2016 12373

34166 Federal Register / Vol. 81, No.
103 / Friday, May 27, 2016 / Rules and Regulations
DEPARTMENT OF HEALTH AND C. Require Measures Only in the Event of pack, or hold food and are required to
HUMAN SERVICES a Credible Threat register under section 415 of the FD&C
D. General Comments on Implementation Act (21 U.S.C. 350d). Section 419 of the
Food and Drug Administration and Compliance
FD&C Act (21 U.S.C. 350h) addresses
E. Comments on Requests for Additional
Exemptions intentional adulteration in the context
21 CFR Parts 11 and 121 F. Other General Comments of fruits and vegetables that are raw
[Docket No. FDA–2013–N–1425] G. Other Issues Discussed in the Proposed agricultural commodities. Section 420 of
Rule the FD&C Act (21 U.S.C. 350i) addresses
RIN 0910–AG63 IV. Subpart A: Comments on Specific intentional adulteration in the context
Provisions of high-risk foods and exempts farms
Mitigation Strategies To Protect Food A. Revisions to Definitions Also Used in except for farms that produce milk. FDA
Against Intentional Adulteration Section 415 Registration Regulations (21
is implementing the intentional
CFR Part 1, Subpart H) and Section 414
AGENCY: Food and Drug Administration, Recordkeeping Regulations (21 CFR Part adulteration provisions in sections 418,
HHS. 1, Subpart J) 419, and 420 of the FD&C Act in this
B. Other Definitions That We Proposed To rulemaking.
ACTION: Final rule.
Establish in Part 121 The purpose of this rule is to protect
SUMMARY: The Food and Drug C. Additional Definitions to Clarify Terms food from intentional acts of
Administration (FDA or we) is issuing Not Defined in the Proposed Rule adulteration where there is an intent to
D. Comments Asking FDA to Establish
this final rule to require domestic and Additional Definitions or Otherwise
cause wide scale public health harm.
foreign food facilities that are required Clarify Terms Not Defined in the Rule This rule applies to both domestic and
to register under the Federal Food, Drug, E. Proposed § 121.5—Exemptions foreign facilities that are required to
and Cosmetic Act (the FD&C Act) to V. Subpart C: Comments on Food Defense register under section 415 of the FD&C
address hazards that may be introduced Measures Act. This rule establishes several
with the intention to cause wide scale A. Proposed § 121.126—Requirement for a exemptions as follows:
public health harm. These food facilities Food Defense Plan • The rule does not apply to a very
are required to conduct a vulnerability B. Proposed § 121.130—Identification of
Actionable Process Steps
small business (i.e., a business,
assessment to identify significant C. Proposed § 121.135—Focused Mitigation including any subsidiaries or affiliates,
vulnerabilities and actionable process Strategies for Actionable Process Steps averaging less than $10,000,000,
steps and implement mitigation D. Final § 121.138—Mitigation Strategies adjusted for inflation, per year, during
strategies to significantly minimize or Management Components the 3-year period preceding the
prevent significant vulnerabilities E. Proposed § 121.140—Monitoring applicable calendar year in both sales of
identified at actionable process steps in F. Proposed § 121.145—Corrective Actions human food plus the market value of
a food operation. FDA is issuing these G. Proposed § 121.150—Verification human food manufactured, processed,
requirements as part of our H. Proposed § 121.160—Training (Final
§ 121.4)
packed, or held without sale, e.g., held
implementation of the FDA Food Safety VI. Subpart D: Comments on Requirements for a fee), except that the facility is
Modernization Act (FSMA). Applying to Records That Must Be required to provide for official review,
DATES: This rule is effective July 26, Established and Maintained upon request, documentation sufficient
2016. See section VIII for compliance A. Proposed § 121.301—Records Subject to to show that the facility qualifies for this
dates. the Requirements of This Subpart D exemption.
B. Proposed § 121.305—General
FOR FURTHER INFORMATION CONTACT: • This rule does not apply to the
Requirements Applying to Records
Ryan Newkirk, Center for Food Safety C. Proposed § 121.310—Additional holding of food, except the holding of
and Applied Nutrition (HFS–005), Food Requirements Applying to the Food food in liquid storage tanks.
and Drug Administration, 5100 Paint Defense Plan • This rule does not apply to the
Branch Pkwy., College Park, MD 20740, D. Proposed § 121.315—Requirements for packing, re-packing, labeling, or re-
Record Retention labeling of food where the container that
240–402–3712, email: Ryan.Newkirk@
E. Proposed § 121.320—Requirements for directly contacts the food remains
fda.hhs.gov. Official Review
intact.
SUPPLEMENTARY INFORMATION: F. Proposed § 121.325—Public Disclosure
G. Proposed § 121.330—Use of Existing • This rule does not apply to
Table of Contents Records activities of a farm that are subject to
Executive Summary VII. Subpart E: Comments on Compliance— section 419 of the Federal Food, Drug,
Purpose and Coverage of the Rule Proposed § 121.401 and Cosmetic Act (Standards for
VIII. Effective and Compliance Dates Produce Safety).
Summary of the Major Provisions of the
IX. Executive Order 13175
Rule
X. Final Regulatory Impact Analysis • This rule does not apply with
Costs and Benefits respect to alcoholic beverages at a
XI. Paperwork Reduction Act of 1995
I. Background facility that meets certain conditions.
XII. Analysis of Environmental Impact
A. FDA Food Safety Modernization Act
B. Proposed Rule on Intentional
XIII. Federalism • This rule does not apply to the
XIV. References manufacturing, processing, packing, or
Adulteration
C. Appendix 4 to Draft Risk Assessment Executive Summary holding of food for animals other than
D. Public Comments man.
II. Legal Authority Purpose and Coverage of the Rule • This rule does not apply to on-farm
mstockstill on DSK3G9T082PROD with RULES4
A. Section 103 of FSMA This regulation implements three manufacturing, processing, packing, or
B. Section 106 of FSMA holding by a small or very small
provisions of the FD&C Act, as amended
C. Intrastate Activities
III. General Comments on the Proposed Rule by FSMA, that relate to the intentional business of certain foods identified as
A. Comments on Overall Framework for adulteration of food. Section 418 of the having low-risk production practices if
the Regulatory Approach FD&C Act (21 U.S.C. 350g) addresses such activities are the only activities
B. One Set of Requirements Under Sections intentional adulteration in the context conducted by the business subject to
418 and 420 of the FD&C Act of facilities that manufacture, process, section 418 of the FD&C Act.
VerDate Sep<11>2014 19:43 May 26, 2016 Jkt 238001 PO 00000 Frm 00002 Fmt 4701 Sfmt 4700 E:\FR\FM\27MYR4.SGM 27MYR4
Federal Register / Vol. 81, No. 103 / Friday, May 27, 2016 / Rules and Regulations 34167
Summary of the Major Provisions of the • Conduct a reanalysis of the food that they are required ‘‘as appropriate to
Final Rule defense plan (§ 121.157). ensure the proper implementation of the
• Ensure that all individuals who mitigation strategies, taking into account
This rule establishes various food
perform required food defense activities the nature of each such mitigation
defense measures that an owner,
are qualified to perform their assigned strategy and its role in the facility’s food
operator, or agent in charge of a facility
duties (§ 121.4). defense system.’’
is required to implement to protect • Establish and maintain certain • We revised the terminology used for
against the intentional adulteration of records, including the written food the food defense management
food. Specifically: defense plan (vulnerability assessment,
• Prepare and implement a written components such that monitoring,
mitigation strategies and procedures for corrective actions, and verification are
food defense plan that includes a food defense monitoring, corrective
vulnerability assessment to identify now food defense monitoring, food
actions, and verification) and defense corrective actions, and food
significant vulnerabilities and documentation related to training of
actionable process steps, mitigation defense verification.
personnel. All records are subject to • We made the requirement to
strategies, and procedures for food certain general recordkeeping and document food defense monitoring
defense monitoring, corrective actions, record retention requirements more flexible by providing for use of
and verification (§ 121.126). (§§ 121.301 to 121.330). exception records.
• Identify any significant • The effective date is 60 days after • We made the food defense
vulnerabilities and actionable process this final rule is published. However, corrective actions requirement more
steps by conducting a vulnerability we are providing for a longer timeline flexible by providing that it is required
assessment for each type of food for facilities to come into compliance. ‘‘as appropriate to the nature of the
manufactured, processed, packed, or Facilities, other than small and very actionable process step and the nature
held at the facility using appropriate small businesses, have 3 years after the of the mitigation strategy.’’
methods to evaluate each point, step, or effective date to comply with part 121. • We made the requirement for
procedure in a food operation Small businesses (i.e., those employing verifying proper implementation of
(§ 121.130). fewer than 500 full-time equivalent mitigation strategies more flexible by
• Identify and implement mitigation employees) have 4 years after the providing for ‘‘other activities
strategies at each actionable process step effective date to comply with part 121. appropriate for verification of proper
to provide assurances that the Very small businesses (i.e., businesses implementation of mitigation
significant vulnerability at each step that have less than $10,000,000, strategies.’’
will be significantly minimized or adjusted for inflation, per year, during • We exempted records required by
prevented and the food manufactured, the 3-year period preceding the this rule from the requirements of 21
processed, packed, or held by the applicable calendar year in both sales of Code of Federal Regulations, part 11.
facility will not be adulterated. For each human food plus the market value of • We provided for the use of existing
mitigation strategy implemented at each human food manufactured, processed, records if certain conditions are met.
actionable process step, include a packed, or held without sale, e.g., held • We removed the term ‘‘qualified
written explanation of how the for a fee) have 5 years after the effective facility’’ and instead refer to ‘‘very small
mitigation strategy sufficiently date to comply with § 121.5(a). business’’ in the exemption under
minimizes or prevents the significant As discussed in detail in later sections 121.5(a).
vulnerability associated with the of the rule, we made several major • We established an exemption for
actionable process step (§ 121.135). revisions to the provisions of this rule, certain on-farm manufacturing,
• Establish and implement mitigation mainly in response to comments, to processing, packing, or holding by small
strategies management components, as provide for greater flexibility and and very small businesses of certain
appropriate to ensure the proper clarity. These major revisions to the foods identified as having low-risk
implementation of each such mitigation regulatory text include the following: production processes.
strategy, taking into account the nature • We removed the key activity types • We added a new definition for
of the mitigation strategy and its role in (KATs); however, the use of the KATs ‘‘qualified individual’’ and included
the facility’s food defense system is still permissible to conduct a new requirements to ensure that all
(§ 121.138). vulnerability assessment and will be individuals who perform activities
• Establish and implement food further discussed in guidance. required under subpart C are qualified
defense monitoring procedures, for • We specified three elements that to perform their assigned activities.
monitoring the mitigation strategies, as must be evaluated when conducting a • We provided longer timelines for
appropriate to the nature of the vulnerability assessment: (1) The facilities to come into compliance with
mitigation strategy and its role in the potential public health impact (e.g., the rule.
facility’s food defense system severity and scale) if a contaminant
(§ 121.140). Costs and Benefits
were added; (2) the degree of physical
• Establish and implement food access to the product; and (3) the ability The total cost of the rule, annualized
defense corrective action procedures of an attacker to successfully over 10 years at a 7 percent discount
that must be taken if mitigation contaminate the product. rate, is between $280 and $490 million.
strategies are not properly implemented, • We specified that the vulnerability With a 3 percent discount rate, the
as appropriate to the nature of the assessment must consider the annualized cost is between $270 and
actionable process step and the nature possibility of an inside attacker. $480 million. The first-year cost is
of the mitigation strategy (§ 121.145). • We removed the distinction between $680 and $930 million.
• Establish and implement specified between ‘‘broad’’ and ‘‘focused’’ Counting only domestic firms, the total
food defense verification activities, as mitigation strategies. annualized costs are between $90 and
appropriate to the nature of the • We made the mitigation strategy $150 million, with initial costs of
mitigation strategy and its role in the management components (food defense between $220 and $300 million. The
facility’s food defense system monitoring, corrective actions, and average annualized cost per covered
(§ 121.150). verification) more flexible by providing facility is between $9,000 and $16,000,
34168 Federal Register / Vol. 81, No. 103 / Friday, May 27, 2016 / Rules and Regulations
and the average annualized cost per showing the number of prevented related illness, the breakeven threshold
covered firm is between $27,000 and attacks at which the benefits are larger is one or two attacks every year. For
$47,000. than the costs. For attacks that are catastrophic terrorist attacks causing
The benefits of the actions required by similar in impact to acts of intentional thousands of fatalities, the breakeven
the rule are a reduction in the adulteration that have happened in the threshold is one attack prevented every
possibility of illness and death resulting United States in the past, the breakeven 270 to 460 years.
from intentional adulteration of food. threshold, counting only producer costs,
We monetize the damage that various is 28 to 48 attacks prevented every year. The table shows the approximate,
intentional adulteration scenarios might For attacks causing similar casualties as rounded, mean values for various cost
cause, and present a breakeven analysis major historical outbreaks of food- components of the rule:
ANNUALIZED COST AND BENEFIT OVERVIEW

All Numbers are USD 2014 (millions), annualized over 10 years 3% Discount 7% Discount
Costs:
Learning about Rule ......................................................................................................................................... $3 $4
Creating Food Defense Plans .......................................................................................................................... 10 11
Mitigation Costs ................................................................................................................................................ 26 28
Monitoring, Corrective Action, Verification ....................................................................................................... 62 62
Employee Training ............................................................................................................................................ 5 6
Documentation .................................................................................................................................................. 9 9
Subtotal (Domestic cost) .................................................................................................................................. 115 119
Cost to Foreign Firms ....................................................................................................................................... 247 256
Total .............................................................................................................................................................. 362 375

Benefits:
Lower Chance of Intentional Adulteration ........................................................................................................ Unquantified
I. Background on reacting to problems after they occur. and territorial authorities. A top priority
A. FDA Food Safety Modernization Act The law also provides new enforcement for FDA are those FSMA-required
authorities to help achieve higher rates regulations that provide the framework
The FDA Food Safety Modernization of compliance with risk-based, for industry’s implementation of
Act (FSMA) (Pub. L. 111–353), signed prevention-oriented safety standards preventive controls and enhance our
into law by President Obama on January and to better respond to and contain ability to oversee their implementation
4, 2011, is intended to allow FDA to
problems when they do occur. In for both domestic and imported food. To
better protect public health by helping
addition, the law contains important that end, we proposed the seven
to ensure the safety and security of the
food supply. FSMA enables us to focus new tools to better ensure the safety of foundational rules listed in table 1 and
more on preventing food safety imported foods and encourages requested comments on all aspects of
problems rather than relying primarily partnerships with State, local, tribal, these proposed rules.
TABLE 1—PUBLISHED FOUNDATIONAL RULES FOR IMPLEMENTATION OF FSMA

Title Abbreviation Publication
Current Good Manufacturing Practice and Hazard Analysis and Risk- 2013 proposed human preventive 78 FR 3646, January 16, 2013.
Based Preventive Controls for Human Food. controls rule.
Standards for the Growing, Harvesting, Packing, and Holding of 2013 proposed produce safety rule 78 FR 3504, January 16, 2013.
Produce for Human Consumption.
Current Good Manufacturing Practice and Hazard Analysis and Risk- 2013 proposed animal preventive 78 FR 64736, October 29, 2013.
Based Preventive Controls for Food for Animals. controls rule.
Foreign Supplier Verification Programs (FSVP) for Importers of Food 2013 proposed FSVP rule ............. 78 FR 45730, July 29, 2013.
for Humans and Animals.
Accreditation of Third-Party Auditors/Certification Bodies to Conduct 2013 proposed third-party certifi- 78 FR 45782, July 29, 2013.
Food Safety Audits and to Issue Certifications. cation rule.
Focused Mitigation Strategies To Protect Food Against Intentional 2013 proposed intentional adulter- 78 FR 78014, December 24, 2013.
Adulteration. ation rule.
Sanitary Transportation of Human and Animal Food ............................. 2014 proposed sanitary transpor- 79 FR 7006, February 5, 2014.
tation rule.
We also issued a supplemental notice listed in table 2 and requested in each supplemental notice of
of proposed rulemaking for the rules comments on specific issues identified proposed rulemaking.
TABLE 2—PUBLISHED SUPPLEMENTAL NOTICES OF PROPOSED RULEMAKING FOR THE FOUNDATIONAL RULES FOR
IMPLEMENTATION OF FSMA
Current Good Manufacturing Practice and Hazard Analysis and Risk- 2014 supplemental human preven- 79 FR 58524, September 29,
Based Preventive Controls for Human Food. tive controls notice. 2014.
Standards for the Growing, Harvesting, Packing, and Holding of 2014 supplemental produce safety 79 FR 58434, September 29,
Produce for Human Consumption. notice. 2014.
Current Good Manufacturing Practice and Hazard Analysis and Risk- 2014 supplemental animal preven- 79 FR 58476, September 29,
Based Preventive Controls for Food for Animals. tive controls notice. 2014.
Foreign Supplier Verification Programs (FSVP) for Importers of Food 2014 supplemental FSVP notice ... 79 FR 58574, September 29,
for Humans and Animals. 2014.
We have finalized six of the

foundational rulemakings, as listed in
table 3.
TABLE 3—PUBLISHED FOUNDATIONAL FINAL RULES FOR IMPLEMENTATION OF FSMA

Current Good Manufacturing Practice, Hazard Analysis and Risk- PCHF final rule .............................. 80 FR 55908, September 17,
Based Preventive Controls for Human Food. 2015.
Current Good Manufacturing Practice, Hazard Analysis and Risk- PCAF final rule .............................. 80 FR 56170, September 17,
Based Preventive Controls for Food for Animals. 2015.
Standards for the Growing, Harvesting, Packing, and Holding of Produce final rule .......................... 80 FR 74354, November 27, 2015.
Produce for Human Consumption.
Foreign Supplier Verification Programs (FSVP) for Importers of Food FSVP final rule .............................. 80 FR 74226, November 27, 2015.
for Humans and Animals.
Accreditation of Third-Party Certification Bodies to Conduct Food Third-party final rule ...................... 80 FR 74570, November 27, 2015.
Safety Audits and to Issue Certifications.
Sanitary Transportation of Human and Animal Food ............................. Transport final rule ........................ 81 FR 20092, April 6, 2016.
As FDA finalizes these seven and assistance, to ensure that actionable process steps, focused
foundational rulemakings, we are stakeholders understand and engage in mitigation strategies, and procedures for
putting in place a framework for food their roles in food safety and food monitoring, corrective actions, and
safety that is modern and brings to bear defense. FDA believes these seven verification (proposed § 121.126).
the most recent science on provisions to foundational final rules, when • Identify any actionable process
enhance food safety and food defense, implemented, will fulfill the paradigm steps, using one of two procedures. In
that is risk-based and focuses effort shift toward prevention that was the proposed rule, we explained that
where the hazards are most significant, envisioned in FSMA and be a major step FDA has analyzed vulnerability
and that is flexible and practical given forward for food safety and food defense assessments conducted using the
our current knowledge of food safety that will protect consumers into the CARVER+Shock methodology and
and food defense practices. To achieve future. identified four key activity types: Bulk
this, FDA has engaged in a great deal of liquid receiving and loading; Liquid
B. Proposed Rule on Intentional
outreach to the stakeholder community storage and handling; Secondary
Adulteration
to find the right balance in these ingredient handling; and Mixing and
regulations of flexibility and In the Federal Register of December similar activities. We further explained
accountability. 24, 2013 (78 FR 78014), we issued a that FDA has determined that the
Since FSMA was enacted in 2011, we proposed rule to implement the presence of one or more of these key
have been involved in approximately intentional adulteration provisions in activity types at a process step (e.g.,
600 engagements on FSMA and the sections 103, 105, and 106 of FSMA manufacturing, processing, packing, or
proposed rules, including public (proposed rule). We initially requested holding of food) indicates a significant
meetings, Webinars, listening sessions, public comments on the proposed rule vulnerability under section 418 of the
farm tours, and extensive presentations by March 31, 2014. We extended the FD&C Act and that the food is at high
and meetings with various stakeholder comment period for the proposed rule risk of intentional adulteration caused
groups (Ref. 1) (Ref. 2). As a result of until June 30, 2014, in response to by acts of terrorism under section 420 of
this stakeholder dialogue, FDA decided several requests for an extension. the FD&C Act. We proposed that
to issue the four supplemental notices of The proposed rule proposed to facilities may identify actionable
proposed rulemaking to share our require various food defense measures process steps using the FDA-identified
current thinking on key issues and get that an owner, operator, or agent in key activity types as described in
additional stakeholder input on those charge of a facility would be required to proposed § 121.130(a) or conduct their
issues. As we move forward into the implement to protect against the own facility-specific vulnerability
next phase of FSMA implementation, intentional adulteration of food, and can assessments as provided in proposed
we intend to continue this dialogue and be summarized as follows: § 121.130(b).
collaboration with our stakeholders, • Prepare and implement a written • Identify and implement focused
through guidance, education, training, food defense plan that includes mitigation strategies at each actionable
process step to provide assurances that We requested comment on all aspects example, some comments express
the significant vulnerability at each step of the proposed requirements. In concern about overregulation in general.
will be significantly minimized or addition, we described our thinking and Some comments believe the Department
prevented and the food manufactured, sought comment on other issues, of Homeland Security is the Federal
processed, packed, or held by the including the framework of the rule; Agency that should protect the food
facility will not be adulterated activities that occur on produce farms; supply. Some comments express
(proposed § 121.135). transportation carriers; food for animals; concern about ‘‘genetically modified
• Establish and implement acts of disgruntled employees, organisms’’, while other comments
procedures, including the frequency consumers, or competitors; express concern about the amount of
with which they are to be performed, for economically motivated adulteration; chemicals in food. Some comments
monitoring the focused mitigation low-risk activities at farm mixed-type express concern that extreme
strategies (proposed § 121.140) facilities; activities that occur on dairy consolidation of our food system is the
• Establish and implement corrective farms; and other ways to focus on foods main reason that it could be a target for
action procedures that must be taken if with a high risk of intentional terrorism or other intentional acts aimed
focused mitigation strategies are not adulteration caused by terrorism. at causing widespread human
properly implemented (proposed casualties. These comments state that
C. Appendix 4 to Draft Risk Assessment
§ 121.145). decentralization is the most resilient
We issued for public comment an defense against those who wish to
• Verify that monitoring is being
‘‘Appendix 4 to Draft Qualitative Risk contaminate the food supply. We do not
conducted and appropriate decisions
Assessment of Risk of Activity/Food discuss such comments in this
about corrective actions are being made;
Combinations for Activities (Outside the document.
verify that the focused mitigation
Farm Definition) Conducted in a
strategies are consistently implemented II. Legal Authority
Facility Co-Located on a Farm’’ (the
and are effectively and significantly
draft RA Appendix) (78 FR 78064, The proposed rule contained an
minimizing or preventing the significant
December 24, 2013). The purpose of the explanation of its legal basis under
vulnerabilities; and conduct a reanalysis
draft RA Appendix was to provide a authorities in the FDA Food Safety
of the food defense plan (proposed
science-based risk analysis of those Modernization Act and section 701 of
§ 121.150). foods whose production processes the FD&C Act. After considering the
• Ensure that personnel and would be considered low risk with comments received in response to the
supervisors assigned to actionable respect to the risk of intentional proposed rule, FDA made changes in
process steps receive appropriate adulteration caused by acts of terrorism. the final rule. The legal authorities
training in food defense awareness and We used the tentative conclusions of the relied on in the final rule are the same
their respective responsibilities in section 103(c)(1)(C) draft RA Appendix as those in the proposed rule unless
implementing focused mitigation to seek comment in the proposed rule otherwise described in the sections that
strategies (proposed § 121.160). on possible exemptions or modified follow.
• Establish and maintain certain requirements for this final rule (78 FR
records, including the written food A. Section 103 of FSMA
78014 at 78029). We are including the
defense plan; written identification of final appendix to the risk assessment in Section 103 of FSMA, Hazard
actionable process steps and the the docket established for this document Analysis and Risk-Based Preventive
assessment leading to that (Ref. 3). Controls, amends the FD&C Act to
identification; written focused create a new section 418, which
mitigation strategies; written procedures D. Public Comments mandates rulemaking. Section
for monitoring, corrective actions, and We received more than 200 public 418(n)(1)(A) of the FD&C Act requires
verification; and documentation related submissions on the proposed rule, each that the Secretary issue regulations ‘‘to
to training of personnel. All such containing one or more comments. We establish science-based minimum
records are subject to certain received submissions from diverse standards for conducting a hazard
recordkeeping requirements, record members of the public, including food analysis, documenting hazards,
retention requirements, requirements for facilities (including facilities co-located implementing preventive controls, and
official review and public disclosure on a farm); farms; cooperatives; documenting the implementation of the
requirements (proposed §§ 121.301 to coalitions; trade organizations; preventive controls. . . .’’ Section
121.325). consulting firms; law firms; academia; 418(n)(1)(B) of the FD&C Act requires
• Proposed the effective date as 60 public health organizations; public that the regulations define the terms
days after this final rule is published. advocacy groups; consumers; consumer ‘‘small business’’ and ‘‘very small
However, we proposed for a longer groups; Congress, Federal, State, local, business,’’ taking into consideration the
timeline for facilities to come into and tribal Governments; and other study of the food processing sector
compliance. Facilities, other than small organizations. Some submissions required by section 418(l)(5) of the
and very small businesses, would have included signatures and statements from FD&C Act. Further, section 103(e) of
1 year after the effective date to comply multiple individuals. Comments FSMA creates a new section 301(uu) in
with part 121. Small businesses (i.e., addressed virtually every provision of the FD&C Act (21 U.S.C. 331(uu)) to
those employing fewer than 500 the proposed rule, including our prohibit ‘‘[t]he operation of a facility
persons) would have 2 years after the requests for comment on including that manufactures, processes, packs, or
effective date to comply with part 121. additional provisions that we did not holds food for sale in the United States
Very small businesses (i.e., businesses include in the proposed regulatory text. if the owner, operator, or agent in charge
that have less than $10,000,000 in total In the remainder of this document, we of such facility is not in compliance
annual sales of food, adjusted for describe these comments, respond to with section 418 [of the FD&C Act].’’
inflation) would be considered a them, and explain any revisions we In addition to rulemaking
qualified facility and have 3 years after made to the proposed rule. requirements, section 418 contains
the effective date to comply with Some comments address issues that requirements applicable to the owner,
§ 121.5(a). are outside the scope of this rule. For operator, or agent in charge of a facility
required to register under section 415. Act requires FDA to issue regulations to with a direct connection to interstate
Section 418(a) is a general provision protect against the intentional commerce.
that requires the owner, operator, or adulteration of food. Section 420(b)(1) of
III. General Comments on the Proposed
agent in charge of a facility to evaluate the FD&C Act requires that such
Rule
the hazards that could affect food regulations are to specify how a person
manufactured, processed, packed, or is to assess whether the person is A. Comments on Overall Framework for
held by the facility, identify and required to implement mitigation the Regulatory Approach
implement preventive controls, monitor strategies or measures intended to
the performance of those controls, and protect against the intentional We proposed a HACCP-type
maintain records of the monitoring. In adulteration of food. Section 420(b)(2) of approach, like the one proposed for the
addition to the general requirements in the FD&C Act requires that the systematic control of food safety hazards
section 418(a) of the FD&C Act, sections regulations specify appropriate science- in the PCHF proposed rule, as the most
418(b)–(i) contain more specific based mitigation strategies or measures effective means of ensuring that
requirements applicable to facilities, to prepare and protect the food supply mitigation strategies are consistently
including several provisions explicitly chain at specific vulnerable points, as applied once the significant
directed at intentional adulteration. For appropriate. Section 420(c) of the FD&C vulnerabilities are identified and
example, section 418(b)(2) of the FD&C Act provides that such regulations are to appropriate mitigation strategies are
Act specifies that the owner, operator, apply only to food for which there is a developed. We requested comment on
or agent in charge of a facility shall high risk of intentional adulteration and the appropriateness of a HACCP-type
identify and evaluate hazards that may for which such intentional adulteration system to ensure that mitigation
be intentionally introduced, including could cause serious adverse health strategies designed to significantly
by acts of terrorism. Section 418(c)(2) of consequences or death to humans or minimize or prevent intentional
the FD&C Act specifies that the owner, animals. Section 420(c)(1) provides that adulteration related to terrorism are
operator, or agent in charge of a facility such foods are to include those for effective and implemented as intended.
shall identify and implement preventive which FDA has identified clear We also requested comment about
controls to provide assurances that any vulnerabilities. Section 420(d) of the whether there are other approaches that
hazards that relate to intentional FD&C Act limits applicability on farms would be more suitable to address
adulteration will be significantly to farms that produce milk. Further, intentional adulteration related to
minimized or prevented and addressed, section 106(d) of FSMA creates a new terrorism.
consistent with section 420 of the FD&C section 301(ww) in the FD&C Act to In the following paragraphs, we
Act. prohibit ‘‘[t]he failure to comply with discuss the comments that disagree
Sections 418(j)–(m) of the FD&C Act section 420 [of the FD&C Act].’’ We are with, or request changes to, the
and sections 103(c)(1)(D) and (g) of issuing all of the provisions of the rule proposed approach. After considering
FSMA provide authority for certain under section 420 of the FD&C Act. these comments, we are continuing to
exemptions and modifications to the require an approach based on an
requirements of section 418 of the FD&C C. Intrastate Activities
analysis of hazards/vulnerabilities and
Act. These include provisions related to FDA concludes that the rule should
the implementation of measures to
seafood and juice hazard analysis apply to activities that are intrastate in
mitigate the identified hazards/
critical control point (HACCP), and low- character. Facilities are required to
vulnerabilities (a HACCP-type
acid canned food (section 418(j)); register under section 415 of the FD&C
approach); however, we are providing
activities of facilities subject to section Act regardless of whether the food from
for additional flexibility, as requested.
419 of the FD&C Act (Standards for the facility enters interstate commerce
Produce Safety) (section 418(k)); (§ 1.225(b)). The plain language of (Comment 1) Some comments state
qualified facilities (section 418(l)); section 418 of the FD&C Act applies to food defense and food safety require
facilities that are solely engaged in the facilities that are required to register different approaches because they are
production of food for animals other under section 415 of the FD&C Act different disciplines. The comments
than man, the storage of raw agricultural (section 418(o)(2)) and does not exclude explain that the science is different, that
commodities (other than fruits and a facility because food from such a food safety deals with known and
vegetables) intended for further facility is not in interstate commerce. identifiable risks whereas food defense
distribution or processing, or the storage Similarly, the plain language of section deals with unknown, often
of packaged foods that are not exposed 420 of the FD&C Act requires FDA to unidentifiable, and ever changing
to the environment (section 418(m)); issue regulations to protect against the threats and that food safety risks can be
facilities engaged only in certain low intentional adulteration of food and prevented or reduced to an acceptable
risk on-farm activities on certain foods does not include a limitation to level but food defense threats only can
conducted by small or very small interstate commerce. Further, the be mitigated. The comments conclude
businesses (section 103(c)(1)(D) of prohibited act provisions in sections that regulatory requirements addressing
FSMA), and dietary supplements 301(uu) and (ww) of the FD&C Act (21 food defense must reflect these key
(section 103(g) of FSMA). We are U.S.C. 331(uu) and (ww)) do not require differences between food defense and
issuing all of the provisions of the rule an interstate commerce nexus. Notably, food safety and use different
under section 418 of the FD&C Act, other subsections in section 301 of the terminology. Some comments state that
except with respect to facilities that are FD&C Act, and section 304 of the FD&C FSMA does not require a preventive
exempt from its coverage. Act (21 U.S.C. 334) demonstrate that controls approach for food defense, and
Congress has included a specific a traditional HACCP approach is too

