves selection, storage, accounting, application and documentation to users; CTPAT criterion 6.1 and CBIC Circular 36/2017-Customs supply those controls for US trade and Indian self-sealed exports.

Indicative, security and high-security: how a seal earns its class

A seal's class is set by its weakest test result on any sample. A model rated H has passed every physical test at the high-security level and comes from a manufacturer whose practices and tamper-evidence features have been audited.

The definitions describe the intent of each class. A high-security seal is made of metal or metal cable and is meant to delay intrusion, though substantial bolt or cable cutters can remove it. A security seal gives limited resistance and needs only lightweight tools. An indicative seal can be broken by hand or with a simple snipping tool, so it shows entry without resisting it.

The test regime is specific. There are four procedures, with the impact test run twice at different temperatures, and five samples for each of the five tests, so 25 samples per classification. Samples are drawn at random from stock for sale, tested by a laboratory accredited to ISO/IEC 17025 with this standard in its scope, and retested every two years or after a meaningful design or material change.

• Lowest result rules: one sample that fails the H level on one test drops the whole model to the class it did reach.
• Bolt seal diameter: metal components of a bolt seal must be at least 18 mm in diameter, a pass-or-fail check added because 17 mm seals could be pulled intact through worn container hasps.
• Tamper evidence: attempts to open and re-close a seal must leave visible evidence, such as cracks, colour change or abrasion, recognisable without a magnifying glass.

Reading a seal: the marks, the number and the certificate behind them

A compliant seal carries three things you can check at the dock: the manufacturer's name or logo, a unique number and the class letter. The certificate that justifies the letter sits with the seal buyer, and an auditor will ask to see it.

Clause 4.2 of ISO 17712 requires unique, permanent identification marks and numbers, the identity of the manufacturer or private-label holder on every seal, and a legible I, S or H mark. Changing the marking must cause obvious, irreversible damage. Where a bar code is used, it must follow ISO/IEC 15417, the Code 128 symbology, so that a dock scanner reads it without a custom format.

• Customs-owned seals: seals bought by a customs administration carry words or markings that authority designates, plus a unique number.
• Private seals: seals used by shippers, manufacturers or carriers must be legibly marked and uniquely numbered, and may carry a company name or logo.
• Reusable devices: the seal number should sit on the part that is cut off, so the device cannot be reused with the same number.

The paperwork behind the mark is the part buyers skip. The manufacturer needs a test report from an ISO/IEC 17025 laboratory for the model and an Annex A compliance certificate from an accredited process review organisation. CTPAT criterion 6.5 asks members that hold seal stock to show a laboratory testing certificate proving compliance, and Indian e-seal vendors must lodge manufacturer certificates with CBIC before selling.

Seal purchasing files for CTPAT criterion 6.5 should hold the ISO/IEC 17025 laboratory report and the ISO 17712 Annex A manufacturer certificate for each seal model, both dated within two years, because ISO 17712:2013 clause 5.1.2 requires retesting every two years or after any meaningful design or material change.

One seal number, several documents: where it has to match

A seal number is keyed or scanned at least four times between the loading dock and the destination terminal, and every copy must match the hardware. Most seal discrepancies are transcription errors at one of these hand-offs, not tampering.

On a US import, the carrier's cargo declaration must state the seal numbers for all seals affixed to containers under 19 CFR 4.7a(c)(4)(xiv), and the same section requires the container and seal numbers beside each bill of lading on the manifest. In India, terminal forms for export gate-in carry seal fields too; the e-Form 13 used at one Nhava Sheva terminal, for example, has mandatory fields for the line or agent seal and the customs seal.

The control that prevents most mismatches is simple: the seal number on the shipping instructions is scanned from the seal itself, or copied from the issue log, never typed from a photo or a driver's call. A bar-coded seal and a handheld scanner remove the transposition errors that cause the majority of false alarms.

Building a seal log that reconciles to stock and shipments

A seal log is a stock ledger with serial numbers. Every number received must end in exactly one state: in stock, issued and used on a shipment, voided with the pieces retained, or reported lost, and the counts must close every audit.

