Focused Mitigation Strategies To Protect Food Against Intentional Adulteration, 78013-78061 [2013-30373]

Agencies

• Food and Drug Administration
• DEPARTMENT OF HEALTH AND HUMAN SERVICES

[Federal Register Volume 78, Number 247 (Tuesday, December 24, 2013)]
[Proposed Rules]
[Pages 78013-78061]
From the Federal Register Online via the Government Printing Office [www.gpo.gov]
[FR Doc No: 2013-30373]



[[Page 78013]]

Vol. 78

Tuesday,

No. 247

December 24, 2013

Part III





Department of Health and Human Services





-----------------------------------------------------------------------





Food and Drug Administration





-----------------------------------------------------------------------





21 CFR Parts 16 and 121





Focused Mitigation Strategies To Protect Food Against Intentional 
Adulteration; Proposed Rule

Federal Register / Vol. 78 , No. 247 / Tuesday, December 24, 2013 / 
Proposed Rules

[[Page 78014]]


-----------------------------------------------------------------------

DEPARTMENT OF HEALTH AND HUMAN SERVICES

Food and Drug Administration

21 CFR Parts 16 and 121

[Docket No. FDA-2013-N-1425]
RIN 0910-AG63


Focused Mitigation Strategies To Protect Food Against Intentional 
Adulteration

AGENCY: Food and Drug Administration, HHS.

ACTION: Proposed rule.

-----------------------------------------------------------------------

SUMMARY: The Food and Drug Administration (FDA or we) is proposing to 
require domestic and foreign food facilities that are required to 
register under the Federal Food, Drug, and Cosmetic Act (the FD&C Act) 
to address hazards that may be intentionally introduced by acts of 
terrorism. These food facilities would be required to identify and 
implement focused mitigation strategies to significantly minimize or 
prevent significant vulnerabilities identified at actionable process 
steps in a food operation. FDA is proposing these requirements as part 
of our implementation of the FDA Food Safety Modernization Act (FSMA). 
Further, as part of the proposal, FDA discusses an approach to 
addressing economically motivated intentional adulteration. We expect 
the proposed rule, if finalized as proposed, would help to protect food 
from intentional adulteration caused by acts of terrorism.

DATES: Submit either electronic or written comments on the proposed 
rule by March 31, 2014. Submit comments on information collection 
issues under the Paperwork Reduction Act of 1995 by January 23, 2014, 
(see the ``Paperwork Reduction Act of 1995'' section of this document).

ADDRESSES: You may submit comments, identified by Docket No. FDA-2013-
N-1425 and/or Regulatory Information Number (RIN) 0910-AG63, by any of 
the following methods, except that comments on information collection 
issues under the Paperwork Reduction Act of 1995 must be submitted to 
the Office of Information and Regulatory Affairs, Office of Management 
and Budget (OMB) (see the ``Paperwork Reduction Act of 1995'' section 
of this document).

Electronic Submissions

    Submit electronic comments in the following way:
     Federal eRulemaking Portal: https://www.regulations.gov. 
Follow the instructions for submitting comments.
    Written Submissions
    Submit written submissions in the following ways:
     Mail/Hand delivery/Courier (for paper or CD-ROM 
submissions): Division of Dockets Management (HFA-305), Food and Drug 
Administration, 5630 Fishers Lane, rm. 1061, Rockville, MD 20852.
    Instructions: All submissions received must include the Agency name 
and Docket No. FDA-2013-N-1425 and Regulatory Information Number (RIN) 
0910-AG63 for this rulemaking. All comments received may be posted 
without change to https://www.regulations.gov, including any personal 
information provided. For additional information on submitting 
comments, see the ``Comments'' heading of the SUPPLEMENTARY INFORMATION 
section of this document.
    Docket: For access to the docket to read background documents or 
comments received, go to https://www.regulations.gov and insert the 
docket number, found in brackets in the heading of this document, into 
the ``Search'' box and follow the prompts and/or go to the Division of 
Dockets Management, 5630 Fishers Lane, rm. 1061, Rockville, MD 20852.

FOR FURTHER INFORMATION CONTACT: Regarding the provisions with respect 
to human food: Ryan Newkirk, Center for Food Safety and Applied 
Nutrition (HFS-005), Food and Drug Administration, 5100 Paint Branch 
Pkwy., College Park, MD 20740, 240-402-2428. Regarding the provisions 
with respect to food for animals: Alfred Montgomery, Center for 
Veterinary Medicine (HFV-200), Food and Drug Administration, 7519 
Standish Pl., Rockville, MD 20855, 240-453-6836.