B. Section 106 of FSMA interstate commerce nexus in the rigorous and prescriptive for food
Section 106 of FSMA, Protection provisions of the FD&C Act when that defense. Conversely, other comments
Against Intentional Adulteration, is its intent. Accordingly, it is support regulatory requirements for
amends the FD&C Act to create a new reasonable to interpret sections 418, food defense that are based on the
section 420, which mandates 420, 301(uu), and 301(ww) of the FD&C proactive approach found in HACCP,
rulemaking. Section 420 of the FD&C Act as not limited to those facilities specifically HACCP concepts related to
analyzing problems and devising advocated option for terrorist groups Section 103(a) specifies that the purpose
appropriate solutions. (Ref. 4). Additionally, recent events of the preventive controls is to ‘‘prevent
(Response 1) We disagree that food have shown a general evolution in the occurrence of such hazards and
safety and food defense require entirely terrorist activity away from large, provide assurances that such food is not
different approaches to ensure that food centrally planned attacks to attacks that adulterated under section 402 [of the
is not adulterated. We agree that there are locally planned and implemented. FD&C Act] or misbranded under section
are important, specific differences These locally planned attacks may be 403(w) [of the FD&C Act]. . . .’’ In
between food safety and food defense, conducted by assailants inspired by addition to the general requirements in
and these differences require different terrorist groups but who otherwise have section 418(a) of the FD&C Act, sections
requirements for particular components no formal connection to, or regular 418(b)–(i) contain more specific
of the approaches. However, we believe contact with, a terrorist organization requirements applicable to facilities.
that food safety and food defense are (Ref. 5, 6, 7). Moreover, recent attacks These include hazard analyses for both
more similar than they are different. For indicate that terrorist groups are adept unintentionally and intentionally
both food safety and food defense, the at responding to protections put in place introduced hazards (section
framework for preventing adulteration, to harden certain targets and will evolve 418(b)(1)(2)), preventive controls for
whether it is intentional or their thinking toward less-protected both unintentionally and intentionally
unintentional, is the same: (1) An targets. Given the potential for wide introduced hazards (section 418(c)
analysis is needed to identify the scale public health harm from (1)(2)), monitoring (section 418(d)),
hazards for which measures should be intentional adulteration of the food corrective actions (section 418(e)),
taken to mitigate the hazard; (2) supply, we believe that a verification (section 418(f)),
appropriate measures must be identified comprehensive, systematic approach, recordkeeping (section 418(g)), a written
and implemented; and (3) management such as a HACCP-type approach, is the plan and documentation (section
components are needed to ensure most appropriate one and is not too 418(h)), and reanalysis of hazards
systematically that the measures are rigorous. Further, as an example of what (section 418(i)). Therefore, we believe
functioning as intended. This is the can happen when someone intending that FSMA directs us to take a
foundation of the HACCP approach, and harm has inside access, in December ‘‘preventive controls approach’’ for food
we continue to believe this approach is 2013 a contract employee at Aqlifoods defense, as well as food safety.
appropriate for food defense as well as (a subsidiary of Naruha Nichiro We agree that, while the regulatory
food safety. In food defense terms, the Holdings, Japan’s largest seafood approaches for food defense and food
three elements are as follows: (1) A company), intentionally adulterated safety fundamentally should be similar,
vulnerability assessment is needed to several frozen foods with the pesticide there need to be differences in how the
identify significant vulnerabilities; (2) malathion. Japanese authorities believe approach is implemented for food
mitigation strategies must be identified the assailant brought malathion to the defense. We do not agree that a HACCP-
and implemented; and (3) mitigation plant and injected it into frozen foods type approach is too prescriptive in
strategy management components are during the manufacturing process (Ref. general for food defense, but additional
needed to ensure systematically that the 8). The employee exploited his access to flexibility is needed in the application
mitigation strategies are functioning as the food prior to packaging to introduce of the approach for food defense given
intended. See the proposed rule (78 FR the agent. The adulteration resulted in the difference in the nature of the
78014 at 78025) for a discussion of how potential adulteration and the
at least 2,843 mild foodborne illnesses
the hazard analysis/preventive control implementation of mitigation strategies
and a recall of 6.4 million packages of
model is consistent with a vulnerability that are not likely to be process-oriented
frozen seafood (Ref. 9). Though this
assessment/mitigation strategy model. or readily lend themselves to validation.
We agree that the nature of the assailant was most likely trying to harm
We also agree that differences in
hazards being analyzed for food safety the company and not trying to cause
terminology are appropriate. (See
and food defense purposes are different, massive public health harm, this
responses to Comment 2, Comment 45,
but we disagree that this means they example indicates the damage that can
and Comment 47.)
need a different analytical approach. As be done by an inside attacker. (Comment 2) While some comments
discussed more in the responses to Section 103 of FSMA reflects a acknowledge that section 103 of FSMA
Comment 71 and Comment 72, the Congressional determination that the directs us to promulgate a framework for
vulnerabilities considered for food ‘‘hazard analysis and risk-based intentional adulteration that includes
defense, while not as predictable as preventive controls’’ approach is concepts that are similar to those in
some food safety hazards, lend appropriate for food defense. Section HACCP, these comments also request
themselves to analytical assessment 103 directs us to promulgate a that we provide more flexibility than a
because they have commonalities that framework for intentional adulteration traditional HACCP framework, with
would make them attractive to an that includes concepts that are similar specific requests for flexibility in the
attacker, particularly an inside attacker. to those in HACCP. Section 103 of management components of monitoring,
In this rule, we are focusing on FSMA contains requirements applicable corrective actions, and verification.
preventing the actions of an inside to the owner, operator, or agent in (Response 2) We agree that the
attacker. Our interactions with the charge of a facility required to register intentional adulteration regulatory
intelligence community, as well as the under section 415 of the FD&C Act. framework should provide more
conclusions reached during Section 103(a) of FSMA is a general flexibility than that of a traditional
vulnerability assessments conducted in provision that requires the owner, HACCP approach. We believe there are
collaboration with industry, have operator, or agent in charge of a facility key disciplinary differences between
identified the inside attacker as the to evaluate the hazards that could affect food safety and food defense that argue
highest threat. Though FDA is not aware food manufactured, processed, packed, for additional flexibility in the
of any information that points to an or held by the facility, identify and intentional adulteration framework.
imminent, credible threat to the food implement preventive controls, monitor Most significantly, improper
supply, achieving public health harm the performance of those controls, and implementation of preventive controls
through an attack via food remains an maintain records of the monitoring. is more likely to result in adulterated
food than is improper implementation we have adopted the flexibility included established as appropriate to ensure the
of mitigation strategies. Preventive in the PCHF final rule management proper implementation of the mitigation
controls are more likely to be process- components regulatory text, as strategies, taking into account the nature
oriented and lend themselves to being appropriate for these intentional of each such mitigation strategy and its
scientifically validated. Mitigation adulteration requirements. The role in the facility’s food safety system
strategies are more likely to be intentional adulteration provisions for (§ 121.138).
implemented to reduce physical access mitigation strategies management (Comment 4) Some comments state
to a point, step, or procedure, and/or components make clear that mitigation that management and oversight
reduce the opportunity for an attacker to strategies management components are activities of mitigation strategies should
successfully contaminate the food and, required as appropriate to ensure the occur if they are ‘‘appropriate’’ (suitable
in most instances, do not lend proper implementation of each such for a particular purpose or capable of
themselves to scientific validation. mitigation strategy, taking into account being applied) and ‘‘necessary’’ (taking
These differences indicate a need to the nature of the mitigation strategy and into account the nature of both the
apply the concepts of the HACCP its role in the facility’s food defense significance of the vulnerability and the
approach in a more flexible manner for system, and we have added § 121.138 to particular mitigation strategy) for food
food defense. reflect this change. Likewise, the defense.
Recognizing the differences in the provisions for each of the individual (Response 4) We agree that mitigation
likelihood of adulteration and the mitigation strategies management strategies management components of
differences in mitigation strategies components (i.e., food defense the HACCP-type framework should
compared to the process-oriented monitoring, food defense corrective occur if they are appropriate and
preventive controls, the intentional actions and food defense verification) necessary. As we have concluded that
adulteration corrective actions individually provide flexibility, either similar regulatory approaches are
requirements contain neither provisions by specifying that the provisions apply appropriate for food safety and food
for the evaluation of all affected food for as appropriate to the nature of the defense, we have adopted the flexibility
safety in the event a corrective action is mitigation strategy and its role in the included in the PCHF final rule
required nor provisions for facility’s food defense system (i.e., for management components regulatory text
unanticipated corrective actions (see food defense monitoring and food (§ 117.140(a)), as appropriate for these
§ 121.145). Further, the intentional defense verification) or as appropriate to intentional adulteration requirements.
adulteration verification requirement both the nature of the mitigation The intentional adulteration provisions
does not contain provisions for strategy and the nature of the significant for mitigation strategies management
validation, calibration, product testing, vulnerability (i.e., for food defense components make clear that mitigation
environmental monitoring, review of corrective actions) (see §§ 121.140, strategies management components are
records for calibration, testing, or 121.145, and 121.150). For additional required as appropriate to ensure the
supplier verification (see § 121.150). We discussion of the flexibility added for proper implementation of the mitigation
believe this more flexible approach for the mitigation strategies management strategies, taking into account the nature
food defense is appropriate and adds components, see sections V.E, V.F, and of each such mitigation strategy and its
flexibility compared to the provisions of V.G and in particular the responses to role in the facility’s food defense
the PCHF final rule. Comment 88, Comment 89, Comment system, and we have revised proposed
We also have added flexibility to the 90, Comment 92, Comment 93, and requirements for monitoring, corrective
identification of mitigation strategies Comment 95. actions, and verification to reflect these
similar to the flexibility added to the (Comment 3) Some comments state changes (see §§ 121.138, 121.140,
identification of preventive controls in that the intentional adulteration 121.145, and 121.150).
the PCHF final rule (80 FR 55908 at proposed HACCP approach is ‘‘one size (Comment 5) Some comments state
56020). Although each facility subject to fits all.’’ that the requirement for the amount of
this rule must prepare and implement a (Response 3) We disagree. The paperwork associated with a HACCP-
food defense plan, the mitigation intentional adulteration requirements to type approach, and the information
strategies that the facility would conduct a vulnerability assessment to contained therein, may be
establish and implement would depend identify actionable process steps, counterproductive to the goal of
on the facility, the food, and the identify and implement mitigation mitigating or preventing vulnerabilities
outcome of the facility’s vulnerability strategies, and use mitigation strategies because individuals or groups interested
assessment to identify actionable management components provide in conducting these types of attacks may
process steps (§§ 121.130 and 121.135). significant flexibility, are tailored to the try to access this information.
For examples of this added flexibility facility and its processes, and are (Response 5) We disagree. A written
related to mitigation strategies, see the therefore not ‘‘one-size-fits-all.’’ food defense plan and its required
discussion in section V.C. Although each facility with significant contents, which include the
As requested in comments, we also vulnerabilities is required to identify vulnerability assessment, the
have changed regulatory text to reflect and implement mitigation strategies, the identification and implementation of
the inclusion of more flexibility in mitigation strategies that the facility mitigation strategies, and mitigation
monitoring, corrective actions, and would establish and implement would strategies management components, are
verification (see §§ 121.138, 121.140, depend on the facility, the food, and the essential to significantly minimizing or
121.145, and 121.150 and discussed in outcome of the facility’s vulnerability preventing significant vulnerabilities
more detail in the relevant sections later assessment (§§ 121.130 and 121.135). In related to intentional adulteration of
in this document). These changes are addition, the mitigation strategies food, where the intent of the
similar to those made in the regulatory management components (i.e., food adulteration is to cause wide scale
text for preventive controls management defense monitoring, food defense public health harm. The required
components. corrective actions, and food defense documentation of the plan and
As we have concluded that similar verification) that a facility would implementation of the plan are
regulatory approaches are appropriate establish and implement for its necessary so that both the facility and
for both food safety and food defense, mitigation strategies would be FDA can ensure that the significant
vulnerabilities are being addressed (Comment 7) One comment asserts with section 106, which it states
properly. We encourage facilities that because we already have required provides FDA with the authority to
covered by this rule to adequately food safety plans for facilities under a designate certain foods as ‘‘high risk,’’
protect food defense plans and separate rulemaking, and because an act and to require certain escalated food
associated information and records. For of intentional adulteration of food that defense activities for those foods. The
a more detailed discussion related to would cause wide scale public health comment asserts that FDA should
protecting food defense plan harm is not likely to occur, a separate designate foods as ‘‘high risk’’ based on
information, see section VI.F. food defense plan, and thus this rule, is real-time actionable intelligence of a
(Comment 6) One comment disagrees not necessary. credible threat. The comment
with the HACCP framework, and (Response 7) We disagree. Although it acknowledges that section 103 of FSMA
requests we use a current good is true that most facilities covered by does not apply to facilities required to
manufacturing practice (CGMP) this rule will also have a food safety or comply with the seafood HACCP
approach. This comment states that HACCP plan, the focus of those plans is program, the juice HACCP program, or
such an approach provides facilities on preventing the contamination of food the dietary supplement CGMPs, but
with sufficient flexibility to address from hazards that are unintentionally because none of these regulations
intentional adulteration. Another introduced and, therefore, the control address food defense programs, the
comment supports using a HACCP points and the measures implemented comment asserts the Agency can use
approach in the context of allowing in those plans differ from those in a other legal authority to require these
facilities to utilize prerequisite food defense plan. It is unlikely that a food facilities to have food defense
programs. facility would choose preventive programs.
(Response 6) We disagree that a controls under the PCHF final rule that (Response 8) The final rule requires
CGMP approach is the most appropriate would be sufficient to address ‘‘basic foundation[al] food defense
approach. We address the vulnerabilities to intentional activities’’ as well as providing for
appropriateness and flexibility of the adulteration. For example, it is unlikely ‘‘escalated food defensive activities’’
HACCP-type approach in responses to that a facility conducting a hazard where warranted. To provide for
Comment 1 and Comment 2. We address analysis would identify the step of foundational food defense, the rule
the potential to consider pre-existing holding a liquid, such as a syrup, in a requires a food defense plan (i.e., a
activities while conducting a tank in a facility as a hazard requiring vulnerability assessment, mitigation
vulnerability assessment and identifying a preventive control. In conducting a strategies, and procedures for food
and implementing mitigation strategies hazard analysis, the facility would defense monitoring, corrective actions,
in Response 72 and Response 83. likely be considering whether there are and verification) and associated actions.
We are requiring a HACCP-type hazards associated with the incoming These requirements are the minimum
approach rather than a CGMP-type syrup or ingredients for the syrup or the measures necessary to provide
approach for several reasons. First, the syrup production process (inadequate assurances that hazards that relate to
management components in a HACCP- heating), but would not likely identify intentional adulteration intended to
type approach are the most effective the step of holding the syrup as cause wide scale public health harm
means, as discussed in the response to requiring a preventive control. However, will be significantly minimized or
Comment 1, of ensuring that the in a vulnerability assessment, the step of prevented. Weakening these provisions,
mitigation strategies are consistently holding liquid syrup may be identified such as by eliminating the requirement
applied. Second, as with food safety, as a significant vulnerability if (1) there to implement mitigation strategies to
there are hazards (or in food defense would be significant public health address significant vulnerabilities at
terms, vulnerabilities) that warrant consequences if a contaminant were each actionable process step, would
requirements that are more rigorous added, (2) there is access to the product result in food defense measures
than general, non-targeted CGMP while being held, and (3) an attacker inadequate to address the threat of an
provisions. The vulnerabilities that would be able to successfully inside attacker. As discussed in
warrant such requirements are those contaminate the product. response to Comment 1, our interactions
that we have concluded are the highest With regard to the statement that an with the intelligence community, as
risk, namely intentional adulteration act of intentional adulteration is not well as the conclusions reached during
conducted at actionable process steps, likely to occur, we agree that the vulnerability assessments conducted in
including those vulnerabilities likelihood of an incident is low. collaboration with industry, have
associated with an inside attacker, However, given the potential for a identified an inside attacker as the
intended to cause wide scale public successful intentional adulteration of highest threat.
health harm. It is precisely these attacks food to cause wide scale public health Further, the suggested approach
at these points that require the most harm, it is prudent for the largest would place too much reliance on FDA
robust and rigorous system to ensure facilities to take preventive measures, having real-time actionable intelligence
that vulnerabilities are assessed, and it is required by sections 418 and of a credible threat. As discussed in the
significant vulnerabilities are identified, 420 of the FD&C Act that they do so. responses to Comment 11 and Comment
and mitigation strategies are properly 12, there are a number of limitations to
implemented to reduce these significant B. One Set of Requirements Under this approach. FDA may not receive
vulnerabilities. General, non-targeted Sections 418 and 420 of the FD&C Act specific, real-time, credible threat
CGMP requirements (e.g., restricting (Comment 8) One comment asserts intelligence. Further, rapidly
access to outsiders) would not that the proposed rule blends sections communicating even specific,
necessarily focus on the significant 103 and 106 of FSMA into one set of actionable information to the food
vulnerabilities or ensure that mitigation requirements and disagrees with that industry so that it is received by all of
strategies are implemented to harden approach. The comment states that the relevant facilities would present
the potential targets. Finally, section section 103 requires basic foundational challenges. Although some facilities
418 of the FD&C Act requires that food defense activities, including food may be able to identify some or all
hazards intentionally introduced be defense plans at all registered food actionable process steps and implement
addressed in a HACCP-type framework. facilities. The comment contrasts this mitigation strategies within a short
timeframe, many other facilities would consequences. The comment asserts that (Comment 10) Some comments
not be able to identify and implement due to the confidentiality of information suggest that FDA require a hybrid
the necessary mitigation strategies and that serves as the basis for the FDA approach where all facilities subject to
the mitigation strategies management vulnerability assessments, it would be section 103 are required to conduct a
components (e.g., food defense more appropriate for FDA to perform vulnerability assessment and develop
monitoring, corrective actions, the assessment for acts that could cause and implement a basic food defense
verification) within the short time massive public health harm and for the plan. Under the hybrid approach, if a
period that could be required in the facility to perform a vulnerability credible threat is identified, then section
event of a credible threat. In addition, assessment for other types of intentional 106 would serve as an escalation
taking action only in the event of a adulteration that may be specific to a provision and allow FDA to designate
credible threat may not be sufficient to facility and are outside of the FDA’s specific food(s) associated with the
prevent wide scale public health harm. vulnerability assessment. credible threat as ‘‘high risk.’’
Measures taken after the threat is known (Response 9) FDA believes that a
single unified set of requirements (i.e., Comments suggest that FDA could then
may not be sufficient to prevent an
this rule) is more clear and less complex require facilities with these high risk
attack if the intelligence does not
provide enough specific information, than dividing the types of intentional foods to reassess their food defense
such as the food product, contaminant, adulteration covered by this rule into plans and implement appropriate
point of attack in a facility, and two categories with two sets of mitigation strategies that FDA may
geographic location of an attack. requirements, as suggested by the specify to address the threat. Comments
Because the vulnerability assessment comment. It is not clear what would be argue that if all potential mitigation
identifies the specific foods at specific covered under section 418 if it applied strategies need to be identified through
process steps at greatest risk, it also only to ‘‘other types of intentional the vulnerability assessment and are
serves to identify those foods that must adulteration that may be specific to a managed in the absence of actionable
be protected against intentional facility,’’ as suggested by the comment. intelligence of a credible threat, then
adulteration under section 420. Having Further, we do not believe the there is no ability to escalate the plan
one set of requirements for food defense provisions of the rule are inconsistent with respect to certain mitigation
measures helps ensure that the with our current guidance; rather, they strategies when needed.
significant vulnerabilities will be are more comprehensive and robust. (Response 10) FDA agrees with the
significantly minimized or prevented FDA believes that these new comment in part. As discussed in
and addressed consistently across requirements will reduce risk beyond
response to Comment 8, this rule
sections 418 and 420 (see section what is contained in our current
requires facilities to conduct a
418(c)(2)). Further, as suggested by the guidance documents. Our guidance
comment, the rule provides for documents mainly focus on assessing vulnerability assessment and develop
escalated food defense activities when vulnerabilities and identifying and implement foundational food
necessary. Specifically, § 121.157(b)(4) mitigation strategies, but do not include defense activities. Further, the rule
requires reanalysis of a food defense recommendations for mitigation strategy provides a mechanism which serves a
plan (which could lead to the management components. We believe similar function to the ‘‘escalation
identification of additional needed the management components (part of a provision’’ described in the comment.
mitigation strategies) whenever FDA HACCP-type framework) are critical to Specifically, under § 121.157(b)(4), FDA
requires it to respond to new ensuring that any hazards that relate to can require facilities to reassess their
vulnerabilities or credible threats to the intentional adulteration intended to food defense plans, which could trigger
food supply. cause wide scale public health harm a requirement to implement additional
(Comment 9) One comment asserts will be significantly minimized or mitigation strategies.
that the proposed combination of prevented. Further, the confidentiality FDA disagrees that the rule requires
provisions under sections 418 and 420 of vulnerability assessments that FDA ‘‘all potential mitigation strategies’’ to
of the FD&C Act has created complexity conducted is not a barrier to a facility be identified and managed. We believe
that could be eliminated by removing conducting a vulnerability assessment we have appropriately balanced the
acts intended to cause massive public under this rule. The key activity types need to provide assurances that hazards
health harm from section 418 and that FDA has identified were derived associated with intentional adulteration
covering them solely under section 420. from FDA’s vulnerability assessments are being prevented with the low
The comment further asserts that and using key activity types to conduct likelihood of a successful attack on the
although section 418 includes ‘‘acts of a vulnerability assessment remains a food supply. The rule does not mandate
terrorism’’ within the hazard analysis, permissible option under the final rule.
Congress did not intend to add this level In addition, as recognized by the specific mitigation strategies be
of complexity to the rule and create new comment, section 418 explicitly applies implemented at actionable process steps
work that is inconsistent with materials to ‘‘acts of terrorism.’’ Specifically, but rather allows strategies to be tailored
previously created to address food 418(b)(2) requires that a hazard analysis to the facility and its procedures. We
defense. Further, the comment states identify and evaluate hazards that may also disagree that there is ‘‘no ability to
that it appears these new requirements be intentionally introduced, including escalate the plan with respect to certain
were included in the rule as a by acts of terrorism. Further, section mitigation strategies.’’ In response to a
consequence of the statutory language 418(i) authorizes FDA to require a credible threat involving a specific
rather than to reduce risk. reanalysis to respond to new hazards agent, a covered facility could reanalyze
The comment states that one key including, as appropriate, results from its food defense plan with specific focus
difference between sections 418 and 420 terrorism risk assessments. Generally, on the relevant agent. The facility then
is that section 418 requires the facility acts of terrorism involving the food could implement specific mitigation
to identify hazards related to intentional supply would be committed with the strategies to counter this threat (such as
adulteration while section 420 requires intention to cause wide scale public processing changes, product testing, or
FDA to identify vulnerabilities that health harm. Therefore, they are clearly other appropriate measures) that are not
could result in serious adverse health covered by section 418. currently required by the rule.
C. Require Measures Only in the Event and State Agencies to ensure that the regarding communicating credible
of a Credible Threat relevant stakeholders of the food threat information.
In the proposed rule, we sought industry are notified in a timely manner (Comment 13) One comment states
comment on whether it would be upon discovery of a credible threat. that the term ‘‘credible threat’’ is not
feasible to require measures to protect These comments discuss that alerting adequately defined in the proposed rule,
against intentional adulteration only in the food industry to known credible nor is the relationship between a
the event of a credible threat. We also threat information would be valuable ‘‘credible threat’’ and a ‘‘reasonably
sought comment on whether such an because there may be additional foreseeable hazard’’ adequately
approach would be consistent with the mitigation strategies that could be put described. The same comment also
intentional adulteration provisions of into place when there is a threat. The notes that because the term ‘‘credible
FSMA and how such requirements comments further explain that having threat’’ is commonly used to discuss
would be communicated to industry in such knowledge would allow for sensitive or classified information, the
a timely and actionable manner. industry stakeholders with specific, use of the term may place an unrealistic
Many comments agree with the technical knowledge of their products, expectation for sharing of sensitive or
requirements as proposed that measures equipment and plant security to better classified threat information between
to protect food against intentional collaborate and support the efforts of government agencies and the private
adulteration be required even in the law enforcement. Some comments sector. The comment suggests either
absence of a credible threat but some recommend that we establish and removing the term ‘‘credible threat’’
comments support requirements only in formalize a mechanism and process to from the rule or including a definition
the event of a credible threat. Some communicate credible threat with an explanation of the mechanism
comments assert that FDA has the tools information to relevant stakeholders in for sharing information about credible
available in the Registration of Food industry and that the Food Facility threats with the food industry.
Facility database to establish a Registration database could help (Response 13) We disagree with this
communications protocol to notify facilitate this. The comments also comment and decline the request to
industry if there is a credible threat. A recommend that we conduct exercises include a definition for credible threat.
few comments express concern over the to test this mechanism so that all It is not possible to identify with
difficulty of developing and stakeholders are aware of the precision what constitutes a credible
implementing food defense plans in a established communications process threat. There are many factors to
timely manner in the event of a credible and can make adjustments and consider in regards to how, what, when,
threat. improvements as necessary. Several or why those who intend to cause harm
In the following paragraphs, we comments recommended that we may take action. As such, it is not
discuss these comments and our convene a panel of industry possible to write a definition for
responses. After considering the stakeholders annually to discuss threat credible threat that is neither so broad
comments, we have revised the intelligence at the ‘‘Secret’’ level. that it covers potentially any piece of
regulatory text in § 121.157(b)(4) to (Response 12) We concur with the intelligence, nor so narrow that it is
include specific language that provides recommendation that we should unnecessarily limiting. FDA routinely
for FDA to require facilities to conduct collaborate with our Federal and State works with other agencies to maintain
a reanalysis of their food defense plans Agency partners on the discovery and situational awareness of potential
to, among other things, respond to communication of credible threats in a threats to the food supply and will
credible threats to the food supply. timely manner. Currently, FDA consider that information in
(Comment 11) Some comments state regularly meets and communicates with determining whether intelligence rises
that this rule should only go into effect DHS, FBI, the U.S. Department of to the level of a credible threat.
in the event of a credible threat. One of Agriculture (USDA), and State and local Within the context of protecting food
these comments argues that the oilseed Agency partners through the Food and against intentional adulteration with the
processing industry that they represent Agriculture Sector Government intent to cause wide scale public health
has never been the target of attacks or Coordinating Council (GCC) to discuss harm, we see no direct relationship
threats and therefore they are unlikely food defense issues and research between a ‘‘credible threat’’ and a
targets for intentional adulteration and activities and introduce new initiatives ‘‘reasonably foreseeable hazard.’’
should be exempted from the rule for mutual evaluation, implementation, ‘‘Known or reasonably foreseeable
unless there is a credible threat against and education. FDA’s Office of Criminal hazard’’ is defined in the PCHF final
a facility or industry as a whole. Investigations (OCI) works closely with rule to mean a biological, chemical
(Response 11) We disagree with these the FBI and other Agencies on a regular (including radiological), or physical
comments. The fact that the oilseed basis on threats against FDA-regulated hazard that is known to be, or has the
processing industry and other food products, including food. We also agree potential to be, associated with the
industry sectors have not been attacked that notifying relevant stakeholders facility or the food. We do not use the
in the past does not mean that these within industry of credible threats is phrase ‘‘reasonably foreseeable’’ within
industry sectors will never be attacked. essential to protecting the food supply. the context of intentional adulteration
Nor does it mean that preventive The Food and Agriculture Sector GCC because it does not apply.
mitigation strategies are unnecessary. As and Sector Coordinating Council We acknowledge that there will be
discussed in response to Comment 8, (consisting of private sector members) challenges to sharing sensitive or
taking action only in the event of a hold in-person joint meetings twice a classified threat information between
credible threat may not be sufficient to year and, when needed, classified government agencies and the private
prevent wide scale public health harm. meetings at the ‘‘Secret’’ level are held sector. That is one of several reasons
(Comment 12) Some comments to exchange information. As we move that we are not making the requirement
encourage FDA to collaborate with the towards implementing this rule, we will for mitigation strategies dependent on a
U.S. Department of Homeland Security continue to work with our partners— particular credible threat. In the event
(DHS), the Federal Bureau of both in government and the private such information was to become known,
Investigation (FBI), and other Federal sector—to include them in discussions FDA intends to work with its
government partners to determine the (Comment 16) Some comments information from food defense plans
appropriate course of action. express concern about the level of when citing food defense-related items
(Comment 14) Some comments training that will be needed for on Form 483.
recommend that in the event of a inspectors. These comments state that (Response 18) FDA is currently in the
credible threat, a facility could conduct the inspectors must be trained process of developing its inspection and
a reassessment or reanalysis of its food specifically on food defense and that compliance strategy for the intentional
defense plan so that it could better tailor FDA should be transparent about the adulteration rule and an important part
its mitigation strategies to the threat. training that we provide the inspectors. of this strategy development will
Some comments recommend that FDA Comments emphasize the importance include methods and processes for
revise the regulatory text within that FDA provide specialized training to information exchange with regulated
proposed § 121.150 for reanalysis to ensure consistent compliance and industry. We recognize that food
require facilities to reassess their food enforcement activity by the Agency. defense inspections could include
defense plans when the Agency has (Response 16) FDA understands and evaluation of sensitive information,
actionable intelligence of a credible agrees with comments that state that including vulnerability assessments and
threat of intentional adulteration. training for inspectors conducting food mitigation strategies. For a more
(Response 14) In the proposed rule, defense inspections is critical to a detailed discussion on how FDA will
we describe that we may require a consistent and adequate inspection, protect food defense-related
reanalysis of the food defense plan in compliance, and enforcement system. information, see section VI.F, Public
the event of a credible threat. However, We agree with the comment that disclosure.
specialized training in food defense will (Comment 19) Some comments
this was not specifically stated within
be required for inspection and request that FDA include State
the regulatory text. Therefore, we have
compliance staff to evaluate a facility’s departments of agriculture in the
revised § 121.157(b)(4) to provide that
compliance with this rule. FDA has process to develop and implement
reanalysis may be required by FDA to
begun the process of assessing its inspection and compliance programs.
respond to credible threats to the food (Response 19) As mentioned
supply. We did not see the need to training needs for inspectors on food
defense. It is our intention that training previously, FDA is currently in the
include ‘‘actionable intelligence’’ in the process of developing its inspection and
provided to our inspection and
regulatory text because we believe that compliance strategy for the intentional
compliance staff will be consistent with
‘‘credible threat to the food supply’’ adulteration rule. FDA’s
that training for industry that will be
implies a threat that also requires implementation working group for this
provided by the Intentional
actionable intelligence. rule includes representation from State
Adulteration subcommittee organized
D. General Comments on within the Food Safety Preventive partners, and State partners will
Implementation and Compliance Controls Alliance (see Comment 105) to continue to play an essential and
facilitate consistent implementation of collaborative role throughout the
We received a substantial number of process.
this rule. This strategy is consistent with
comments with regard to how the (Comment 20) Several comments state
the other FSMA food safety regulations
Agency will implement this rule. Many that an alliance would be beneficial for
and training strategies.
comments focused specifically on the (Comment 17) Some comments state the implementation of the intentional
need for inspectors to be provided food that inspections should have a ‘‘big adulteration rule.
defense training to enable them to make picture’’ focus, and focus on the (Response 20) Training alliances have
informed decisions during inspections evaluation of the facility’s vulnerability played an important role in facilitating
and compliance activities. Another assessment. Additionally, comments industry compliance with many
issue raised by many comments is that state that this inspection should not regulations in the past. We agree with
the Agency should make available compare the mitigation strategies used the comment and are in the initial stages
guidance resources, tools, training, and at other facilities to the facility being of organizing and establishing the
other information to help facilities inspected. Intentional Adulteration subcommittee
comply with the final rule. In the (Response 17) We agree. The rule is within the Food Safety Preventive
section that follows, comments related designed to provide flexibility such that Controls Alliance operated out of the
to implementation and compliance are facilities can select appropriate Institute for Food Safety and Health at
discussed. mitigation strategies that are best suited the Illinois Institute of Technology. We
(Comment 15) Some comments state for their operations. FDA investigators anticipate the Intentional Adulteration
that existing regulatory inspections will consider a facility’s written training subcommittee will assist
should include evaluation of the explanations regarding identification of industry compliance with this final rule
intentional adulteration rule actionable process steps and selection of by supporting the development and
requirements for the best use of time mitigation strategies when evaluating a dissemination of training resources. We
and resources. food defense plan to understand a further anticipate that the curriculum
(Response 15) FDA is currently facility’s rationale. In addition, we will developed through the Intentional
considering the best approach for work to educate industry before and Adulteration subcommittee will form
structuring and conducting food defense while we regulate to assist industry to the basis of training for regulators as
inspections. We recognize that gain and maintain compliance with the well.
inspections require resources from rule. (Comment 21) Some comments state
facilities and recognize that some (Comment 18) Some comments that equal enforcement of this rule
facilities may prefer that food defense request that FDA not cite food defense- across companies domestically and
inspections be conducted as part of an related items on FDA’s Form 483 until globally may require FDA to adopt
inspection for other regulatory the facilities and inspectors learn about different enforcement mechanisms.
programs, such as preventive controls compliance with the intentional (Response 21) We intend to enforce
for human food. We will consider this adulteration rule. Additionally, some this rule in a consistent manner with
when developing our enforcement comments state concerns about FDA regard to imported and domestically
strategy. including potentially sensitive produced foods. FDA is currently in the
process of developing its inspection and CFATS is a DHS program which defense plan, and then implement, test,
compliance strategy, including how regulates high-risk chemical facilities to and maintain the plan.
facilities will be selected for inspections ensure they have anti-terrorism There are important similarities
and how inspections will be conducted measures in place to reduce risks between the plan template and some
for both domestic and foreign facilities. associated with the storage and use of requirements in this rule. For example,
Further, we intend to engage in these high-risk chemicals. Any facility some security measures listed in the
significant outreach activities—both that possesses ‘‘chemicals of interest,’’ template are similar to some mitigation
domestically and internationally—to as identified by DHS, in certain strategies included in the FDA
facilitate industry compliance with this quantities is considered a covered Mitigation Strategies Database. The
rule and to communicate the Agency’s facility that must meet some or all of the testing of the plan is somewhat similar
current thinking on inspection, requirements under CFATS. Some to food defense monitoring. The plan
compliance, and enforcement strategies. agriculture and food facilities are template also suggests awareness
Additionally, we intend to develop fact subject to CFATS requirements. Covered training for employees, which is similar
sheets, FAQ documents, guidance chemical facilities are required to to a food defense awareness training
documents, and other informational prepare Security Vulnerability requirement in this rule. The
materials as needed to support domestic Assessments that identify facility similarities reflect FDA and USDA
and foreign industry compliance with security vulnerabilities and to develop collaboration on food defense activities
the rule. and implement Site Security Plans that for many years as discussed in the
(Comment 22) Several comments identify measures that satisfy risk-based proposed rule (78 FR 78014 at 78021).
recommend that food defense activities performance standards. These risk- However, food defense plans
conducted under programs, such as the based performance standards focus on developed using the FSIS template
Department of Homeland Security’s physical security of the chemicals. would not meet all requirements of this
(DHS) Customs-Trade Partnership Although both CFATS and C–TPAT final rule. Specifically, FSIS’s food
Against Terrorism (C–TPAT) and programs address some of the security defense plan template does not include
concerns related to some food facilities, a vulnerability assessment of the points,
mutually recognized international
neither program addresses the unique steps, or procedures in a food process,
programs, the Chemical Facility Anti-
vulnerabilities associated with the food nor does it include implementation of
Terrorism Standards (CFATS), the
being manufactured, processed, packed mitigation strategies specific to the
USDA Food Safety and Inspection
or held at the facility. In general, vulnerable points. Additionally, the
Services (FSIS) food defense plan
voluntary security programs such as C– plan template does not include food
template, should be recognized as
TPAT focus on global supply chain defense monitoring, food defense
meeting the requirements of this rule.
security measures involved in the corrective action, food defense
Several comments state that there are
transportation of goods from location to verification, and some training required
global food safety schemes that include
location. The CFATS program focuses by this rule.
food defense requirements which could In addition, we recognize that there
on reducing risks related to chemicals,
be leveraged in inspections and are existing global food safety schemes
even in facilities that are mainly geared
implementation. Comments suggest that that include food defense requirements
toward food production. In contrast,
audits and private certifications done and that many in the food industry have
vulnerability assessments required by
under these food safety schemes should already adopted and implemented these
this rule require identification of
be sufficient for meeting the requirements. For example, the Global
significant vulnerabilities at discrete
requirements of this rule. Food Safety Initiative’s (GFSI) Guidance
processing steps within a facility, where
(Response 22) We disagree. The the intent of the attack is to cause wide Document Sixth Edition (Ref. 10)
programs identified by comments are scale public health harm by addresses food defense. Subsequently,
not sufficient to substitute for contaminating the food supply. Further, many of the GFSI-recognized schemes
compliance with this rule. For example, a vulnerability assessment must include more specific food defense
they do not require mitigation strategies consider the threat stemming from an requirements. The Safe Quality Foods
at all actionable process steps and inside attacker. Once these significant (SQF) Code, edition 7.1 is a process and
therefore are not sufficient to vulnerabilities are identified, mitigation product certification standard that
significantly minimize or prevent strategies are implemented at or near specifies various food defense elements,
intentional adulteration intended to those most vulnerable processing steps. including that the methods,
cause wide scale public health harm. Given these differences, it is unlikely responsibility, and criteria for
Further, even if currently they were that facilities would be compliant with preventing food adulteration caused by
sufficient for compliance for this rule, this rule were they to rely wholly on a deliberate act of sabotage or terrorist-
they could change at any time. assessments and mitigation strategies like incident shall be documented,
C–TPAT is a voluntary supply-chain conducted as part of other programs. implemented and maintained (Ref. 11).
security certification program led by The food defense plan template from Another example of industry standards
U.S. Customs and Border Protection USDA FSIS is voluntary for FSIS- that incorporate food defense elements
(CBP) that focuses on private companies regulated facilities, and is organized in is the International Featured Standards
(including food companies) four sections: (1) Outside Security (IFS) Food Version 6 Standard, which
implementing anti-terrorism measures Measures, (2) Inside Security Measures, specifies that areas critical to security be
to protect their supply chains. When (3) Personnel Security Measures, and (4) identified, food defense hazard analysis
companies join C–TPAT, they sign an Incident Response Security Measures. and assessment of associated risks be
agreement to work with CBP to identify The template focuses on a facility’s conducted annually or upon changes
supply chain security gaps and physical security measures, which are that affect food integrity, and an
implement specific security measures analogous to recommended, but not appropriate alert system be defined and
and best practices. CBP has found that required, facility wide security periodically tested for effectiveness (Ref.
the security standards of some foreign measures in this rule. FSIS-regulated 12). We recognize that some in the food
industry partnership programs are facilities are encouraged to read and industry have already voluntarily taken
similar to those of the C–TPAT program. sign the template, adopt it as their food steps to incorporate and implement food
defense measures; however, they are not rule implementation will include these of terrorism. In this document we
adequate to substitute for meeting the efforts to ensure facilities gain discuss comments we received with
requirements of this rule. understanding and awareness to comply specific recommendations on foods or
Although participation with global with the rule. In addition, we are activities to exempt from the rule.
food safety schemes and other programs providing for a longer timeline for (Comment 27) Some comments assert
administered by our Federal partners facilities to come into compliance, that facilities engaged solely in cooling,
are not substitutes for compliance with allowing for more outreach and dialogue holding, handling, packing, repacking,
this rule, we believe that participation with industry. Facilities, other than packaging and shipping of raw, intact
in programs such as C–TPAT, CFATS, small and very small businesses, have 3 fresh produce, similar to activities that
the use of the FSIS food defense plan years after the effective date to comply may be performed on farms, are unlikely
template, or international programs with part 121. Small businesses (i.e., to be engaged in any of the key activity
granted mutual recognition status as those employing fewer than 500 full- types and should be exempt from this
that of C–TPAT, for example, decreases time equivalent employees) have 4 years rule. The comments describe activities
a facility’s vulnerability to intentional after the effective date to comply with conducted by these facilities, including
adulteration and can work in concert part 121. Very small businesses (i.e., application of fungicide, food grade wax
with the requirements of the final rule. businesses that have less than coating, sorting and placing whole
Additionally, a facility’s participation in $10,000,000, adjusted for inflation, per intact produce into boxes for shipping.
such programs may be considered by year, during the 3-year period preceding The comments further state that whole
FDA as we prioritize risk-based the applicable calendar year in both intact produce would not be an
inspections of facilities subject to the sales of human food plus the market attractive or feasible target for an act of
final rule. Further, we note that a value of human food manufactured, intentional adulteration with the intent
facility may use existing records (e.g., processed, packed, or held without sale, to cause wide scale public health harm,
records that are kept as part of these e.g., held for a fee) have 5 years after the regardless of where the activities occur.
other programs) to meet the effective date to comply with § 121.5(a). (Response 27) We decline the
requirements of this rule, if they contain (Comment 25) Some comments requested exemption for facilities
all of the required information and, recommend that FDA update the Food engaged solely in cooling, holding,
facilities may supplement existing Defense Plan Builder software tool to handling, packing, repacking, packaging
records as necessary to include all of the capture the elements of a food defense and shipping of raw, intact fresh
information required by this rule plan required by the final rule, such as produce. We recognize that some of
(§ 121.330). monitoring, corrective actions, and these facilities may not have any
(Comment 23) Some comments state verification. significant vulnerabilities; however,
that laws in the European Union (Response 25) FDA plans to update some may. For example, packaging may
currently require food facilities to take existing tools and resources, including be a significant vulnerability, depending
necessary measures to prevent the Food Defense Plan Builder software, on the degree of access to the food and
intentional adulteration, and it is to assist industry with meeting the the characteristics of the packaging area
therefore not justified to request requirements for the final rule. (e.g., in a minimally trafficked area
additional safety or security (Comment 26) Several comments where individuals are working alone for
requirements for facilities subject to request that FDA periodically update its extended periods of time, or if the
these laws. online tools and resources for product is being sprayed with fumigant
(Response 23) We disagree. This rule companies to have access to information or fungicide applications that may serve
contains those measures FDA has about broad mitigation strategies, to apply a contaminant onto the food).
determined are necessary to protect food although they are not required under the Therefore, to determine whether any
against intentional adulteration. To the rule. mitigation strategies are needed, each
extent a facility is already taking actions (Response 26) FDA intends to publish facility must conduct a facility specific
that are required by this rule, a facility guidance to support industry vulnerability assessment that considers,
will have to make fewer changes to its compliance with the final rule. This at a minimum: (1) The potential public
operations. These security measures guidance will include information health impact if a contaminant were
should be evaluated on a case-by-case relevant to the required provisions of added (e.g., severity and scale); (2) the
basis to determine if they qualify as a the final rule and also will likely degree of physical access to product;
mitigation strategy under this rule. include helpful information on facility- and (3) the ability of an attacker to
(Comment 24) Some comments wide security measures as well as other successfully contaminate the product.
request that FDA focus on education best practices and recommendations to Any of the activities described in the
over enforcement and use discretion assist facilities in their development of comments that are otherwise covered by
during inspections. a comprehensive food defense program. existing exemptions do not need to be
(Response 24) As FSMA as a whole is In addition, FDA has a number of tools considered in the vulnerability
a substantial change in how FDA and resources currently available on our assessment. For example, holding of
approaches regulating the food and Web site (http://www.fda.gov/ foods other than in liquid storage tanks
agriculture sector, we recognize that fooddefense) that were developed for is exempt from the rule (§ 121.5(b)).
significant outreach, education, and our voluntary food defense program that Also, packing or re-packing of food
training will be required to facilitate can assist industry. where the container that directly
industry compliance with all FSMA contacts the food remains intact is
rules. As previously stated by the E. Comments on Requests for Additional exempt (§ 121.5(c)).
Agency, one of the guiding principles Exemptions If after conducting a vulnerability