CTPAT criterion 6.1 requires written procedures covering restricted access, secure storage, recording receipt and issue in a log, and tracking seals through it. Criterion 6.6 requires management or a security supervisor to audit seal stock periodically against the log and the shipping documents, with documented results. The query below runs the four checks an auditor applies, against tables most warehouse or yard systems already hold.

-- Seal log reconciliation, run before each periodic audit
-- seal_receipt(seal_no, box_id, received_at)
-- seal_issue(seal_no, issued_to, issued_at, status)   -- status: USED, VOID, LOST
-- shipment_seal(shipment_id, container_no, seal_no, doc_type)  -- SI, BL, EFORM13

-- 1. Received seals never issued and not in the counted stock
SELECT r.seal_no FROM seal_receipt r
LEFT JOIN seal_issue i ON i.seal_no = r.seal_no
WHERE i.seal_no IS NULL
  AND r.seal_no NOT IN (SELECT seal_no FROM stock_count WHERE count_id = :audit_id);

-- 2. Seal numbers on shipping documents that the log never issued
SELECT s.shipment_id, s.seal_no FROM shipment_seal s
LEFT JOIN seal_issue i ON i.seal_no = s.seal_no AND i.status = 'USED'
WHERE i.seal_no IS NULL;

-- 3. One seal number on more than one container
SELECT seal_no, COUNT(DISTINCT container_no) AS boxes
FROM shipment_seal GROUP BY seal_no HAVING COUNT(DISTINCT container_no) > 1;

-- 4. Documents for one shipment that disagree on the seal number
SELECT shipment_id FROM shipment_seal
GROUP BY shipment_id HAVING COUNT(DISTINCT seal_no) > 1;

-- Closing check: received = in_stock + used + void + lost  (difference must be 0)

Query 4 catches the transposed-digit case from the opening paragraph before the box leaves the yard: the shipping instructions and the stuffing report disagree, and the documentation team corrects the instructions while the carrier still accepts amendments. Query 2 is the one that matters most for security, because a number the log never issued may mean a seal from outside the controlled stock.

India's RFID e-seal for self-sealed export containers

Indian exporters who stuff and seal containers at their own premises use RFID e-seals rather than officer-supervised sealing. The e-seal must meet ISO 17712:2013 (H) and the ISO/IEC 18000-6 Class 1 Gen 2 RFID standard, and its data record links the seal to a shipping bill.

The procedure comes from CBIC Circular 26/2017-Customs of 1 July 2017, which replaced supervised factory stuffing with self-sealing, and Circular 36/2017-Customs of 28 August 2017, which set the e-seal standards. Circular 37/2017-Customs of 20 September 2017 required vendors to submit self-attested manufacturer certificates to CBIC before selling, to re-submit them on any change of manufacturer, and to capture each seal's tag identification (TID) linked to the exporter's IEC.

• Data tagged to the seal: IEC, shipping bill number and date, e-seal number, date and time of sealing, destination customs station, container number and trailer or truck number, entered on the vendor's web or mobile application.
• No edits after confirmation: the JNCH FAQ states that data confirmed against an e-seal cannot be deleted or edited, so a wrong entry means blocking that seal and using a new one.
• Reading at the port: customs reads the seal with a handheld or fixed reader; "NOT TAMPERED" proceeds towards the Let Export Order, while "TAMPERED" sends the consignment for physical examination.
• One shipping bill per seal: the FAQ says only one shipping bill can be assigned to an e-seal record; additional bills travel as physical dockets.

The reading step has recently been centralised at one major port. A Jawaharlal Nehru Custom House public notice dated 1 September 2025 reported 16 approved e-seal vendors, each with its own reader, and announced a universal reader at the JNPA Centralised Parking Plaza, live from 7 August 2025. ICEGATE passes the vendor sealing data to the plaza, the gate reader validates the seal against it, and the gate receipt confirms verification.

Indian self-sealed export containers carry RFID e-seals meeting ISO 17712:2013 (H) and ISO/IEC 18000-6 Class 1 Gen 2 under CBIC Circular 36/2017-Customs; at the JNPA Centralised Parking Plaza a universal reader live since 7 August 2025 validates each seal against ICEGATE sealing data, and a TAMPERED read triggers physical examination.