SUPPLEMENTARY INFORMATION: 

Table of Contents

Executive Summary

    Scope of Coverage of the Proposed Rule
    Summary of the Major Provisions of the Proposed Rule
    Costs and Benefits
I. Introduction
II. Background
    A. Incidents of Intentional Adulteration of Food
    B. Interagency Approach to Food Defense
    C. Resources for the Food Sector
    D. Outreach
    E. Industry Standards
    F. International Food Defense Guidelines
III. Legal Authority
    A. Section 103 of FSMA
    B. Section 106 of FSMA
    C. Intrastate Activities
IV. Regulatory Approach
    A. Framework of the Rule
    B. Activities That Occur on Produce Farms
    C. Transportation Carriers
    D. Food for Animals
    E. Acts of Disgruntled Employees, Consumers, or Competitors
    F. Economically Motivated Adulteration
    G. Low-Risk Activities at Farm Mixed-Type Facilities
    H. Activities That Occur on Dairy Farms
    I. Other Ways To Focus on Foods With a High Risk of Intentional 
Adulteration Caused by Terrorism
V. The Proposal
    A. Definitions
    B. Exemptions
    C. Food Defense Measures
    D. Requirements Applying to Records That Must Be Established and 
Maintained
    E. Compliance
VI. Preliminary Regulatory Impact Analysis
VII. Analysis of Environmental Impact
VIII. Federalism
IX. Comments
X. References

Executive Summary

    This proposed regulation implements three provisions of the Federal 
Food, Drug, and Cosmetic (FD&C) Act, as amended by the FDA Food Safety 
Modernization Act (FSMA), that relate to the intentional adulteration 
of food. Section 418 of the FD&C Act (21 U.S.C. 350g) addresses 
intentional adulteration in the context of facilities that manufacture, 
process, pack, or hold food and are required to register under section 
415 of the FD&C Act (21 U.S.C. 350d). Section 419 of the FD&C Act (21 
U.S.C. 350h) addresses intentional adulteration in the context of 
fruits and vegetables that are raw agricultural commodities. Section 
420 of the FD&C Act (21 U.S.C. 350i) addresses intentional adulteration 
in the context of high risk foods and exempts farms except for farms 
that produce milk. FDA is implementing the intentional adulteration 
provisions in sections 418, 419, and 420 of the FD&C Act in this 
rulemaking.

Scope of Coverage of the Proposed Rule

    The subject of this proposed rule is protection of food against 
intentional adulteration caused by acts of terrorism. This proposed 
rule would apply to both domestic and foreign facilities that are 
required to register under section 415 of the FD&C Act. However, as 
explained in the remainder of this document and shown in Diagram 1 and 
Table 1, the proposed rule contains several exemptions. (The diagrams 
and table below are intended to illustrate the proposed scope and 
requirements of this rule, and do not include all aspects of the 
proposed regulation.) These exemptions are:
     The proposed rule would not apply to a qualified facility, 
except that the

[[Page 78015]]

facility would be required to provide for official review, upon 
request, documentation that was relied upon to demonstrate that the 
facility qualifies for this exemption. As proposed, a qualified 
facility would be: (1) A very small business (i.e., a business that has 
less than $10,000,000 in total annual sales of food, adjusted for 
inflation), or (2) a facility that meets two requirements, i.e., (a) 
During the 3-year period preceding the applicable calendar year, the 
average annual monetary value of the food manufactured, processed, 
packed or held at such facility that is sold directly to qualified end-
users (as defined in this part) during such period exceeded the average 
annual monetary value of the food sold by such facility to all other 
purchasers; and (b) the average annual monetary value of all food sold 
during the 3-year period preceding the applicable calendar year was 
less than $500,000, adjusted for inflation.
     This proposed rule would not apply to the holding of food, 
except the holding of food in liquid storage tanks.
     This proposed rule would not apply to the packing, re-
packing, labeling, or re-labeling of food where the container that 
directly contacts the food remains intact.
     This proposed rule would not apply to activities of a 
facility that are subject to section 419 of the Federal Food, Drug, and 
Cosmetic Act (Standards for Produce Safety).
     This proposed rule would not apply with respect to 
alcoholic beverages at a facility that meets certain conditions.
     This proposed rule would not apply to the manufacturing, 
processing, packing, or holding of food for animals other than man.
    We seek comment on these exclusions and whether additional 
exclusions are warranted.
BILLING CODE 4160-01-P

[[Page 78016]]

[GRAPHIC] [TIFF OMITTED] TP24DE13.026

BILLING CODE 4160-01-C

[[Page 78017]]