for implementing FSMA is that the In the proposed rule we specifically assessment, a facility appropriately
Agency will educate before and while requested comments on whether there concludes that it has no actionable
we regulate. This includes a focus on are other ways in which the coverage of process steps, the facility would not be
sector-specific guidance, education, this regulation can be further focused on required to implement mitigation
outreach, and technical assistance for foods that present a high risk of strategies. The facility’s food defense
industry. The intentional adulteration intentional adulteration caused by acts plan would include the vulnerability
assessment, the conclusion that no packaging of food ingredients from to consumers, and whether used as a
actionable process steps are present, and requirements for focused mitigation food additive or an ingredient the gas
an explanation for this conclusion at strategies and make them subject only to comprises a very small percentage of the
each step. In contrast, facilities with requirements for broad mitigation final food product.
actionable process steps are required to strategies. (Response 31) We decline the request.
implement mitigation strategies and the (Response 29) We decline this The comment identifies that food gases
appropriate mitigation strategies request. As discussed in section IV.B.3, may be stored in bulk storage tanks
management components. the rule now refers to ‘‘mitigation either during manufacture, or prior to
(Comment 28) One comment suggests strategy’’ rather than ‘‘focused containerization or transport. We
that we exempt food additives used in mitigation strategy.’’ Further, our recognize at some facilities
low dosages. The comment asserts that vulnerability assessments concluded manufacturing food gas may not have
‘‘the dosage of food additives are that an act of intentional adulteration any significant vulnerabilities; however,
approximately 0.01—1 percent of the could still result in wide scale public each covered facility must conduct a
total food, and the final amount of the health harm even if the adulteration facility specific vulnerability
food additive absorbed into the human occurred during the production of an assessment, and that assessment must
body should be very small, roughly 1/ ingredient. Ingredients have many consider, at a minimum: (1) The
100—1/10,000 of the total food different distribution paths. Many potential public health impact if a
consumed.’’ The comment further ingredients can be sold in bulk to contaminant were added (e.g., severity
asserts that if a contaminant is added to manufacturing facilities for inclusion in and scale); (2) the degree of physical
a food additive used in low dosages, the processed finished foods or be sold in access to product; (3) the ability of an
risk to public health is very small. consumer sized packaging for home use. aggressor to successfully contaminate
(Response 28) We decline this Some ingredients can be used in later the product. The comment mentions
request. Our vulnerability assessments processing as a primary ingredient or as that breaching food gas containers
considered a number of factors when a secondary ingredient added in much would require use and knowledge of
evaluating a product’s vulnerability to lower volumes. In either case, the specialized equipment that is not
acts of intentional adulteration and the ingredient manufacturer could be an readily available. However, the
potential public health consequences of effective point for an attacker to achieve vulnerability assessment must include
such an act, including a wide variety of wide scale public health harm. consideration of an inside attacker, so
threat agents. Our vulnerability (Comment 30) One comment supports this information may be available to
assessments concluded that there were our proposed exemption § 121.5(c) such an individual. The comment also
situations where an act of intentional applicable to packing, repacking, mentions that gases can be stored or
adulteration could still result in wide labeling, or re-labeling of food where the transported in liquid form. Based on our
scale public health harm even if the container that directly contacts the food vulnerability assessments, liquids
dose of the adulterant were at or below remains intact. The comment would like storage and handling has been identified
the levels highlighted in this comment. us to further exempt the transportation as potentially significantly vulnerable.
Moreover, the concentration of a food and holding of foods in retail packaged Therefore, facilities manufacturing food
additive in the finished product may form from coverage under this rule. gas would need to evaluate their
vary depending on the nature of the (Response 30) The holding of food, manufacturing process through a
product (e.g., citric acid can be added to except for holding of food in liquid vulnerability assessment. If after
a food as a flavor enhancer in relatively storage tanks, is exempt under conducting a vulnerability assessment,
low concentrations, or to other foods in § 121.5(b). Therefore, the holding of the facility appropriately concludes that
higher concentrations as a color foods in retail packaged form is exempt there are no actionable process steps in
retention agent). from this rule. Furthermore, as the facility, the facility would not be
(Comment 29) One comment explained in section III.G.1, required to implement mitigation
recommends that we exempt production transportation carriers are not included strategies. The food defense plan at this
and packaging of food ingredients from in the scope of this rule. facility would include the vulnerability
the rule. The comment asserts that (Comment 31) One comment requests assessment, the conclusion that no
terrorist groups are more likely to attack that food gases be considered for an actionable process steps are present, and
finished food production than food exemption for several reasons. The an explanation for this conclusion at
ingredient production because they comment states that food gas containers each step.
want the publicity associated with are extremely difficult to breach. (Comment 32) Some comments
seeing the harm that their act causes. Further, the comment states that food request that FDA exempt research and
The comment further asserts that it may gases may be stored in bulk storage development (R&D) and pilot plants
be months or years before a tanks either during manufacture, or from the rule. These comments argue
contaminated ingredient reaches prior to containerization (i.e., that a vulnerability assessment
consumers, and therefore it would not pressurized cylinders) or transport (i.e., conducted at such a facility would in all
be a likely or attractive target for cryogenic tankers) but a person likelihood conclude that there are no
terrorists who want to make a more intentionally trying to contaminate the significant vulnerabilities due to the low
immediate impact. The comment also product during storage or transportation volume of product produced, because
states that a contaminant can be would require use and knowledge of such products are not typically for retail
degraded, inactivated, or destroyed in specialized equipment that is not sale, and because of the narrow scope of
further processing or prolonged storage readily available. The comment argues consuming individuals, if any.
if it is added to an ingredient. The therefore that food gases are not at high (Response 32) We decline the request.
comment maintains that it is far easier risk for intentional adulteration. In We note that if food at an R&D facility
to select an appropriate contaminant addition, the comment notes that there is not for consumption, the facility is
with some knowledge of what types of are several uses for food gases, such as not required to register and would not
processing it will have to survive. The processing aids (e.g., freezing, chilling, be subject to this rule. Food processed
comment requests that, at a minimum, pressure transfer) that will have at R&D facilities may be consumed as
we exempt the production and minimal contact with the food provided samples, distributed at special events, or
may take other routes to public comments that suggest we repropose option to identify actionable process
consumption. As with other facilities this rule to give industry more time to steps. We did not identify receiving and
covered by the rule, it is possible, based comply, we have addressed this issue by loading of other types of foods (e.g.,
on a facility specific vulnerability extending the compliance dates by an non-bulk liquid, solid, gaseous) as key
assessment, that an R&D facility may additional 2 years (see section VIII). activity types because we determined
conclude that it does not contain any (Comment 34) One comment through our vulnerability assessments
significant vulnerabilities. If, after disagrees with the exemption for that they do not present the same level
conducting a vulnerability assessment, holding non-liquid bulk food. The of risk. Further, we tentatively
the facility appropriately concludes that comment asserts that most bulk foods, concluded that requiring receivers and
it has no actionable process steps, the irrespective of their physical form, are shippers of bulk liquids to implement
facility would not be required to likely to be mixed or blended at some mitigation strategies at actionable
implement mitigation strategies. The point after receipt by the end-user (i.e., process steps involving loading and
facility’s food defense plan would the manufacturer or packager that will receiving of bulk liquid foods would
include the vulnerability assessment, convert the bulk food into retail significantly minimize or prevent the
the conclusion that no actionable packaged food), and are likely to be potential for intentional adulteration of
process steps are present, and an processed into a much larger volume of these foods during transportation.
explanation for this determination at finished food. Thus, the comment Based on our vulnerability
each step. In contrast, an R&D facility maintains that any contamination assessments, we proposed to require
with actionable process steps is required introduced into a bulk food during that mitigation strategies to ensure the
to implement mitigation strategies and storage prior to its use in the integrity of food during transport would
the appropriate mitigation strategies preparation of a retail packaged food be implemented by facilities, rather than
management components. may affect a large volume of finished carriers. Where such measures are
food and may thereby cause massive implemented by the shippers and
F. Other General Comments receivers of bulk liquids, we tentatively
public health harm.
(Comment 33) Some comments ask us (Response 34) As discussed in the concluded that the food would be
to publish a revised proposed rule or an proposed rule, based on an analysis of sufficiently protected, and that no
interim rule before proceeding to a final the vulnerability assessments that FDA further actions by a carrier would be
rule because of anticipated, significant has conducted using the needed. For this reason, we did not
changes resulting from comments that CARVER+Shock methodology, we propose to cover transportation carriers
we received in response to the proposed identified four key activity types (Bulk in the proposed rule. We requested
rule. Some comments state that food liquid receiving and loading; Liquid comment on our analysis and tentative
defense is a new and evolving area storage and handling; Secondary conclusion.
without existing regulatory ingredient handling; and Mixing and Some comments agree with the
requirements or a long history of similar activities) as production tentative conclusion in the proposed
broadly accepted practices and that processes that require focused rule to exclude transportation carriers.
further substantive dialogue with mitigation strategies. With the exception Some comments oppose this approach.
industry is needed. Some comments of the holding of food in liquid storage In the following paragraphs, we discuss
state that a reproposal would serve the tanks, which is not included in the comments that disagree with the
same purpose as an Advance Notice of exemption, we are not aware of proposed approach. After considering
Proposed Rulemaking which was FDA’s activities performed during the holding the comments, we are finalizing the rule
stated intent prior to the imposition of of food that fit within any of these four as proposed with regard to
judicial deadlines. Some comments key activity types (see 78 FR 78014 at transportation carriers.
state that because FSMA rules are (Comment 35) Some comments
78036). There is no likely way that a
dependent on one another, some disagree with our conclusion that
contaminant can be homogeneously
proposed FSMA rules should be issued implementing mitigation strategies at
mixed throughout a non-liquid bulk
concurrently so that a concurrent the receiving and loading steps for bulk
food during storage. We found in our
evaluation and comment period may be liquids will adequately protect food
vulnerability assessments that the
conducted. Some comments state that during transportation. Some comments
potential for uniform distribution of a argue that transport of food is one of the
industry must first get used to the new
contaminant into the food is a major most vulnerable stages in a process, as
food safety regulations and then
factor in elevating vulnerability. Since it food is not protected by a secure facility
concentrate on new food defense
is highly unlikely that an inside attacker and may often be parked at a truck stop
regulations and believe reproposing at a
would be able to evenly distribute a or other unsecure locations for extended
later date will give industry a chance to
comply with all the new regulations. contaminant into a dry bulk ingredient periods of time which provides the
(Response 33) We decline these during storage, the vulnerability opportunity for an attacker to gain
requests. These revisions in the final associated with these steps did not rise access. One comment states that food
rule more closely align the rule with to the level associated with the shipments have consistently been
many current food defense best vulnerability associated with the key documented as either the first or second
practices and increase flexibility for activity types. most stolen truckloads on U.S.
facilities to comply. With regard to the G. Other Issues Discussed in the highways, and if terrorists were to use
suggestion that we should issue the Proposed Rule this mode of attack on the food supply,
FSMA foundational proposed rules the result could be a major event for
simultaneously for comment, this was 1. Transportation Carriers which we were not only unprepared,
not feasible given our judicial deadlines In the proposed rule, we tentatively but for which we could have foreseen
for the seven rules (Ref. 13). We believe determined that there is a significant the risk.
that stakeholders were given adequate vulnerability to intentional adulteration (Response 35) We disagree with these
opportunity to comment on the during bulk liquid receiving and comments. Based on our vulnerability
proposed rules, and we extended many loading, one of the four key activity assessments, we determined that the
comment periods. With regard to the types included in the proposal as an most practical mitigation strategies to
ensure the integrity of food during shipments, inspecting loads prior to situations where only one of the entities
transport would be implemented by receipt, and rejecting damaged or involved is covered by the intentional
facilities, rather than by carriers. For suspect items. These steps together will adulteration rule (e.g., the shipper is
example, to significantly minimize or then work to significantly reduce the covered, but the receiver is exempt due
prevent the product from being significant vulnerabilities associated to size or vice versa) and states that FDA
intentionally adulterated during with the transport of food. With respect may need to take a closer look into
transport, a shipper may elect to use to the prevalence of theft of food during exemption of carriers.
seals to secure access points, such as transport, such theft is economically
doors or hatches, on the transport motivated; the scope of this rule is (Response 37) A covered facility may
conveyance. The shipper seals the load limited to acts of intentional ship food to or receive food from a
prior to departure from its facility by adulteration where the intent is to cause facility that is not covered by the rule
using seals with unique identification wide scale public health harm. (e.g., it is a very small business). The
numbers. The shipper includes the seal (Comment 36) One comment states covered facility is responsible for
numbers on shipping documentation that the use of seals or tamper-evident implementing mitigation strategies to
and transmits the seal numbers to the containers is insufficient to protect bulk address transportation if it has a
receiving facility. Once the shipment foods during transportation and/or significant vulnerability associated with
arrives at the receiving facility, the holding because tamper-evident seals transportation at the receiving or
receiver would verify the seals are in can be defeated and cannot be expected shipping steps. The mitigation strategies
place and that the identification to prevent a determined attacker. The used by the covered facility must
numbers match. This mitigation strategy comment further states that tamper- significantly minimize or eliminate the
ensures the food was not accessible evident containers or seals should be significant vulnerability at this step.
during transport. To ensure that the used in combination with other Mitigation strategies are available to
driver cannot exploit his position to measures. protect the food during transport
gain access and intentionally adulterate (Response 36) Mitigation strategies are
regardless of whether the shipper or
the food during transport, the carrier has ‘‘risk-based,’’ ‘‘reasonably appropriate
measures’’ employed to ‘‘significantly receiver is exempt from the rule. If the
no role in the seal mitigation strategy. If receiving facility is exempt, the
seals are missing or the identification minimize or prevent’’ significant
vulnerabilities. They cannot always shipping facility can address the
numbers do not match the shipping vulnerability by implementing
documentation, the receiving facility eliminate entirely any possibility of
intentional adulteration. Furthermore, mitigation strategies such as those
would reject the load and notify the discussed in Response 36. If the
shipper. each facility has some degree of
discretion in determining how, and shipping facility is exempt, the
Facilities are required to implement whether, each mitigation strategy is receiving facility can address the
mitigation strategies that significantly properly implemented, as part of the vulnerability by implementing
minimize or prevent significant facility’s written explanation of how the mitigation strategies such as visually
vulnerabilities associated with mitigation strategy sufficiently inspecting seals and cargo to identify
actionable process steps. Therefore, if a minimizes or prevents the significant any suspicious activity or tampering,
food operation has a significant vulnerability associated with the verifying shipping documents are
vulnerability associated with actionable process step. Facilities are accurate, ensuring only scheduled
transportation, the facility must choose required to implement mitigation
a mitigation strategy or combination of deliveries are accepted, and
strategies that significantly minimize or investigating delayed or inaccurate
strategies to significantly reduce the prevent the significant vulnerability;
vulnerability at the receiving or loading shipments. Additionally, we do not
therefore, if a significant vulnerability is
step. Mitigation strategies implemented believe a shipping and/or receiving
identified, the mitigation strategy or
at inbound receiving and outbound facility that qualifies for the very small
combination of strategies chosen by the
shipping would work complementary to facility must be sufficient to reduce the business exemption is an attractive
each other to protect the food during vulnerability to an acceptable level at target for attackers intending to cause
transport. For example, if the these steps. wide scale public health harm, as
vulnerability assessment concludes that In many cases the use of tamper detailed in section IV.B.11.
loading is an actionable process step evident seals may be an appropriate (Comment 38) Some comments state
because of a vulnerability during mitigation strategy for limiting access to that covering carriers under this rule
transportation, the facility would the product. Additionally, if a tamper may not be the best approach and this
implement mitigation strategies to evident seal had been circumvented by component of the food sector may be
protect its outbound food from an attacker, a close inspection of the better addressed in guidance. Some
intentional adulteration (e.g., sealing the seal at receiving may reveal suspicious comments ask us to continue to develop
bulk liquid tanker truck access points). activity or tampering which reduces the materials, guidelines and other tools to
Likewise, if the facility receiving the likelihood of a successful attack. promote voluntary compliance of food
food identifies receiving as an However if the facility concludes that
defense measures by the transportation
actionable process step because of a tamper evident seals are not by
vulnerability during transportation, it component of the food sector.
themselves sufficient to significantly
would implement mitigation strategies reduce the vulnerability, they should (Response 38) We agree with these
to reduce the vulnerability of the food employ other or additional measures comments. As resources allow, we will
to intentional adulteration during (such as directing carriers to travel continue to develop best practices for
shipping. The mitigations employed at directly to the end destination without the transportation industry to assist
the receiving/unloading step may stop-overs, or requiring teamed drivers with voluntary compliance with food
include procedures to accept only to prevent the load from being defense measures.
scheduled shipments, verification of unsupervised during transport).
shipping documentation, procedures to (Comment 37) One comment requests
investigate delayed or missing clarification of expectations in
2. Other Types of Intentional intentional adulteration at an actionable milk (also referred to in this document
Adulteration: Disgruntled Employees, process step—even if that act of as ‘‘dairy farms’’) subject to section 420
Consumers, and Competitors; and intentional adulteration is not intended of the FD&C Act to take measures to
Economically Motivated Adulteration to cause wide-scale public health harm. address economically motivated
a. Disgruntled Employees, Consumers, We continue to believe that an approach adulteration. With regard to produce
and Competitors that does not focus on preventing wide- farms, we tentatively concluded that
scale public health harm, but rather there are not procedures, processes, or
In the proposed rule, we explained attempts to address intentional acts practices that are reasonably necessary
that when we considered the spectrum regardless of their potential severity, to be implemented by these entities to
of risk associated with intentional would require restricting access to prevent the introduction of known or
adulteration of food, attacks conducted nearly all points in the food system reasonably foreseeable biological,
with the intent of causing massive because these types of attacks are chemical, or physical hazards that can
casualties and to a lesser extent, typically conducted at areas of cause serious adverse health
economic disruption, would be ranked convenience and could occur at any consequences or death as a result of
as relatively high risk. (Note that to point in the food system. economically motivated adulteration.
further clarify the rule’s focus we have With regard to farms that produce milk,
removed the reference to economic b. Economically Motivated Adulteration
we tentatively concluded that there are
disruption from the definition of ‘‘food In the proposed rule, we stated that not appropriate science-based strategies
defense.’’) We further explained that the goal of the perpetrator of or measures intended to protect against
attacks by disgruntled employees, economically motivated adulteration is economically motivated adulteration
consumers, or competitors would be for the adulteration to go undetected so that can be applied at the farm. Those
consistently ranked as relatively low the perpetrator can continue to obtain tentative conclusions were based on our
risk mainly because their public health the desired economic benefit. Unlike assessment that preventive controls are
and economic impact would be with intentional adulteration, where the suitable to address economically
generally quite small. We further stated intent is to cause wide scale public motivated adulteration when it is
that disgruntled employees are generally health harm through instances such as perpetrated by the entity’s supplier, but
understood to be interested primarily in acts of terrorism focused on the food not when it is perpetrated by the entity
attacking the reputation of the company supply, occurrences of economically itself, and supplier controls are not
and otherwise have little interest in motivated adulteration are expected to warranted in this context because of the
public health harm. Typically, acts of be long term, and would not be lack of inputs into the growing,
disgruntled employees, consumers, or appropriately viewed as a rare harvesting, packing, or holding of
competitors target food and the point(s) occurrence, but rather as reasonably produce or milk (i.e., activities within
in its production that are convenient likely to occur. Because of these our farm definition) that could be
(i.e., a point at which they can easily reasons, we concluded that the subject to economically motivated
access the food and contaminate it). To approaches in the PCHF and PCAF final adulteration that could cause serious
minimize or prevent this type of rules are better suited to address adverse health consequences or death
adulteration would require restricting economically motivated adulteration. under sections 419 and 420 of the FD&C
access to nearly all points in the food We sought comment on our Act.
system. Instead, we proposed to focus conclusions. We received one comment suggesting
on those points in the food system We received numerous comments we include requirements related to
where an attack would be expected to related to economically motivated economically motivated adulteration on
cause massive adverse public health adulteration, including comments produce farms and stating that
impact. suggesting economically motivated economically motivated adulteration
We received comments supporting the adulteration is best addressed in this (e.g., illegal use of dyes and ripening
proposed approach; comments stating rule, comments suggesting it is best agents) has occurred on foreign produce
that measures should be required to addressed in the PCHF and PCAF final farms. We continue to believe that
protect against acts of terrorism and rules, comments recommending preventive controls are suitable to
disgruntled employees; and a comment different hazard identification address economically motivated
stating that disgruntled employees can methodologies, comments related to adulteration when it is perpetrated by
be recruited by terrorist organizations. terminology and definitions, and an entity’s supplier, but not by the
The final rule is focused on protecting comments requesting postponement of entity itself. Preventive controls for
food against intentional adulteration any economically motivated economically motivated adulteration are
where the intent of the adulteration is adulteration-associated requirements. not suitable to address the situation
to cause wide scale public health harm. We continue to believe that the where the same farm that would be
In the circumstance described by the approaches in the PCHF and PCAF final economically adulterating the food
comment where a disgruntled employee rules are better suited to address (which is already prohibited) would
is recruited by a terrorist organization, economically motivated adulteration, also be responsible for implementing
the motivation of the employee has and have finalized this rule with no preventive controls to prevent the
changed from harming the reputation of requirements related to economically adulteration. After considering this
the company to that of the terrorist motivated adulteration for facilities comment, we have finalized this rule
organization intending to cause wide- covered by those rules. For further with no requirements related to
scale public health harm. The rule is discussion see the PCHF final rule (80 economically motivated adulteration on
designed to reduce the likelihood that FR 55908 at 56028–56029) and the produce and dairy farms.
such an attack would be successful. PCAF final rule (80 FR 56170 at 56243–
Further, the protections required by the 56246). 3. Dairy Farms
rule would be effective in minimizing In the proposed rule, we also In the proposed rule, we stated that
the likelihood of success of a tentatively decided not to require FDA-led vulnerability assessments and
disgruntled employee, consumer, or produce farms subject to section 419 of associated data analyses identified
competitor who attempts an act of the FD&C Act and farms that produce certain categories of points, steps, or
procedures in the food system which awareness training while other not farms (e.g., dairy processing
scored high on vulnerability scales comments state that such training may facilities) from complying with this rule.
related to intentional adulteration of be beneficial and is provided on some Unlike farms, such facilities have
food, regardless of the food being farms, but more information is needed identified effective mitigation strategies
assessed. Two of these key activity to identify effective training programs. available to them. In addition, PMO
types, liquid storage and handling, and Additionally, several comments requirements do not currently address
bulk liquid receiving and loading, are address procedural matters, with many intentional adulteration. Further, unlike
present on dairy farms in areas such as comments stating that FDA must either farms, these facilities are not exempt
the bulk liquid storage tank. We allow a full and separate comment from the PCHF rule. We note that the
requested comment on several period for any potential requirements earliest compliance date for this rule (3
questions, including whether and how for dairy farms because there were no years) is the same as the extended
access to the bulk milk storage tank and requirements related to dairy farms in compliance date in the PCHF rule,
milk house could be limited; the the proposed rule, or issue a fully which was chosen to give the NCIMS
presence and types of any mitigation separate proposal for dairy farms which time to modify the PMO to include the
strategies currently used on farms; and will cover the requirements in their requirements of the PCHF rule.
whether and what mitigation strategies entirety independent of the intentional
would be appropriate and feasible given adulteration regulations for facilities IV. Subpart A: Comments on Specific
current dairy farming practices. that are not farms. Some comments also Provisions
Some comments acknowledge that request that dairy processing facilities A. Revisions to Definitions Also Used in
limiting access to the bulk milk tank be exempt from the requirements of this Section 415 Registration Regulations (21
and milk house is an important rule. CFR Part 1, Subpart H) and Section 414
objective; however, these comments Although we believe requiring Recordkeeping Regulations (21 CFR Part
describe significant challenges regarding mitigation strategies that restrict access 1, Subpart J)
limiting access to milk. These comments to milk on dairy farms is warranted
state that some State laws require based on risk, at this time there are not As discussed in the proposed rule (78
unannounced access to the bulk tank strategies that limit access to milk that FR 78014 at 78030), several terms we
and/or the milk house for food safety are appropriate and practical to require proposed have the same definitions as
inspections. Additionally, comments for all farms. We believe it is important proposed in 21 CFR part 117 (the PCHF
state that locking only the bulk tank that any mitigation strategies we proposed rule) and therefore we did not
would be ineffective because this would consider imposing include restricting include an extensive discussion in the
still leave the milk accessible via the access to milk while it is on farms. We proposed rule of the following terms:
milk house. These comments also state agree with comments that state that facility, farm, holding, manufacturing/
that it is common for many dairy farms potential mitigation strategies, such as processing, mixed-type facility, and
to leave the bulk tank and the milk locking the milk tank and milk house, packing. We did not receive specific
house unlocked to facilitate normal day- are not currently workable given the comments on any of our proposed
to-day operations and that any realities of milking schedules and the definitions for these terms, except that
regulation requiring strictly limiting access to the bulk tank needed for food many comments state that it is critical
access, such as locking the milk house, safety inspections and milk collection. for FDA to cross-reference and be
would be impractical due to the We need further dialogue with key consistent with the same terms as
multiple entry points and the number of stakeholders and collaborative research finalized in the PCHF final rule. We
personnel needed for these measures to to develop and identify strategies that agree and we have amended each of
function effectively. Some comments are protective and practical; we are these terms to be consistent with the
suggest that FDA engage in substantial aware of technology-mediated definitions as finalized in the PCHF
dialogue with industry to gain a better advancements that are under final rule. See section IV. of the PCHF
understanding of current practices and development, and are potentially final rule for extensive discussion of the
better ascertain the food defense promising for the future in this area. comments received and changes made
measures that would be effective and Given the current lack of mitigation to these definitions.
appropriate before issuing regulations. strategies that would practically limit
1. Facility
Some comments state that FDA should access to milk, we agree that working
utilize existing programs to identify with the Federal-State collaborative We proposed to define the term
potential activities to reduce the program for milk safety, the National ‘‘facility’’ to mean a domestic facility or
vulnerability to intentional adulteration Conference on Interstate Milk a foreign facility that is required to
on dairy farms because these programs Shipments (NCIMS), is the most register under section 415 of the FD&C
have demonstrated efficacy and have appropriate way to address concerns Act (21 U.S.C. 350d), in accordance
the structures in place to successfully regarding intentional adulteration on with the requirements of 21 CFR part 1,
implement new food defense measures. dairy farms in the near term as strategies subpart H. We have finalized this term
Some comments state that FDA that can limit access to milk while on as proposed, except that we have made
should not issue requirements for dairy farm are developed. We believe NCIMS editorial changes by removing the U.S.
farms because they are not at high risk offers an effective platform for FDA to Code citation and amended the Code of
for intentional adulteration. Some advance the development and Federal Regulations citation.
comments describe the willingness of implementation of mitigation strategies
2. Farm
stakeholders to adopt voluntary food for dairy farms because the cooperative
defense measures, with specific program includes key partners, such as We proposed to define the term
examples including State-led education the U.S. Public Health Service/FDA, the ‘‘farm’’ by reference to the definition of
efforts and adoption of some elements of States, and the dairy industry, and has that term in § 1.227 of this chapter. We
existing FDA guidance relating to food a central role in helping to ensure the have finalized this term as proposed.
defense measures on dairy farms. Some safety of milk and milk products. For a detailed discussion of the
comments state that any requirements We are not exempting Pasteurized definition of ‘‘farm,’’ see sections IV.A
should be limited to food defense Milk Ordinance (PMO) facilities that are and IV.B of the PCHF final rule.
3. Holding 5. Mixed-Type Facility use of statutory definitions in section