A tagged e-seal that named the wrong container, traced to the gate

Because confirmed e-seal data cannot be edited, a keying error at the factory surfaces only at the port gate. The illustrative trace below follows one such error and shows the check that would have caught it before the truck left.

• 14:05, exporter's dispatch office: the clerk tags e-seal number 00418827 on the vendor portal to shipping bill 7712046 and container TGHU 518204-0; the container actually being loaded is TGHU 518240-9, and the portal accepts the entry because both numbers are valid.
• 14:20, loading bay 2: the loader applies e-seal 00418827 to TGHU 518240-9, records it on the stuffing report, and the truck leaves with its GST transport documents.
• 19:40, port parking plaza gate: the reader returns the seal intact but the ICEGATE record names TGHU 518204-0; the gate does not issue a verified receipt, and the box is diverted for officer examination.
• Next day, 11:30: after examination the officer reseals the box and the exporter's broker files the explanation; the container misses its vessel cutoff and is rolled to the next sailing five days later.
• Controlled version: the dispatch clerk scans the container number from the box door into the portal, and the loading lead compares the portal printout with the door and seal before the truck leaves, a check taking about two minutes.

Our article on the Let Export Order and export general manifest covers what happens after the seal is verified. The trace here ends earlier, at the point where a clean seal and a dirty data record produce the same delay as a broken seal.

Handling a seal discrepancy from the gate to the claim file

A seal discrepancy is a broken seal, a missing seal or a number that does not match the documents. Treat every one as a security event until the evidence shows otherwise, and record it in a way that will also support a cargo claim.

CTPAT criterion 6.1 sets the minimum routine for members: written steps for an altered, tampered or wrongly numbered seal, documentation of the event, communication with partners, an investigation with documented findings and prompt corrective action. When a load is examined, the replacement seal number is recorded, and the shipper, broker and importer are told of the change.

• Photograph before touching: door, hasp, seal number and any damage, with a timestamp and the container number in frame.
• Compare three sources: the seal in hand, the issue log entry and the bill of lading or e-seal record; a single-digit difference with an intact seal points to transcription.
• Keep the physical seal: bag and label the cut seal with the reason and the cutter's name; it is evidence for both investigators and insurers.
• Report as required: CTPAT members report compromised seals to CBP and the relevant foreign authority where applicable; in India, a TAMPERED reading is handled through customs examination at the port.
• Open the claim file early: note shortage or damage on the delivery receipt before signing, because a clean receipt weakens a later claim against the carrier.

Not every discrepancy leads to an examination, and not every examination comes from a seal. Our guide to a customs exam hold explains the US examination process and its costs once a container has been selected.

Seal programme cost in dollars and rupees against one discrepancy

A well-run seal programme costs a few dollars or a few hundred rupees per container, and a single held container can cost more than a year of seal stock. The worked example compares both, using illustrative figures except where noted.

The model assumes 1,200 export containers a year at each site, a 5% allowance for voided seals, two minutes of scanning and logging per container in the US and three minutes of portal entry in India, and a quarterly four-hour audit. The ₹300 e-seal price is the approximate figure in the JNCH FAQ, before tax and transport; all other prices are illustrative.

On these figures one discrepancy costs about 47% of the US programme and about 7% of the Indian one, where the seal itself dominates. Either way, preventing two or three transcription errors a year pays for the scanners and the audit time, which is the business case most security managers need.

Seal checks a system enforces and calls a security lead keeps

Number matching is exact and belongs in software; judging whether a seal has been tampered with is visual and stays with a trained person. Tools that read images can speed the visual check, but they do not decide it.

Buying and auditing container seals: a documentation manager's checklist

Seal control is complete when purchasing, issue, documentation and discrepancy handling each have a test that can pass or fail. The checklist sets one for each stage, so an internal audit and a customs validation look at the same evidence.

For the wider set of trade and transport document guides, see the Logistics and Supply Chain hub. If you want seal issue, scanning and reconciliation built into your yard, warehouse or export documentation system, tell us about your operation.