 Table 1--Scope of Intentional Adulteration and Proposed Exclusions and
                               Exemptions
------------------------------------------------------------------------
                                                    Brief rationale, and
                                 Coverage within          relevant
     Type of intentional      scope of proposed 21      corresponding
        adulteration                 CFR 121         section of the rule
                                                              *
------------------------------------------------------------------------
    I. Types of Intentional Adulteration Considered in this Proposed
                               Rulemaking
------------------------------------------------------------------------
1. Acts of disgruntled        Not within the scope  [ssquf] Not
 employees, consumers, or      of intentional        considered ``high
 competitors intended to       adulteration          risk'' because not
 attack the reputation of a    covered under         intended to cause
 company, and not to cause     proposed 21 CFR 121.  widespread,
 public health harm,                                 significant public
 although public health harm                         health harm.
 may occur.                                         [ssquf] See section
                                                     IV.E of this
                                                     document.
2. Economically motivated     Not within the scope  [ssquf] Considering
 adulteration (EMA) intended   of intentional        addressing as part
 to obtain economic gain,      adulteration          of hazard analysis
 and not to cause public       covered under         in a preventive
 health harm, although         proposed 21 CFR 121.  controls framework
 public health harm may                              where EMA is
 occur.                                              ``reasonably likely
                                                     to occur.''
                                                    [ssquf] See section
                                                     IV.F of this
                                                     document.
3. Acts intended to cause     Covered within        [ssquf] Considered
 massive public health harm,   scope, and is the     ``high risk''
 including acts of terrorism.  focus of proposed     because intent of
                               21 CFR 121.           the act is to cause
                                                     widespread,
                                                     significant public
                                                     health harm.
                                                    [ssquf] See section
                                                     IV.A of this
                                                     document.
------------------------------------------------------------------------
 II. Facilities or Operations Excluded or Exempted from Proposed 21 CFR
                                   121
------------------------------------------------------------------------
    Facility or Operation         Exclusion or      Brief rationale, and
                                Exemption (and any         relevant
                               associated modified      corresponding
                                  requirements)      section of the rule
                                                              *
------------------------------------------------------------------------
Activities that fall within   Excluded............  [ssquf] Activities
 the definition of ``farm''                          that occur on
 (as defined in 21 CFR Sec.                          produce farms are
  1.227).                                            not considered
                                                     ``high risk.''
                                                    [ssquf] Activities
                                                     that occur on dairy
                                                     farms are addressed
                                                     below.
                                                    [ssquf] Activities
                                                     that occur on other
                                                     farms are outside
                                                     the scope of 103,
                                                     105, and 106 of
                                                     FSMA.
                                                    [ssquf] See section
                                                     IV.B of this
                                                     document.
Transportation carriers.....  Excluded............  [ssquf]
                                                     Transportation of
                                                     bulk liquids is
                                                     addressed by
                                                     coverage of
                                                     shippers and
                                                     receivers.
                                                    [ssquf] Other
                                                     transportation
                                                     activities are not
                                                     considered ``high
                                                     risk.''
                                                    [ssquf] See section
                                                     IV.C of this
                                                     document.
------------------------------------------------------------------------
Activities that occur on      [ssquf] Fluid milk storage and loading
 dairy farms.                  appear to pose a significant
                               vulnerability.
                              [ssquf] We seek comment on practical and
                               effective approach to address this
                               vulnerability.
                              [ssquf] See section IV.H of this document.
------------------------------------------------------------------------
Qualified facility, as        Exempt, except must   [ssquf] Very small
 defined in proposed Sec.      provide for FDA       businesses are not
 121.3.                        review, upon          considered ``high
                               request,              risk.''
                               documentation        [ssquf] See section
                               relied on to          V.B.1 of this
                               demonstrate that      document.
                               the facility
                               qualifies for this
                               exemption.
Holding of food, except the   Exempt..............  [ssquf] Not
 holding of food in liquid                           considered ``high
 storage tanks.                                      risk'' because
                                                     these activities do
                                                     not fit within any
                                                     of the FDA-
                                                     identified key
                                                     activity types.
                                                    [ssquf] See section
                                                     V.B.2 of this
                                                     document.
------------------------------------------------------------------------
Packing, re-packing,          Exempt..............  [ssquf] Not
 labeling, or re-labeling of                         considered ``high
 food where the container                            risk'' because
 that directly contacts the                          these activities do
 food remains intact.                                not fit within any
                                                     of the FDA-
                                                     identified key
                                                     activity types.
                                                    [ssquf] See section
                                                     V.B.3 of this
                                                     document.
Activities of a facility      Exempt..............  [ssquf] Activities
 that are subject to                                 that occur on
 Standards for Produce                               produce farms are
 Safety (proposed 21 CFR                             not considered
 112).                                               ``high risk.''
                                                    [ssquf] See section
                                                     V.B.4 of this
                                                     document.
Alcoholic beverages at        Exempt..............  [ssquf] Alcoholic
 certain alcohol-related                             beverages at these
 facilities, and certain                             facilities are
 prepackaged food sold in                            outside the scope
 limited quantities along                            of 103, 105, and
 with alcoholic beverages at                         106 of FSMA.
 the same facilities (see                           [ssquf] See section
 proposed Sec.   121.5(e)).                          V.B.5 of this
                                                     document.
Manufacturing, processing,    Exempt..............  [ssquf] Not
 packing, or holding of food                         considered ``high
 for animals.                                        risk'' because
                                                     unlikely to impact
                                                     human health.
                                                    [ssquf] See section
                                                     V.B.6 of this
                                                     document.
------------------------------------------------------------------------
* Please see the corresponding sections of the rule identified in the
  column for a complete discussion of our analysis, rationale, and
  tentative conclusions related to the proposed exclusions or exemption.