We proposed to define mixed-type 201 of the FD&C Act, and we are
We proposed to define the term finalizing that provision without
‘‘holding’’ to mean storage of food. In facility to mean an establishment that
engages in both activities that are change. In this section, we discuss each
addition, we proposed that holding definition as proposed, related
facilities include warehouses, cold exempt from registration under section
comments, and our responses.
storage facilities, storage silos, grain 415 of the FD&C Act and activities that
elevators, and liquid storage tanks. require the establishment to be 1. Actionable Process Step
registered. The proposed definition also We proposed to define the term
Further, we proposed that for farms and
stated that an example of such a facility ‘‘actionable process step’’ to mean a
farm mixed-type facilities, holding also
is a ‘‘farm mixed-type facility,’’ which is point, step, or procedure in a food
includes activities traditionally
an establishment that grows and process at which food defense measures
performed by farms for the safe or
harvests crops or raises animals and can be applied and are essential to
effective storage of raw agricultural
may conduct other activities within the prevent or eliminate a significant
commodities grown or raised on the farm definition, but also conducts
same farm or another farm under the vulnerability or reduce such
activities that require the establishment vulnerability to an acceptable level.
same ownership, but does not include to be registered. In this final rule,
activities that transform a raw Although we did not receive comments
consistent with PCHF final rule and as on the proposed definition for
agricultural commodity (RAC), as a conforming change associated with the
defined in section 201(r) of the Federal actionable process step, we have revised
revisions to the ‘‘farm’’ definition, we the definition to improve understanding
Food, Drug, and Cosmetic Act (21 U.S.C. have revised the example of a ‘‘farm of the regulatory requirements in
321), into a processed food as defined in mixed-type facility’’ to specify that it is § 121.130 (Vulnerability assessment to
section 201(gg). In this final rule, an establishment that is a farm, but also identify significant vulnerabilities and
consistent with the PCHF final rule, we conducts activities outside the farm actionable process steps) and to be
have revised the definition for definition that require the establishment consistent with the definition of
‘‘holding’’ by removing the distinction to be registered. For a detailed mitigation strategies. In this final rule,
for farms and farm mixed-type facilities discussion of the definition of ‘‘mixed- actionable process step is defined to
and added that holding also includes type facility,’’ see section IV.F of the mean a point, step, or procedure in a
activities performed incidental to PCHF final rule. food process where a significant
storage of a food, but does not include vulnerability exists and at which
activities that transform a RAC into a 6. Packing
mitigation strategies can be applied and
processed food and included additional We proposed to define packing to are essential to significantly minimize
examples of holding activities. For a mean placing food into a container other or prevent the significant vulnerability.
detailed discussion of the definition of than packaging the food. Further, the
‘‘holding,’’ see section IV.D of the PCHF proposed rule provided that for farms 2. Contaminant
final rule. and farm mixed-type facilities, packing We proposed to define the term
also includes activities traditionally ‘‘contaminant’’ to mean any biological,
4. Manufacturing/Processing performed by farms to prepare RACs chemical, physical or radiological agent
We proposed to define grown or raised on the same farm or that may be intentionally added to food
manufacturing/processing to mean another farm under the same ownership and that may cause illness, injury or
making food from one or more for storage and transport, but does not death.
include activities that transform a RAC, (Comment 39) Some comments assert
ingredients, or synthesizing, preparing,
as defined in section 201(r) of the FD&C the proposed language defining
treating, modifying or manipulating
Act, into a processed food as defined in ‘‘contaminant’’ could be interpreted to
food, including food crops or
section 201(gg). In this final rule, include ingredients intentionally added
ingredients. Further, the proposed
consistent with the PCHF final rule, we to food that resulted in harm, even if
definition provided that examples of
have revised the definition for unintentional, such as an unintended
manufacturing/processing activities are allergic or other adverse health
‘‘packing’’ by removing the distinction
cutting, peeling, trimming, washing, response. The comments urge FDA to
for farms and farm mixed-type facilities
waxing, eviscerating, rendering, and adding that packing includes clarify the meaning to be an
cooking, baking, freezing, cooling, activities performed incidental to ‘‘intentional’’ contaminant, for the
pasteurizing, homogenizing, mixing, packing a food, but does not include purpose of this rule, by amending the
formulating, bottling, milling, grinding, activities that transform a RAC into a proposed definition as follows:
extracting juice, distilling, labeling, or processed food. We have also revised ‘‘Contaminant means any biological,
packaging. In addition, the proposed the definition to clarify that packing chemical, physical or radiological agent
definition provided that for farms and includes ‘‘re-packing.’’ For a detailed added to food to intentionally cause
farm mixed-type facilities, discussion of the definition of illness, injury or death.’’
manufacturing/processing does not ‘‘packing,’’ see section IV.G of the PCHF (Response 39) We agree with the
include activities that are part of final rule. possible confusion as pointed out by the
harvesting, packing, or holding. In this comments and have amended the
final rule, consistent with PCHF final B. Other Definitions That We Proposed proposed definition. The term
rule, we have revised the definition of To Establish in Part 121 ‘‘contaminant’’ is used in the context of
‘‘manufacturing/processing’’ by adding To establish the scope of facilities, intentional acts of adulteration with
to the list of examples and we have activities and food covered by this intent to cause wide scale public health
reorganized the listed examples to regulation, we proposed to define key harm. We agree that amending the
present them in alphabetical order. For terms. We also proposed to establish proposed definition for contaminant to
a detailed discussion of the definition of that the definitions in section 201 of the make clear that the harm must be
‘‘manufacturing/processing,’’ see section FD&C Act apply when used in part 121. intended better reflects how the term is
IV.E of the PCHF final rule. We received no comments regarding the used in this rule.
(Comment 40) One comment asserts laboratory materials, and pesticides; (4) or an attacker who circumvents
the term ‘‘contaminant,’’ is used widely management practices, such as perimeter protections (e.g., scaling a
in the food and dietary supplement ingredient storage inventory procedures; fence), with the goal of intentionally
industries and that if FDA were to key security procedures, PINs or contaminating the food.
include a definition for this term, it passwords; procedures to restrict Although the regulatory text now only
must employ a definition that is personal items from all food production refers to ‘‘mitigation strategies,’’ we
consistent throughout all regulations areas; procedures requiring IDs and continue to believe that facilities must
pertaining to food and dietary uniforms to be returned when a person’s protect vulnerable points in their
supplements. Further, one comment employment ends; and supplier
operation from acts of intentional
notes that this term is defined verification or certification procedures;
adulteration intended to cause wide
differently in the proposed rule (i.e., a and (5) crisis management planning,
scale public health harm and that a
contaminant is any agent that may be such as maintenance of updated
facility’s vulnerability to acts of
added to food) than it is in the Codex emergency contact information,
Alimentarius guidelines (i.e., procedures for responding to reported intentional adulteration by attackers
contaminants are substances that are threats, and establishment of a who have achieved access to the facility
‘‘not intentionally added to food or designated food defense leadership must be significantly reduced or
feed’’). The comment suggests that FDA team. We further explained that broad prevented to protect the food from
take note of this difference and consider mitigation strategies, by nature, are intentional adulteration intended to
revisions with the goal of promoting generally applicable to a facility, cause wide scale public health harm.
consistency and common understanding regardless of the type of food being General, facility-level protections do not
of terminology. processed, and, as such, are not targeted sufficiently address the significant
(Response 40) As discussed in the to a specific processing step in a food vulnerabilities within a facility because
proposed rule (78 FR 78014 at 78031), operation. they do not address an inside attacker
we based the proposed definition, in In contrast, focused mitigation who has obtained access to the facility.
part, on the definition of ‘‘contaminant’’ strategies are specific to an actionable (Comment 41) Some comments state
used in Codex Alimentarius guidelines, process step in a food operation where that the distinction between ‘‘broad’’
but made modifications to reflect the a significant vulnerability is identified. and ‘‘focused’’ mitigation strategies is
narrower context that the term is used They represent reasonably appropriate confusing, and request that the
within this rule. Further, as discussed in measures that are necessary to reduce distinction be removed. One comment
response to Comment 39, we are the likelihood of intentional states the line between broad and
amending the definition of adulteration intended to cause wide focused mitigation strategies is often
‘‘contaminant’’ to better reflect its scale public health harm. Focused blurry. The comment asks how close
limited use in this rule. mitigation strategies are customized to ingredient handling needs to be to a gate
the processing step at which they are for the gate to be considered a focused
3. Focused Mitigation Strategies
applied, tailored to existing facility mitigation strategy and not a broad one.
We proposed to define the term practices and procedures, and depend The comment further asserts that a
‘‘focused mitigation strategies’’ to mean on an evaluation of the significant mandate for focused mitigation
those risk-based, reasonably appropriate vulnerability associated with the strategies will result in endless debates
measures that a person knowledgeable actionable process step at which they between facility management and FDA
about food defense would employ to are applied. In the proposal we investigators as to whether a particular
significantly minimize or prevent tentatively concluded, based on our mitigation strategy is broad or focused
significant vulnerabilities identified at vulnerability assessments, that the and that this potential for difference of
actionable process steps, and that are implementation of focused mitigation opinion between facilities and FDA
consistent with the current scientific strategies at actionable process steps in
understanding of food defense at the investigators is of significant concern for
a food operation is necessary to industry stakeholders.
time of the analysis. minimize or prevent the significant
We explained in the proposed rule vulnerabilities that are identified in a (Response 41) The question asked by
that a ‘‘mitigation strategy’’ is a measure vulnerability assessment, regardless of the comment highlights the nuance and
taken by a facility to reduce the the existence of broad mitigation gradation that exists within mitigation
potential for intentional adulteration of strategies. strategies. After considering the
food. We further explained that FDA We further explained, in contrast to comments, we agree that many
divides mitigation strategies into two broad mitigation strategies, focused mitigation strategies may not lend
types, ‘‘broad mitigation strategies’’ and mitigation strategies are targeted to themselves to clear categorizations as
‘‘focused mitigation strategies.’’ We actionable process steps and, therefore, either ‘‘broad’’ or ‘‘focused,’’ and we
explained that broad mitigation are more effective at countering an agree that the delineation between broad
strategies are general facility-level attacker who has legitimate access to the and focused mitigation strategies, as
measures that are intended to minimize facility. Our conclusion was based upon described in the proposed rule, may be
a facility’s vulnerability, as a whole, to our interactions with the intelligence confusing because of the wide diversity
potential acts of intentional community and the many vulnerability of potential mitigations as well as
adulteration. We provided some assessments we conducted with variation as to how a facility chooses to
examples of broad mitigation strategies, industry, which showed that an act of implement a particular strategy. As a
such as (1) physical security, such as intentional adulteration by an insider result, we have modified the regulatory
perimeter security fencing, locking presents significant risk for that text throughout the final rule to refer to
exterior doors, penetration alarms; (2) adulteration to result in wide scale ‘‘mitigation strategy’’ rather than
personnel security, such as pre-hire public health harm and that broad ‘‘focused mitigation strategy.’’ For
background and reference checks, mitigation strategies are not specific example, § 121.135 now requires
identification badges, and controlled enough, for example, to counter the ‘‘mitigation strategies for actionable
visitor access; (3) securing hazardous actions of an attacker who has legitimate process steps.’’ Also, the title of the rule
materials, such as cleaning products, access to the facility (i.e., insider attack) has been modified to reflect this change.
4. Food the rule is not the protection against safety and food defense HACCP-type
We proposed to define the term economic disruption we have removed system differ in important, specific
‘‘food’’ to mean food as defined in that language from the definition of ways. As noted in the Regulatory
section 201(f) of the FD&C Act and ‘‘food defense’’ for purposes of this rule. Approach discussion in section III.A,
include raw materials and ingredients. In addition, as discussed in section food safety uses the term ‘‘hazard
(Comment 42) Some comments urged III.G.2, economically motivated analysis’’ to identify hazards, while food
us to clarify that the definition of food adulteration is not addressed in this defense uses the term ‘‘vulnerability
does not include food contact final rule. assessment’’ to identify significant
(Comment 44) One comment states vulnerabilities. These terms are
substances as defined in section
that the proposed rule defines ‘‘food completely different because they
409(h)(6) of the FD&C Act (21 U.S.C.
defense’’ within the scope of the rule represent key disciplinary differences
348(h)(6)). One comment recommends
and requests that FDA establish a which require different methodological
FDA amend the definition of food to generalized definition of ‘‘food defense’’ considerations related to whether the
exempt EPA registered antimicrobials/ that can be adopted for the purposes of adulteration is intentional. A hazard
pesticides and food contact substances all FDA activities and subsequently the analysis has very different
which have no ongoing intended scope of this rule can then be further considerations than a vulnerability
technical effect in the final finished elaborated. The comment proposes the assessment.
food. following definition of food defense: However, we disagree that completely
(Response 42) This rule only applies ‘‘Actions and activities related to different terminology is appropriate for
to facilities required to register with prevention, protection, mitigation, a term that describes the performance of
FDA. The registration rule does not response, and recovery of the food similar activities for both food safety
include food contact substances and system from intentional acts of and food defense. Monitoring is
pesticides (21 CFR 1.227(a)(4)(i)). No adulteration. This includes intentional conducted to perform a similar function
change to the definition of food in this adulteration from both terrorism and and in similar ways in both a food
rule is necessary. criminal activities. Criminal activities defense and a food safety framework. In
5. Food Defense include economically motivated both contexts monitoring is conducted
adulteration, as well as acts by to assess whether control measures are
We proposed to define the term ‘‘food disgruntled employees, consumers, or operating as intended, and in
defense’’ to mean the effort to protect competitors intending to cause public accordance with the food safety or food
food from intentional acts of health harm or business disruption.’’ defense plan. However, constant
adulteration where there is an intent to (Response 44) We decline this monitoring of some preventive controls
cause public health harm and economic request. The purpose of § 121.3 is necessary (e.g., time-temperature
disruption. (Definitions) is to define terminology monitoring for pasteurization), while
(Comment 43) One comment states that is used within the regulatory text of periodic monitoring is likely to be more
that references to ‘‘terrorism’’ in the the rule. Therefore, the definitions of appropriate for many mitigation
preamble to the proposed rule were terms need to be within the context and strategies (e.g., checking the lock on an
unnecessarily limiting and confusing scope of the rule, rather than a access hatch to a liquid storage tank at
and recommends that instead of definition to be used by FDA or industry the end of the tank cleaning cycle).
attempting to narrow the scope of activities not related to the rule in Therefore, to recognize that the
intentional adulteration to ‘‘terrorism,’’ particular. management components for food safety
FDA should use the definition of ‘‘food and food defense perform similar
defense’’ to explain and further clarify 6. Monitor
activities, but also include some
the focus of activities covered by the We proposed to define the term differences, we are changing the term to
rule. ‘‘monitor’’ to mean to conduct a ‘‘food defense monitoring’’ to make
(Response 43) We agree with this planned sequence of observations or clear that the expectations for
comment and have modified the measurements to assess whether compliance are different. In additional
definition of ‘‘food defense’’ in the final focused mitigation strategies are recognition that the management
rule as follows: ‘‘Food defense means, consistently applied and to produce an components for food safety and food
for purposes of this part, the effort to accurate record for use in verification. defense perform similar activities, we
protect food from intentional acts of (Comment 45) Some comments assert are finalizing the definition of food
adulteration where there is intent to that food safety and food defense defense monitoring to mean to conduct
cause wide scale public health harm.’’ require different terminology and a planned sequence of observations or
As discussed in the preamble to the suggest referring to the activities as measurements to assess whether
proposed rule, although we referred to ‘‘checking’’ instead of ‘‘monitoring.’’ mitigation strategies are operating as
the protection of the food supply from These comments go on to suggest that intended. This definition is similar to
‘‘acts of terrorism’’ throughout the the definition of checking should be ‘‘to the definition of monitoring in the
proposed rule, we expect our approach observe or otherwise assess whether PCHF final rule.
would generally address acts intended mitigation strategies or measures are in As we have concluded that, in some
to cause wide scale public health harm, place and fully implemented.’’ The instances, similar terminology is
whether committed by terrorists, comments also state that ‘‘a planned appropriate for activities that are
terrorist organizations, individuals or sequence of observations and conducted to perform similar functions
groups of individuals. The purpose of measurements’’ may not be appropriate for food safety and food defense,
this rule is to protect the food supply for all or any mitigation strategies, and incorporation of elements from
against individuals or organizations questions what kind of measurements of definitions of internationally recognized
with the intent to cause wide scale a mitigation strategy a facility would standards (e.g., Codex) is appropriate for
public health harm. Further, although take. this rule. A ‘‘planned sequence’’ is
economic disruption is likely to occur (Response 45) We agree that using included in the definition because it is
in any such instance of wide scale completely different terminology is important to thoughtfully and
public health harm, because the focus of appropriate when components of a food systematically assess whether mitigation
strategies are operating as intended, and death and the degree of accessibility to (see § 1.328). Under this approach, the
the inclusion of ‘‘a planned sequence’’ that point in the food process. number of full-time equivalent
in the definition conveys this Although we did not receive employees is determined by dividing
importance. For example, a facility may comments on the proposed definition the total number of hours of salary or
establish and implement written for significant vulnerability, we have wages paid directly to employees of the
monitoring procedures to include a revised the definition to improve business entity claiming the exemption
planned sequence of observations to understanding of the regulatory and of all of its affiliates and
monitor a lock on an access hatch to requirements in § 121.130 (Vulnerability subsidiaries by the number of hours of
occur at the end of every silo cleaning assessment to identify significant work in 1 year, 2,080 hours (i.e., 40
cycle, when there is potential to add a vulnerabilities and actionable process hours × 52 weeks).
contaminant because the access hatch steps). In this final rule, significant In addition, we are adding ‘‘including
can be opened without the contents of vulnerability is defined to mean a any subsidiaries and affiliates’’ to the
the silo spilling out. Without planning vulnerability that, if exploited, could definition to provide clarity on how to
the sequence of observations of this reasonably be expected to cause wide calculate ‘‘500 full-time equivalent
mitigation strategy, monitoring the scale public health harm. A significant employees’’ for purposes of this rule.
strategy may occur in the middle of the vulnerability is identified by a
cleaning cycle when the access hatch vulnerability assessment, conducted by 10. Verification
must be open to complete the cleaning a qualified individual, that includes We proposed to define the term
process, and would therefore not be able consideration of the following: (1) ‘‘verification’’ to mean those activities,
to assess if the mitigation strategy was Potential public health impact (e.g., other than monitoring, that establish
functioning as intended (i.e., properly severity and scale) if a contaminant that the system is operating according to
locking the access hatch at the end of were added, (2) degree of physical the food defense plan.
the cleaning cycle). Additionally, we access to the product, and (3) ability of (Comment 46) One comment suggests
include the term ‘‘measurements’’ not an attacker to successfully contaminate ‘‘verification’’ be defined as ‘‘the
only to align more so with definitions the product. The assessment must application of methods, procedures,
from international standards, but also to consider the possibility of an inside tests and other evaluations, in addition
reflect a facility’s flexibility to choose attacker. For further discussion of the to monitoring, to determine whether a
the most appropriate mitigation strategy related changes made to the requirement focused mitigation strategy is or has
and how to monitor that strategy. In in § 121.130 for a vulnerability been operating as intended.’’
many cases, a facility will observe that assessment to identify significant
(Response 46) We have revised the
a mitigation strategy is functioning as vulnerabilities and actionable process
definition of food defense verification to
intended; however, there are some cases steps, see section V.B.
more closely align with the Codex
where a facility may measure whether a 8. Significantly Minimize definition of verification. The term is
strategy is functioning as intended. For now defined as the application of
We proposed to define the term
example, a facility may choose to methods, procedures, and other
‘‘significantly minimize’’ to mean to
implement a mitigation strategy that is evaluations, in addition to food defense
reduce to an acceptable level, including
a thermal-kill step. It would then be monitoring, to determine whether a
to eliminate.
necessary for the facility to take We did not receive comments on the mitigation strategy or combination of
measurements of the time and proposed definition for significantly mitigation strategies is or has been
temperature to ensure the thermal-kill minimize and we are finalizing the operating as intended according to the
step is functioning as intended. definition as proposed. food defense plan. ‘‘Methods,
Additionally, we have deleted procedures, and other evaluations’’
‘‘consistently applied’’ in the proposed 9. Small Business better describes the scope of verification
definition and added ‘‘operating as We proposed to define the term than ‘‘activities’’ used in the proposal.
intended’’ as this more closely aligns ‘‘small business’’ to mean a business Although the Codex definition includes
with the ISO 22000:2005 and with a employing fewer than 500 persons. We ‘‘test’’ as a form of verification, we have
similar change made in the PCHF final proposed to establish the same not included it because the rule does
rule. Finally, we have removed ‘‘and to definition for small businesses as that not require verification testing. We
produce an accurate record for use in which has been established by the U.S. believe changing ‘‘that establish the
verification’’ from the proposed Small Business Administration under system is operating’’ to ‘‘to determine
definition because the requirement for 13 CFR part 121 for most food whether a mitigation strategy is or has
documenting monitoring records is manufacturers. We did not receive any been operating’’ more accurately
established by the requirement for comments on this definition. We are describes the purpose of food defense
monitoring, and not by the definition of finalizing the definition as proposed, verification. We have added ‘‘a
monitor. As discussed in Response 89, with several changes for clarity. We are combination of mitigation strategies’’ to
we have made several revisions to the using the term ‘‘500 full-time equivalent recognize that facilities may use more
regulatory text, with associated editorial employees’’ rather than ‘‘500 persons.’’ than one mitigation strategy to
changes, to clarify that monitoring In addition, we are adding a definition significantly minimize or prevent a
records may not always be necessary. of ‘‘full-time equivalent employee’’ to significant vulnerability. The definition
7. Significant Vulnerability the definition section (§ 121.3). We have proposed by the comment limits
made these changes because we will verification to mitigation strategies; it
We proposed to define the term base the calculation on ‘‘full-time does not require verification of the food
‘‘significant vulnerability’’ to mean a equivalent employees’’ and use the defense plan. Verification of the food
vulnerability for which a prudent same approach to calculating full-time defense plan reflects the fact that
person knowledgeable about food equivalent employees for the purpose of verification is broader than just
defense would employ food defense this rule as we used to calculate full- mitigation strategies; it includes, for
measures because of the potential for time equivalent employees in the example, verification of food defense
serious adverse health consequences or section 414 recordkeeping regulations monitoring and corrective actions.
(Comment 47) Some comments because otherwise firms may be subject rules under FSMA they are required to
suggest using the term ‘‘evaluation’’ to significant changes in status from comply with if the definitions of the
instead of verification. These comments year to year. Those comments also ask size of business are not consistent
suggest that evaluation be defined as us to clarify that the sales are to be throughout all FSMA rules. Some
‘‘those activities, in addition to evaluated retrospectively, not comments encourage us to establish a
checking, that establish that the facility prospectively. Although we did not tiered system that clearly outlines
is implementing a food defense plan.’’ receive similar comments to this rule, in coverage under all FSMA rules by
(Response 47) We deny this request. an effort to be consistent with the PCHF business size, while others request that
As discussed in response to Comment final rule, we have revised the we provide clear guidance to assist
46, we have revised the definition of definition of very small business to firms, especially small and very small
food defense verification to include specify that it is based on average sales businesses, to identify which of the
‘‘evaluation’’ because evaluation is an during the 3-year period preceding the seven FSMA rules are applicable to
appropriate verification activity. applicable calendar year. The applicable them.
However, we disagree that completely calendar year is the year after the 3 (Response 49) We recognize that the
different terminology (in this case, calendar years used to determine varying business size thresholds across
‘‘evaluation’’ rather than ‘‘verification’’) whether a facility is a very small the FSMA rules may be cause for
is appropriate for a term that describes business. confusion. However, each of the rules
the performance of similar activities for We also revised the definition to differs in scope and intent, which
both food safety and food defense (see include the market value of human food compels us to establish requirements
Responses 45 and 46). Verification is manufactured, processed, packed, or and exemptions that are specific to and
conducted to perform a similar function held without sale (e.g., held for a fee). appropriate for each rule. To help small
and in similar ways in both a food When there are no sales of human food, and very small businesses comply with
defense and a food safety framework. In market value of the human food each rule, we plan to issue Small Entity
both frameworks verification is manufactured, processed, packed, or Compliance Guides.
conducted to determine whether control held without sale is a reasonable (Comment 50) One comment objected
measures are operating as intended approach to calculating the dollar to exempting any facilities from the
according to the food safety or food threshold for a very small business. rule, arguing that this would give
defense plan, and these verification (Comment 48) One comment requests terrorists a ‘‘road map’’ to those
activities are in addition to monitoring. that FDA change the definition of ‘‘very facilities not covered and make them
At the same time, by using the term small business’’ to only apply to targets for intentional adulteration. The
‘‘food defense verification,’’ we make $10,000,000 in annual sales of food that comment recommends that FDA remove
clear that verification as required by this is covered under the rule, and not to the exemptions for very small
rule is not identical to verification total annual food sales. The comment businesses and qualified facilities
required in the preventive controls asserts that basing the threshold on the completely.
context. sale of food covered by the intentional (Response 50) We disagree with this
adulteration rule, rather than all food, comment. Section 418(l)(2) of the FD&C
11. Very Small Business would be necessary to be consistent Act specifies that qualified facilities,
We proposed to define the term ‘‘very with the fact that covered produce is which include very small businesses,
small business’’ to mean a business that regulated under the produce rule. are not subject to the requirements in
has less than $10,000,000 in total Specifically, the comment requests that sections 418(a) through (i) and (n). We
annual sales for food, adjusted for we exclude the sale of animal foods note that section 418(l)(2) requires
inflation. In the preamble of the from the calculation of annual food qualified facilities to submit one of two
proposed rule we explained our sales because this rule exempts the types of documentation to the Secretary.
rationale for defining ‘‘very small manufacturing, processing, packing, or The PCHF and PCAF rules have
businesses’’ at the $10,000,000 holding of animal foods. The comment requirements reflecting this provision
threshold because the purpose of this further argues that this approach is but this rule does not. Section
rule is to protect the food supply against consistent with the statutory mandate 418(l)(2)(B)(i)(I) requires documentation
individuals or organizations with the that FDA regulations be flexible in scale that demonstrates that the facility has
intent to cause wide scale public health and supply chain appropriate and identified potential hazards and is
harm. We tentatively conclude these provide special considerations for small implementing and monitoring the
individuals or groups would likely and very small businesses. preventive controls. We have concluded
target the product of relatively large (Response 48) We have revised the that very small businesses are at
facilities, especially firms whose brand definition of very small businesses to reduced risk and therefore do not have
is nationally or internationally include only the sale of human food significant vulnerabilities that require
recognizable. Some comments agree plus the market value of human food mitigation strategies. Therefore, there is
with our proposed definition while manufactured, processed, packed, or nothing for very small businesses to
others disagree. Among the comments held without sale (e.g., held for a fee). document under this option. In contrast,
that disagree with the definition, some Under this revised definition, firms that a human or animal food facility is not
state that the $10,000,000 amount is too process both human and animal foods at lesser risk of a food safety problem
high or too low, and several comments will not be required to include sale of solely because it is relatively small.
suggest alternatives to using dollar animal food in their calculation to Section 418(l)(i)(II) is similarly
amount as the threshold. We further determine whether they fall under the inapplicable for several reasons. That
discuss these comments and our $10,000,000 threshold. section requires documentation that a
response to them in this document. (Comment 49) Several comments facility is in compliance with State,
Some comments submitted to the expressed confusion with the varying local, county, or other applicable non-
PCHF proposed rule request that we business size thresholds across the Federal food safety law. First, food
specify that the monetary threshold for seven FSMA rules and stated that it will safety is traditionally viewed as separate
the definition be based on average sales be a significant challenge for the food from food defense. Second, no States
during a 3-year period on a rolling basis industry to interpret and decide which currently require food defense
measures, and States are unlikely to the food supply and in the government’s cause public health harm that was
impose measures different from those in ability to ensure its safety and, perpetrated in a setting that would be
this rule. Therefore, compliance with consequently, cause greater economic covered by this rule (i.e., all such
‘‘food safety law’’ as described in the disruption than a relatively unknown previous attacks have involved
provision would be irrelevant. In brand that is distributed regionally. restaurant or donated food), it would
contrast, all States have food safety (Comment 52) Several comments appear that the risk of any such attack
laws. Further, regulations issued under argue that the $10,000,000 threshold is occurring is overall quite low, and that
section 420 of the FD&C Act are to apply too high, is arbitrary and not risk-based, only the most attractive targets can
to food for which there is a high risk of and excludes many suppliers and co- conceivably be considered ‘‘high’’ risk.’’
intentional contamination (section manufacturers to large food companies. (Response 53) We decline this
420(c)). Individuals or groups intending The comments state that suppliers who request. Although we agree that those
to cause wide scale public health harm provide ingredients to larger firms intending to cause wide scale public
are more likely to target the product of would not be covered under the rule health harm would more likely target
relatively large facilities, especially for and therefore would pose a significant the larger well known food brands, we
facilities whose brands are nationally or vulnerability to these large, nationally disagree that there is little benefit to be
internationally recognizable, than to branded food manufacturers that have gained by imposing the requirements of
target very small businesses. Covering large consumer exposure. They argue this rule on companies under a
all facilities would be inconsistent with that this high threshold creates a major $50,000,000 or $1,000,000,000
the statutory requirement to limit hole in the industry that may be threshold. To identify which facilities to
coverage to foods at high risk. The exploited, and they point out that we cover under this rule, we assessed risk
$10,000,000 threshold for very small identified ‘‘ingredient handling’’ as a based on both the likelihood of being a
businesses still covers 97–98 percent of key activity type having significant target and the potential impact to public
the market share of manufactured vulnerabilities and therefore all health. If we were to increase the
packaged foods (Ref. 14). In addition, ingredient manufacturers need to be threshold for a very small business to
section 420(a)(1)(B) of the FD&C Act covered. $50,000,000 or $1,000,000,000, a large
directs FDA to consider the risks, costs, (Response 52) The full name of the number of facilities producing large
and benefits associated with protecting key activity type referenced is quantities of food, including some well-
food against intentional adulteration. ‘‘secondary ingredient handling.’’ known brands, would not be covered.
Imposing the full requirements of the Secondary ingredient handling refers to (Comment 54) Several comments state
rule on all facilities, regardless of size, activity occurring in the production that using annual sales is not indicative
would almost triple the current cost of facility where the ingredient is being of risk and offer alternative ways to
the rule while only covering an added; it does not refer to a facility’s define which facilities are covered
additional 2–3 percent of the market ingredient supply chain. The potential under the rule. The comments argue
share of manufactured foods. for incoming ingredients to be that annual sales do not determine the
(Comment 51) One comment intentionally adulterated is addressed potential consumer exposure as it
recommends we apply the lower dollar by the rule’s applicability to ingredient relates to preventing wide scale public
amount used to define ‘‘very small suppliers. As with finished food, not all health harm because more expensive
businesses’’ in the PCHF proposed rule. ingredient suppliers are covered. The products could have higher annual sales
Another comment recommends that the rule focuses on those foods at highest but lower consumer exposure. The
threshold be lowered to $3,000,000 risk of intentional adulteration; it does comments point out that a manufacturer
because smaller companies are less not eliminate all risk. of a premium chocolate bar would sell
likely to implement food defense (Comment 53) Several comments fewer chocolate bars than a commodity
measures unless mandated. argue that the $10,000,000 threshold is chocolate manufacturer with sales of the
(Response 51) The higher threshold too low and recommend that we same dollar amount. Some comments
for very small businesses in this rule as increase it to $50,000,000 or suggest alternatives to using annual
compared to the PCHF rule reflects the $1,000,000,000 in annual sales. One sales, including units of a product sold
difference in the nature of risk of comment states that for an intentional (e.g., 100,000 retail units), number of
intentional adulteration as compared to adulteration event to happen, the brand servings, volume manufactured, and
unintentional adulteration (i.e., or food must be one that a terrorist or distribution patterns of the product.
traditional food safety). This rule a similarly ill-intentioned person is Other comments recommend using the
protects food against intentional likely to target, which would encompass shelf life of products or the shelf
adulteration caused by individuals or only the largest and most well-known stableness of product as alternatives.
organizations whose goal is to maximize food brands. The comment goes on to (Response 54) We use sales and the
public health harm. An attacker would argue that, ‘‘the top roughly 250 food market value of food manufactured,
more likely target the product of brands in the Western world are owned processed, packed, or held without sale
relatively large facilities, especially by only a handful companies having as a proxy for volume. We are aware
firms whose brand is nationally or annual human food revenues from tens that dollar amounts can be skewed by
internationally recognizable. An attack of billions of dollars to over 100 billion product values and, thus, sales are an
on such a target would potentially dollars,’’ and therefore, if we are imperfect proxy for volume. However,
provide the desired wide scale public focusing the rule on those at ‘‘high we are not aware of a more practical
health consequences and the significant risk,’’ as specified under section 420 of way to identify a threshold based on
public attention that would accompany the FD&C Act, then there is little benefit volume or amount of product that could
an attack on a recognizable brand. Such to be gained by imposing the be applied across all product sectors,
facilities are likely to have larger batch requirements of this rule on hundreds of and the comments provide no
sizes, potentially resulting in greater thousands of companies whose products suggestions for how their
human morbidity and mortality. are not likely to be targeted. The recommendations could be carried out.
Further, an attack on a well-recognized, comment points out that because we are Shelf life and shelf stability are not
trusted brand is likely to result in ‘‘unable to identify any previous act of necessarily good indicators of the speed
greater loss of consumer confidence in intentional adulteration intended to at which a particular product moves
through the distribution system because amount of food has more resources than year, 2,080 hours (i.e., 40 hours × 52
many products are sold and consumed the businesses being excluded, even if weeks). If the result is not a whole
months, and even years, before their less than that threshold dollar amount number, round down to the next lowest
shelf life expires. The risk of a product reflects sales to the United States. whole number. Because the calculation
for intentional adulteration does not Likewise, a domestic business that sells for the number of employees affects the
increase based solely on a short shelf more than the threshold dollar amount small business definition and extended
life. Similarly, a product that has a of food has more resources than the compliance dates, we are establishing
longer shelf life is not necessarily at businesses being excluded, even if that the definition of ‘‘full-time equivalent
lower risk for intentional adulteration; it domestic business exports some of its employees’’ in the definitions for this
could be an attractive target based on food and, as a result, less than that rule and modifying the definition of
the potential to cause wide scale public threshold dollar amount reflects sales ‘‘small business’’ to use the term ‘‘500
health harm. within the United States. Further, this is full-time equivalent employees’’ rather
(Comment 55) One comment suggests consistent with the PCHF final rule. than ‘‘500 persons.’’
that we base the very small business
definition on the number of full-time 12. Vulnerability 4. Qualified Individual
employees, similar to how we define We proposed to define the term In this final rule, we have defined the
‘‘small business.’’ The comment ‘‘vulnerability’’ to mean the term ‘‘qualified individual’’ to mean a
recommends that we define ‘‘very small susceptibility of a point, step, or person who has the education, training,
business’’ at 50 full-time employees. procedure in a facility’s food process to or experience (or a combination thereof)
(Response 55) We deny this request. intentional adulteration. necessary to perform an activity
The purpose of the definition of ‘‘very We did not receive comments on the required under subpart C, as appropriate
small business’’ is to exempt the proposed definition of vulnerability and to the individual’s assigned duties. A
smallest businesses from the we are finalizing the definition as qualified individual may be, but is not
requirements of the rule because they proposed. required to be, an employee of the
are less likely to be targeted by C. Additional Definitions To Clarify establishment. See section V.H. for a
individuals or organizations intending Terms Not Defined in the Proposed Rule detailed discussion of the new
to cause wide scale public health harm. requirements in § 121.4—Qualifications
The consideration of sales is consistent 1. Adequate of Individuals Who Perform Activities
with the other option for being a We have defined the term ‘‘adequate’’ Under Subpart C.
qualified facility under section 418 of to mean that which is needed to 5. You
the FD&C Act, which also considers accomplish the intended purpose in
sales (section 418(l)(1)(C)). (As keeping with good public health In this final rule, we have defined the
discussed in IV.E.1 of this rule, we have practices. See section V.E for a detailed term ‘‘you’’ for purposes of this part, to
removed the term ‘‘qualified facility’’ discussion of the changes to the mean the owner, operator, or agent in
from the exemption provided in requirement for food defense monitoring charge of a facility. We have made
§ 121.5(a) for simplicity because any in § 121.140, including the requirement conforming changes throughout the
facility that would be a ‘‘qualified to monitor the mitigation strategies with regulatory text to replace ‘‘owner,
facility’’ as proposed in § 121.5(a) will ‘‘adequate’’ frequency to provide operator, or agent in charge’’ with ‘‘you’’
also meet the definition for a ‘‘very assurances that they are consistently for simplicity and consistency with the
small business.’’) performed. PCHF and PCAF regulations.
In contrast, section 418(l) of the FD&C D. Comments Asking FDA To Establish
Act does not specify any particular 2. Affiliate and Subsidiary
Additional Definitions or Otherwise
criterion (whether sales or number of We have defined the term ‘‘affiliate’’ Clarify Terms Not Defined in the Rule
employees) for the definition of ‘‘small to mean any facility that controls, is
business,’’ other than directing us to controlled by, or is under common 1. Correction
consider the results of the Food control with another facility. We have (Comment 57) Some comments that
Processing Sector Study. Basing the defined the term ‘‘subsidiary’’ to mean request the addition of corrections to the
definition of ‘‘small business’’ on the any company which is owned or requirement related to corrective actions
number of employees is consistent with controlled directly or indirectly by request we define ‘‘correction’’ to mean
our approach to defining ‘‘small another company. These definitions the action to eliminate a non-
business’’ in many other regulations incorporate the definitions in sections conformity.
(see, e.g., the PCHF final rule, Produce 418(l)(4)(A) and (D) of the FD&C Act (Response 57) We decline this
final rule, HACCP regulation for juice and would make the meanings of these request. Because we are not providing
(§ 120.1(b)(1)), the section 414 terms clear when used in the definition for corrections and the term
recordkeeping regulations (69 FR 71562, of ‘‘very small business.’’ ‘‘corrections’’ is not in the regulatory
December 9, 2004), and our CGMP text, there is no need to define the term.
3. Full-Time Equivalent Employee
regulation for manufacturing, packaging,
labeling, or holding operations for We have established a definition for 2. Defensive Controls or Defensive
dietary supplements (72 FR 34752, June ‘‘full-time equivalent employee’’ as a Control Point
25, 2007)). term used to represent the number of (Comment 58) One comment requests
(Comment 56) Some comments employees of a business entity for the that FDA consider adoption of food
request that we change the definition of purpose of determining whether the defense terminology that is
‘‘very small business’’ to only include business qualifies as a small business. complementary to food safety
the total annual sales of food in the The number of full-time equivalent terminology used in the PCHF final rule,
United States, adjusted for inflation, for employees is determined by dividing such as ‘‘defensive controls’’ or
foreign facilities that export food to the the total number of hours of salary or ‘‘defense control point.’’
United States. wages paid directly to employees of the (Response 58) We decline the request
(Response 56) A foreign business that business entity and of all of its affiliates to adopt the specific terms of ‘‘defense
sells more than the threshold dollar by the number of hours of work in 1 controls’’ or ‘‘defense control point.’’