[[Page 78018]]

Summary of the Major Provisions of the Proposed Rule

    This proposed rule would establish various food defense measures 
that an owner, operator, or agent in charge of a facility would be 
required to implement to protect against the intentional adulteration 
of food, as summarized in Diagram 2. Specifically:
     Prepare and implement a written food defense plan that 
includes actionable process steps, focused mitigation strategies, and 
procedures for monitoring, corrective actions, and verification 
(proposed Sec.  121.126).
     Identify any actionable process steps, using one of two 
procedures. FDA has analyzed vulnerability assessments conducted using 
the CARVER+Shock methodology and identified four key activity types: 
Bulk liquid receiving and loading; Liquid storage and handling; 
Secondary ingredient handling; and Mixing and similar activities. FDA 
has determined that the presence of one or more of these key activity 
types at a process step (e.g., manufacturing, processing, packing, or 
holding of food) indicates a significant vulnerability under section 
418 of the FD&C Act and that the food is at high risk of intentional 
adulteration caused by acts of terrorism under section 420 of the FD&C 
Act. Facilities may identify actionable process steps using the FDA-
identified key activity types as described in proposed Sec.  121.130(a) 
or conduct their own facility-specific vulnerability assessments as 
provided in proposed Sec.  121.130(b).
     Identify and implement focused mitigation strategies at 
each actionable process step to provide assurances that the significant 
vulnerability at each step will be significantly minimized or prevented 
and the food manufactured, processed, packed, or held by the facility 
will not be adulterated (proposed Sec.  121.135).
     Establish and implement procedures, including the 
frequency with which they are to be performed, for monitoring the 
focused mitigation strategies (proposed Sec.  121.140).
     Establish and implement corrective action procedures that 
must be taken if focused mitigation strategies are not properly 
implemented (proposed Sec.  121.145).
     Verify that monitoring is being conducted and appropriate 
decisions about corrective actions are being made; verify that the 
focused mitigation strategies are consistently implemented and are 
effectively and significantly minimizing or preventing the significant 
vulnerabilities; and conduct a reanalysis of the food defense plan 
(proposed Sec.  121.150).
     Ensure that personnel and supervisors assigned to 
actionable process steps receive appropriate training in food defense 
awareness and their respective responsibilities in implementing focused 
mitigation strategies (proposed Sec.  121.160).
     Establish and maintain certain records, including the 
written food defense plan; written identification of actionable process 
steps and the assessment leading to that identification; written 
focused mitigation strategies; written procedures for monitoring, 
corrective actions, and verification; and documentation related to 
training of personnel (proposed Sec. Sec.  121.301 to 121.325).
    As proposed, the effective date is 60 days after a final rule is 
published. However, we are providing for a longer timeline for 
facilities to come into compliance. Facilities, other than small and 
very small businesses, would have one year after the effective date to 
comply with proposed part 121. Small businesses (i.e., those employing 
fewer than 500 persons) would have 2 years after the effective date to 
comply with proposed part 121. Very small businesses (i.e., businesses 
that have less than $10,000,000 in total annual sales of food, adjusted 
for inflation) would be considered a qualified facility and would have 
3 years after the effective date to comply with proposed Sec.  
121.5(a).
BILLING CODE 4160-01-P

[[Page 78019]]

[GRAPHIC] [TIFF OMITTED] TP24DE13.027

BILLING CODE 4160-01-C

[[Page 78020]]

    In addition, we describe our current thinking and seek comment on 
other issues, including activities that occur on dairy farms and 
economically motivated adulteration. Finally, elsewhere in this issue 
of the Federal Register, FDA is publishing for comment its evaluation 
that identifies low-risk activities that occur at farm mixed-type 
facilities, with a specific focus on the risk presented by hazards that 
may be intentionally introduced by acts of terrorism.

Costs and Benefits

    As described in the Preliminary Regulatory Impact Analysis (PRIA), 
we estimate the annualized costs of the actions required by this 
proposed rule to be about $370 million. The benefits of these actions 
are a reduction in the possibility of illness, death, and economic 
disruption resulting from intentional adulteration of food. We are 
unable to quantify these benefits. However, we monetize the damage that 
various intentional adulteration scenarios might cause, and present a 
breakeven analysis showing the number of prevented attacks at which the 
benefits are larger than the costs.

                  Annualized Cost and Benefit Overview
------------------------------------------------------------------------
    All numbers are USD millions,
      annualized over 10 years           3% discount       7% discount
------------------------------------------------------------------------
Costs:
    Learning about Rule.............                $3                $3
    Mitigation Costs................                59                63
    Monitoring and Corrective Action               100               100
    Employee Training...............                 4                 5
    Documentation...................                 6                 6
                                     -----------------------------------
        Subtotal (Domestic cost)....               172               177
    Cost to Foreign Firms...........               185               190
                                     -----------------------------------
        Total.......................               357               367
                                     -----------------------------------
Benefits: Lower Chance of
 Intentional Adulteration...........             Unquantified.
------------------------------------------------------------------------

I. Introduction

    The FDA Food Safety Modernization Act (FSMA) (Pub. L. 111-353), 
signed into law on January 4, 2011, enables FDA to better protect 
public health by helping to ensure the safety and security of the food 
supply. FSMA enables us to focus more on preventing food safety 
problems rather than primarily reacting to problems after they occur. 
The law also provides us with new enforcement authorities to help us 
achieve higher rates of compliance with prevention- and risk-based 
safety standards and to better respond to and contain problems when 
they do occur. In addition, the law gives us important new tools to 
better ensure the safety of imported foods and directs us to build an 
integrated national food safety system in partnership with State, 
local, tribal, and territorial authorities.
    Section 103 of FSMA directs FDA to issue regulations establishing 
requirements for facilities that manufacture, process, pack or hold 
food and requires facilities to consider hazards that may be 
intentionally introduced, including by acts of terrorism. Section 106 
of FSMA requires FDA to issue regulations to protect food for which 
there is a high risk of intentional contamination and for which such 
intentional contamination could cause serious adverse health 
consequences or death to humans or animals. In addition, section 105 of 
FSMA directs FDA to issue regulations setting forth science-based 
minimum standards for the safe production and harvesting of produce, 
and requires that the rulemaking consider hazards that may be 
intentionally introduced, including by acts of terrorism.
    Efforts to protect against intentional adulteration require a shift 
in perspective from that applied to traditional food safety. In 
proposed rules entitled ``Current Good Manufacturing Practice and 
Hazard Analysis and Risk-Based Preventive Controls for Human Food'' (78 
FR 3646, January 16, 2013) (Docket No. FDA-2011-N-0920; hereafter 
referred to as ``the PC proposed rule''), ``Current Good Manufacturing 
Practice and Hazard Analysis and Risk-Based Preventive Controls for 
Food for Animals'' (78 FR 64736, October 29, 2013) (Docket No. FDA-
2011-N-0922; hereafter referred to as ``the Animal Food PC proposed 
rule''), and ``Standards for the Growing, Harvesting, Packing and 
Holding of Produce for Human Consumption'' (78 FR 3504, January 16, 
2013) (Docket No. FDA-2011-N-0921; hereafter referred to as ``the 
Produce Safety proposed rule''), FDA tentatively decided not to include 
requirements to address ``hazards that may be intentionally introduced, 
including by acts of terrorism'' (sections 418(b)(2) and 419(a)(3)(C) 
of the FD&C Act (21 U.S.C. 350g(b)(2) and 350h(a)(3)(C))) and to 
implement sections 103 and 105 of FSMA regarding such hazards in a 
separate rulemaking (this proposed rule). As noted in those proposed 
rules, FDA tentatively concluded that intentional adulteration, which 
is not addressed by traditional Hazard Analysis and Critical Controls 
Point (HACCP) or other food safety systems, likely will require 
different kinds of controls. FDA is taking the action described in this 
proposed rule to implement the intentional adulteration provisions in 
sections 103, 105, and 106 of FSMA.

II. Background

    Intentional adulteration of the food supply can result in 
catastrophic public health consequences, widespread public fear, loss 
of public confidence in the safety of food and the ability of 
government to ensure food safety, and significant adverse economic 
impacts, including disruption of trade (Ref. 1, Ref. 2, Ref. 3, Ref. 
4). Acts of intentional adulteration may take several forms, including 
acts of terrorism; acts of disgruntled employees, consumers, or 
competitors; and economically motivated adulteration. Acts of terrorism 
are associated with an intent to cause massive public health harm and, 
to a lesser extent, economic disruption (Ref. 5, Ref. 2, Ref. 3, Ref. 
6). Acts of disgruntled employees, consumers, or competitors are 
generally understood to be directed at attacking the reputation of the 
company and not at public health harm. The primary purpose of 
economically motivated adulteration is to obtain economic gain, and not 
to impact public health (Ref. 7, Ref. 8, Ref. 9), although public 
health harm may occur (Ref. 10, Ref. 11).

[[Page 78021]]

    ``Food defense'' and ``food security'' are terms that are sometimes 
used interchangeably. We use the term ``food defense'' to refer to the 
effort to protect food from acts of intentional adulteration where 
there is an intent to cause public health harm and economic disruption. 
``Food security'' is defined by the World Health Organization (WHO) to 
mean ``when all people at all times have access to sufficient, safe, 
nutritious food to maintain a healthy and active life'' (Ref. 12). To 
avoid confusion, we use the term ``food defense'' and not the term 
``food security'' in the context of intentional adulteration.