Although the comment did not further such vulnerability to an acceptable 2. Proposed § 121.5(b)—Exemption
explain what terms ‘‘defense controls’’ level, the definition for actionable Applicable to Holding of Food
or ‘‘defense control point’’ would process step provides flexibility for a We proposed to exempt holding of
replace, we believe ‘‘actionable process facility to determine what that level food, except the holding of food in
steps’’ and ‘‘mitigation strategies’’ would be in a particular circumstance. liquid storage tanks. We received one
appropriately differentiate these terms, We now use ‘‘person knowledgeable comment that disagrees with the
related to intentional adulteration, from about food defense’’ without reference holding exemption, and have addressed
analogous food safety terms used in the to ‘‘prudent’’ in the definitions of the comment in Response 34. After
PCHF final rule. ‘‘significant vulnerability’’ and considering this comment, we are
‘‘mitigation strategies.’’ A person finalizing the exemption as proposed.
3. Reasonably Foreseeable
knowledgeable about food defense
(Comment 59) Some comments state would meet the requirements of being a 3. Proposed § 121.5(c)—Exemption
FDA should clearly define what Qualified Individual (§ 121.4). Applicable To Packing, Re-Packing,
constitutes a ‘‘reasonably foreseeable’’ Labeling, or Re-Labeling of Food Where
threat as it relates to the risk of E. Proposed § 121.5—Exemptions the Container That Directly Contacts the
intentional adulteration. We proposed to establish a series of Food Remains Intact
(Response 59) We decline this exemptions from the intentional We proposed to exempt packing, re-
request. The term ‘‘reasonably adulteration requirements. We also packing, labeling, or re-labeling of food
foreseeable’’ is not used in the sought comments on whether we should where the container that directly
regulatory text of this rule. exempt on-farm manufacturing, contacts the food remains intact. We did
4. Supply Chain processing, packing, or holding of the not receive comments on the proposed
food identified as having low-risk exemption and we are finalizing the
(Comment 60) One comment requests production practices identified in exemption as proposed.
that FDA define ‘‘supply chain’’ as it Appendix 4 to the Draft Risk
relates to food and provides a 4. Proposed § 121.5(d)—Exemption
Assessment (further discussed in Applicable to Activities of a Facility
recommended definition to be included section I.C). We discuss these in the
in the rule. That Are Subject to Section 419 of the
following sections. FD&C Act
(Response 60) We decline this
request. The term ‘‘supply chain’’ is not 1. Proposed § 121.5(a)—Exemption We proposed to exempt activities of a
used in the regulatory text of this rule. Applicable to a Qualified Facility facility that are subject to section 419 of
5. Validation We proposed to exempt a qualified the FD&C Act (Standards for Produce
facility, except that qualified facilities Safety). We did not receive comments
(Comment 61) One comment suggests on the proposed exemption and we are
we define ‘‘validation’’ as obtaining must, upon request, provide for official
review documentation that was relied finalizing the exemption as proposed.
evidence that a control measure or
combination of control measures, if upon to demonstrate that the facility 5. Proposed § 121.5(e)—Exemption With
properly implemented, is capable of meets this exemption. We also proposed Respect to Alcoholic Beverages
controlling the hazard to a specified that such documentation must be Section 116 of FSMA (21 U.S.C. 2206)
outcome. retained for 2 years. We proposed to (Alcohol-Related Facilities) provides a
(Response 61) We decline this define qualified facility, in part, as a rule of construction for certain facilities
request. The term ‘‘validation’’ is not facility that is (1) a very small business; engaged in the manufacturing,
used in the regulatory text of this rule. or (2) a facility to which certain processing, packing, or holding of
circumstances must apply. alcoholic beverages and other food. In
6. Miscellaneous We have removed the exemption the proposed rule, we discussed our
(Comment 62) One comment requests applicable to a qualified facility and interpretation of section 116 of FSMA
that FDA define certain terms or phrases replaced it with a very small business and requested comment on our
that are used in some definitions and exemption. Revised § 121.5(a) provides interpretation. Based on our
that the comment suggests will have a that this part does not apply to a very interpretation, we proposed that part
wide range of interpretations. The small business, except that a very small 121 would not apply with respect to
comment cites ‘‘acceptable level’’ (used business must, upon request, provide alcoholic beverages at facilities meeting
in the definitions of ‘‘actionable process for official review documentation two specified conditions (78 FR 78014
step’’ and ‘‘significantly minimize’’), sufficient to show that the facility meets at 78037). We also proposed that part
‘‘reasonably appropriate measures’’ and the exemption and that such 121 would not apply with respect to
‘‘person knowledgeable about food documentation must be retained for 2 food other than alcoholic beverages at
defense’’ (both used in the definition of years. We have removed the term facilities described in the exemption,
‘‘focused mitigation strategies’’), and ‘‘qualified facility’’ from the exemption provided such food is in prepackaged
‘‘prudent person knowledgeable about provided in § 121.5(a) to simplify the form that prevents direct human contact
food defense’’ (used in the definition of provision and provide clarity as to the with the food and constitutes not more
‘‘significant vulnerability’’). applicability of the exemption. For than 5 percent of the overall sales of the
(Response 62) The terms ‘‘acceptable purposes of this rule, any facility that facility. No comments disagreed with
level’’ and ‘‘reasonably appropriate would be a ‘‘qualified facility’’ as the exemption of alcoholic beverages,
measures’’ are meant to be flexible proposed in § 121.5(a) will also meet the but some comments requested changes
standards. We do not need to define definition for a ‘‘very small business.’’ or clarifications to the proposed
every term used in the definitions. By Further, section 418(l)(3) of the FD&C activities covered in the exemption.
specifying that a point, step, or Act, which provides for withdrawal of After reviewing the comments, we are
procedure in a food process at which an exemption from a ‘‘qualified finalizing this exemption as proposed.
food defense measures can be applied facility,’’ is not relevant because we are (Comment 63) Two comments
and are essential to prevent or eliminate also issuing these requirements under supported the exemption for alcoholic
a significant vulnerability or reduce section 420 of the FD&C Act. beverages and FDA’s interpretation of
section 116 of FSMA, but one comment a high risk for intentional contamination and lacks a significant potential for
requests changing the language from just because our analysis shows that human morbidity and mortality. One
‘‘alcoholic beverages’’ to adulteration of animal food has minimal comment supports the exemption but
‘‘manufacturing, processing, packing potential for human morbidity and requests clarification that the exemption
and holding of alcoholic beverages,’’ mortality which would lead to wide of animal feed includes the byproduct of
stating that in reducing the words FDA scale public health harm. In considering manufactured human food regardless of
may unintentionally limit the scope of whether to provide an exemption the small business exemption.
the exemption to facilities holding related to animal food, we evaluated (Response 65) We conclude that
finished beverage alcohol products. three types of possible attack scenarios: animal food, regardless of whether it is
(Response 63) We agree with the (1) Incorporation of a contaminant into produced at a facility solely engaged in
comments that support the exemption feed to be used for muscle meat- the production of animal food or at a
as written. We do not believe it is producing animals; (2) incorporation of facility engaged in the production of
necessary to list the activities in the a contaminant into feed to be used for both animal and human food, does not
codified as requested by one comment. egg-producing or milk producing involve significant vulnerabilities that
Under section 415 of the FD&C Act a animals; and (3) incorporation of a require mitigation strategies under
facility is required to register as a contaminant into pet food. With regard section 418 of the FD&C Act, and is not
facility because it is engaged in to the two former scenarios, we did not high risk under section 420 of the FD&C
manufacturing, processing, packing, or identify any contaminants that could be Act. Therefore, we are not requiring a
holding of one or more alcoholic incorporated into feed at levels that vulnerability assessment to determine
beverages. Therefore, the language would lead to human morbidity or that there are no actionable process
stating ‘‘alcoholic beverages at a mortality among consumers that steps present and no mitigation
facility’’ encompasses facilities engaged subsequently eat the meat, eggs or milk strategies needed. Regarding the
in the activities listed previously and without first showing noticeable clinical requested clarification, the exemption
the regulatory text in § 121.5(e) clearly signs and/or mortality in the animals. applies to animal food regardless of
covers the intended exemption for the While some contaminants can increase whether a facility is part of a small
‘‘manufacturing, processing, packing the risk of chronic disease, such as business.
and holding of alcoholic beverages.’’ cancer, among consumers, such an (Comment 66) Some comments
(Comment 64) One comment supports outcome is not consistent with our disagree with our conclusion that
the exemption for alcoholic beverages understanding of the goals of terrorist animal feed would not be at high risk
but requests that we further exempt craft organizations, which include a more for intentional contamination for several
breweries from drying and packaging immediate impact. Regarding the third reasons. Some comments cite the 2007
requirements for disposal of spent incident of melamine in animal food
attack scenario, adulterants could be
grains as cattle feed to small farmers. that sickened and killed many animals
incorporated into feed or pet food that
(Response 64) The exemption as an example of previous intentional
result in significant animal morbidity
established under the rule of contamination suggesting that animal
construction in section 116 of FSMA and mortality as well as lead to
food is at high risk for intentional
applies to alcoholic beverages, not to secondary infections of humans through
contamination. Some comments state
any other food (see section 116(c) of cross contamination, but this type of
that in section 420(c) of the FD&C Act
FSMA (21 U.S.C. 2206(c)). The by- intentional adulteration of animal food
the intent of Congress was for
products described in this comment poses a lower risk because secondary
regulations to be issued that addressed
appear to be products that would be human illness or death is not the
hazards that would cause ‘‘serious
used in food for animals rather than in primary goal of an attacker with the health consequences or death to humans
human food, and we exempt these foods intent to cause wide scale public health or animals.’’ One comment asserts that
in section § 121.5(f). Since this rule harm. As such, the proposed rule would pet food and human food supply chains
exempts both alcoholic beverages at a not apply to the manufacturing, are interconnected, and therefore should
facility, provided certain conditions are processing, packing, or holding of food be covered by this rule. One comment
met, and food for animals, we believe for animals other than man. We believes that animal food comes into our
this comment misunderstands the requested comment on our tentative homes as pet food therefore can harm
exemptions. conclusions. Some comments agreed families via cross-contamination. One
with our conclusions and support the comment asserts that the risk of Foot
6. Proposed § 121.5(f)—Exemption exemption as proposed. One comment and Mouth Disease has been the focus
Applicable To Manufacturing, supported the exemption but requested of many exercises and discussions with
Processing, Packing, or Holding of Food a clarification of exempted activities. respect to intentional adulteration and
for Animals Other Than Man Some comments disagreed with our asserts that terrorists have attacked
We proposed to exempt conclusions and assert that animal food livestock in the past.
manufacturing, processing, packing, or is at high risk for intentional (Response 66) We disagree with these
holding of food for animals other than adulteration because it has been comments and continue to believe that
man. Section 418(m) of the FD&C Act intentionally contaminated in the past. animal food is not at high risk for
authorizes FDA to exempt or modify the Some comments state that FDA should intentional adulteration within the
requirements for compliance with protect against intentional adulteration context of this rule. While we agree that
section 418 with regard to facilities that that leads to serious health some animal feed could be intentionally
engage solely in the production of consequences or death to humans or contaminated, our analysis shows only
animal food. Further, section 420(c) of animals. After reviewing the comments, minimal potential for human morbidity
the FD&C Act requires that regulations we are finalizing the exemption as and mortality as a result of an attack
that FDA issues under that section proposed. during, or associated with, animal food
apply only to food for which there is a (Comment 65) Some comments production. We analyzed both human
high risk of intentional contamination. support our tentative conclusions and and animal food using CARVER+Shock
FDA tentatively concluded in the agree that animal food would not be at methodology. For human food, our
proposed rule that animal food is not at high risk for intentional contamination analyses show the potential for
significant human morbidity and target than human food, when the intent foods included in the draft RA
mortality should intentional of the adulteration is to cause wide scale Appendix as being out of scope of the
adulteration occur at certain points in a public health harm for humans. The final appendix because of the changes to
food operation. In contrast, for animal event in 2007 involving contamination the definition of ‘‘farm’’ made by the
food, our analysis shows only minimal of wheat flour and wheat gluten with PCHF rule, including some foods
potential for human morbidity or melamine that resulted in pet illnesses determined to have low risk production
mortality as a result of attacks at points and deaths did not affect human health practices in the draft appendix.
in an animal food operation. and was motivated by economic gain. Finished foods that are produced using
Significantly, our CARVER+Shock That form of intentional adulteration only activities that fall within the farm
vulnerability assessments of animal (i.e., economically motivated definition (e.g., RACs such as fruits and
food have had to focus entirely on adulteration) is addressed by the PCHF vegetables, grains, and unpasteurized
economic consequences because of the and PCAF final rules. milk) are out of scope for the purposes
lack of potential for human morbidity of this final appendix because this
and mortality. As stated in the preamble 7. Exemption for Low-Risk Activities at
Farm Mixed-Type Facilities evaluation focuses on the production
to the proposed rule (78 FR 78014 at processes used to produce a finished
78037), in considering whether to As discussed in section I.D, we issued food and applies only to activities
provide an exemption related to animal for public comment an ‘‘Appendix to outside the farm definition performed
food, we evaluated three types of Draft Qualitative Risk Assessment of by facilities co-located on farms.
possible attack scenarios: (1) Risk of Activity/Food Combinations for Accordingly, we have provided a new
Incorporation of a contaminant into feed Activities (Outside the Farm Definition) exemption in the regulatory text in
to be used for muscle meat-producing Conducted in a Facility Co-Located on § 121.5(g) that exempts on-farm
animals; (2) incorporation of a a Farm’’ (the draft RA Appendix) (78 FR manufacturing, processing, packing, or
contaminant into feed to be used for 78064, December 24, 2013). The draft holding of eggs (in-shell, other than
egg-producing or milk producing RA Appendix was conducted to provide RACs, e.g., pasteurized), and game
animals; and (3) incorporation of a a science-based risk analysis to meats (whole or cut, not ground or
contaminant into pet food. With regard determine which foods’ production shredded, without secondary
to the two former scenarios, we are not processes would be considered low risk ingredients) when conducted by a small
aware of contaminants that could be with respect to the risk of intentional or very small business if such activities
incorporated into feed at levels that adulteration. Based on the tentative are the only activities conducted by the
would not produce noticeable clinical conclusions of the draft RA Appendix,
business subject to section 418 of the
signs and/or mortality in animals but we asked for comment in the proposed
FD&C Act. This exemption is also
would result in significant human rule on possible exemptions or modified
appropriate under section 420 of the
morbidity or mortality among requirements for this final rule. In the
FD&C Act because such activities are
consumers that subsequently eat the draft RA Appendix we tentatively
not high risk under that provision.
meat, eggs or milk. While such concluded that the production processes
contaminants can increase the long-term for the following finished foods are low- The draft RA, considered fruits and
risk of chronic disease, such as cancer, risk: Eggs (in-shell); fruits and vegetables other than pods, seeds for
among consumers, such an outcome is vegetables other than pods, seeds for direct consumption, and hesperidia, and
not consistent with our understanding direct consumption, and hesperidia determined them to be low risk. Because
of the more-immediate goals of (fresh, intact); game meats (whole or cut, these foods are produced using only
individuals or groups intending to cause not ground or shredded, without activities that fall within the modified
wide scale public health harm. secondary ingredients); peanuts and tree farm definition, these finished foods are
Regarding the third attack scenario, nuts (raw, in-shell); and sugarcane and now out of scope of the RA.
incorporation of a contaminant into pet sugar beets (fresh, intact). We sought Additionally, peanuts, tree nuts (raw, in
food, we are aware of contaminants that comment on whether we should exempt shell), sugarcane, and sugar beets were
could be incorporated into feed or pet on-farm manufacturing, processing, also considered and determined to be
food that could result in significant packing, or holding of the foods low risk in the draft RA. These foods
animal (including pet) morbidity and identified as having low-risk production similarly are out of scope of the
mortality, including some which could practices when conducted by a small or evaluation of risk because these foods
result in secondary infectious spread of very small business if such activities are are produced using only activities that
disease (because some infectious agents the only activities conducted by the fall within the modified farm definition.
can be transmitted orally as well as business that are subject to section 418 The finished foods mentioned in this
through aerosol). Such attacks could be of the FD&C Act. paragraph, when produced on farms, are
significant from an economic and (Comment 67) Several comments exempt under § 121.5(d).
societal standpoint. However, the risk agree with the conclusions of the draft
that they pose with regard to targeting RA Appendix and state we should V. Subpart C: Comments on Food
by individuals or groups intending to provide exemptions in the regulatory Defense Measures
cause wide scale public health harm text for those on-farm manufacturing, A. Proposed § 121.126—Requirement for
appears to be significantly lower than processing, packing, or holding a Food Defense Plan
those involving human morbidity and activities identified as having low-risk
mortality. production practices when conducted We proposed that the owner, operator,
Foot and mouth disease, mentioned in by a small or very small business if such or agent in charge of a facility must
one comment, can lead to animal death activities are the only activities prepare, or have prepared, and
and economic consequences, but does conducted by the business subject to implement a written food defense plan
not affect human morbidity or mortality. section 418 of the FD&C Act. which must include: (1) Written
Because foot and mouth disease would (Response 67) We agree with these identification of actionable process
not cause wide scale public health comments. In addition, we have steps; (2) written focused mitigation
harm, it does not change our conclusion conducted a reanalysis of the risk strategies; (3) written procedures for
that animal food is a less attractive assessment and have identified some monitoring; (4) written corrective action
procedures; and (5) written verification existing food defense plans that are considering the comments, we have
procedures. already in place and working properly. revised this section as follows: (1)
Some comments agree with the These comments argue that existing Removing from the regulatory text the
requirements for a food defense plan as food defense plans should be adequate option to identify actionable process
proposed. In general, comments support to meet the requirements of this rule so steps by utilizing the four FDA-
the proposed requirement that facilities long as they were thoughtfully identified key activity types, (2) adding
develop and maintain food defense developed. to the regulatory text the factors that
plans to protect food against intentional (Response 69) We recognize that some must be considered when conducting a
adulteration. In the following facilities have already voluntarily vulnerability assessment, (3) adding to
paragraphs, we discuss comments that developed and implemented food the regulatory text a requirement to
disagree with, or suggest one or more defense plans. These facilities likely explain why each process step was or
changes to, the proposed requirements. have a head start on compliance with was not identified as an actionable
After considering these comments, we this rule. To the extent a food defense process step, (4) adding to the regulatory
are finalizing the provisions as plan satisfies elements of this rule, a text a requirement that the vulnerability
proposed, with editorial and conforming facility has less to do to meet these assessment must consider the
changes as discussed in the other requirements. Further, in the final rule possibility of an inside attacker, and (5)
applicable sections of this document. we have specified that existing records changing the title of this section to
(Comment 68) Some comments state do not need to be duplicated if they ‘‘Vulnerability Assessment to Identify
that facilities should be allowed to contain all of the required information Significant Vulnerabilities and
develop food defense plans that are and satisfy the requirements of part 121, Actionable Process Steps.’’
tailored to and best meet the needs and subpart D (§ 121.330). (Comment 71) Some comments
unique characteristics of the (Comment 70) Some comments recommend removing from the
establishment. Other comments state express concern that it is too premature regulatory text the option for facilities to
that the requirements should be to require that all foreign facilities use the key activity types as a method
adequately broad and provide flexibility prepare and implement a food defense for identifying actionable process steps,
so that companies can build on their plan. and instead, requiring all facilities to
plans over time based on emerging (Response 70) All foreign facilities do conduct facility-specific vulnerability
threats and new mitigation strategies. not have to prepare and implement a assessments. Some comments
(Response 68) We agree with these food defense plan. For example, foreign recommend continuing to provide the
comments and recognize that there facilities that are not required to register option to use key activity types but not
needs to be flexibility within the are not subject to this rule. This specifically providing for it in the
requirements for a facility to develop a includes a foreign facility, if food from regulatory text. Under this approach,
food defense plan that meets its needs such a facility undergoes further key activity types would be considered
and unique characteristics. In the final manufacturing/processing (including an ‘‘appropriate method’’ for identifying
rule we have added flexibility for packaging) by another facility outside actionable process steps with the
management components (see Comment the United States (21 CFR 1.226(a)). In specific key activity types identified in
88, Comment 92, Comment 93, and addition, the rule contains exemptions guidance. These comments express
Comment 95 for a detailed discussion). applicable to domestic and foreign concern that identifying a particular
Additionally, we agree that food defense facilities (§ 121.5). For example, very methodology (i.e., key activity types) in
plans should change over time based on small businesses are only required to the codified indicates there is one
emerging threats and identification of keep records documenting their status. ‘‘right’’ way to conduct vulnerability
new mitigation strategies. The rule assessments. Furthermore, some
(§ 121.157) requires a reanalysis of the B. Proposed § 121.130—Identification of
comments express concern that the key
food defense plan as a whole or to the Actionable Process Steps
activity types may become the de facto
applicable portion of the plan when any We proposed to require that the standard for the regulatory inspection of
of the following circumstances occur: a owner, operator, or agent in charge of a actionable process steps, even if
significant change made in the activities facility identify any actionable process facilities conduct facility-specific
conducted at the facility creates a steps by either conducting a facility- vulnerability assessments. Some
reasonable potential for a new specific vulnerability assessment or by comments express concerns that
vulnerability or a significant increase in using the four key activity types we including key activity types in the
a previously identified vulnerability; a identified. Recognizing that various codified would result in mitigation
facility becomes aware of new methodologies may exist to conduct a strategies being required at key activity
information about potential facility-specific vulnerability types regardless of the outcome of a
vulnerabilities; a mitigation strategy, a assessment, and not wishing to preclude facility-specific vulnerability
combination of mitigation strategies, or the benefits of future science in this assessment.
the food defense plan as a whole is not area, we did not propose to require a (Response 71) The key activity types
properly implemented; or whenever specific methodology for the facility- are based upon the results of over 50
FDA requires reanalysis to respond to specific vulnerability assessment. vulnerability assessments which reflect
new vulnerabilities, credible threats to Further, we proposed that regardless of the activities and associated
the food supply, or developments in the method chosen, the identification of vulnerabilities present in a wide array of
scientific understanding. See section actionable process steps and the manufacturing settings. The
V.G.2 for more detailed discussion of assessment leading to that identification vulnerability assessments included
the reanalysis section. must be written. consideration of the three elements now
(Comment 69) Some comments state Some comments agree with the required by § 121.130 to be evaluated in
that many food facilities have already requirements as proposed. In the any vulnerability assessment: (1) The
voluntarily developed and implemented following paragraphs, we discuss potential public health impact if a
food defense plans. The comments comments that suggest one or more contaminant were added (e.g., severity
express concern that FDA would require changes to, and/or disagree with the and scale); (2) the degree of physical
companies to completely overhaul their proposed requirements. After access to product; and (3) the ability of
an attacker to successfully contaminate tank would be significantly vulnerable, improvement would significantly
the food. The four identified key activity then the facility would identify the minimize or eliminate access to product
types are processes, steps, or procedures mixing tank as an actionable process in the dryer and thereby significantly
that consistently ranked as the most step. The facility may then decide that minimize or prevent a significant
vulnerable, regardless of the commodity the existing locks could serve as a vulnerability at this process step. The
being assessed, and reflect significant mitigation strategy that reduces the implementation of this engineering
vulnerabilities to intentional significant vulnerability of the mixing improvement would be detailed in the
adulteration caused by acts intended to tank and evaluate if any other mitigation facility’s food defense plan and, upon
cause wide scale public health harm. strategies are necessary. The food reanalysis, the facility may determine
Therefore, using the key activity types is defense plan would then capture the that this processing step is no longer an
an appropriate method to conduct a mixing tank step as an actionable actionable process step.
vulnerability assessment. In addition, process step and the locks as the (Comment 73) Some comments
using key activity types has the benefit mitigation strategy. As a mitigation recommend that vulnerability
of allowing facilities with less technical strategy, the locks would be subject to assessments should consider
expertise in conducting food defense mitigation strategy management downstream processing steps, the
vulnerability assessments to leverage components (i.e., food defense volume of product, shelf life,
their expertise in food processing to monitoring, corrective actions, and marketplace turnover, and consumption
identify actionable process steps. verification). patterns and that additional details
However, in response to comments, There are some instances where it is regarding vulnerability assessments
we are no longer singling out key appropriate to consider existing food should be in the regulatory text. The
activity types in the regulatory text. defense measures before the comments did not provide specifics or
Importantly, using key activity types vulnerability assessment is completed. recommendations regarding what
remains as one appropriate vulnerability For example, the owner of the same additional details about vulnerability
assessment method. We intend to place facility may assess a second mixing tank assessments should be included.
the key activity types in guidance, that is part of an entirely closed system, (Response 73) As previously stated,
which will provide us with greater with no direct access points into the we are not prescribing a specific
flexibility to update them in the future, system, such that an individual methodology that facilities must use to
if necessary. The final rule provides attempting to access this mixing tank conduct vulnerability assessments to
firms the flexibility to choose a likely would cause a major disruption to identify actionable process steps. In the
vulnerability assessment methodology the line, foiling any attempted preamble to the proposed rule, we listed
appropriate to their operations, intentional adulteration. Because this a number of elements to consider when
provided that methodology includes the second mixing tank has specific closed conducting vulnerability assessments
three fundamental elements required by properties designed into the system, that (78 FR 78014 at 78042) and did not
§ 121.130(a). We expect that some firms are inherent characteristics of the require particular elements in the
will use key activity types, and some mixing tank, it would be appropriate for regulatory text. However, in light of
firms will use other methods. the facility to consider these inherent comments requesting further
(Comment 72) Some comments characteristics in the vulnerability vulnerability assessment details in the
recommend that vulnerability assessment. Based on this assessment, regulatory text, and the removal of key
assessments should consider the the facility may conclude that the activity types as a separately identified
contribution of existing practices, inherent characteristics of this mixing option, we are specifying that three
procedures, and programs that may tank, in this case its enclosed nature, elements must be considered in any
already function to reduce vulnerability. renders the product inaccessible at this vulnerability assessment. These three
(Response 72) When conducting step and, therefore would not identify elements are based on our extensive
facility-specific vulnerability an actionable process step associated experience conducting vulnerability
assessments, the role of existing with this mixing tank (in which case, assessments and collaborating with
measures (e.g., security practices, there would also be no requirement to stakeholders to refine vulnerability
procedures, or programs) should be implement a mitigation strategy at this assessment methodology and are critical
determined on a case-by-case basis. In step). elements of an acceptable vulnerability
general, existing measures that are Permanent equipment changes may assessment methodology. Specifically,
applied to the process (e.g., locks, area reduce a significant vulnerability to we have revised § 121.130 to require
access controls, peer or supervisory such an extent that a processing step that for each processing step under
monitoring) and are not inherent would no longer be considered an evaluation, the facility must consider, at
characteristics of a particular process actionable process step. For example, a a minimum: (1) The potential public
step, should be considered after the facility might identify a rotating air health impact if a contaminant were
vulnerability assessment is completed dryer as an actionable process step and added (e.g., severity and scale); (2) the
and actionable process steps have been in the supporting rationale discuss the degree of physical access to product;
identified, and should not be considered high degree of accessibility at the point and (3) the ability of an attacker to
during the identification of significant where product is fed from a pneumatic successfully contaminate the product.
vulnerabilities. For example, when conveyor into the top of the dryer. The a. Element 1: The potential public
evaluating the vulnerability of a mixing facility later installs a permanent, clear health impact if a contaminant were
tank, a facility would not conclude the plastic shield affixed to, and extending added (e.g., severity and scale). This
tank does not represent a significant from, the discharge of the pneumatic factor includes, for each processing step,
vulnerability because the mixing tank conveyor to the opening of the dryer. consideration of the volume of product
lid and sampling ports are routinely The clear plastic shield enables workers impacted, the number of at risk servings
locked. Instead, the vulnerability of the to supervise the product flow into the generated, and the number of potential
mixing tank would be evaluated as if the dryer while serving as an effective exposures. As appropriate, and with
existing measure (in this case the locks) barrier to an attacker wishing to sufficient scientific rigor, the facility
were not in place. If, in the absence of introduce a contaminant into the may also consider other factors such as
properly implemented locks, the mixing product at the dryer. This engineering food velocity (i.e., the speed at which a
particular product moves through the the openness of the processing step to process under evaluation, recognizing
distribution system); potential agents of intentional adulteration, based on the that each processing step has some
concern; the infectious or lethal dose of presence of physical barriers such as associated vulnerability (i.e., the
agents of concern; and the morbidity/ gates, railings, doors, lids, seals, shields, susceptibility of a point, step, or
mortality rate if the intentional and other barriers. This element is procedure in a facility’s food process to
adulteration were successful. This required in the vulnerability assessment intentional adulteration). Second, the
element is required in the vulnerability because it enables facilities to prioritize facility would identify which
assessment because it enables facilities how easy or difficult it is to access vulnerabilities are significant
to focus resources on processing steps product at each processing step, based vulnerabilities (by using the three
with the highest degree of public health on the inherent characteristics of the required elements), and third, the
impact if the intentional adulteration physical environment surrounding the facility would identify actionable
were successful. step. process steps where significant
We recognize that some facilities may c. Element 3: The ability of an vulnerabilities are present. We intend to
not have the scientific knowledge to attacker to successfully contaminate the provide further guidance on conducting
critically identify and evaluate product. This element includes, for each vulnerability assessments to satisfy
individual agents of concern across their processing step, consideration of, at a these requirements.
production process. The potential minimum, the ease of introducing an As noted previously, some comments
public health impact can also be agent to the product; the ability for an suggested that vulnerability assessments
determined through the consideration of agent to be uniformly mixed or evenly should consider downstream processing
the volume of food at risk should an act applied; and the ability of an attacker to steps, the volume of product, shelf life,
of intentional adulteration be successful work unobserved and have sufficient marketplace turnover, and consumption
at each process step. This approach time to introduce the agent. As patterns. We have found that shelf life
would serve to extrapolate the potential appropriate, and with sufficient is not necessarily a good indicator of the
public health impact without the scientific rigor, the facility may also speed at which a particular product
scientifically rigorous examination of consider: The amount of specific agent moves through the distribution system
specific agents (e.g., consideration of required; whether downstream dilution (i.e., food velocity), because many
infectious or lethal dose). For example, or concentration steps would affect the products are sold and consumed
using this approach, a facility volume of agent required; whether months, if not years, before their shelf
considering the potential public health downstream processing would or would life expires. Marketplace turnover and
impact of the intentional adulteration of not neutralize the agent(s) under consumption patterns are captured
its primary ingredient storage tank evaluation; and the ability of the within the concept of food velocity,
would consider the volume of food in attacker to successfully introduce a which may be considered in a
the tank and the servings generated from sufficient volume of agent to the food vulnerability assessment as a
this volume. If the facility has a 50,000 without being detected or interdicted. component of Element 1, detailed
gallon primary ingredient liquid storage This element is required in the previously in this document. Likewise,
tank that would generate 800,000 one vulnerability assessment because it the potential effect of downstream
cup servings (50,000*16), the facility enables facilities to understand whether processing can be considered as a
would consider all of these 800,000 the amount of agent required at each component of Element 3, detailed
servings as being at risk. Note that processing step is feasible and if previously in this document.
potential servings at risk is not limited subsequent processing steps would (Comment 74) One comment suggests
to the amount of food being processed successfully remove an agent if present. adding laboratory professionals to the
at an actionable process step. This is Taken together, these three required list of possible vulnerability assessment
illustrated by a process step that applies vulnerability assessment elements team members.
a minor ingredient, such as a vitamin provide facilities appropriate tools to (Response 74) The list of potential
mixture applied over toasted cereal as it adequately identify which members of the vulnerability assessment
passes underneath spray nozzles. The vulnerabilities should be identified as team discussed in the preamble to the
facility’s metering tank for application significant vulnerabilities (i.e., those proposed rule is not exhaustive (78 FR
to the cereal is 10 gallons. However, vulnerabilities, if attacked, could 78014 at 78042). The original list
these 10 gallons will be sprayed over reasonably be expected to cause wide included ‘‘personnel working in the
100,000 servings of cereal. The facility scale public health harm). If the step areas of security, food safety/quality
would conclude that 100,000 servings under evaluation has significant assurance or control, human resources,
are at risk if the intentional adulteration vulnerabilities associated with it and operations, maintenance, and other
were successful at this point. requires the application of mitigation individuals deemed necessary to
A number of other factors may also go strategies to prevent or eliminate a facilitate the formation of the
into the calculations a facility uses to significant vulnerability or reduce such vulnerability assessment.’’ We agree that
determine the potential public health vulnerability to an acceptable level, the laboratory professionals can provide
impact. For example, if a facility has step would be categorized as an important contributions to the
conducted market research and actionable process step. vulnerability assessment and can be
concludes that each distribution unit of By utilizing these three required included as potential team members.
20 servings is typically consumed by elements when conducting a (Comment 75) A few comments seek
four persons, the potential public health vulnerability assessment, regardless of clarification on what type of
impact of that distribution unit could be the vulnerability assessment justification would be required in the
considered four persons rather than 20. methodology utilized, facilities are instance where no significant
b. Element 2: The degree of physical provided with a systematic approach vulnerabilities are identified through a
access to product. This element that enables them to move in a logical, vulnerability assessment.
includes consideration of, at a step-wise manner to identify actionable (Response 75) It has been our
minimum, the ability of an attacker to process steps. First, a facility would experience that most facilities will
conduct the attack at the particular develop a list or flow diagram of each identify one or more significant
processing step under evaluation; and point, step, or procedure in the food vulnerabilities. For a facility to
conclude that it has no significant we will consider these comments when methodological approach, such as
vulnerabilities and therefore no developing guidance to support the use grouping different production areas or
actionable process steps, the facility of key activity types as an appropriate processing steps.
would need to determine that none of method to conduct a vulnerability (Response 79) Facilities have the
its production steps present a significant assessment. flexibility to choose a vulnerability
vulnerability for wide scale public (Comment 78) One comment suggests assessment methodology appropriate to
health harm from intentional that the definition for ‘‘holding’’ used in their operations, provided that
adulteration. In conducting its two key activity types should be methodology includes consideration of
vulnerability assessment, the facility modified to account for activities that three fundamental elements (i.e., the
would need to consider at each step of involve the safe and effective storage of evaluation of the potential public health
its process: (1) The potential public raw agricultural commodities, other impact if a contaminant were added
health impact if a contaminant were than fruits and vegetables, intended for (e.g., severity and scale), the degree of
added (e.g., severity and scale); (2) the further distribution or processing, but physical access to the product, and the
degree of physical access to the product; does not include activities that ability of an attacker to successfully
and (3) the ability of an attacker to transform a raw agricultural commodity contaminate the product) and is
successfully contaminate the product. into a processed food. The specific performed by an individual qualified by
The written vulnerability assessment, example of mineral oil applied to raw training and/or experience to conduct
including the accompanying rationale grains and oilseeds for dust control was vulnerability assessments. A facility
supporting the decision not to identify provided. must conduct written vulnerability
any significant vulnerabilities would be (Response 78) In response to the assessments for all of the foods that it
important for determining if such a comment, we have conducted an manufactures/processes, packs, or
facility had complied with § 121.130. analysis of this activity and believe that holds. We recognize there are instances
(Comment 76) One comment suggests the storage of mineral oil and its where facilities are manufacturing very
the term ‘‘vulnerability assessment’’ application onto raw, whole grains or similar products using either the same
should be clearly defined in the rule. oilseeds in accordance with 21 CFR equipment and/or very similar
(Response 76) We deny this request. 172.878 is not a significant vulnerability processes. In such instances, it is
As discussed in Response 73, § 121.130 and facilities engaged in these specific appropriate for the facility to conduct
has been revised to provide required practices are not required to evaluate vulnerability assessments of like
elements the facility would need to these processing steps when conducting products by grouping these products
consider at each step of its process vulnerability assessments (Ref. 15). into one or more processes and
when conducting vulnerability Facilities storing and using mineral oil conducting vulnerability assessments on
assessments: (1) The potential public on other food products, such as baked these process groupings. However, any
health impact if a contaminant were goods, condiments, spices, or product or process-specific differences
added (e.g., severity and scale); (2) the confectionery products, are required to must be carefully delineated and noted
degree of physical access to the product; evaluate mineral oil storage and use in the vulnerability assessment, and the
and (3) the ability of an attacker to when conducting vulnerability facility must clearly identify the specific
successfully contaminate the product. assessments. products included in each vulnerability
Additionally, the definition for Additionally, we are removing the key assessment. In some facilities with
significant vulnerability has been activity types from the regulatory text, limited types of products, the written
revised to include these three required as discussed previously, although the vulnerability assessment may contain a
elements, which underscores the key activity types are one appropriate single set of process steps that addresses
importance of the evaluation that leads method to conduct vulnerability all of the products produced. For
to the identification of significant assessments to identify actionable example, a facility making fruit-flavored
vulnerabilities, which in turn leads to process steps. Further, we are revising beverages may be able to conduct a
the identification of actionable process the definition of ‘‘holding’’ in this final single vulnerability assessment for all of
steps. rule, as discussed in section IV.A.3, by its beverages using a single set of
We believe the combination of removing the distinction for farms and processing steps.
required vulnerability assessment farm mixed-type facilities and adding In other facilities, there may not be a
elements in § 121.130 and a revised that holding also includes activities practical way to group all products into
definition for significant vulnerability performed incidental to storage of a a single set of process steps, and
provides a high degree of specificity food, but does not include activities that vulnerability assessments may be
regarding what constitutes a transform a RAC into a processed food needed for multiple groups of products.
vulnerability assessment and will and we include additional examples of For example, a facility that makes both
provide direction to facilities as they holding activities. However, the holding ready-to-eat (RTE) entrees and entrees
select an appropriate vulnerability of food in liquid storage tanks remains that are not RTE may need to conduct
assessment methodology. an activity subject to the rule under a vulnerability assessment of the RTE
(Comment 77) One comment suggests § 121.5(b). entrees and conduct a separate
that the term ‘‘secondary ingredient (Comment 79) Some comments state vulnerability assessment for the entrees
handling’’ used in a key activity type is that when conducting vulnerability that are not RTE.
confusing because it is not obvious assessments, facilities should take
whether ‘‘secondary’’ describes different processing steps into d. Qualified Individual
‘‘ingredient’’ or ‘‘handling,’’ nor what is consideration, but facilities should not (Comment 80) Several comments
meant by ‘‘secondary.’’ be expected to conduct vulnerability requested more information regarding