A. Incidents of Intentional Adulteration of Food

    Several cases of intentional adulteration with the intent to cause 
public health harm and economic disruption in the United States have 
been documented. For example, in 1984, in an attempt to prevent the 
general public from voting in the local elections, members of a local 
religious commune in The Dalles, OR, intentionally contaminated food in 
restaurants with Salmonella. A total of 751 people became ill and 45 
were hospitalized (Ref. 4). In another incident, in 1996, 12 laboratory 
workers at a large medical facility in Texas became ill from consuming 
anonymously donated pastries that were intentionally contaminated with 
Shigella dysenteriae type 2, which was later discovered to have 
originated from the facility's stock culture (Ref. 13). In 2009, two 
related incidents resulted in 49 individuals reporting rapid and acute 
onset of gastrointestinal and neurological symptoms after eating meals 
at a restaurant in Lenexa, KS. Investigations concluded that the 
illnesses were caused by methomyl (an insecticide) poisoning associated 
with the consumption of salsa at the restaurant. Two former employees 
of the restaurant were found guilty of intentionally contaminating the 
salsa (Ref. 14).
    A widespread incident of economically motivated adulteration 
occurred in China in 2008. Some Chinese milk firms added melamine, a 
nitrogen-rich industrial by-product, to diluted dairy products to 
increase the apparent protein content. This adulteration resulted in 
significant public health consequences, with more than 290,000 ill 
infants and 6 deaths in China. In addition, this incident caused 
significant economic disruption within the Chinese dairy industry, with 
estimates approaching $3 billion in loss to industry (Ref. 10, Ref. 
11).

B. Interagency Approach to Food Defense

1. Homeland Security Presidential Directives and Presidential Policy 
Directives for the Food and Agriculture Sector
    Intelligence gathered since the attacks on the United States on 
September 11, 2001, indicates that terrorist organizations have 
discussed contamination of the food supply as a means to harm U.S. 
citizens and disrupt the global economy (Ref. 15). In response, FDA, 
along with the Centers for Disease Control and Prevention (CDC), the 
United States Department of Agriculture (USDA), the Department of 
Homeland Security (DHS), the Federal Bureau of Investigation (FBI), the 
Environmental Protection Agency (EPA), the Department of Defense, the 
Department of Energy, the Department of Commerce, and the Department of 
the Interior, as well as with State, local, tribal, territorial, and 
private sector partners have coordinated efforts to prevent, prepare 
for, and respond to threats against the food supply. Many of these 
efforts were accomplished in accordance with applicable Homeland 
Security Presidential Directives (HSPD), specifically HSPD-7, HSPD-8, 
and HSPD-9, and Presidential Policy Directives (PPD), specifically PPD-
8 and PPD-21 (Ref. 16, Ref. 17, Ref. 18, Ref. 19, Ref. 20). In 
accordance with these directives, FDA, USDA, DHS, State and local 
governments and the food industry collaborated to conduct vulnerability 
assessments of a variety of products and processes within the food and 
agriculture sector.
2. The Evolution of Vulnerability Assessments
    Initially, FDA used Operational Risk Management (ORM), which is a 
vulnerability assessment methodology that uses a six-step sequence of 
identifying hazards and reducing the potential for negative public 
health consequences. The ORM process resulted in three main outcomes: 
(1) A calculation of risk by combining assessments of severity and 
probability of an attack on a specific food; (2) calculations for 
specific contaminants and specific food processes or related 
activities; and (3) a categorization of specific food/contaminant/food 
process or related activity into a high, medium, or low risk scheme.
    At first, ORM-based assessments were focused on reducing large 
public health consequences of attacks on the food supply. FDA realized 
that other significant considerations (i.e., large economic 
disruptions, public alarm, loss of confidence in the food supply, and 
interruption of the food stream) warranted incorporation into the 
vulnerability assessment calculus. To incorporate these considerations, 
FDA and USDA's Food Safety and Inspection Service (FSIS) adapted a 
military targeting tool known as CARVER to assess vulnerabilities of 
the food and agriculture sector. CARVER is an acronym for the following 
six attributes used to evaluate the attractiveness of a target for 
attack:
     Criticality--measure of public health and economic impacts 
of an attack;
     Accessibility--ability to physically access and egress 
from target;
     Recuperability--ability of a system to recover from an 
attack;
     Vulnerability--ease of accomplishing an attack;
     Effect--amount of direct loss from an attack as measured 
by loss in production; and
     Recognizability--ease of identifying a target.
    A seventh attribute, ``Shock'', was added to the original six 
attributes to assess the combined health, economic, and psychological 
impacts of an attack on the food industry. ORM and CARVER+Shock 
assessment conclusions were consistent; however, the CARVER+Shock 
methodology improved vulnerability assessment efforts because its 
process allowed for the identification and estimation of economic and 
psychological impacts throughout the food system.
    In 2005, the Strategic Partnership Program Agroterrorism (SPPA), a 
public-private cooperative effort was established by FDA, USDA, FBI, 
and DHS, in partnership with State and industry partners. The intent of 
the SPPA Initiative was to collect the necessary data to identify food 
and agriculture sector-specific vulnerabilities using the CARVER+Shock 
method, develop mitigation strategies, identify research gaps, and 
increase coordination between government and industry partners. The 
SPPA initiative ran from 2005 to 2008, resulting in vulnerability 
assessments of 36 food products and processes (Ref. 21). The SPPA 
Initiative was a significant step towards identifying vulnerabilities, 
mitigation strategies, and research needs within the food and 
agriculture industries. This initiative also provided Federal, State, 
and local government agencies with an in-depth look at the 
vulnerabilities that may be associated with the food and agriculture 
industry, and helped enhance communication among industry, government, 
and law enforcement

[[Page 78022]]

stakeholders concerned with the protection of the U.S. food supply. 
Since the conclusion of the SPPA Initiative, we have conducted 
additional vulnerability assessments, which continue to help inform our 
research and policy.

C. Resources for the Food Sector

    FDA has issued guidance documents and developed other resources to 
assist industry in their efforts to protect the food supply against 
intentional adulteration. In 2003, FDA issued five guidance documents 
covering food defense preventive measures for various segments of the 
food and cosmetic industry: (1) Guidance for Industry: Food Producers, 
Processors, and Transporters: Food Security Preventive Measures 
Guidance (Ref. 22); (2) Guidance for Industry: Importers and Filers: 
Food Security Preventive Measures Guidance (Ref. 23); (3) Guidance for 
Industry: Dairy Farms, Bulk Milk Transporters, Bulk Milk Transfer 
Stations and Fluid Milk Processors: Food Security Preventive Measures 
Guidance (Ref. 24); (4) Retail Food Stores and Food Service 
Establishments: Food Security Preventive Measures Guidance (Ref. 25); 
and(5) Cosmetics Processors and Transporters of Cosmetics Security 
Preventive Measures Guidance (Ref. 26). These guidance documents 
provide FDA's recommendations for best practices in food defense, and 
describe preventive measures that establishments can take to minimize 
the risk of intentional adulteration of food. We updated the guidance 
documents in 2007 to include a self-assessment tool that guides the 
user through an assessment of recommended preventive measures to 
identify those most applicable to the facility.
    FDA also has made available other resources to help industry 
identify and mitigate potential vulnerabilities for intentional 
adulteration. These include:
     The ``ALERT'' program,
     The ``Employees FIRST'' training tool,
     The ``CARVER+Shock Vulnerability Assessment'' software 
tool,
     The ``Mitigations Strategies Database,''
     The ``Food Defense Plan Builder'' software tool,
     The Food Related Emergency Exercise Bundle, and
     The ``Food Defense 101'' training courses.
    We describe each briefly in this section of the document.
    The ALERT program, originally released in 2006, is an educational 
program intended to raise the awareness of State and local governments 
and industry regarding food defense (Ref. 27). ALERT identifies five 
key elements that industry can use in food defense planning:
     A--How do you ASSURE that the supplies and ingredients you 
use are from safe and secure sources?
     L--How do you LOOK after the security of the products and 
ingredients in your facility?
     E--What do you know about your EMPLOYEES and people coming 
in and out of your facility?
     R--Could you provide REPORTS about the security of your 
products while under your control?
     T--What do you do and who do you notify if you have a 
THREAT or issue at your facility, including suspicious behavior?
    Similarly, the Employees FIRST educational tool, originally 
released in 2008, is a food defense awareness training program for 
front-line food industry workers about the risk of intentional 
adulteration and the actions they can take to identify and reduce these 
risks (Ref. 28). This tool identifies the following five key elements:
     F--Follow company food defense plan and procedures;
     I--Inspect your work area and surrounding areas;
     R--Recognize anything out of the ordinary;
     S--Secure all ingredients, supplies, and finished product; 
and
     T--Tell management if you notice anything unusual or 
suspicious.
    The CARVER+Shock Vulnerability Assessment software tool, originally 
released in 2007, helps users conduct vulnerability assessments for 
their establishments to identify and prioritize the ``critical nodes,'' 
(also known as critical process steps) the potential targets vulnerable 
to intentional adulteration attacks (Ref. 29). It guides users through 
a series of questions to determine the vulnerability of each of the 
nodes within their facility. After the vulnerabilities are identified, 
the software helps users to identify mitigation strategies for reducing 
the risk of intentional adulteration. Using the software tool, the user 
can focus resources on protecting the most susceptible points in their 
system.
    The Mitigation Strategies Database (MSD), originally released in 
2011, is a database of mitigation strategies that can be applied to 
different steps in a food operation to reduce the risk of intentional 
adulteration (Ref. 30). The database is searchable by key words and 
processing steps common to agriculture and food operations (e.g., 
growing, harvesting, packing, manufacturing, processing, and holding). 
See also the discussion in section V.C.3 of this document.
    The Food Defense Plan Builder (FDPB) software tool, released in 
2013, is a user-friendly computer software program designed to assist 
owners and operators of food facilities in developing food defense 
plans for their facilities (Ref. 31). In addition to providing new 
functionality for food defense planning and implementation, the FDPB 
software tool harnesses our food defense guidance documents, 
CARVER+Shock Vulnerability Assessment software tool, and the MSD into a 
single application.
    The Food Related Emergency Exercise Bundle (FREE-B), which FDA 
released in 2011 and developed in collaboration with CDC and FSIS and 
USDA's Animal and Plant Health Inspection Service (APHIS), is a 
compilation of scenarios based on both intentional and unintentional 
food contamination events. The FREE-B is designed to assist the food 
industry, government regulatory agencies, and public health 
organizations in assessing existing food emergency response plans, 
protocols, and procedures (Ref. 32). The FREE-B tool is designed to 
allow an individual agency or industry entity to test its own plans, 
protocols, and procedures independently. Additionally, the tool allows 
multiple jurisdictions and organizations (e.g., medical community, 
private sector, law enforcement, and first responder communities) to 
jointly conduct exercises. The tool is a set of five scenarios, each of 
which contains a Facilitator's Guide, a Lead Planner's guide, and a 
Situation Manual.
    Finally, our food defense training courses, entitled ``Food Defense 
101'' and released in 2013, reflect FDA's current thinking on how to 
minimize the likelihood and impact of incidents of intentional 
adulteration (Ref. 27). Four courses integrated into one module 
include: (1) Food Defense Awareness for Professionals, (2) Food Defense 
Awareness for Frontline Employees, (3) FDA Regulations, and (4) ALERT 
for owners and operators of food facilities. The ALERT program is 
described previously. The other programs are described in section V.C.7 
of this document.