(Response 77) We are removing the assessments based on product type. the requirement that vulnerability
key activity types from the regulatory Rather, they should be able to conduct assessments must be conducted by
text, although the key activity types are a tailored vulnerability assessment individual(s) qualified by experience
one appropriate method to conduct based on the best methodology for each and/or training using appropriate
vulnerability assessments to identify facility, either in its entirety or by any methods. Specifically, additional
actionable process steps. Consequently, appropriate, locally determined clarification was requested regarding
training such individuals must receive understanding and implementation for vulnerability assessment will differ
(particularly in the absence of FDA the regulated industry. depending on the type of vulnerability
standardized curriculum); the process As stated in the preamble to the assessment conducted. Using key
and criteria by which relevant work proposed rule, we recognize that the activity types requires less technical
experience may supplement or task of performing a vulnerability expertise and experience than other
substitute for training; and the criteria assessment requires an individual with methodologies and this would be
by which FDA will determine if the a specific skill set to properly assess and reflected in the necessary qualifications.
individual is adequately qualified to prioritize the various points, steps, or
procedures in a food process to C. Proposed § 121.135—Focused
conduct vulnerability assessments. Mitigation Strategies for Actionable
Additionally, several comments believe characterize their susceptibility to
intentional adulteration, to identify Process Steps
there is confusion with the use of
qualified individuals in this rule significant vulnerabilities and to We proposed that the owner, operator,
compared to other rules and believe the identify actionable process steps where or agent in charge of a facility must
term should be defined. mitigation strategies are essential to identify and implement focused
significantly minimize or eliminate the mitigation strategies at each actionable
(Response 80) We agree that further
significant vulnerabilities. We also process step to provide assurances that
clarification is needed regarding a
believe that various activities required the significant vulnerability at each step
definition for a qualified individual in
by this rule may require higher levels of will be significantly minimized or
the context of this rule and in particular, prevented and the food manufactured,
training based on the difficulty and
how it relates to the qualifications processed, packed, or held by such
intensity of the task. We believe that a
necessary to conduct vulnerability facility will not be adulterated under
standardized curriculum will be
assessments. Consequently, in § 121.3 section 402 of the FD&C Act (21 U.S.C.
required to ensure clear and consistent
we have defined a qualified individual 342). As discussed in section IV.B.3, in
training is provided for this activity.
to mean ‘‘a person who has the the final rule we use the term
The training developed for the purpose
education, training, or experience (or a ‘‘mitigation strategies’’ and no longer
of conducting or overseeing a
combination thereof) necessary to reference focused and broad mitigation
vulnerability assessment will require an
perform an activity required under strategies.
in-depth analysis of the functional and
subpart C, as appropriate to the In addition, we have modified this
thought processes required to properly
individual’s assigned duties. A qualified characterize significant vulnerabilities provision to provide that for each
individual may be, but is not required associated with a facility’s points, steps mitigation strategy or combination of
to be, an employee of the or procedures and the identification of strategies implemented at each
establishment.’’ We have further actionable process steps. The process of actionable process step, the facility must
clarified the qualifications necessary for conducting a vulnerability assessment include a written explanation of how
the conduct of a vulnerability may be new to much of the industry and the mitigation strategy(ies) sufficiently
assessment by creating a new section the training must take this into minimizes or prevents the significant
(§ 121.4, Qualifications of Individuals consideration. The standardized vulnerability associated with the
Who Perform Activities Under Subpart curriculum for conducting a actionable process step. In the preamble
C). In § 121.4 we state ‘‘each individual vulnerability assessment will need to be to the proposed rule, we stated that a
responsible for . . . conducting or a comprehensive training that teaches justification for how the strategy
overseeing a vulnerability assessment as an individual the required components significantly reduces or eliminates the
required in § 121.130’’ must (1) have the of a vulnerability assessment and risk of intentional adulteration at that
appropriate education, training, or provides enough information for an actionable process step(s) must be
experience (or a combination thereof) individual to calibrate their decision documented (see 78 FR 78014 at 78048);
necessary to properly perform the making based on the scientific analysis however, this was not explicitly
activities; and (2) have successfully required by a vulnerability assessment. included in the regulatory text. We
completed training for the specific We believe that the curriculum designed believe that providing additional
function at least equivalent to that for this activity will require multiple flexibility in the nature of the mitigation
received under a standardized days and may best be offered in person. strategies facilities may employ makes it
curriculum recognized as adequate by (Comment 81) A few comments critical that facilities explain their
FDA or be otherwise qualified through believe the key activity type option for rationale as to how the strategy(ies) are,
job experience to conduct the activities. identifying actionable process steps in fact, protective of the actionable
Job experience may qualify an should include a requirement that the process step. This explanation will
individual to perform these functions if evaluation be performed by an include a facility’s rationale for
such experience has provided an individual(s) qualified by experience selecting its mitigation strategies. This
individual with knowledge at least and/or training using appropriate explanation can provide additional
equivalent to that provided through the methods. benefits to the facility by assisting them
standardized curriculum. This new (Response 81) We agree with the in the decision-making process for
definition and qualifications section has comments and this is reflected in the identifying mitigation strategies as well
provided more information on what revised requirements. As explained in as identifying the most appropriate
would qualify an individual to perform Response 71, key activity types have mitigation strategies management
a vulnerability assessment. We believe been removed from the regulatory text, components for the mitigation
that our definition of ‘‘qualified but are still considered an appropriate strategy(ies).
individual’’ as well as the qualifications method to conduct a vulnerability Based on our vulnerability
required of those individuals have assessment. The rule requires that a assessments, we believe that adequate
addressed this need and fulfill the vulnerability assessment, no matter mitigation strategies are designed to
request of the comments. This new which methodology is used, must be minimize or eliminate the chances an
approach is consistent with other FSMA conducted or overseen by a qualified attacker would be successful if an act of
rules, including the PCHF final rule, individual. We note that the intentional adulteration were attempted
which we believe allows for easier requirements to conduct or oversee a at the actionable process step by either
(1) minimizing the accessibility of the mitigation strategy is achieving its also be highly beneficial in establishing
product to an attacker (e.g., physically intended aim and, therefore, is properly common understanding and
reducing access to the product by implemented. communication between the facility and
locking storage tanks) or (2) reducing For example, for a facility that secures inspectors during inspections.
the opportunity for an attacker to its liquid storage tank with a lock, a (Comment 82) Many comments
successfully contaminate the product review of monitoring records may show support our proposed requirement that
(e.g., increasing observation of the area that the lock is consistently in place and mitigation strategies be targeted at high
through supervision or use of the buddy locked, therefore reducing accessibility vulnerability process steps instead of
system), or a combination of both. and significantly reducing the setting requirements for general facility-
Mitigation strategies found within vulnerability associated with the liquid level protections. Further, some
FDA’s Mitigation Strategies Database, storage tank. By being consistently comments assert that significant
generally, are designed to address one or implemented as intended, the lock is vulnerabilities by nature present
both of these concepts. The content of achieving the aim as explained in the themselves at particular points in a
the Mitigation Strategies Database is food defense plan to reduce access to process and that these individual
derived from our experience conducting the liquid food held in the liquid storage points, steps, or procedures must be
vulnerability assessments with industry tank. In this case, the facility can protected. These comments also state
and can serve as a resource for facilities conclude that this mitigation strategy is that broad mitigation strategies would
to identify adequate and appropriate properly implemented and is reducing a be far reaching and require significantly
mitigation strategies. The explanation of significant vulnerability. more capital investment from industry,
how the mitigation strategy sufficiently In contrast, consider a lock on a mixer while not directly protecting the most
minimizes or prevents the significant that is not achieving its intended aim. vulnerable processes.
vulnerability associated with the In this example, the worker at the mixer (Response 82) We agree with
actionable process step would, must routinely open the mixer’s lid to comments supporting the direction of
generally, address the mitigation determine if the product is being mitigation strategies to those areas
strategy’s impact on one or both of these sufficiently mixed. The worker finds the where vulnerability is highest. As
outcomes. lock to be interfering with his or her discussed previously, we now refer to
For example, a facility seeking to responsibilities and frequently does not mitigation strategies, rather than broad
protect its liquid storage tank’s access engage the lock after checking on the and focused mitigation strategies.
hatch with a lock may conclude that the product, repeatedly leaving the mixer However, we continue to believe that to
lock significantly reduces access to the unsecured. This deviation is be sufficient and appropriate mitigation
liquid food stored in the tank by documented in monitoring records by strategies must be specifically tailored
rendering the hatch inaccessible and the production supervisor. In this case, to the significant vulnerability and
include this explanation in its food the facility’s explanation as to how the customized to the actionable process
defense plan. As another example, a mitigation strategy would be protective step where they are applied rather than
facility may elect to protect its liquid of the mixer included the rationale that applied to the entire facility (e.g.,
storage tank actionable process step the lock would reduce access to the locking exterior doors, or ensuring
with a policy to require two or more product. A component of the facility’s employees and visitors have
employees to be in the area at all times. corrective action procedure for this identification badges). We would not
The facility’s explanation would mitigation strategy was to retrain the consider these two examples to be
include the rationale that this ‘‘buddy employee on the importance of locking adequate to significantly reduce or
system’’ reduces the opportunity and the mixer, but the employee continues prevent a significant vulnerability
ability of an attacker to bring a to repeatedly leave the mixer unlocked because they do not address an inside
contaminant into the vulnerable due to its interference with his or her attacker.
production area and introduce the responsibilities. Since the mitigation However, we believe that many
contaminant into the food without being strategy, as determined through a review policies or procedures that a facility
detected by his or her co-workers. These of monitoring and corrective action currently has in place can be modified
two examples show that the same records, was not consistently or altered to provide protection against
actionable process step can be protected implemented, it is not achieving the aim acts of intentional adulteration without
in a variety of ways. The explanation as specified in the mitigation strategy’s the facility incurring significant costs, or
will clarify the facility’s thinking and explanation. Therefore, the mitigation requiring additional capital investment.
rationale as to how a mitigation strategy strategy cannot be determined to be For example, consider a liquid food
significantly minimizes or prevents a properly implemented and is not storage tank with an inward opening
significant vulnerability. reducing significant vulnerabilities hatch. When the tank is full, the
We believe that the explanation associated with the mixer. Since the pressure of the liquid prevents the hatch
accompanying the mitigation facility has found that the mitigation from being opened, rendering the tank
strategy(ies) will be highly beneficial to strategy is not properly implemented, inaccessible. However, when the tank is
the facility in gauging the proper the facility must reanalyze this portion empty, the hatch may be opened and a
implementation of the mitigation of the food defense plan under the contaminant added. It may be part of
strategy during required verification requirements of § 121.157(b)(3) and then normal facility practice for a supervisor
activities. In identifying and identify and implement a different to conduct a visual check of storage
implementing appropriate mitigation mitigation strategy, or combination of tanks after a cleaning cycle to ensure the
strategies, the facility will need to strategies, for the mixer that would cleaning has been conducted properly.
reason through how and why the reduce the likelihood that an act of Rather than incur the cost of installing
mitigation strategy(ies) will be intentional adulteration would be a lock or other access control on the
protective of the respective actionable successful. hatch, the facility may elect to
process step in question. This Additionally, we believe that the implement a food defense mitigation
explanation and the monitoring of the explanation for how the mitigation strategy by altering its visual check
mitigation strategy play key roles in strategy(ies) are suitable and intended to procedure so that the visual check by
enabling the facility to determine if the reduce the significant vulnerability will the supervisor is conducted
immediately prior to food being added that mitigation strategies implemented secondary ingredient handling area. To
to the storage tank so that the tank is at actionable process steps that are implement the second mitigation
observed after the tank has been empty customized to the processing step at strategy (use of most trusted employees),
and accessible for an extended period of which they are applied, tailored to the facility could utilize either senior
time. Alternatively, the facility could existing facility practices and and/or long-term employees who had
elect to secure the tank’s hatch with a procedures, and consider the actionable earned their trust over time, or the
tamper-evident seal or tape after the process step’s vulnerability to an insider facility could conduct a more detailed
visual inspection. This slight attack are sufficient to protect the background check on specific
modification of an existing facility actionable process step. An insider employees.
practice could be implemented with attack must be considered because an Much the same way the Federal
little, if any, cost to the facility and attacker who has achieved access to the government assigns more sensitive tasks
serve to protect the actionable process facility will have already circumvented to Federal workers based on a multi-
step—in this case the storage tank— the facility’s general facility-level layered classification and security
from an attacker adding a contaminant protections. During the course of our clearance process, the facility could
to the tank while it is empty and vulnerability assessments, we require basic level pre-employment
accessible after it been cleaned and determined that if an actionable process screening for most employees, but for
visually inspected. step was sufficiently protected against those employees working at actionable
(Comment 83) Some comments state an attack perpetrated by an insider with process steps, a mitigation strategy
that those strategies previously termed legitimate access to the facility, it would could be to require a more detailed level
as broad mitigation strategies should be be similarly protected against the of background check. The facility would
considered as being among appropriate actions of an outside attacker who has also conduct periodic review of the
mitigation strategies for compliance circumvented perimeter protections. background check, as appropriate. By
with the requirements, with the majority Facility-wide security measures can applying a more targeted approach to
of those comments indicating that FDA support or compliment the mitigation establishing trust for the employee
should not distinguish between focused strategy(ies) the facility implements; working in the secondary ingredient
and broad mitigation strategies in the however the significant vulnerability handing area, the facility leveraged what
final rule. Some comments disagree associated with the actionable process was previously described in the
with FDA’s statement in the proposed step must be significantly reduced or proposal as a ‘‘broad’’ mitigation
rule that the implementation of focused prevented. strategy in a much more directed and
mitigation strategies at actionable For example, if a facility implements targeted way such that it was
process steps in a food operation is a strategy to restrict access at an specifically addressing the significant
necessary to minimize or prevent the actionable process step to only those vulnerability associated with the
significant vulnerabilities that are authorized individuals who work in the secondary ingredient staging area. This
identified in a vulnerability assessment area, and the facility leverages example shows how what were ‘‘broad’’
regardless of the existence of broad identification badges to enforce this and ‘‘focused’’ mitigation strategies can
mitigation strategies. These comments strategy, then the strategy becomes work together to protect an actionable
contend that mitigation strategies much more targeted. In this case, the process step.
(whether broad or focused) can work in strategy is simply not about identifying We caution against using background
concert with one another and play an personnel who work anywhere in the checks as the sole mitigation strategy to
important role in a facility’s food facility, but rather, restricting access to reduce significant vulnerabilities at an
defense approach. Additionally, some a specifically vulnerable area. In this actionable process step because a
comments state that broad mitigation case, the pre-existing badging process background check may not identify all
strategies can sometimes achieve the the facility had in place to positively indicators of an insider threat.
same results as focused mitigation identify employees and visitors serves Additionally, information within a
strategies and some comments state that as the foundation upon which the more background check may be outdated or
the differentiation between the two tailored mitigation strategy is built. missing more recent key information
types of strategies is confusing and However, the badging process itself is that could be indicators of an insider
subjective. not a mitigation strategy sufficient to threat. Background checks should be
(Response 83) We believe this significantly reduce or prevent a used in concert with other mitigation
comment is largely addressed by significant vulnerability at the strategies to counter the risk of an
changing the regulatory text to refer to actionable process step because the insider attack. In this example, the
only mitigation strategies in this final badging process alone does not restrict facility also mitigated vulnerability at
rule. We agree with comments that access to the actionable process step. the secondary ingredient staging area by
mitigation strategies exist across a Another example to illustrate how reducing the staging time of ingredients
spectrum from those that are very broad different practices can work in concert and increasing observation of the area.
and facility-wide in nature to those that with each other to achieve protection is Similarly, some other mitigation
are very specific and tailored to unique that of vetting employees. In the strategies may not be adequate when
processing steps and areas. If proposal we described a hypothetical used in isolation. For example, ensuring
implemented in a directed manner, a scenario where a facility’s secondary adequate lighting around an actionable
strategy that may tend to be thought of ingredient handling area was identified process step would generally be a
as ‘‘broad’’ can be effective at reducing as significantly vulnerable and was, mitigation strategy that must be used in
vulnerability associated with a specific therefore, identified as an actionable concert with other strategies to
actionable process step and could process step. In the scenario, the facility significantly reduce the likelihood of, or
sufficiently minimize the likelihood of a elected to mitigate this vulnerability by prevent, successful acts of intentional
successful act of intentional (1) reducing the time ingredients were adulteration at an actionable process
adulteration at the actionable process open and accessible, (2) entrusting the step. The increased lighting can support
step. handling of secondary ingredients to other mitigation strategies (i.e.,
Based on the results of our one of the most trusted employees, and increased supervision of an actionable
vulnerability assessments, we believe (3) increasing observation over the process step) but, generally, increased
lighting would not by itself be sufficient significant vulnerability they are particular, these comments suggest the
to address the significant vulnerability addressing and customized to the C–TPAT program has proved successful
associated with the actionable process actionable process step where they are in requiring that broad mitigation
step. applied, while taking into account strategies be implemented, including
(Comment 84) Some comments state existing facility practices and physical security, personnel security,
that existing facility practices and procedures. We disagree with the ingredient storage and inventory
facility-level measures should be comment’s assertion that strategies procedures, and crisis management
considered when a facility is identifying previously termed as ‘‘focused planning.
appropriate mitigation strategies. mitigation strategies’’ are questionable (Response 87) As discussed in section
(Response 84) We agree. As discussed or of unproven efficacy. Indeed, we III.D, we believe that participation in
previously, mitigation strategies should conclude as determined through our other security programs, such as C–
be tailored to existing facility practices vulnerability assessments that TPAT or CFATS for example, raises the
and procedures, and take into account mitigation strategies specifically overall security posture for a facility and
the nature of the actionable process designed to protect the most vulnerable can be beneficial along with the
step’s significant vulnerability. points in a food operation are the most requirements of the final rule. In certain
Mitigation strategies can be effective at reducing the likelihood that circumstances, security measures
complemented by or built on top of an act of intentional adulteration would implemented under other security
existing practices or facility-level be successful. General facility-level programs may also prove to be effective
measures. For example, a facility might security measures have questionable mitigation strategies once actionable
prepare secondary ingredients in an area value in protecting actionable process steps are identified. These
near the process step where they will be processing steps from significant security measures should be evaluated
added to the product line. The facility vulnerabilities, especially those on a case-by-case basis to determine if
weighs and measures ingredients the significant vulnerabilities associated they significantly reduce or prevent
night before use so they are ready for with attackers with legitimate access to significant vulnerabilities at actionable
introduction into the product line in the the facility. However, this comment process steps. If so, the facility may
morning. To identify a suitable and illustrates why we are changing the consider these protections as mitigation
appropriate mitigation strategy, the codified to refer to only ‘‘mitigation strategies under § 121.135 and
facility would consider its normal strategies.’’ We would consider the document them in the food defense
practice of staging ingredients the night efforts described by this comment to be plan. However, FDA will not consider a
before and any other relevant practices focused mitigation strategies as we used facility’s participation with other
the facility engages in regarding its that term in the proposed rule. We agree security programs as de facto
handling of secondary ingredients in that ‘‘bulk foods prior to and at process compliance with this rule.
this area. The facility might conclude steps that may disperse contamination
that staging ingredients the night before in a large volume of finished food’’ D. Final § 121.138—Mitigation
is unnecessary and elect to implement would most likely be significantly Strategies Management Components
the mitigation strategy that ingredients vulnerable and thus require appropriate We have added a new § 121.138
will only be handled immediately mitigation strategies. (Mitigation Strategies Management
before their introduction into the (Comment 86) Some comments state Components) to establish that mitigation
product line to prevent them from being that some of the mitigation strategies strategies required under § 121.135 are
open and accessible for extended identified in the preamble of the subject to the following mitigation
periods of time. Alternatively, if the proposed rule may not be appropriate or strategies management components as
facility concludes that their operating suitable in certain circumstances. For appropriate to ensure the proper
practices prevent this approach, it could example, some comments mention that implementation of the mitigation
implement the mitigation strategy to one-way sample ports as a mitigation strategies, taking into account the nature
place the ingredients in tamper evident strategy may not be appropriate for of each such mitigation strategy and its
storage containers overnight to prevent products that require aseptic sampling. role in the facility’s food defense
an attacker from being able to introduce Some comments contend that making system: (1) Food defense monitoring in
an agent without indications of engineering enhancements to equipment accordance with § 121.140; (2) Food
tampering with the ingredients. The or repositioning equipment to increase defense corrective actions in accordance
facility would implement the most visual observation may be prohibitively with § 121.145; and (3) Food defense
appropriate mitigation strategy taking costly. verification in accordance with
into consideration its existing practices (Response 86) We agree that certain
§ 121.150. We have created this new
and procedures. mitigation strategies may not be
section to provide clarity and
(Comment 85) One comment asserts appropriate or suitable in some
understanding regarding the application
broad mitigation strategies offer situations. Therefore, we are not
of the three management components to
significant protections to the food requiring any specific mitigation
the mitigation strategies as required by
supply and that focused mitigation strategies in this rule. A facility may
§ 121.135.
strategies are of questionable or at least identify the most appropriate and
unproved efficacy. This comment goes suitable mitigation strategies for its E. Proposed § 121.140—Monitoring
on to request that FDA focus facility, the food being processed, the
1. Proposed § 121.140(a)–(b)
requirements only on broad mitigation actionable process step being protected,
Requirement for Written Procedures for
strategies that limit access to bulk foods and the nature of the significant
and Frequency of Monitoring

prior to and at process steps that may vulnerability being mitigated.
disperse contamination in a large (Comment 87) Some comments urge We proposed that you must establish
volume of finished food. FDA to permit requirements that are and implement written procedures,
(Response 85) During the course of already in place by other government including the frequency with which
our vulnerability assessments, we found agencies to count as mitigation they are to be performed, for monitoring
that appropriate mitigation strategies strategies, when appropriate based on a the mitigation strategies, and you must
must be specifically tailored to the thoughtful vulnerability assessment. In monitor the mitigation strategies with
sufficient frequency to provide mitigation strategies; it does not indicate (i.e., suitable for a particular purpose
assurance that they are consistently that each mitigation strategy must be and capable of being applied) because it
applied. monitored, and it does not specify the allows for the assessment or observation
Some comments support the proposed frequency at which monitoring must that the ingredient staging time is being
requirements. In the following occur. However, the comments agree reduced. When establishing the
paragraphs, we discuss comments that that facilities should assess whether monitoring procedure, the facility
disagree with the proposed mitigation strategies are in place and are considered the nature of the mitigation
requirements, ask us to clarify the fully implemented. The comments agree strategy (i.e., an observation would
proposed requirements, or suggest one that facilities should have written determine if reducing the staging time
or more changes to the proposed procedures regarding how, and the was being consistently performed) and
requirements. Some comments request frequency at which, observations take its role in the facility’s food defense
that we provide more flexibility than a place, but also indicate that these system (i.e., the facility deemed it
traditional HACCP framework, with procedures and frequencies should be necessary to conduct the monitoring for
specific requests for flexibility in the less rigorous than procedures and the mitigation strategy because the
management components, including frequencies for preventive controls. reducing the staging time significantly
monitoring. (Response 88) We agree that facilities minimized the significant vulnerability
After considering these comments, we must assess whether mitigation associated with the ingredient
are making three revisions to the strategies are in place. We also agree containers). Additionally, the facility
requirements for monitoring in that facilities must provide written reasoned that monitoring the staging
§ 121.140. First, we are adding the procedures regarding how, and the area immediately prior to the addition
qualification ‘‘as appropriate to the frequency at which, monitoring occurs. of the ingredients to the hopper met the
nature of the mitigation strategy and its This rule implements section 103 of requirement for monitoring to be
role in the facility’s food defense FSMA, and therefore includes conducted on an adequate frequency
system,’’ to the beginning of the components for monitoring (section because this frequency meets the
provision. Second, we are changing 418(d) of the FD&C Act). We agree that definition of adequate (i.e., that which is
‘‘sufficient’’ to ‘‘adequate’’ in monitoring in the intentional needed to accomplish the intended
§ 121.140(b), which now states that adulteration regulatory framework purpose in keeping with good public
‘‘you must monitor the mitigation should be more flexible than monitoring health practice) in that monitoring prior
strategies with adequate frequency to as described in the National Advisory to ingredient addition to the hopper
provide assurances that they are Committee on Microbiological Criteria ensures that employees will properly
consistently performed.’’ We are for Foods’ HACCP Principles and implement the reduced staging time and
substituting the term ‘‘adequate’’ for the Application Guidelines. Therefore, we reduce the significant vulnerability.
term ‘‘sufficient’’ to be consistent with have modified the requirement for
the PCHF final rule definition for monitoring in the regulatory text to 2. Proposed § 121.140(c)—Requirement
monitoring. We conclude that there is include ‘‘as appropriate to ensure the for Records
no meaningful difference between proper implementation of the mitigation We proposed that all monitoring of
‘‘adequate’’ and ‘‘sufficient’’ for the strategies, taking into account the nature focused mitigation strategies in
purposes of part 121. We have also of each such mitigation strategy and its accordance with this section must be
added a definition for the term role in the facility’s food defense documented in records that are subject
‘‘adequate’’ in the regulatory text to system’’ (see §§ 121.138, 121.140) and to to verification in accordance with
mean that which is needed to provide for the use of exception records proposed § 121.150(a) and records
accomplish the intended purpose in (see § 121.140(c)(2)). These changes review in accordance with proposed
keeping with good public health allow a facility to select the appropriate § 121.150(c).
practice. We also conclude that the rigor and frequency of its monitoring In the following paragraphs, we
regulations will be clearer if we use the based on its particular circumstances discuss comments that disagree with the
single term ‘‘adequate’’ throughout the and are similar to those made in the proposed requirements, ask us to clarify
regulations. Third, we are changing PCHF final rule regulatory text for the proposed requirements, or suggest
‘‘applied’’ to ‘‘performed’’ to address monitoring in the preventive controls one or more changes to the proposed
comments that state the language was management components. requirements. After considering these
unclear. Section 121.140(b) now states For example, a facility stages comments, we have revised the
that ‘‘you must monitor the mitigation ingredients overnight so the first shift regulatory text to provide that exception
strategies with adequate frequency to can immediately begin adding records may be adequate in some
provide assurances that they are ingredients to a hopper. The facility circumstances (see § 121.140(c)(2)).
consistently performed.’’ identifies staged ingredient containers (Comment 89) Some comments state
(Comment 88) Some comments argue as an actionable process step because that a facility will be much more likely
that the language of section 418(d) of the the overnight staging makes the to document a deviation from an
FD&C Act is ambiguous, and state that ingredient containers significantly established mitigation strategy (i.e., a
monitoring in section 418(d) does not vulnerable. The facility then identifies a light is broken or turned off) rather than
require that facilities conduct mitigation strategy of reducing a confirmation that the light was
monitoring as described in the National ingredient staging time. The facility working properly each day. These
Advisory Committee on Microbiological establishes and implements food comments seem to indicate that this
Criteria for Foods’ HACCP Principles defense monitoring procedures to could be a potential area where greater
and Application Guidelines. These include observations of the staging area flexibility is needed regarding how
comments state that the statute sets a to ensure the ingredients are staged monitoring is documented.
standard for facilities to ‘‘monitor the immediately prior to addition into the (Response 89) New § 121.140(c)(2)
effectiveness of the preventive hopper rather than overnight. This provides for exception records and
controls.’’ The comments state that the monitoring procedure is tailored to the states records may be affirmative
statute does not indicate how facilities facility’s circumstances and is records demonstrating the mitigation
are to monitor the effectiveness of the appropriate to the mitigation strategy strategy is functioning as intended and
that exception records demonstrating procedures that must be taken if the ‘‘appropriate action is taken’’ in
the mitigation strategy is not mitigation strategy is not properly § 121.145(a)(2)(ii).
functioning as intended may be implemented. The corrective action (Comment 90) A few comments state
adequate in some circumstances. This procedures must describe the steps to be that greater flexibility is needed to
revision to the regulatory text was made taken to ensure that appropriate action reflect the differences between
to clarify that exception records, in is taken to identify and correct a mitigation strategies and preventive
certain circumstances, are acceptable. problem with implementation of a controls and that corrective actions is
We understand exception reporting as a mitigation strategy to reduce the one potential area in which to increase
structure where automated systems are likelihood that the problem will recur. flexibility. While comments agree that a
designed to alert operators and facility should take action when a
Some comments support the proposed mitigation strategy is not properly or
management on an exception basis—i.e.,
requirements. In the following fully implemented, these comments
only when a deviation from food safety
paragraphs, we discuss comments that further state that detailed, written
parameter limits are observed by the
disagree with the proposed corrective action procedures should not
system.
Exception reporting would be an requirements, ask us to clarify the be required to address every possible
acceptable monitoring system in some proposed requirements, or suggest one deviation for each mitigation strategy. In
circumstances. A facility must be able to or more changes to the proposed addition, comments state that facility
verify that food defense monitoring is requirements. Some comments request employees should make corrections,
being conducted (§ 121.150(a)(1)). This that the intentional adulteration rather than take corrective actions, in
is straightforward with affirmative requirements provide more flexibility some circumstances. These comments
monitoring records but can be more than a traditional HACCP framework, provide an example of corrections
difficult or impossible with exception with specific requests for flexibility in where a door is simply closed, and the
records. The following example the management components, including action is not documented, in response to
provides an instance where a facility corrective actions. After considering a single, isolated event where a door is
may choose exception records when these comments, we are making several propped open.
monitoring a mitigation strategy. A revisions to the proposed requirements (Response 90) As described
facility identifies an ingredient storage for corrective actions. First, we are previously, we have modified the
area as an actionable process step, and adding the qualification ‘‘as appropriate provision to provide that corrective
identifies and implements a restricted to the nature of the actionable process action procedures are established and
access system that uses electronic step and the nature of the mitigation implemented based on the nature of the
swipe/key cards to limit access to the strategy’’ to the beginning of the actionable process step in addition to
area. The restricted access system is provision in § 121.145(a). Second, we the nature of the mitigation strategy (see
designed to allow authorized personnel are separating the requirements to take § 121.145(a)). The rule allows for a
to open a door to the area, while also appropriate action to identify and facility’s corrective action procedures to
alerting management when the door is correct a problem that has occurred reflect the extent of the deviation. For
left unlocked. While the system would from the requirement to take example, a facility’s monitoring
not need to produce a record for every appropriate action, when necessary, to indicates that a peer monitoring
authorized access to the area, the system reduce the likelihood that the problem mitigation strategy is not implemented
will recur. The separated requirements as intended because one of the
would produce a record for each
employees does not accompany the
instance that the door is left unlocked are now included in the regulatory text
other employee at the actionable process
and alert operators to those instances. In as § 121.145(a)(2)(i) and
step. A component of the facility’s
this example, the facility would § 121.145(a)(2)(ii), respectively. Similar
written corrective action is to retrain the
periodically verify that the restricted changes were made to the PCHF final
employee on the importance of
access system is working properly, in rule regulatory text for corrective
accompanying the other employee while
part, by leaving the door unlocked, and actions, as comments related to that rule at the actionable process step. We
ensuring the system alerts the operator asserted the proposed corrective action expect, in most cases, that food defense
by generating a record that documents regulatory text could have been corrective action procedures will be
the door being unlocked. Exception misunderstood as a requirement to simple and easy to undertake. Further,
records are not always appropriate. For establish a new preventive control after we agree that written corrective action
example, it would not be appropriate to implementing a corrective action procedures need not address every
create a record that indicates adequate procedure. These comments also possible deviation, and the rule does not
lighting is not functioning as intended, asserted that it would be inappropriate require this. Written corrective action
rather than documenting adequate to assume that corrective action procedures should address
lighting is functioning as intended, procedures always correct a problem circumstances where deviations are
unless the facility devised an approach with the implementation of a new or likely to occur. The reason to have
that would allow it to verify that food additional preventive control. We have corrective action procedures is to
defense monitoring was being addressed these comments to the consider the likely scenarios in advance,
conducted as required. requirement to identify and correct a rather than react to these scenarios on
F. Proposed § 121.145—Corrective problem by adding ‘‘that has occurred’’ an ad hoc basis.
Actions after ‘‘correct a problem’’ in We do not agree that certain situations
§ 121.145(a)(2)(i). We have also are more appropriate for corrections
1. Proposed § 121.145(a)(1)–(2) addressed these comments by qualifying rather than corrective actions. A
Requirement To Establish and the requirement that the corrective ‘‘correction’’ does not include, among
Implement Corrective Action action procedures must describe the other things, actions to reduce the
Procedures That Must Describe Steps To steps to be taken to ensure that likelihood that the problem will recur.
Be Taken appropriate action is taken to reduce the The comment describes a situation
We proposed that you must establish likelihood that the problem will recur where a facility is locking the door to
and implement written corrective action by inserting ‘‘when necessary’’ after serve as the mitigation strategy, and the
monitoring of the mitigation strategy failure to implement the mitigation clarification specifically related to
indicates the strategy is not performing strategy. Further, without implementation and effectiveness. One
as intended (i.e., the door is not locked, documentation, it may not be known comment requests that we provide for
and it is propped open). Because whether it was a one-time event or the other activities appropriate for
monitoring has indicated the mitigation door was propped up more regularly. verification of implementation and
strategy is not properly implemented, a Documentation of the corrective actions effectiveness. After considering these
corrective action is required and review of the documentation to comments, we are making several
(§ 121.145(a)(1)). While the example verify proper implementation of changes to the requirements for
includes a corrective action that is quite mitigation strategies is necessary to verification.
simplistic and easy to undertake, it is identify trends and patterns of First, we are adding text to
important that a corrective action, and implementation of mitigation strategies § 121.150(a) (Food defense verification)
not a correction, be taken because the over time, and is also necessary to to reflect that verification procedures
corrective action includes actions to ensure appropriate decisions about are established and implemented based
reduce the likelihood that the problem corrective actions are being made. After on the nature of the mitigation strategy
will recur, while the correction does considering the comment, we are and its role in the facility’s food defense
not. An unlocked door leaves the finalizing these requirements as system. Second, we made edits to reflect
significant vulnerability unmitigated, proposed. new § 121.138. We have changed
and therefore, this seemingly isolated proposed § 121.150(a) to final
G. Proposed § 121.150—Verification § 121.150(a)(1), which now states
problem directly impacts product
vulnerability. We proposed to require verification of ‘‘Verification that food defense
Furthermore, corrections, such as monitoring, verification of corrective monitoring is being conducted as
those discussed in the PCHF final rule actions, verification of implementation required by § 121.138 (and in
(e.g., facility observes food residue on and effectiveness, reanalysis, and accordance with § 121.140).’’ We have
‘‘clean’’ equipment prior to production documentation of all verification changed proposed § 121.150(b) to final
of food, and then cleans the equipment), activities. Specifically regarding § 121.150(a)(2), which now states
are appropriate for minor and isolated verification of implementation and ‘‘Verification that appropriate decisions
problems that do not directly impact effectiveness, (proposed § 121.150(c)), about food defense corrective actions
product safety. An analogous situation we proposed that you must verify that are being made as required by § 121.138
does not exist in the context of the focused mitigation strategies are (and in accordance with § 121.145).’’ We
intentional adulteration where consistently implemented and are have changed proposed § 121.150(c) to
requirements of this rule are designed to effectively and significantly minimizing final § 121.150(a)(3) which requires
reduce significant vulnerabilities or preventing the significant verification that mitigation strategies are
associated with an insider attack. vulnerabilities. We proposed that this properly implemented and significantly
Additionally, food defense corrective must include, as appropriate to the minimizing the significant
action requirements are less rigorous facility and the food, review of the vulnerabilities.
and resource-intensive than corrective monitoring and corrective actions Third, we have removed the
actions for food safety purposes. Food records within appropriate timeframes requirement to verify that mitigation
defense corrective actions do not to ensure that the records are complete, strategies are effectively significantly
include requirements to evaluate all the activities reflected in the records minimizing or preventing significant
affected food for safety, prevent affected occurred in accordance with the food vulnerabilities in § 121.150(c) because it
food from entering commerce, or defense plan, the focused mitigation is more appropriate to verify mitigation
include requirements for unanticipated strategies are effective, and appropriate strategies are being properly
problems. decisions were made about corrective implemented, in accordance with the
actions. We also requested comment on food defense plan, rather than verifying
2. Proposed § 121.145(a)(3)— whether we should specify the these strategies are effective. In the food
Documentation verification activities that must be safety context, verification of
We proposed that all corrective conducted for verification of monitoring effectiveness is mainly accomplished
actions taken in accordance with this and for verification of corrective actions via validation and testing, which are not
section must be documented in records and, if so, what verification activities required in this final rule due to the
that are subject to verification in should be required. nature of mitigation strategies. Fourth,
accordance with proposed § 121.150(b) we are adding a new section
and records review in accordance with 1. Verification of Monitoring, Corrective
§ 121.150(a)(3)(ii) to provide for ‘‘other
proposed § 121.150(c). Actions and Implementation and
activities appropriate for verification of
Some comments support the proposed Effectiveness proper implementation’’ to allow for
requirements without change. One Some comments support the proposed increased flexibility in verifying
comment states that documentation requirements. In the following mitigation strategies are properly
would not be needed in a single, paragraphs, we discuss comments that implemented beyond what is included
isolated event, such as where a door is disagree with the proposed in § 121.150(a)(3)(i). Fifth, we added a
propped open, and the corrective action requirements, ask us to clarify the requirement (§ 121.150(b)), to establish
would simply result in the door being proposed requirements, or suggest one and implement written procedures,
closed. While the example includes a or more changes to the proposed including the frequency for which they
corrective action that is simple and easy requirements. Some comments request are performed, for verification activities.
to undertake, it is necessary that it be that the intentional adulteration This requirement was added because
documented. Without such requirements provide more flexibility the flexibility, provided in
documentation, verification of proper than a traditional HACCP framework, § 121.150(a)(3)(ii), is significant but not
implementation of the mitigation with specific requests for flexibility in unbounded. Written procedures are
strategy, as required in § 121.150(a)(3), the management components, including essential to ensure these activities are
may not be possible because there are verification. Most of the comments occurring in accordance with the food
no records to review which reflect addressing verification activities request defense plan. Sixth, we moved the more
extensive section for reanalysis step, or procedure, or directly reduce defense system. Review of monitoring
(proposed § 121.150(d)) to a new section the ability of an attacker to contaminate records is necessary to determine
(final § 121.157) to improve readability the food at a point, step, or procedure, whether mitigation strategies are
and clarity. As a result, we created a and in doing so, indirectly reduce the implemented as intended and are
new § 121.150(a)(4) (‘‘Verification of potential public health impact if a therefore significantly minimizing
Reanalysis in accordance with contaminant were added at a point, significant vulnerabilities. For example,
§ 121.157’’) to include in § 121.150 the step, or procedure. review of monitoring records for a
requirement to verify that reanalysis has As a facility reasons through its mitigation strategy of using a lock to
been conducted. Some of these changes explanation of how the mitigation secure an access hatch on top of a silo
are similar to those made in the PCHF strategy significantly minimizes or could indicate that the lock is
final rule regulatory text for verification prevents the significant vulnerability functioning as intended because the
and preventive controls management (§ 121.135(a)), the facility’s explanation securing mechanism is fully engaged,
components. will most likely include the rationale for and the hatch cannot be accessed
(Comment 91) Some comments how the mitigation strategy reduces, to without a key to the lock. The
request clarification and elaboration for an acceptable level, either the degree of significant vulnerability has been
verification activities related to unauthorized access to the actionable significantly minimized because the
implementation and effectiveness of process step or the ability of an attacker food in the silo is no longer accessible.
mitigation strategies (proposed to successfully contaminate the product The facility determines the mitigation
§ 121.150(c)). at the actionable process step. When the strategy is properly implemented
(Response 91) As mentioned facility reviews the monitoring and because it is functioning as intended
previously, we have removed the corrective action records to ensure that and minimizes the significant
requirement to verify the effectiveness activities reflected in the records occur vulnerability.
of mitigation strategies. As part of food as envisioned by the food defense plan Review of corrective action records is
defense verification, a facility must (§ 121.135(a)) and are consistently necessary to determine whether
determine if each mitigation strategy is implemented (§ 121.150(a)(3)), the appropriate decisions are being made to
properly implemented and significantly facility can then determine whether the identify and correct any problems with
minimizing or preventing significant mitigation strategy is properly the implementation of a mitigation
vulnerabilities. To do this, a facility implemented and is significantly strategy and whether actions are being
would determine whether the mitigation minimizing the significant vulnerability taken to reduce the likelihood that a
strategies are consistently implemented at the actionable process step. problem would recur. To continue with
and functioning as intended. Part of this (Comment 92) One comment states the example, if the review of monitoring
determination would be based on that verification methods other than records indicated that the lock was not
review of monitoring and corrective those required by proposed § 121.150(c) properly implemented due to employee
action records. In addition, as may be appropriate, and provides error, the facility implements the
mentioned in section V.D, facilities may suggestions of such methods, including corrective action, which consists of
use, but are not limited to, two direct observation of monitoring, such engaging the securing mechanism of the
important factors to determine the as a supervisor observing monitoring lock on the access hatch, and retraining
proper implementation of mitigation conducted by an employee, and review the employee assigned to this step in
strategies to significantly minimize or of monitoring and corrective actions how to properly use the securing
prevent significant vulnerabilities: (1) activities during team meetings. mechanism. During the review of the
The degree of physical access to the (Response 92) We agree that the rule corrective action records, the facility
product at the actionable process step should provide flexibility for additional determines that appropriate decisions
and (2) the ability of an attacker to activities related to verification of about corrective actions were made
successfully contaminate the product at properly implemented mitigation because the problem was identified that
the actionable process step. strategies, and have revised the specific the lock was not properly implemented
For example, if a mitigation strategy is requirements to provide for other due to employee error, the problem was
significantly minimizing the degree of activities appropriate for verification of corrected because the facility engaged
physical access to the product at an proper implementation of mitigation the securing mechanism of the lock to
actionable process step, and the strategy strategies in § 121.150(a)(3)(ii). lock the access hatch, and actions were
is consistently implemented as Providing specific requirements for taken to reduce the likelihood the
determined by record review, the verification of implementation problem would recur by training the
strategy can be considered properly (§ 121.150(a)(3)(i)), but allowing for employee on how to successfully engage
implemented. Likewise, if the other activities appropriate for the securing mechanism of the lock in
mitigation strategy is significantly verification of implementation order to lock the access hatch.
minimizing the ability of an attacker to (§ 121.150(a)(3)(ii)), addresses, in part, Further, FDA has provided a flexible
successfully contaminate the product at comment requests that mitigation time period for review, allowing review
the actionable process step, and the strategies management components of monitoring and corrective action
strategy is consistently implemented as need to provide more flexibility. records to take place in an ‘‘appropriate
determined by record review, the (Comment 93) One comment timeframe.’’ For example, a facility
strategy can be considered properly disagrees with the requirement that, as chooses to use several mitigation
implemented. These factors are the part of verification, monitoring and strategies, including adequate lighting,
same as two of the factors required to be corrective action records must be at the bulk truck unloading bay to
evaluated in a vulnerability assessment reviewed and further states that the protect the actionable process step, and
(§ 121.130(a)(2) and (3)). proposed requirement is too the lighting may be monitored each time
We are not including the third factor prescriptive and not applicable to food a shipment is received or on a weekly
(the potential for public health impact defense. basis depending on the facility’s
(§ 121.130(a)(1)) because it has been our (Response 93) Review of monitoring determination of the frequency of the
experience that mitigation strategies and corrective action records is a key monitoring procedures. The review of
either directly reduce access to a point, component of verification in a food these monitoring records may occur on
a weekly or monthly basis, depending prevents the significant vulnerability for when the reanalysis requires a
on the frequency of the monitoring associated with an actionable process revision to the food defense plan (e.g.,
procedures and the role this mitigation step, a facility may choose a mitigation the proposed language stated a revision
strategy plays in a facility’s food defense strategy that it believes provides to the food defense plan is required
system. We disagree that this maximum benefit, regardless of when a significant change is made, and
requirement is too prescriptive. availability or convenience, if it the text was edited to state that a
(Comment 94) Some comments assert complies with the requirement to revision to the food defense plan is
that industry cannot be held to a significantly minimize, or prevent, the required when a significant change in
standard of absolute prevention of significant vulnerability. activities conducted at your facility
intentional adulteration, and given this creates a reasonable potential for a new
assertion, one of these comments further 2. Proposed § 121.150(d)—Reanalysis
significant vulnerability or a significant
states that effectiveness of mitigation (Final § 121.157)
increase in a previously identified
strategies should be interpreted We proposed that you must conduct vulnerability). Also, the new reanalysis
reasonably by both FDA and industry. a reanalysis of the food defense plan (1) section provides more flexibility in the
The comment agrees that facilities At least once every 3 years; (2) timeframe for when a reanalysis must be
should be expected to take reasonably Whenever a significant change in the completed, and clarifies when a
appropriate measures to mitigate activities conducted at your facility reanalysis requires a revision to the food
vulnerabilities and also states that creates a reasonable potential for a new defense plan.
facilities should have discretion to vulnerability or a significant increase in In the following paragraphs, we
determine how mitigation strategies are a previously identified vulnerability; (3) discuss comments that suggest one or
effective. This comment goes on to state Whenever you become aware of new more changes to the proposed
that facilities should not be expected to information about potential requirements.
employ a certain measure just because vulnerabilities associated with the food (Comment 95) Some comments state
the measure is available, particularly operation or facility; (4) Whenever you that greater flexibility is needed to
when the added benefit might be find that a focused mitigation strategy is reflect the differences between
minimal. Finally, the comment states ineffective; and (5) Whenever FDA mitigation strategies and preventive
that, in the context of interpreting requires reanalysis to respond to new controls and that verification is one
effectiveness of mitigation strategies in vulnerabilities and developments in potential area in which to increase
a reasonable manner, FDA should be scientific understanding including, as flexibility. These comments believe that
mindful of the extremely low likelihood appropriate, results from the the oversight burden and the records
of an intentional adulteration event that Department of Homeland Security burden associated with verification
may cause massive public health harm biological, chemical, radiological, or could be lessened by adding more
or economic disruption. other terrorism risk assessments. These flexibility.
(Response 94) We acknowledged the requirements for reanalysis of the food (Response 95) We interpreted these
low probability of an intentional defense plan were proposed within comments to include reanalysis in the
adulteration event that may cause wide § 121.150 Verification. verification activities mentioned. We
scale public health harm in the Many comments responded to agree that the overall regulatory
proposed rule (78 FR 78014 at 78024). § 121.150 (Verification) as a whole, framework for this rule should provide
The rule does not create a standard of without specifically referring to more flexibility than that of a traditional
absolute prevention at every identified reanalysis as an area needing edits. HACCP approach and have described
actionable process step. Mitigation However, some comments regarding our general thinking in Comment 1 and
strategies are, among other things, ‘‘risk- verification potentially apply to Comment 2 of this document. To align
based’’ and ‘‘reasonably appropriate reanalysis, and these are addressed in with this thinking we have made
measures.’’ They are employed to this section. Some comments support specific changes to the reanalysis
‘‘significantly minimize or prevent’’ the proposed requirements without requirements. We removed reanalysis
significant vulnerabilities. change and some support the proposed from § 121.150 and created a new
Furthermore, each facility has some provisions but ask for more flexibility section § 121.157 devoted entirely to
degree of discretion in determining and suggest alternative regulatory text. requirements for reanalysis to help
how, and whether, each mitigation After considering these comments, to clarify activities for the purpose of
strategy is properly implemented, as improve clarity and readability and to verification versus activities specific to
part of the facility’s written explanation be consistent with the PCHF final rule reanalysis. Within this section we
of how the mitigation strategy with respect to the regulatory text for provide for reanalysis of an applicable
sufficiently minimizes or prevents the reanalysis, we have removed reanalysis portion of the food defense plan (rather
significant vulnerability associated with from § 121.150 and created a new than the complete food defense plan) in
the actionable process step. section § 121.157 devoted entirely to specified circumstances. We have
Additionally, facilities are not requirements for reanalysis. We have revised the regulatory text to state that
required to employ measures just revised the regulatory text within this when reanalysis is conducted for any
because they are available or section to clarify which portions of the reason other than § 121.157(a) (every 3
convenient. Rather, facilities are food defense plan will need reanalysis years), the food defense plan as a whole
required to identify and implement and how often (e.g., the whole plan may need to be reanalyzed, or just the
mitigation strategies that reflect the needs reanalysis at least every 3 years, applicable portion of the food defense
specific circumstances of the actionable and the whole plan or the applicable plan that may be affected by the
process step and the facility. Because portions of the plan need reanalysis for proposed change or the new information
the facility considers these all other reasons required in the text), to (see § 121.157(a) and 121.157(b)). In the
circumstances when identifying and expand the scope of situations that proposed rule, the portions of the plan
implementing an appropriate mitigation trigger a reanalysis (e.g., added a that required reanalysis were not
strategy, and provides a written reanalysis requirement when required detailed, and the implication was that
explanation of how the mitigation by FDA based on credible threats to the the entire plan must be reanalyzed in all
strategy sufficiently minimizes or food supply), and we increased clarity cases. Our clarification of this language
allows flexibility for the facility to option to conclude that a revision to the section, § 121.4 (Qualifications of
determine the extent of the required food defense plan is not needed as long Individuals Who Perform Activities
reanalysis based on the nature of the as the basis for that conclusion has been Under Subpart C), which replaces
reanalysis trigger. In addition, we made documented. § 121.160 and defining the term
associated editorial changes for the Many of the changes we made to the ‘‘qualified individual’’ in § 121.3. In
intentional adulteration reanalysis reanalysis provisions are similar to summary, the final rule requires all
requirements to improve the readability changes made in the PCHF final rule, individuals who perform activities
of the requirement to conduct reanalysis and we believe this consistency will under Subpart C to be qualified through
‘‘whenever a mitigation strategy, a assist with overall understanding and training or job experience or a
combination of mitigation strategies, or implementation of these rules. combination thereof. Individuals and
the food defense plan as a whole, is not (Comment 96) Some comments ask us their supervisors at actionable process
properly implemented’’ (see to recognize other terminologies steps are required to take food defense
§ 121.157(b)(3)). In the proposed rule suggesting reanalysis could be referred awareness training and individuals who
this requirement applied only to the to as ‘‘reassessment.’’ prepare the food defense plan, conduct
ineffective nature of a mitigation (Response 96) We decline this a vulnerability assessment, identify and
strategy and did not take into account request. We have acknowledged that the explain mitigation strategies and
other areas of the food defense plan that terminology used in relation to the perform reanalysis must have
may be contributing to an ineffective concept of ‘‘reanalysis’’ varies in current successfully completed training for the
food defense plan. We also added new regulations and guidelines for systems specific activity at least equivalent to
text to the reanalysis requirement to such as HACCP (78 FR 3646 at 3759). that received under a standardized
allow FDA to require a reanalysis A facility may choose to use a term such curriculum recognized as adequate by
‘‘when credible threats are made to the as ‘‘reassessment’’ in its records—e.g., if FDA or be otherwise qualified through
food supply’’, as discussed more fully in it relies on existing records that use the job experience to conduct the activities.
section III.C. term ‘‘reassessment’’ to satisfy some or
all of the requirements of this rule for Section 121.4 requires that
Further, additional flexibility has
reanalysis. However, the rule will use a individuals performing activities under
been provided with respect to
single term to minimize the potential for Subpart C have certain qualifications
timeframes associated with completing
confusion about whether different terms that vary based on the activity
reanalysis. The proposed rule required
have a different meaning for the performed. Section 121.4(a) requires
that reanalysis be completed ‘‘before the
change in activities at the facility were purposes of the rule. that you ensure that each individual
operative’’ or ‘‘when necessary, during who performs activities required under
H. Proposed § 121.160—Training (Final Subpart C is a qualified individual. A
the first 6 weeks of production.’’ The § 121.4)
new requirement states that the qualified individual is ‘‘a person who
reanalysis must be complete ‘‘before any We proposed in § 121.160 to require has the education, training, or
changes in activities (including any that (1) Personnel and supervisors experience (or a combination thereof)
change in mitigation strategy) at the assigned to actionable process steps necessary to perform an activity
facility is operative,’’ or ‘‘when must receive appropriate training in required under Subpart C, as
necessary, within 90 days of food defense awareness and their appropriate to the individual’s assigned
production’’ or ‘‘within a reasonable respective responsibilities in duties. A qualified individual may be,
timeframe, providing a written implementing focused mitigation but is not required to be, an employee
justification is prepared for a timeframe strategies and (2) All required training of the establishment’’ (§ 121.3). See
that exceeds 90 days after production of must be documented in records. We section IV.C.4 for further discussion of
the applicable food first begins.’’ This asked for comment on several questions this definition. Section 121.4(b) requires
flexibility in timeframes lessens the related to training, including whether that each individual assigned to an
burden on the facility. We believe the we should require that basic food actionable process step (including
90-day timeframe is sufficient for defense awareness training be temporary and seasonal personnel) or in
completing the reanalysis but recognize completed by all employees and the supervision thereof must (1) be a
that there may be instances where the whether we should require training to qualified individual and (2) receive
90-day timeframe is exceeded and this be repeated periodically. We also training in food defense awareness.
is allowed with sufficient written requested comment on the adequacy of Section 121.4(c) requires that each
justification. FDA’s Food Defense 101 training individual assigned to (1) the
We lessened the documentation materials and whether additional FDA preparation of the food defense plan, (2)
burden by only requiring a revision to training materials are needed. Finally, the conduct of a vulnerability
the food defense plan ‘‘if a significant we requested comment on the feasibility assessment, (3) the identification and
change in the activities conducted at of the proposed training requirements, explanation of the mitigation strategies,
your facility creates a reasonable in light of the current state of food or (4) the reanalysis of the food defense
potential for a new significant defense awareness in the industry and plan must be a qualified individual and
vulnerability or a significant increase in available training resources. have successfully completed training for
a previously identified vulnerability.’’ No comments disagree with the need the specific activity at least equivalent
The proposed rule required a revision to for training for facilities to be able to to that received under a standardized
the food defense plan if ‘‘a significant properly implement this rule, and many curriculum recognized as adequate by
change was made.’’ By stating comments acknowledge that training is FDA or be otherwise qualified through
specifically that revisions are only crucial to creating an effective food job experience to conduct the activities.
required if a change is made in activities defense environment in a facility. Some Job experience may qualify an
that affect vulnerabilities, we eliminate comments agree with our proposed individual to perform any of the
the revision requirements for changes training approach, and other comments activities listed previously if such
that are not directly related to the risk request changes. After considering the experience has provided an individual
of intentional adulteration. Both the comments, we have changed the with knowledge at least equivalent to
proposed and final rules provide for the training requirements by creating a new that provided through the standardized
curriculum. Section 121.4(d) requires believe it is the best use of resources to combination thereof) necessary to
that responsibility for ensuring train individuals at actionable process properly perform their assigned
compliance by individuals with the steps in food defense awareness because activities and have successfully
requirements be clearly assigned to that is where intentional adulteration, completed training at least equivalent to
supervisory personnel with adequate when intended to cause wide scale that received under a standardized
qualifications to supervise the activities. public health harm, is most likely to curriculum recognized as adequate by
Section 121.4(e) requires that the occur. Our food defense guidance FDA or be otherwise qualified through
training required by § 121.4(b) and (c) includes options for increasing general job experience to conduct the activities.
must be documented in records that awareness of food defense throughout a Job experience may qualify an
include the date of the training, the type facility by incorporating the importance individual to perform these functions if
of training, and the person trained, and of food defense procedures into routine such experience has provided an
must be established and maintained in facility communications, such as individual with knowledge at least
accordance with the requirements of brochures, staff meetings, or payroll equivalent to that provided through the
subpart D. stuffers. We recommend that facilities standardized curriculum. We believe
In the following paragraphs, we encourage all employees to report the activities listed previously require
discuss comments that respond to our unusual or suspicious individuals or an additional level of expertise and
request for comment regarding the activities to management. training than other activities required
proposed training requirement and In addition to requiring food defense under subpart C and, therefore, FDA is
comments that request changes to the awareness training for certain establishing a standardized curriculum
training requirement as proposed. individuals, the rule requires that each for training which individuals
(Comment 97) Some comments assert individual who performs activities performing these activities must
that FDA should require facilities to required by subpart C be a qualified successfully complete (or be otherwise
conduct food defense awareness individual as that term is defined in qualified through job experience). This
training for all employees and not just § 121.3. In addition, the rule requires approach is consistent with the PCHF
for employees and supervisors who individuals performing certain final rule, where additional food safety
work at actionable process steps. Some activities, including the preparation of training is required for individuals who
comments indicate that, since food the food defense plan or the conduct of prepare or oversee preparation of the
defense is a new area of regulation, that a vulnerability assessment, to have food safety plan, including conducting
training to increase general awareness successfully completed training for the the hazard analysis (21 CFR
by all employees would be a useful specific activity at least equivalent to 117.126(a)(2)).
requirement in gaining familiarity with that received under a standardized We anticipate that the standardized
the risk and mitigation of intentional curriculum recognized as adequate by curriculum for activities other than the
adulteration. Some comments state that FDA or be otherwise qualified through conduct of a vulnerability assessment
food defense awareness training for all job experience to conduct the activities. will be an approximately 4-hour
employees is fundamental for creating a (Comment 98) Some comments training that will cover food defense
food defense culture at a facility and express a need for advanced food awareness and food defense planning
may be the critical element for defense training requirements for components such as preparing,
preventing a successful attack. individuals conducting higher level implementing, and reanalysis of a food
Alternatively, some comments state that food defense activities such as food defense plan and selecting and
expanding the food defense awareness defense coordinators, individuals who explaining mitigation strategies. We
training requirement to all employees prepare, monitor, verify, or conduct plan for the training to be available
will not advance food defense and could corrective actions associated with food online.
create a generalized approach that may defense plans, managers or quality The training for conducting or
diminish the ability of the facility to control personnel or personnel who overseeing a vulnerability assessment
effectively train personnel who have would be responsible for identification will require in-depth analysis of the
significant roles in implementing food of appropriate mitigation strategies. functional and thought processes
defense requirements. Some comments Some comments assert that these food required to properly characterize
state that the cost of requiring training defense activities require specialized significant vulnerabilities associated
of all employees would be overly knowledge that would not be covered in with a facility’s points, steps, or
burdensome. food safety training and that qualified procedures and the identification of
(Response 97) Although we agree that individuals should perform these higher actionable process steps. The process of
food defense awareness training would level functions. conducting a vulnerability assessment
be useful for all employees, we believe (Response 98) We agree with these may be new to much of the industry and
that the best use of training resources for comments and are requiring that each the training will take this into
industry would be to focus the individual engaged in activities in consideration. The standardized
requirement for food defense awareness subpart C must be a qualified individual curriculum for conducting a
training on personnel who are assigned with the appropriate education, vulnerability assessment will need to
to an actionable process step. We do not training, or experience (or a cover each required component of the
believe it is necessary to require that combination thereof) to perform the vulnerability assessment and provide
facilities provide all employees with activity. Further, the rule requires enough information for an individual to
awareness training to significantly increased qualifications for individuals calibrate their decision making based on
minimize or prevent significant responsible for higher level activities, the scientific analysis required by a
vulnerabilities. Although we disagree such as preparation of the food defense vulnerability assessment. We believe
that training all employees could plan, conducting a vulnerability that the curriculum designed for this
diminish the ability of a facility to assessment, identifying and explaining activity will require multiple days and
effectively train personnel, we agree that mitigation strategies, and reanalysis may be best offered in person. Based on
concentrating awareness training on (§ 121.4(c)). These individuals must the vulnerability assessment method
certain individuals is less burdensome have the appropriate education, chosen, the length of the standardized
than a general training requirement. We training, or experience (or a curriculum may vary, for example if a
facility is using the key activity types individual’’ in terms of an ability to varying based on the difficulty and skill
the training could be shorter. perform assigned responsibilities we level of the activity being performed,
Finally, with regard to comments that have provided the flexibility for firms to with the vulnerability assessment
suggest that individuals who prepare, consider relevant factors in determining training module being the most in-depth
monitor, verify, or conduct corrective how often to perform training. and lengthy (See Comment 80 and
actions associated with food defense Individuals conducting activities under Comment 81).
plans receive specialized training, we subpart C must be qualified to The training for individuals and
agree that individuals responsible for successfully implement the food supervisors assigned to actionable
these activities should be qualified defense measures contained in the food process steps may require facility-
individuals and may need training to defense plan. If the food defense plan specific information for proper
perform such activities. However, we changes, because of a production change implementation of the mitigation
are not standardizing a curriculum for resulting in a mitigation strategy change, strategy or strategies and, therefore, will
such training and realize that for example, employees and supervisors need to be developed and administered
individuals may be qualified through may need retraining if their on the job and will not be developed by
education or experience to do these responsibilities under subpart C change. FDA.
activities because these concepts are not Also, retraining may be needed as a We will continue to provide food
completely unique to food defense component of corrective action. For defense training and other materials in
planning and analogous food safety example, if during the course of as many formats as resources allow,
concepts have been in routine practice monitoring a facility determines that such as online, DVD, and hard copy.
in many food facilities for the purpose certain mitigations strategies are not FDA currently has some food defense
of food safety plans and/or HACCP being implemented consistently or materials in languages other than
approaches. appropriately, a component of the English, but will work as we are able
(Comment 99) Some comments state corrective action may be to retrain the towards translating more materials in
that food defense awareness training responsible staff and their supervisors. other languages to reach a broader
should be recognized as a beneficial To ensure that employees remain audience.
mitigation strategy within food defense qualified to perform their duties under In response to the development of a
plans to create heightened awareness subpart C, facilities will need to retrain ‘‘train the trainer’’ course to assist
and that this training can be used to employees when the food defense plan management with meeting the training
address intentional contamination changes and when a problem has been requirements of this rule, we interpret
including insider threats. Other identified that training would address. this comment to mean that we should
comments state that the only (Comment 101) Some comments offer materials so that companies can
requirement for food defense should be commend FDA on the development of a deliver their own food defense
training and that any requirements broad range of free training materials awareness training. Since the
beyond this approach are not necessary. that will be efficient and useful to meet requirement for awareness training has
(Response 99) We agree that food training requirements. Some comments inherent flexibility, facilities can deliver
defense awareness training for suggest updating and expanding these their own food defense awareness
employees and supervisors assigned to trainings to include options for free, trainings. We believe the training tools
actionable process steps would increase downloadable, and customizable and resources that we intend to update,
awareness and could assist with materials to reach a broad range of based on the requirements of this rule,
recognizing or thwarting an insider cultural and language groups, and to will assist facility management with
threat; however, the training alone will include information on how to protect gaining knowledge necessary for
not protect the food at that actionable food defense-related documents. One delivering food defense awareness
process step. It is the properly comment recommends that FDA update training, and we intend to explore the
implemented mitigation strategies, all of its food defense resources to development of a ‘‘train the trainer’’ in
which are designed to reduce the reflect the requirements ultimately consultation with the alliance to meet
significant vulnerability at that step, included in this final rule. One the needs of the standardized
which would protect the food against comment suggests that FDA develop a curriculum requirements.
intentional adulteration. ‘‘train-the-trainer’’ course that could be (Comment 102) Some comments
(Comment 100) Some comments effectively utilized by industry to equip request that FDA support the
recommend that FDA set a requirement management of food companies with the development and distribution of
for periodic retraining, and some training materials needed to comply educational and training resources to
comments suggest the training with the training requirements. assist very small facilities exempt from
requirement should specify training (Response 101) We agree that many of the rule with voluntary compliance.
intervals such as during an employee our trainings and other resources will Some comments request that FDA
‘‘onboarding’’ process and periodically assist industry in complying with this clarify how it will work with retail
thereafter or when significant changes rule. However, we recognize that many stakeholders to strengthen education
are made to the food defense plan. One of our existing materials will need to be and training for retail facilities that want
comment did not request a requirement updated to reflect the provisions of the to take voluntary food defense risk
for retraining but stated that it should be rule and new training materials will reduction measures.
understood that education and training need to be developed. We intend to (Response 102) FDA offers free tools
are not a one-time occurrence. One update our training materials to provide and food defense awareness training, as
comment asked for flexibility for an option to comply with the food well as guidance, that we intend to
training and retraining frequencies so a defense awareness training requirement, update based on the final requirements
facility can take into account facility and we will be developing a which should assist non-covered
size, environment, seasonality of standardized curriculum for training in entities, such as those at the retail level,
employees, and other circumstances. accordance with the requirements of who wish to voluntarily comply with
(Response 100) We agree that training § 121.4(c). We anticipate the the final provisions of this rule.
should not be a one-time occurrence standardized content of the training will (Comment 103) Some comments
and believe that by defining ‘‘qualified be modular, with certain modules support the food defense awareness
training requirement but ask that FDA general, FDA is still in the process of deploy an effective implementation
keep the requirement flexible and make assessing its training needs for plan.
clear that online training or other non- inspection and enforcement of this rule. (Response 108) It is unclear what is
FDA developed trainings are acceptable. (Comment 105) Some comments state meant by training and compliance
One comment asked us to state whether that Alliances have been successfully incentives, but we have established
the ‘‘Food Defense 101’’ training used to support implementation of other extended compliance dates to allow
released in 2013 by FDA is the preferred national requirements, including other facilities the time necessary to comply
resource for employee awareness FSMA rules, using a partnership model. with this training requirement. See
training. Some comments state that it These comments recommend that FDA section VIII for information on
might not be possible to provide the consider formation of an Alliance compliance dates.
same type of training to all staff at structure for the area of food defense as (Comment 109) One comment
various levels, and that it should be up well. Comments state that Alliances, suggests that FDA should mandate
to the facility to determine which made up of State and local public health training on a ‘‘code of ethics’’ to prevent
training to provide to which staff, based professionals, State and local public economically motivated adulteration.
on their food defense responsibilities. health associations, and industry can (Response 109) Acts of intentional
(Response 103) We agree with the play an important role in information adulteration for the purpose of
need to avoid rigid requirements with sharing and outreach and a formal economic gain, i.e., economically
respect to training content for food Alliance for food defense is the best way motivated adulteration, are outside the
defense awareness. We recognize that to accomplish the development of scope of the rule and are addressed in
many food defense awareness trainings standardized food defense training the preventive controls for human food
exist and may already be utilized at content and effective training tools and rule (80 FR 55907 at 56028–56029) and
facilities, and mandating specific resources. the preventive controls for animal food
content in trainings may lead to (Response 105) We agree with these final rule (80 FR 56170 at 56244–56246).
redundancy and additional cost. We comments and have funded the
intend to update our ‘‘Food Defense establishment of an Intentional VI. Subpart D: Comments on
101, Food Defense Awareness for the Adulteration Subcommittee under the Requirements Applying to Records
Front-line Employee’’ training such that existing Food Safety Preventive Controls That Must Be Established and
it would satisfy the requirement for food Alliance. We intend to leverage the Maintained
defense awareness training; however, it expertise of State and local public We proposed to establish in subpart D
is not the only acceptable training. In health professionals, State and local requirements that would apply to all
addition, we believe that there are public health associations, and industry records that would be required by the
several existing trainings that would be associations to develop the standardized various provisions of proposed part 121,
acceptable for other activities that may curriculum needed to meet the training including general requirements related
require training such as food defense requirement. to the content and form of records,
monitoring, food defense corrective (Comment 106) Some comments additional requirements specific to the
actions, and food defense verification. suggest that FDA establish a technical food defense plan, requirements for
(Comment 104) Some comments assistance office based out of the Center record retention, requirements for
recommend that, because food defense for Food Safety and Applied Nutrition official review of records by FDA, and
is a new and evolving area, and because (CFSAN) that can answer queries, public disclosure.
this regulation will be the first of its provide guidance, and release Some comments generally support
kind worldwide, training and education information consistently to both requiring records to demonstrate that a
need to occur at many levels to regulators and the covered industry to food defense plan has been created, is
effectively implement this rule. These assist with educating industry and functioning, and is being monitored.
comments state that FDA must provide regulators. However, many comments disagreed
significant outreach and education to (Response 106) FDA has established a with some of the specific requirements
both industry and State regulatory FSMA Technical Assistance Network that we proposed. In the following
Agencies with jurisdiction over the (TAN) to provide technical assistance to paragraphs, we discuss comments that
production of human food. These industry, regulators, academia, ask us to clarify the proposed
comments emphasize that FDA and consumers, and others regarding FSMA requirements, disagree with, or suggest
State and local inspection personnel implementation. Inquiries are answered one or more changes to the proposed
will need significant training in by FDA Information Specialists or requirements.
conducting food defense inspections Subject Matter Experts, based on the
and that training developed for FDA complexity of the question. To find out A. Proposed § 121.301—Records Subject
investigators should be extended to more about the FSMA TAN please visit to the Requirements of This Subpart D
State and local governments as well as http://www.fda.gov/food/guidance We proposed that all records required
industry to help food facilities regulation/fsma/ucm459719.htm. by proposed subpart C (Food Defense
understand what is expected and how (Comment 107) Some comments Measures) are subject to all
compliance will be determined. request funding from FDA for the requirements of this subpart except that
(Response 104) We appreciate these training of State, local, tribal, and the requirements of § 121.310 apply
comments regarding consistency of territorial regulators. only to the written food defense plan.
training between industry and Federal, (Response 107) Funding associated We received no comments on this
State, local and tribal regulators, and we with training State, local, tribal, and section and are finalizing as proposed.
agree that this is a novel area of territorial regulators is outside the scope
regulation that could benefit from of this rule. B. Proposed § 121.305—General
alignment of training between the (Comment 108) One comment asserts Requirements Applying to Records
regulated industry and its regulators. that training and compliance incentives We proposed that the records must (1)
We have addressed the issue of training must be available at the same time the be kept as original records, true copies,
for the purposes of inspection and final regulation is released to give or electronic records (and that electronic
compliance in section III.D, but in facilities time to learn about, build, and records must be kept in accordance with
part 11 (21 CFR part 11)); (2) contain the approving. The comment requests that (Comment 113) Some comments
actual values and observations obtained we provide for the creation of records express concern that we will require
during monitoring; (3) be accurate, ‘‘in a timely manner following records to be kept in English. These
indelible, and legible; (4) be created performance of the activity,’’ rather than comments ask us to limit the documents
concurrently with performance of the ‘‘concurrently with performance of the that must be written in English to
activity documented; (5) be as detailed activity.’’ reduce translation and records
as necessary to provide history of work (Response 111) We decline this duplication. These comments ask that
performed; and (6) include the name request. The comment did not provide records related to verification and
and location of the plant or facility, the any specific examples of activities monitoring should be allowed to be
date and time of the activity where concurrent record creation would written in languages other than English.
documented, the signature or initials of prove difficult, and we are not aware of (Response 113) The rule does not
the person performing the activity, and, any such circumstance. For example, we require that any records be kept in
where appropriate, the identity of the are not aware of any difficulty English.
product and the production code, if any. complying with longstanding similar (Comment 114) One comment seeks
In the following paragraphs, we discuss requirements associated with our clarification on whether the use of
comments that ask us to clarify the HACCP regulations for seafood and checklist-type forms to document
proposed requirements or that disagree juice (see §§ 123.9(a)(4) and monitoring observations would satisfy
with, or suggest one or more changes to, 120.12(b)(4), respectively). the requirement in § 121.305(b) that
the proposed requirements. records contain actual values and
(Comment 112) Some comments
(Comment 110) Several comments observations obtained during
assert that for certain production and
express concern over the proposed monitoring. The comment argues that
associated activities documenting the
requirement that all electronic records properly developed checklists will
time of activity is not necessary.
be kept in accordance with part 11 and allow monitoring records to be accurate,
Specific examples cited include
request that FDA exempt electronic indelible, and legible as required in
equipment setup, verification of
records under part 121 from compliance § 121.305(c) and will lessen the
equipment setup, charging an ingredient
with part 11. Comments argue that recordkeeping burden. For example,
into a blender, and weighing material
while some of the larger companies may monitoring a mitigation strategy such as
for process yield and reconciliation adequate lighting at the truck unloading
have the technologies in place to
purposes. These comments ask us to bay could be recorded as a ‘‘yes’’ or
comply with part 11, many of the
modify the proposed requirements so ‘‘no’’ by checking the appropriate box
covered facilities do not. These
that the records would only be required on a checklist.
comments assert that compliance with
to include the time of the activity where (Response 114) Although monitoring
part 11 would create the need to
appropriate for food defense. records must contain the actual values
redesign and recreate existing systems,
thus leading to considerable cost, which (Response 112) The recordkeeping and observations obtained during
was not taken into account in the cost requirements in the rule only apply to monitoring, facilities have flexibility to
analysis in the preliminary regulatory records required by subpart C (Food tailor the amount of detail to the nature
analysis for the proposed rule. The defense measures). It is not clear that all of the record (§ 121.305(e)). Monitoring
comments go on to point out that we do of the activities specified by the for adequate lighting at the truck
not impose these requirements for comments relate to food defense unloading bay could be recorded as
recordkeeping requirements imposed measures and therefore are subject to ‘‘yes’’ or ‘‘no’’ in either a narrative or
under section 414 of the FD&C Act, and the recordkeeping requirements in the checklist format. However, in the case of
that this requirement is an added rule. For records that are required, we an improperly implemented mitigation
burden and expense that does not have agree that documenting the time of the strategy, we would recommend that the
any added benefit to public health. activity is not always necessary. The facility also document the extent to
(Response 110) The final rule does not rule requires that records must contain which the strategy was incorrectly
require compliance with part 11 ‘‘when appropriate, the time of the applied, because this information would
(§ 121.305 (a)). Similar to the PCHF final activity documented’’ (§ 121.305(f)(2)). support the identification of previously
rule, we are making a conforming Monitoring records are an example of written corrective actions that could be
change in part 11 to specify in new when documenting the time of the used to remedy the situation, as well as
§ 11.1(o) that part 11 does not apply to activity is appropriate because provide context as to why the mitigation
records required to be established or monitoring records are used to strategy failed in this instance, which
maintained under part 121, and that determine if a particular mitigation would be beneficial information for
records that satisfy the requirements of strategy is properly implemented. verification activities. For example, if
part 121, but that also are required Without documenting the time the lighting in the bulk unloading bay was
under other applicable statutory monitoring was conducted, a facility insufficient, the monitoring document
provisions or regulations, remain cannot identify patterns over time as to may record this instance as ‘‘no’’ in a
subject to part 11. Although we are not the mitigation strategy’s implementation checklist and also may note that half of
specifying that part 11 applies, facilities and whether appropriate corrective the lights were inoperative due to a
should take appropriate measures to actions were being made. For circuit-breaker that failed. This
ensure that records are trustworthy, mitigations strategies that are not time- information would be helpful to facility
reliable, and generally equivalent to dependent (e.g., permanent equipment management to determine whether the
paper records and handwritten changes to reduce access to the product, mitigation strategy is consistently
signatures executed on paper. such as permanently affixing a shield to applied and appropriate to the
(Comment 111) One comment asserts the rotating air drying to prevent access actionable process step in question. In
that while it is common for certain to the food at the point where product this case, a faulty circuit breaker would
records to be created concurrently with is introduced into the dryer from the be replaced, thereby correcting the
performance of the activity, some pneumatic conveyance), facilities are deviation in the mitigation strategy. The
records may require more time for not required to document the time the mitigation strategy could still be
writing, reviewing, editing, or activity was performed. determined to be achieving its aim with
this corrective action. Alternatively, if retention requirements for the purpose provided onsite within 24 hours would
monitoring records document that the of tracking potentially contaminated be sufficient.
lighting was turned off by an employee, food than to record retention (Response 117) We have revised the
a different corrective action may be requirements for the purpose of provisions to provide for offsite storage
required, such as retraining of the evaluating compliance with this rule. of all records (except the food defense
employee on the importance of Finally, 2 years is the same retention plan), provided that the records can be
maintaining adequate lighting in the period as required by the PCHF final retrieved and made available to us
area. We note in Response 83 that rule. within 24 hours of a request for official
ensuring adequate lighting around an (Comment 116) Some comments ask review. We expect that many records
actionable process step would generally us to exercise flexibility regarding the 2- will be electronic records that are
be a mitigation strategy that must be year record retention requirement accessible from an onsite location and,
used in concert with other strategies to because the unique nature of food thus, would be classified as being onsite
significantly reduce the likelihood of, or defense activities and the technologies (see § 121.315(c)). As a companion
prevent, successful acts of intentional used in protecting the food supply change, we have revised the proposed
adulteration at an actionable process against intentional adulteration do not provision directed to the special
step. typically allow for record retention for circumstance of storing records when a
such a long period of time. For example, facility is closed for prolonged periods
C. Proposed § 121.310—Additional several comments explain that records of time so that it only relates to the
Requirements Applying to the Food related to video surveillance cannot be offsite storage of the food defense plan
Defense Plan kept for 2 years because it is in such circumstances (see
We proposed that the food defense impractical; industry practice is § 121.315(d)). Further, we require
plan must be signed and dated by the typically to keep video records for 30 records that a facility relies on during
owner, operator, or agent in charge of days or less. Comments argue that the 3-year period preceding the
the facility upon initial completion and requiring 2-year retention of video applicable calendar year to support its
upon any modification. We did not records would be very difficult and status as exempt as a very small
receive any comments related to this costly, and that FDA likely did not business must be retained at the facility
section, and we are finalizing as include calculations for those added as long as necessary to support the
proposed. costs in our preliminary regulatory status of a facility as a very small
D. Proposed § 121.315—Requirements impact analysis for the proposed rule. business during the applicable calendar
(Response 116) The assertion that it is year (see § 121.315(a)(2)).
for Record Retention
impractical for food defense records (Comment 118) One comment states
We proposed that (1) All required cannot be kept for 2 years seems to that records and documentation should
records must be retained at the facility reflect a misunderstanding of the rule. not increase costs for farm-based
for at least 2 years after the date they The rule does not require maintaining operations, most of whom operate as
were prepared; (2) The food defense video surveillance footage for 2 years. small businesses. They argue that these
plan must be retained at the facility for Video surveillance used as part of a businesses already maintain a variety of
at least 2 years after its use is mitigation strategy is not a monitoring records but some do not have the
discontinued; (3) Except for the food record. If the video is being sent to a technical or financial resources
defense plan, offsite storage of records is security office for observation, the available to maintain an electronic
permitted after 6 months following the monitoring record could be a log system for records. The comment
date that the records were made if such affirming that a security officer requests that FDA accept records in
records can be retrieved and provided reviewed the video and detected no formats that are not electronic.
onsite within 24 hours of request for abnormal activities. If the video is being (Response 118) To clarify, we did not
official review; and (4) If the facility is watched by a security officer in real propose to require that any records must
closed for a prolonged period, the time, the monitoring record could be the be kept in electronic format. In addition,
records may be transferred to some timesheets of the security officer this rule does not apply to farms.
other reasonably accessible location but showing he was in the security office
must be returned to the plant or facility performing his duties in observing the E. Proposed § 121.320—Requirements
within 24 hours for official review upon video feed. for Official Review
request. (Comment 117) Some comments ask We proposed that all records required
(Comment 115) One comment asserts us to specify our expectations for record by this part must be made promptly
that a 2-year retention period for availability and allow companies the available to a duly authorized
monitoring, corrective actions, and flexibility in using technology to meet representative of the Secretary of Health
verification records for a product with a those expectations. The comments and Human Services upon oral or
short shelf life is unnecessary. The explain that many companies keep written request. In the following
comment argues that industry has been important records such as food defense paragraphs, we discuss comments that
following record retention requirements plans at their corporate headquarters or ask us to clarify the proposed
in the Seafood HACCP regulation which other central locations and not at requirements or that disagree with, or
requires 1 year records retention for individual facilities but that the suggest one or more changes to, the
refrigerated products and 2 years facilities can easily access those records proposed requirements.
records retention for frozen, preserved, electronically if needed. The comments (Comment 119) Some comments
or shelf-stable products and requests also assert that 6-month onsite record assert that FDA investigators should
that we use the same requirements in retention requirement is arbitrary and only review food defense plans on site
this rule. that FDA should establish a workable and that we should not copy,
(Response 115) We decline this requirement that provides for the photograph, transmit, or take possession
request. The 2-year record retention efficient storage and retrieval of records of food defense plans. These comments
period is explicitly provided for by in a timely manner. Some comments ask assert that onsite review of records
section 418(g) of the FD&C Act. Further, us to revise the requirement so that allows facility staff that is familiar with
shelf life is more relevant to record records that can be retrieved and the documents and recordkeeping
practices to answer any questions or protecting food defense records from authority to copy food defense plans or
provide clarification to the investigator. disclosure. records.
Some comments state that we should (Comment 121) One comment asserts (Response 122) As we described in
make it clear that any State investigators that section 106 of FSMA does not give the seafood HACCP rule (60 FR 65096
must follow the same policy and not FDA express access to review food at 65101, December 18, 1995), to
copy, photograph, transmit, or take defense plans and that FSMA indicates effectuate the broad purposes of the
possession of food defense plans. Other a Congressional intent to limit the FD&C Act, there may be some
comments assert that we should only distribution of certain materials related circumstances in which access to the
take possession of food defense plans to food defense. records would be meaningless without
for compliance reasons or in the event (Response 121) The provisions in the opportunity to copy them, and
of an emergency or a credible threat. section 106 of FSMA concerning limited therefore copying records is necessary
(Response 119) Some of the issues distribution relate to the ability of the for the efficient enforcement of the
raised by these comments are similar to Secretary of HHS (and by delegation, FD&C Act. For further discussion of
issues raised by comments on the PCHF FDA) to limit the distribution of certain copying records, see response to
rule (see the discussion at 80 FR 55908 information already in the Agency’s Comment 121.
at 56091) and seafood HACCP rule (see possession. Specifically, section F. Proposed § 121.325—Public
the discussion at 60 FR 65096 at 65137– 420(a)(2) of the FD&C Act authorizes Disclosure
65140, December 18, 1995). During an FDA to determine the time, manner, and
inspection, we expect that FDA We proposed that records required by
form in which a vulnerability
investigators will determine whether to this part will be protected from public
assessment is made publically available.
copy records on a case-by-case basis as disclosure to the extent allowable under
Further, section 420(b)(3) provides for
necessary and appropriate. It may be part 20 of this chapter. We received
FDA to determine the time, manner, and
necessary to copy records when, for numerous comments expressing
form in which certain guidance concern with protecting food defense
example, our investigators need documents are made public. The
assistance in reviewing a certain record plans and records from public
provisions do not limit FDA’s authority disclosure, especially due to the
from relevant experts in headquarters. If to access information in a facility’s
we are unable to copy records, we sensitive nature of the content within a
possession, such as a food defense plan. food defense plan. One comment fully
would have to rely solely on our
Further, the ability of FDA to review supports our proposal and believes
investigators’ notes and reports when
food defense plans is necessary for the there is sufficient precedent and need to
drawing conclusions. In addition,
efficient enforcement of the FD&C Act. protect the sensitive documents from
copying records will facilitate follow-up
The rule requires a food defense plan public disclosure. In the following
regulatory actions. The public
consisting of a written vulnerability paragraphs, we discuss comments that
availability of any records that FDA
assessment, mitigation strategies, and ask us to clarify the proposed
would possess as a result of copying
procedures for food defense monitoring, requirements or that disagree with, or
during an inspection would be governed
corrective actions, and verification. suggest one or more changes to, the
by section 301(j) of the FD&C Act and
Access to food defense plans is proposed requirements.
by the Freedom of Information Act
(FOIA) and regulations issued pursuant necessary for FDA to assess the (Comment 123) Some comments
to it by the Department of Health and adequacy of each of these documents assert that food defense plans include
Human Services (DHHS) and FDA. and determine compliance with the information that is commercial
Section 301(j) of the FD&C Act expressly rule. For example, to assess compliance confidential or trade secret and,
prohibits FDA from disclosing trade with § 121.130(a), FDA must review a therefore, should be exempt from
secret information obtained during the facility’s vulnerability assessment to disclosure under FOIA. The comments
course of an inspection. FDA’s determine whether it includes an argue that food defense plans may
disclosure regulations also provide that evaluation of the potential public health include information on a facility’s food
FDA will not divulge either trade secret impact if a contaminant were added, the defense-related measures and that
or confidential commercial information. degree of physical access to the product, disclosure of one facility’s food defense
See section VI.F. for a further discussion and the ability of an attacker to plan may adversely affect other facilities
of protecting food defense records from successfully contaminated the product. and companies that may process similar
disclosure. In addition to section 420 (added to foods or have similar processing
(Comment 120) Some comments the FD&C Act by section 106 of FSMA), procedures.
assert that FDA investigators should not FDA is issuing this rule under the (Response 123) FDA protects records
include details of food defense plans in authority of section 418 of the FD&C from disclosure under Exemption 4 of
the Establishment Inspection Reports Act. Section 418 explicitly provides FOIA to the extent they contain ‘‘trade
(EIR) Form 483 and that food defense authority for FDA access to certain secrets’’ or ‘‘commercial or financial
information should be kept separate documents. Under section 418, the information obtained from a person and
from food safety information on FDA required ‘‘written plan, together with privileged or confidential.’’ The
reports. The comments argue that if the documentation of [monitoring, questions raised in these comments are
investigators include food defense- instances of nonconformance, the similar to some of the questions raised
related noncompliance on an official results of testing and other appropriate during the rulemaking to establish our
report, that report could become public means of verification, instances where HACCP regulation for seafood (see the
and could increase the risk to public corrective actions were implemented, discussion at 60 FR 65096 at 65137–
health by disclosing weak points in a and the efficacy of preventive controls 65140). Our experience in conducting
facility’s food defense plan. and corrective actions] shall be made CGMP inspections in processing plants,
(Response 120) As we do now, FDA promptly available to [FDA] upon oral our experience with enforcing our
would redact any protected information or written request.’’ HACCP regulations for seafood and
in an EIR or other document before (Comment 122) One comment asserts juice, and our understanding from the
publically releasing the document. See that neither section 103 nor 106 of Regulatory Impact Analysis for this rule
section VI.F for further discussion of FSMA expressly provide FDA with the make it clear that food defense plans
will take each facility time and money and to help plan and execute an attack disclosure are not aligned with the
to develop. involving intentional adulteration. public disclosure provisions of our
There is value in a plan to a company (Comment 125) Some comments state HACCP regulations for seafood and
that produces it for no other reason than that food defense plans could be juice. Our regulations in part 20
that it took work to write. The equity in classified under Executive Order 13526 regarding public information apply to
such a product is not readily given away because their unauthorized disclosure all Agency records, regardless of
to competitors. We expect that plant could reasonably be expected to cause whether a particular recordkeeping
configurations will be unique to identifiable or describable damage to requirement says so. In the public
individual processors, or at least have national security and because food disclosure provisions for our HACCP
unique features, as was the case in the defense plans pertain to ‘‘vulnerabilities regulations for seafood and juice, we
seafood industry (Ref. 16). While or capabilities of systems, installations, provided specific details about how
generic plans will have great utility in infrastructures, projects, plans, or particular provisions in part 20 (i.e.,
many circumstances, they will serve protection services relating to national § 20.61 (Trade secrets and commercial
primarily as starting points for facilities security.’’ These comments or financial information which is
to develop their own plans. Facilities acknowledge that classifying food privileged or confidential) and § 20.81
will still need to expend time and defense plans would be cumbersome (Data and information previously
money to tailor a generic food defense and access to the classified documents disclosed to the public)) would apply to
plan to their individual circumstances. would be extremely restricted and the applicable records, because we
Thus, we conclude that food defense therefore, they recommend that FDA recognized that such details were of
plans generally will meet the definition implement a policy that FDA particular interest to the regulated
of trade secret, including the court’s investigators not copy, photograph, or industries and such recordkeeping
definition in Public Citizen Health transmit any food defense plan records requirements were relatively new. In
Research Group v. FDA, 704 F.2d 1280 or make detailed notes about the food this rule, we framed the provisions
(D.C. Cir. 1983). defense plans in the Establishment regarding public disclosure more
(Comment 124) Some comments ask Inspection Reports that could reveal broadly by referring to all the
us to provide assurances that food sensitive information. requirements of part 20, consistent with
defense plans and related records will (Response 125) See response to our more recent approach to public
not be made public and assert that Comment 124 for a discussion of FDA disclosure provisions in regulations (see
protecting these documents from handling of food defense plans. We note e.g., 21 CFR 112.167, 117.325).
disclosure to the extent allowable under that FDA cannot classify food defense (Comment 128) Some comments
part 20 may not be sufficient. They plans under Executive Order 13526. assert that FDA should develop
argue that food defense plans are more That executive order provides that guidance and training for industry on
sensitive than food safety plans because information may be originally classified how to protect food defense-related
food defense plans contain specifics on only if several conditions are met, documents because industry is
a facility’s vulnerabilities and how they including that the information is owned developing these documents to meet an
protect those vulnerabilities, and as by, produced by or for, or is under the FDA requirement and has a potential to
such, could provide a ‘‘road map’’ for control of the U.S. Government. A food increase the risk to public health.
individuals intending to cause harm. defense plan that is developed by (Response 128) Our implementation
These comments state that FDA should industry for use by industry is not of this rule will involve a broad,
be more protective of food defense plans owned by, produced by or for, or under collaborative effort to foster awareness
and argue that due to the sensitivity of the control of, the U.S. Government. and compliance through guidance,
information contained in food defense (Comment 126) One comment education, and technical assistance. We
plans, it is too risky to rely on FOIA suggests that FDA only allow agree that protection of food defense
exemptions alone. investigators who have the appropriate plans—by FDA and by industry—is
(Response 124) We agree that food national security credentials (e.g., important; we plan on including
defense plans contains information that background checks, security clearances) information within guidance for
presents sensitivities not likely to be to review the content of a food defense industry on best practices for how to
present in food safety plans. Exemption plan. The comment asserts that this will protect food defense plans.
7(F) of FOIA allows Agencies to help prevent the risk of a sophisticated
withhold ‘‘records or information G. Proposed § 121.330—Use of Existing
insider attack by a potential wrongdoer Records
compiled for law enforcement purposes who has infiltrated the Agency.
. . . to the extent that production of (Response 126) All FDA investigators We are adding new section § 121.330
such law enforcement records or and contracted State investigators are (Use of Existing Records) to the final
information . . . could reasonably be required to undergo background checks rule to increase recordkeeping
expected to endanger the life or physical by the Federal government prior to flexibility. Section 121.330 specifies
safety of any individual.’’ Food defense employment and periodically thereafter. that existing records (e.g., records that
plans are likely to meet the criteria to Food defense plans are not classified, are kept to comply with other Federal,
withhold them from disclosure under and therefore FDA investigators would State, or local regulations) do not need
exemption 7(F). Food defense plans in not need national security clearances. to be duplicated if they contain all of
FDA’s possession would be compiled (Comment 127) Some comments state the required information and satisfy the
for law enforcement purposes because that FDA should, at a minimum, be requirements of subpart D. Section
they would be collected as part of aligned with and apply the same 121.330 also provides that existing
compliance efforts. Further, production protection for food defense plans and records may be supplemented as
of such records could reasonably be records required under this part as necessary to include all of the required
expected to endanger life or physical HACCP seafood and juice regulations information. Further, § 121.330 clarifies
safety. Specifically, a food defense plan (see §§ 123.9(d) and 120.12(f), that the information required does not
is likely to contain information that respectively). need to be kept in one set of records; if
could be used to identify weaknesses in (Response 127) We disagree that the existing records contain some of the
a facility’s security, to choose targets, proposed provisions governing public required information, any new
information required may be kept either have 3 years after the effective date to The Small Business Regulatory
separately or combined with the comply with part 121. Small businesses Enforcement Fairness Act of 1996 (Pub.
existing records. (i.e., those employing fewer than 500 L. 104–121) defines a major rule for the
full-time equivalent employees) have 4 purpose of congressional review as
VII. Subpart E: Comments on
years after the effective date to comply having caused or being likely to cause
Compliance—Proposed § 121.401 one or more of the following: An annual
with part 121. Very small businesses
1. Proposed § 121.401(a)—Failure To (i.e., businesses that have less than effect on the economy of $100 million
Comply With Section 418 of the FD&C $10,000,000, adjusted for inflation, per or more; a major increase in costs or
Act year, during the 3-year period preceding prices; significant adverse effects on
the applicable calendar year in both competition, employment, productivity,
We proposed that the operation of a
sales of human food plus the market or innovation; or significant adverse
facility that manufactures, processes,
value of human food manufactured, effects on the ability of U.S.-based
packs, or holds food for sale in the
processed, packed, or held without sale) enterprises to compete with foreign-
United States if the owner, operator, or
have 5 years after the effective date to based enterprises in domestic or export
agent in charge of such facility is
comply with § 121.5(a). markets. In accordance with the Small
required to comply with, and is not in Business Regulatory Enforcement
compliance with, section 418 of the IX. Executive Order 13175 Fairness Act, the Office of Management
FD&C Act or subparts C or D of this part and Budget (OMB) has determined that
is a prohibited act under section 301(uu) In accordance with Executive Order
13175, FDA has consulted with tribal this rule is a major rule for the purpose
of the FD&C Act. of Congressional review.
We did not receive any comments on government officials. A Tribal Summary
Impact Statement has been prepared The Unfunded Mandates Reform Act
this provision, and we are finalizing as of 1995 (section 202(a)) requires us to
proposed. that includes a summary of Tribal
officials’ concerns and how FDA has prepare a written statement, which
2. Proposed § 121.401(b)—Failure To addressed them (Ref. 17). Persons with includes an assessment of anticipated
Comply With Section 420 of the FD&C access to the Internet may obtain the costs and benefits, before proposing
Act Tribal Summary Impact Statement at ‘‘any rule that includes any Federal
http://www.fda.gov/Food/Guidance mandate that may result in the
We proposed that the failure to expenditure by State, local, and tribal
comply with section 420 of the FD&C Regulation/FSMA/ucm378628 or at
http://www.regulations.gov. Copies of governments, in the aggregate, or by the
Act or subparts C or D of this part is a private sector, of $100,000,000 or more
prohibited act under section 301(ww) of the Tribal Summary Impact Statement
also may be obtained by contacting the (adjusted annually for inflation) in any
the FD&C Act. one year.’’ The current threshold after
We did not receive any comments on person listed under FOR FURTHER
INFORMATION CONTACT.
adjustment for inflation is $144 million,
this provision, and we are finalizing as using the most current (2014) Implicit
proposed. X. Final Regulatory Impact Analysis Price Deflator for the Gross Domestic
VIII. Effective and Compliance Dates Product. This final rule may result in a
We have examined the impacts of the
1-year expenditure that would meet or
We proposed the effective date would final rule under Executive Order 12866,
exceed this amount.
be 60 days after this final rule is Executive Order 13563, the Regulatory
published. However, we proposed for a Flexibility Act (5 U.S.C. 601–612), and XI. Paperwork Reduction Act of 1995
longer timeline for facilities to come the Unfunded Mandates Reform Act of This rule contains information
into compliance. As proposed, facilities, 1995 (Pub. L. 104–4). Executive Orders collection requirements that are subject
other than small and very small 12866 and 13563 direct Agencies to to review by the OMB under the
businesses, would have 1 year after the assess all costs and benefits of available Paperwork Reduction Act of 1995 (PRA)
effective date to comply with part 121. regulatory alternatives and, when (44 U.S.C. 3501–3521). A description of
Small businesses (i.e., those employing regulation is necessary, to select these provisions is given in this section
fewer than 500 persons) would have 2 regulatory approaches that maximize with an estimate of the annual reporting
years after the effective date to comply net benefits (including potential and recordkeeping burden; there is no
with part 121. Very small businesses economic, environmental, public health third-party disclosure burden associated
(i.e., businesses that have less than and safety, and other advantages; with the information collection.
$10,000,000 in total annual sales of distributive impacts; and equity). We Included in the estimate is the time for
food, adjusted for inflation) would have have developed a comprehensive reviewing instructions, searching
3 years after the effective date to comply Economic Analysis of Impacts that existing data sources, gathering and
with § 121.5(a). assesses the impacts of the final rule. maintaining the data needed, and
Some comments express concern that We believe that this final rule is a completing and reviewing each
facilities will not have the time or significant regulatory action under collection of information.
resources to implement requirements for Executive Order 12866. Title: Mitigation Strategies to Protect
the intentional adulteration rule at the The Regulatory Flexibility Act Food Against Intentional Adulteration
same time they must comply with other requires us to analyze regulatory options Description: The Food and Drug
FSMA rules. Some comments also state that would minimize any significant Administration (FDA or we) is requiring
that more time is necessary to comply impact of a rule on small entities. The domestic and foreign food facilities that
with this rule because food defense is annualized costs per entity due to this are required to register under the
different from current requirements for rule are about $13,000 for a one-facility Federal Food, Drug, and Cosmetic Act to
food safety. These comments request firm with 100 employees, and there are address hazards that may be introduced
additional time for compliance. about 4,100 small businesses that would with the intention to cause wide scale
We agree with the comments and are be affected by the rule, so we tentatively public health harm. These food facilities
providing more time for facilities to conclude that the final rule could have are required to identify and implement
come into compliance. Facilities, other a significant economic impact on a mitigation strategies that significantly
than small and very small businesses, substantial number of small entities. minimize or prevent significant
vulnerabilities identified at actionable show documentation of their exemption very small business’’ is required to
process steps in a food operation. FDA status under the rule, upon request. provide for official review, upon
is promulgating these requirements as In the Federal Register of December request, documentation that was relied
part of our implementation of the FDA 24, 2013, FDA published a proposed upon to demonstrate that the facility
Food Safety Modernization Act (FSMA). rule including a PRA analysis of the meets this exemption. At this time we
We expect the rule to help protect food information collection provisions found estimate there are 18,080 firms with less
from acts of intentional adulteration in the regulations. While FDA did not than $10 million in annual sales,
intended to cause wide scale public receive specific comments in response exempting them from the rule. However,
health harm. to the four information collection topics
these facilities must show
solicited, comments in response to the
Description of Respondents: documentation upon request to verify
rule are addressed elsewhere in this
Respondents to the collection are food their exempt status under the
document. Comments filed in response
production facilities with more than $10 to the rulemaking are filed under Docket regulations (§ 121.5(a)). We estimate
million in annual sales. We estimate No. FDA–2013–N–1425. preparing and updating relevant files
there are 9,759 such facilities owned by We estimate the burden for this will require an average of 30 minutes
3,247 firms. We estimate there are information collection as follows: per respondent for a total annual burden
18,080 facilities with less than $10 Reporting: The rule does not apply to of 9,040 hours (30 minutes × 18,080), as
million in annual sales that will need to very small businesses, except that ‘‘a reflected in table 4.
TABLE 4—ESTIMATED ANNUAL REPORTING BURDEN 1

Number of
Number of Total annual Average burden per
21 CFR Section; activity responses per Total hours
respondents responses response
respondent
§ 121.5; Exemption for food from very small businesses 18,080 1 1 0.50 (30 minutes) 9,040
1 There are no capital costs, or operating and maintenance costs associated with this collection.
Recordkeeping: Under the rule, the defense monitoring; written procedures 409,486 annual responses. This is a
owner, operator, or agent in charge of a for food defense corrective actions; and revision from our previous estimate,
facility must prepare, or have prepared, written procedures for food defense reflecting a slight decrease in burden
and implement a written food defense verification. Table 5 shows the hours as a result of finalizing regulatory
plan, including a written vulnerability estimated recordkeeping burden requirements from the proposed rule
assessment; written mitigation associated with these activities, totaling and revising the number of estimated
strategies; written procedures for 2,515,258 annual burden hours and respondents.
TABLE 5—ESTIMATED ANNUAL RECORDKEEPING BURDEN 1

Number of Average
Number of Total annual
21 CFR Section; activity records per burden per Total hours
recordkeepers records
recordkeeper recordkeeping
Food Defense Plan; § 121.126 ........................................ 3,247 1 3,247 23 hrs ........................ 74,681
Vulnerability Assessment; § 121.130 ............................... 9,759 1 9,759 20 hrs ........................ 195,180
Mitigation Strategies; § 121.135(b) .................................. 9,759 1 9,759 20 hrs ........................ 195,180
Monitoring, Corrective Actions, Verification; 9,759 1 9,759 175 hrs ...................... 1,707,825
§ 121.140(a), § 121.145(a)(1), § 121.150(b).
Training; § 121.4 .............................................................. 367,203 1 367,203 0.67 hrs. (40 minutes) 244,802
Records; § 121.305, § 121.310 ........................................ 9,759 1 9,759 10 hrs ........................ 97,590
Total .......................................................................... ........................ ........................ 409,486 .................................... 2,515,258

1 Costs of compliance are discussed in the Final Regulatory Impact Analysis to this final rule.
We estimate 3,247 firms will need to manager will need 20 hours for this minimized or prevented, ensuring that
create a food defense plan under activity, as reflected in table 5, row 2. the food manufactured, processed,
§ 121.126, that a one-time burden of 50 At the same time we note that this is a packed, or held by the facility will not
hours will be needed to create such a one-time burden we expect will have be adulterated. The rule does not
plan, and that a burden of 10 hours will been realized upon implementation of specify a specific number or set of
be required to update the plan. We the rule by the affected facilities. In our mitigation strategies to be implemented.
annualize this estimate by dividing the subsequent evaluation of the burden Some of the covered facilities are
total number of burden hours (70 hours) associated with this information already implementing mitigation
over a 3-year period, as reflected in table collection provision, we will adjust our strategies. We estimate it will require an
5, row 1. estimate accordingly. average of 20 hours per facility to satisfy

Under § 121.130, each of the Under § 121.135(b), each of the the recordkeeping burden associated
estimated 9,759 food production estimated 9,759 facilities must identify with these activities for a total of
facilities will identify and specify and implement mitigation strategies for 195,180 hours, as reflected in table 5,
actionable process steps for its food each actionable process step to provide row 3.
defense plan. We estimate that an assurances that any significant We estimate that the recordkeeping
individual at the level of an operations vulnerability at each step is significantly activities associated with monitoring,
documenting mitigation strategies, XIV. References gfsifiles/information-kit/GFSI_Guidance_

implementing necessary corrective Document.pdf), 2012.
actions, and verification activities will The following references are on 11. Safe Quality Food Institute. ‘‘SQF Code:
require first-line supervisors or others display in the Division of Dockets A HACCP-Based Supplier Assurance
Management (HFA–305), Food and Drug Code for the Food Industry, Edition 7.1’’
responsible for quality control an April 2013.
average of 175 hours for each Administration, 5630 Fishers Lane, Rm.
1061, Rockville, MD 20852, and are 12. International Featured Standards. ‘‘IFS
recordkeeper, and that these provisions Food: Standard for Auditing Quality and
apply to each of the 9,759 facilities. This available for viewing by interested
Food Safety of Food Products, Version
results in a total of 1,707,825 annual persons between 9 a.m. and 4 p.m., 6.’’ (http://www.ifscertification.com/
burden hours, as reflected in table 5, Monday through Friday; they are also images/ifs_standards/ifs6/IFS_Food_V6_
row 4. available electronically at http:// en.pdf) January 2012. Accessed
www.regulations.gov. FDA has verified November 10, 2015.
We estimate that recordkeeping
the Web site addresses, as of the date 13. Hamilton, P.J., ‘‘Center for Food Safety,
activities associated with training under et al. v. Margaret A. Hamburg, M.D.
this document publishes in the Federal
§ 121.4 total 244,802 annual burden Order Granting Injunctive Relief.’’
Register, but Web sites are subject to
hours, as reflected in table 5, row 5. United States District Court Northern
change over time.
This figure assumes that there are an District of California. http://www.center
estimated 1.2 million employees 1. FDA Memorandum. ‘‘FDA Memorandum forfoodsafety.org/files/fsma-remedy-
working at the regulated facilities and to Dockets on Records of Outreach. See order_52466.pdf, June 21, 2013.
that 30 percent of them (367,203) will Reference 7 to the 2014 supplemental 14. FDA. ‘‘Mitigation Strategies to Protect
human preventive controls notice,’’ Food Against Intentional Adulteration:
require training. This figure also 2013.
assumes that the average burden for the Regulatory Impact Analysis, Regulatory
2. FDA Memorandum. ‘‘Memoranda of Flexibility Analysis, and Unfunded
associated recordkeeping activity is Outreach,’’ 2015. Mandates Reform Act Analysis,’’ 2016.
approximately 40 minutes (or 0.67 3. FDA. ‘‘Appendix 3 to the Final Qualitative 15. FDA Memorandum. ‘‘Memo Detailing an
hours) per record. Risk Assessment: Risk of Activity/Food Evaluation of the Potential For Wide-
Finally, we expect each of the Combinations for Activities (Outside the Scale Public Health Harm Resulting
estimated 9,759 firms will fulfill the Farm Definition) Conducted in a Facility From Intentional Adulteration Of
recordkeeping requirements under Co-Located on a Farm,’’ 2016. Mineral oil When Used as a Dust Control
4. Avel, D., ‘‘ISIS Calls for Poisoning and Agent During Storage and Handling Raw
§ 121.305 and § 121.310, and that it will Running Down Westerners.’’ The
require the equivalent of an operations Grain,’’ November 16, 2015.
Algemeiner (http://www.algemeiner. 16. FDA. ‘‘CPG Sec. 555.300 Foods, Except
manager and a legal analyst an average com/2014/11/28/isis-calls-for-poisoning- Dairy Products—Adulteration With
of 5 hours each (10 hours) per record, and-running-down-westerners/#), Salmonella,’’ March 1995.
as reflected in table 5, row 6. November 28, 2014. Accessed December 17. FDA. ‘‘Tribal Summary Impact
15, 2015. Statement,’’ 2016.
XII. Analysis of Environmental Impact 5. Norton, R.A., ‘‘Food Defense in the Age of 18. FDA. ‘‘Memorandum to the File:
We previously considered the Domestic Terrorism.’’ Food Safety Environmental Analysis Related to the
environmental effects of this rule, as Magazine (http://www.foodsafety Final Rule on Mitigation Strategies to
magazine.com/enewsletter/food-defense- Protect Food Against Intentional
stated in the proposed rule (78 FR in-the-age-of-domestic-terrorism/,
78014). We stated that we had Adulteration.’’ February 2016.
December 15, 2015. Accessed December
determined under 21 CFR 25.30(h) and 15, 2015. List of Subjects
21 CFR 25.30(j) that this action is of a 6. Valdmanis, R., ‘‘Boston Bomb Suspect
type that does not individually or Influenced by Al Qaeda: Expert 21 CFR Part 11
cumulatively have a significant effect on Witness.’’ Reuters (http://www.reuters. Administrative practice and
the human environment such that com/article/us-boston-bombings-trial- procedure, Computer technology,
neither an environmental assessment idUSKBN0MJ0Z620150323), March 23, Reporting and recordkeeping
nor an environmental impact statement 2015. Accessed December 15, 2015. requirements.
7. Faiola, A., and S. Mekhennet, ‘‘Paris
is required. We have not received any Attacks Were Carried Out by Three 21 CFR Part 121
new information or comments that Groups Tied to Islamic State, Official
would affect our previous determination Says.’’ The Washington Post (https:// Food packaging, Foods.
(Ref. 18). www.washingtonpost.com/world/string- Therefore, under the Federal Food,
of-paris-terrorist-attacks-leaves-over-120- Drug, and Cosmetic Act and under
XIII. Federalism dead/2015/11/14/066df55c-8a73-11e5- authority delegated to the Commissioner
FDA has analyzed this final rule in bd91-d385b244482f_story.html), of Food and Drugs, 21 CFR Chapter 1 is
accordance with the principles set forth November 15, 2015. Accessed December amended as follows:
in Executive Order 13132. FDA has 15, 2015.
8. ‘‘Toxins Tie Suspect to Poisonings.’’ The PART 11—ELECTRONIC RECORDS;
determined that the rule does not Japan Times (http://www.japantimes.co.
contain policies that have substantial ELECTRONIC SIGNATURES
jp/news/2014/01/26/national/crime-
direct effects on the States, on the legal/toxins-tie-suspect-to-poisonings/#.
relationship between the National ■ 1. The authority citation for part 11
VvBCLnn2ZD9) January 26, 2014.
Government and the States, or on the Accessed December 14, 2015. continues to read as follows:
distribution of power and 9. ‘‘Toshiki Abe Arrested for Poisoning Authority: 21 U.S.C. 321–393; 42 U.S.C.
responsibilities among the various Frozen Food in Japan.’’ news.com.au 262.
levels of government. Accordingly, the (http://www.news.com.au/world/toshiki-

abe-arrested-for-poisoning-frozen-in- ■ 2. In § 11.1, add paragraph (o) to read
Agency has concluded that the rule does as follows:
japan/story-fndir2ev-1226810502913)
not contain policies that have January 25, 2014. Accessed December 15,
federalism implications as defined in § 11.1 Scope.
2015.
the Executive order and, consequently, 10. Global Food Safety Initiative. ‘‘GFSI * * * * *
a federalism summary impact statement Guidance Document Version 6.3.’’ (o) This part does not apply to records
is not required. (http://www.mygfsi.com/images/mygfsi/ required to be established or maintained
by part 121 of this chapter. Records that applicable to such terms when used in whole number, round down to the next
satisfy the requirements of part 121 of this part. The following definitions also lowest whole number.
this chapter, but that also are required apply: Holding means storage of food and
under other applicable statutory Actionable process step means a also includes activities performed
provisions or regulations, remain point, step, or procedure in a food incidental to storage of food (e.g.,
subject to this part. process where a significant vulnerability activities performed for the safe or
■ 3. Add part 121 to read as follows: exists and at which mitigation strategies effective storage of that food, such as
can be applied and are essential to fumigating food during storage, and
PART 121—MITIGATION STRATEGIES significantly minimize or prevent the drying/dehydrating raw agricultural
TO PROTECT FOOD AGAINST significant vulnerability. commodities when the drying/
INTENTIONAL ADULTERATION Adequate means that which is needed dehydrating does not create a distinct
to accomplish the intended purpose in commodity (such as drying/dehydrating
Sec. keeping with good public health hay or alfalfa)). Holding also includes
Subpart A—General Provisions practices. activities performed as a practical
121.1 Applicability. Affiliate means any facility that necessity for the distribution of that
121.3 Definitions. controls, is controlled by, or is under food (such as blending of the same raw
121.4 Qualifications of individuals who common control with another facility. agricultural commodity and breaking
perform activities under subpart C of this Calendar day means every day as down pallets), but does not include
part. shown on the calendar. activities that transform a raw
121.5 Exemptions. Contaminant means, for purposes of agricultural commodity into a processed
Subpart B—Reserved this part, any biological, chemical, food as defined in section 201(gg) of the
physical, or radiological agent that may Federal Food, Drug, and Cosmetic Act.
Subpart C—Food Defense Measures be added to food to intentionally cause Holding facilities could include
121.126 Food defense plan. illness, injury, or death. warehouses, cold storage facilities,
121.130 Vulnerability assessment to Facility means a domestic facility or storage silos, grain elevators, and liquid
identify significant vulnerabilities and a foreign facility that is required to storage tanks.
actionable process steps. register under section 415 of the Federal Manufacturing/processing means
121.135 Mitigation strategies for actionable Food, Drug, and Cosmetic Act, in making food from one or more
process steps.
accordance with the requirements of ingredients, or synthesizing, preparing,
121.138 Mitigation strategies management
components. part 1, subpart H of this chapter. treating, modifying or manipulating
121.140 Food defense monitoring. Farm means farm as defined in food, including food crops or
121.145 Food defense corrective actions. § 1.227 of this chapter. ingredients. Examples of
121.150 Food defense verification. FDA means the Food and Drug manufacturing/processing activities
121.157 Reanalysis. Administration. include: Baking, boiling, bottling,
Food means food as defined in section canning, cooking, cooling, cutting,
Subpart D—Requirements Applying to
Records That Must Be Established and
201(f) of the Federal Food, Drug, and distilling, drying/dehydrating raw
Maintained Cosmetic Act and includes raw agricultural commodities to create a
materials and ingredients. distinct commodity (such as drying/
121.301 Records subject to the requirements
Food defense means, for purposes of dehydrating grapes to produce raisins),
of this subpart.
121.305 General requirements applying to this part, the effort to protect food from evaporating, eviscerating, extracting
records. intentional acts of adulteration where juice, formulating, freezing, grinding,
121.310 Additional requirements applying there is an intent to cause wide scale homogenizing, irradiating, labeling,
to the food defense plan. public health harm. milling, mixing, packaging (including
121.315 Requirements for record retention. Food defense monitoring means to modified atmosphere packaging),
121.320 Requirements for official review. conduct a planned sequence of pasteurizing, peeling, rendering, treating
121.325 Public disclosure. observations or measurements to assess to manipulate ripening, trimming,
121.330 Use of existing records. whether mitigation strategies are washing, or waxing. For farms and farm
Subpart E—Compliance operating as intended. mixed-type facilities, manufacturing/
121.401 Compliance.
Food defense verification means the processing does not include activities
application of methods, procedures, and that are part of harvesting, packing, or
Authority: 21 U.S.C. 331, 342, 350g, other evaluations, in addition to food holding.
350(i), 371, 374. defense monitoring, to determine Mitigation strategies mean those risk-
Subpart A—General Provisions whether a mitigation strategy or based, reasonably appropriate measures
combination of mitigation strategies is that a person knowledgeable about food
§ 121.1 Applicability. or has been operating as intended defense would employ to significantly
This part applies to the owner, according to the food defense plan. minimize or prevent significant
operator or agent in charge of a domestic Full-time equivalent employee is a vulnerabilities identified at actionable
or foreign food facility that term used to represent the number of process steps, and that are consistent
manufactures/processes, packs, or holds employees of a business entity for the with the current scientific
food for consumption in the United purpose of determining whether the understanding of food defense at the
States and is required to register under business qualifies as a small business. time of the analysis.
section 415 of the Federal Food, Drug, The number of full-time equivalent Mixed-type facility means an
and Cosmetic Act, unless one of the employees is determined by dividing establishment that engages in both
exemptions in § 121.5 applies. the total number of hours of salary or activities that are exempt from
wages paid directly to employees of the registration under section 415 of the
§ 121.3 Definitions. business entity and of all of its affiliates Federal Food, Drug, and Cosmetic Act
The definitions and interpretations of and subsidiaries by the number of hours and activities that require the
terms in section 201 of the Federal of work in 1 year, 2,080 hours (i.e., 40 establishment to be registered. An
Food, Drug, and Cosmetic Act are hours × 52 weeks). If the result is not a example of such a facility is a ‘‘farm
mixed-type facility,’’ which is an facility’s food process to intentional for ensuring compliance by individuals
establishment that is a farm, but also adulteration. with the requirements of this part must
conducts activities outside the farm You means, for purposes of this part, be clearly assigned to supervisory
definition that require the establishment the owner, operator, or agent in charge personnel with a combination of
to be registered. of a facility. education, training, and experience
Packing means placing food into a necessary to supervise the activities
§ 121.4 Qualifications of individuals who
container other than packaging the food under this subpart.
perform activities under subpart C of this
and also includes re-packing and part.
(e) Records. Training required by
activities performed incidental to paragraphs (b)(2) and (c)(2) of this
(a) Applicability. You must ensure section must be documented in records,
packing or re-packing a food (e.g.,
that each individual who performs and must:
activities performed for the safe or
activities required under subpart C of (1) Include the date of training, the
effective packing or re-packing of that
this part is a qualified individual as that type of training, and the persons
food (such as sorting, culling, grading,
term is defined in § 121.3. trained; and
and weighing or conveying incidental to
(b) Qualifications of individuals (2) Be established and maintained in
packing or re-packing)), but does not
assigned to an actionable process step. accordance with the requirements of
include activities that transform a raw
Each individual assigned to an subpart D of this part.
agricultural commodity into a processed
actionable process step (including
food as defined in section 201(gg) of the
temporary and seasonal personnel) or in § 121.5 Exemptions.
Federal Food, Drug, and Cosmetic Act.
the supervision thereof must: (a) This part does not apply to a very
Qualified individual means a person (1) Be a qualified individual as that small business, except that a very small
who has the education, training, or term is defined in § 121.3—i.e., have the business must, upon request, provide
experience (or a combination thereof) appropriate education, training, or for official review documentation
necessary to perform an activity experience (or a combination thereof) sufficient to show that the facility meets
required under subpart C of this part, as necessary to properly implement the this exemption. Such documentation
appropriate to the individual’s assigned mitigation strategy or combination of must be retained for 2 years.
duties. A qualified individual may be, mitigation strategies at the actionable (b) This part does not apply to the
but is not required to be, an employee process step; and holding of food, except the holding of
of the establishment. (2) Receive training in food defense food in liquid storage tanks.
Significant vulnerability means a awareness. (c) This part does not apply to the
vulnerability that, if exploited, could (c) Qualifications of individuals for packing, re-packing, labeling, or re-
reasonably be expected to cause wide certain activities described in paragraph labeling of food where the container that
scale public health harm. A significant (c)(3) of this section. Each individual directly contacts the food remains
vulnerability is identified by a assigned to certain activities described intact.
vulnerability assessment conducted by a in paragraph (c)(3) of this section must: (d) This part does not apply to
qualified individual, that includes (1) Be a qualified individual as that activities of a farm that are subject to
consideration of the following: (1) term is defined in § 121.3—i.e., have the section 419 of the Federal Food, Drug,
Potential public health impact (e.g., appropriate education, training, or and Cosmetic Act (Standards for
severity and scale) if a contaminant experience (or a combination thereof) Produce Safety).
were added, (2) degree of physical necessary to properly perform the (e)(1) This part does not apply with
access to the product, and (3) ability of activities; and respect to alcoholic beverages at a
an attacker to successfully contaminate (2) Have successfully completed facility that meets the following two
the product. The assessment must training for the specific function at least conditions:
consider the possibility of an inside equivalent to that received under a (i) Under the Federal Alcohol
attacker. standardized curriculum recognized as Administration Act (27 U.S.C. 201 et
Significantly minimize means to adequate by FDA or be otherwise seq.) or chapter 51 of subtitle E of the
reduce to an acceptable level, including qualified through job experience to Internal Revenue Code of 1986 (26
to eliminate. conduct the activities. Job experience U.S.C. 5001 et seq.) the facility is
Small business means, for purposes of may qualify an individual to perform required to obtain a permit from,
this part, a business (including any these functions if such experience has register with, or obtain approval of a
subsidiaries and affiliates) employing provided an individual with knowledge notice or application from the Secretary
fewer than 500 full-time equivalent at least equivalent to that provided of the Treasury as a condition of doing
employees. through the standardized curriculum. business in the United States, or is a
Subsidiary means any company This individual may be, but is not foreign facility of a type that would
which is owned or controlled directly or required to be, an employee of the require such a permit, registration, or
indirectly by another company. facility. approval if it were a domestic facility;
Very small business means, for (3) One or more qualified individuals and
purposes of this part, a business must do or oversee: (ii) Under section 415 of the Federal
(including any subsidiaries and (i) The preparation of the food defense Food, Drug, and Cosmetic Act the
affiliates) averaging less than plan as required in § 121.126; facility is required to register as a
$10,000,000, adjusted for inflation, per (ii) The conduct of a vulnerability facility because it is engaged in
year, during the 3-year period preceding assessment as required in § 121.130; manufacturing, processing, packing, or
the applicable calendar year in sales of (iii) The identification and holding one or more alcoholic
human food plus the market value of explanation of the mitigation strategies beverages.
human food manufactured, processed, as required in § 121.135; and (2) This part does not apply with
packed, or held without sale (e.g., held (iv) Reanalysis as required in respect to food that is not an alcoholic
for a fee). § 121.157. beverage at a facility described in
Vulnerability means the susceptibility (d) Additional qualifications of paragraph (e)(1) of this section,
of a point, step, or procedure in a supervisory personnel. Responsibility provided such food:
(i) Is in prepackaged form that processed, packed, or held at your § 121.140 Food defense monitoring.
prevents any direct human contact with facility using appropriate methods to As appropriate to the nature of the
such food; and evaluate each point, step, or procedure mitigation strategy and its role in the
(ii) Constitutes not more than 5 in your food operation to identify facility’s food defense system:
percent of the overall sales of the significant vulnerabilities and (a) Written procedures. You must
facility, as determined by the Secretary actionable process steps. Appropriate establish and implement written
of the Treasury. methods must include, at a minimum, procedures, including the frequency
(f) This part does not apply to the an evaluation of: with which they are to be performed, for
manufacturing, processing, packing, or (1) The potential public health impact food defense monitoring of the
holding of food for animals other than (e.g., severity and scale) if a mitigation strategies.
man. (b) Food defense monitoring. You
contaminant were added;
(g) This part does not apply to on- must monitor the mitigation strategies
(2) The degree of physical access to with adequate frequency to provide
farm manufacturing, processing,
the product; and assurances that they are consistently
packing, or holding of the following
foods on a farm mixed-type facility, (3) The ability of an attacker to performed.
when conducted by a small or very successfully contaminate the product. (c) Records—(1) Requirement to
small business if such activities are the (b) Inside attacker. The assessment document food defense monitoring. You
only activities conducted by the must consider the possibility of an must document the monitoring of
business subject to section 418 of the inside attacker. mitigation strategies in accordance with
Federal Food, Drug, and Cosmetic Act. this section in records that are subject
(c) Written vulnerability assessment. to verification in accordance with
(1) Eggs (in-shell, other than raw Regardless of the outcome, the
agricultural commodities, e.g., § 121.150(a)(1) and records review in
vulnerability assessment must be accordance with § 121.150(a)(3)(i).
pasteurized); and written and must include an (2) Exception records. Records may be
(2) Game meats (whole or cut, not explanation as to why each point, step, affirmative records demonstrating the
ground or shredded, without secondary or procedure either was or was not mitigation strategy is functioning as
ingredients). identified as an actionable process step. intended. Exception records
Subpart B—Reserved § 121.135 Mitigation strategies for
demonstrating the mitigation strategy is
actionable process steps. not functioning as intended may be
Subpart C—Food Defense Measures adequate in some circumstances.
(a) You must identify and implement
§ 121.126 Food defense plan. mitigation strategies at each actionable § 121.145 Food defense corrective actions.
(a) Requirement for a food defense process step to provide assurances that (a) Food defense corrective action
plan. You must prepare, or have the significant vulnerability at each step procedures. As appropriate to the nature
will be significantly minimized or of the actionable process step and the
prepared, and implement a written food
prevented and the food manufactured, nature of the mitigation strategy:
defense plan.
processed, packed, or held by your (1) You must establish and implement
(b) Contents of a food defense plan. written food defense corrective action
The written food defense plan must facility will not be adulterated under
section 402 of the Federal Food, Drug, procedures that must be taken if
include: mitigation strategies are not properly
(1) The written vulnerability and Cosmetic Act. For each mitigation
strategy implemented at each actionable implemented.
assessment, including required (2) The food defense corrective action
explanations, to identify significant process step, you must include a written
explanation of how the mitigation procedures must describe the steps to be
vulnerabilities and actionable process taken to ensure that:
steps as required by § 121.130(c); strategy sufficiently minimizes or
prevents the significant vulnerability (i) Appropriate action is taken to
(2) The written mitigation strategies, identify and correct a problem that has
including required explanations, as associated with the actionable process
step. occurred with implementation of a
required by § 121.135(b); mitigation strategy; and
(3) The written procedures for the (b) Mitigation strategies and (ii) Appropriate action is taken, when
food defense monitoring of the accompanying explanations must be necessary, to reduce the likelihood that
implementation of the mitigation written. the problem will recur.
strategies as required by § 121.140(a); (b) Records. All food defense
§ 121.138 Mitigation strategies
(4) The written procedures for food management components. corrective actions taken in accordance
defense corrective actions as required by with this section must be documented
§ 121.145(a)(1); and Mitigation strategies required in records that are subject to food
(5) The written procedures for food under§ 121.135 are subject to the defense verification in accordance with
defense verification as required by following mitigation strategies § 121.150(a)(2) and records review in
§ 121.150(b). management components as appropriate accordance with § 121.150(a)(3)(i).
(c) Records. The food defense plan to ensure the proper implementation of
the mitigation strategies, taking into § 121.150 Food defense verification.
required by this section is a record that
is subject to the requirements of subpart account the nature of each such (a) Food defense verification
D of this part. mitigation strategy and its role in the activities. Food defense verification
facility’s food defense system: activities must include, as appropriate
§ 121.130 Vulnerability assessment to

(a) Food defense monitoring in to the nature of the mitigation strategy
identify significant vulnerabilities and and its role in the facility’s food defense
actionable process steps. accordance with § 121.140;
system:
(a) Requirement for a vulnerability (b) Food defense corrective actions in (1) Verification that food defense
assessment. You must conduct or have accordance with § 121.145; and monitoring is being conducted as
conducted a vulnerability assessment (c) Food defense verification in required by § 121.138 (and in
for each type of food manufactured, accordance with § 121.150. accordance with § 121.140);
(2) Verification that appropriate understanding including, as (g) Records that are established or
decisions about food defense corrective appropriate, results from the maintained to satisfy the requirements
actions are being made as required by Department of Homeland Security of this part and that meet the definition
§ 121.138 (and in accordance with biological, chemical, radiological, or of electronic records in § 11.3(b)(6) of
§ 121.145); other terrorism risk assessment. this chapter are exempt from the
(3) Verification that mitigation (c) You must complete such requirements of part 11 of this chapter.
strategies are properly implemented and reanalysis required by paragraphs (a) Records that satisfy the requirements of
are significantly minimizing or and (b) of this section and implement this part, but that also are required
preventing the significant any additional mitigation strategies under other applicable statutory
vulnerabilities. To do so, you must needed to address the significant provisions or regulations, remain
conduct activities that include the vulnerabilities identified, if any: subject to part 11 of this chapter.
following, as appropriate to the facility, (1) Before any change in activities
the food, and the nature of the (including any change in mitigation § 121.310 Additional requirements
strategy) at the facility is operative; applying to the food defense plan.
mitigation strategy and its role in the
facility’s food defense system: (2) When necessary within 90- The owner, operator, or agent in
(i) Review of the food defense calendar days after production; and charge of the facility must sign and date
monitoring and food defense corrective (3) Within a reasonable timeframe, the food defense plan:
actions records within appropriate providing a written justification is (a) Upon initial completion; and
timeframes to ensure that the records prepared for a timeframe that exceeds
90 days after production of the (b) Upon any modification.
are complete, the activities reflected in
the records occurred in accordance with applicable food first begins. § 121.315 Requirements for record
the food defense plan, the mitigation (d) You must revise the written food retention.
strategies are properly implemented, defense plan if a significant change in
the activities conducted at your facility (a)(1) All records required by this part
and appropriate decisions were made must be retained at the facility for at
about food defense corrective actions; creates a reasonable potential for a new
vulnerability or a significant increase in least 2 years after the date they were
and prepared.
(ii) Other activities appropriate for a previously identified vulnerability or
verification of proper implementation of document the basis for the conclusion (2) Records that a facility relies on
mitigation strategies; and that no revisions are needed. during the 3-year period preceding the
(4) Verification of reanalysis in applicable calendar year to support its
accordance with § 121.157. Subpart D—Requirements Applying to status as exempt as a very small
(b) Written procedures. You must Records That Must Be Established and business must be retained at the facility
establish and implement written Maintained as long as necessary to support the
procedures, including the frequency for status of a facility as a very small
§ 121.301 Records subject to the business during the applicable calendar
which they are to be performed, for requirements of this subpart.
verification activities conducted year.
(a) Except as provided by paragraph
according to § 121.150(a)(3)(ii). (b) of this section, all records required (b) The food defense plan must be
(c) Documentation. All verification by subpart C of this part are subject to retained for at least 2 years after its use
activities conducted in accordance with all requirements of this subpart. is discontinued.
this section must be documented in (b) The requirements of § 121.310 (c) Except for the food defense plan,
records. apply only to the written food defense offsite storage of records is permitted if
§ 121.157 Reanalysis. plan. such records can be retrieved and
provided onsite within 24 hours of
(a) You must conduct a reanalysis of § 121.305 General requirements applying request for official review. The food
the food defense plan, as a whole at to records. defense plan must remain onsite.
least once every 3 years; Records must: Electronic records are considered to be
(b) You must conduct a reanalysis of (a) Be kept as original records, true onsite if they are accessible from an
the food defense plan as a whole, or the copies (such as photocopies, pictures, onsite location.
applicable portion of the food defense scanned copies, microfilm, microfiche,
plan: (d) If the facility is closed for a
or other accurate reproductions of the
(1) Whenever a significant change prolonged period, the food defense plan
original records), or electronic records;
made in the activities conducted at your (b) Contain the actual values and may be transferred to some other
facility creates a reasonable potential for observations obtained during food reasonably accessible location but must
a new vulnerability or a significant defense monitoring; be returned to the facility within 24
increase in a previously identified (c) Be accurate, indelible, and legible; hours for official review upon request.
vulnerability; (d) Be created concurrently with § 121.320 Requirements for official review.
(2) Whenever you become aware of performance of the activity documented;
new information about potential (e) Be as detailed as necessary to All records required by this part must
vulnerabilities associated with the food provide history of work performed; and be made promptly available to a duly
operation or facility; (f) Include: authorized representative of the
(3) Whenever you find that a (1) Information adequate to identify Secretary of Health and Human Services
mitigation strategy, a combination of the facility (e.g., the name, and when for official review and copying upon
mitigation strategies, or the food defense necessary, the location of the facility); oral or written request.
plan as a whole is not properly (2) The date and, when appropriate,
§ 121.325 Public disclosure.
implemented; and the time of the activity documented;
(4) Whenever FDA requires reanalysis (3) The signature or initials of the Records required by this part will be
to respond to new vulnerabilities, person performing the activity; and protected from public disclosure to the
credible threats to the food supply, and (4) Where appropriate, the identity of extent allowable under part 20 of this
developments in scientific the product and the lot code, if any. chapter.
§ 121.330 Use of existing records. some of the required information, any part is a prohibited act under section
(a) Existing records (e.g., records that new information required by this part 301(uu) of the Federal Food, Drug, and
are kept to comply with other Federal, may be kept either separately or Cosmetic Act.
State, or local regulations, or for any combined with the existing records. (b) The failure to comply with section
other reason) do not need to be 420 of the Federal Food, Drug, and
Subpart E—Compliance
duplicated if they contain all of the Cosmetic Act or subparts C or D of this
required information and satisfy the § 121.401 Compliance. part is a prohibited act under section
requirements of this subpart. Existing (a) The operation of a facility that 301(ww) of the Federal Food, Drug, and
records may be supplemented as manufactures, processes, packs, or holds Cosmetic Act.
necessary to include all of the required food for sale in the United States if the Dated: May 20, 2016.
information and satisfy the owner, operator, or agent in charge of
requirements of this subpart. Leslie Kux,
such facility is required to comply with,
(b) The information required by this and is not in compliance with, section Associate Commissioner for Policy.
part does not need to be kept in one set 418 of the Federal Food, Drug, and [FR Doc. 2016–12373 Filed 5–26–16; 8:45 am]
of records. If existing records contain Cosmetic Act or subparts C or D of this BILLING CODE 4164–01–P

2016 12373

Uploaded by

Document Information

Original Title

Copyright

Available Formats

Share this document

Share or Embed Document

Sharing Options

Did you find this document useful?

Is this content inappropriate?

Copyright:

Available Formats

2016 12373

Uploaded by

Copyright:

Available Formats

34166 Federal Register / Vol. 81, No.

103 / Friday, May 27, 2016 / Rules and Regulations

ANNUALIZED COST AND BENEFIT OVERVIEW

Total .............................................................................................................................................................. 362 375

Lower Chance of Intentional Adulteration ........................................................................................................ Unquantified

TABLE 1—PUBLISHED FOUNDATIONAL RULES FOR IMPLEMENTATION OF FSMA

We have finalized six of the

TABLE 3—PUBLISHED FOUNDATIONAL FINAL RULES FOR IMPLEMENTATION OF FSMA

Congress has included a specific a traditional HACCP approach is too

Agency, one of the guiding principles Exemptions If after conducting a vulnerability

3. Holding 5. Mixed-Type Facility use of statutory definitions in section

meant by ‘‘secondary.’’ be expected to conduct vulnerability requested more information regarding

and Frequency of Monitoring

TABLE 4—ESTIMATED ANNUAL REPORTING BURDEN 1

TABLE 5—ESTIMATED ANNUAL RECORDKEEPING BURDEN 1

Total .......................................................................... ........................ ........................ 409,486 .................................... 2,515,258

5, row 1. estimate accordingly. average of 20 hours per facility to satisfy

documenting mitigation strategies, XIV. References gfsifiles/information-kit/GFSI_Guidance_

levels of government. Accordingly, the (http://www.news.com.au/world/toshiki-

§ 121.130 Vulnerability assessment to

You might also like