D. Outreach

    We have conducted food defense awareness outreach to international 
and domestic stakeholders. Beginning in 2008, under the auspices of the 
Asia-Pacific Economic Cooperation (APEC), we collaborated with the U.S. 
Department of State, USDA's Foreign Agricultural Service, and FSIS to 
launch the Food Defense Pilot Program for the

[[Page 78023]]

APEC member countries. The Pilot Program was developed with the intent 
to implement the food defense principles endorsed by the APEC Counter 
Terrorism Task Force. The goal of the program was to build and foster 
global capacity to prevent and protect against deliberate tampering and 
intentional contamination of the food supply through information 
sharing, outreach, and technical assistance on food defense, thereby 
safeguarding food trade and public health across the APEC member 
countries. In addition, to support the international capacity building 
goals of FSMA, we conducted several workshops in various countries to 
discuss topics such as increasing food defense awareness, developing 
food defense plans, conducting vulnerability assessments, and 
implementing mitigation strategies.
    In 2013, we increased our domestic outreach activities with a 
series of workshops in the United States. Using a similar format and 
agenda as the international workshops, we conducted 1-day food defense 
awareness workshops to provide industry, State and local governments, 
and academic partners with information on food defense, and share tools 
and resources. During these workshops, we shared information on how to 
use the new FDPB software tool to develop a comprehensive food defense 
plan. These workshops also served as a forum to discuss food defense 
concerns, understand industry's current practices, and share ideas for 
collaboration to better protect the food supply against intentional 
adulteration. We plan to continue to hold additional workshops in 2014.

E. Industry Standards

    Guidelines accompanying industry standards in the United States 
have addressed intentional adulteration of food. For example, the 
Global Food Safety Initiative's (GFSI) Guidance Document Sixth Edition 
(Ref. 33) addresses food defense. Some organizations that own and 
manage industry standards have worked or are working to incorporate 
food defense requirements into their standards to meet this GFSI 
guideline. For example, the Safe Quality Foods (SQF) Code, edition 7.1, 
issued in 2013, is a process and product certification standard that 
specifies various food defense elements, including that the methods, 
responsibility, and criteria for preventing food adulteration caused by 
a deliberate act of sabotage or terrorist-like incident shall be 
documented, implemented and maintained (Ref. 34). Another example of 
industry standards that incorporate food defense elements is the 
International Featured Standards (IFS) Food Version 6 Standard, which 
specifies that areas critical to security be identified, food defense 
hazard analysis and assessment of associated risks be conducted 
annually or upon changes that affect food integrity, and an appropriate 
alert system be defined and periodically tested for effectiveness (Ref. 
35).

F. International Food Defense Guidelines

    In 2008, WHO issued its ``Terrorist Threats to Food--Guidelines for 
Establishing and Strengthening Prevention and Response Systems'' to 
provide policy guidance to its Member States for integrating 
consideration of deliberate acts of sabotage of food into existing 
prevention and response programs (Ref. 6). WHO uses the term ``food 
terrorism'' and defines it as ``an act or threat of deliberate 
contamination of food for human consumption with biological, chemical 
and physical agents or radionuclear materials for the purpose of 
causing injury or death to civilian populations and/or disrupting 
social, economic or political stability.'' Focusing on the two key 
strategies of prevention and response, WHO recommends that all segments 
of the food industry consider the development of security and response 
plans for their establishments, proportional to the threat and their 
resources. The guidelines state that the key to preventing food 
terrorism is enhancing existing food safety programs and implementing 
reasonable security measures on the basis of vulnerability assessments. 
The guidelines further state that the most vulnerable foods, food 
ingredients, and food processes should be identified, including: the 
most readily accessible food processes; foods that are most vulnerable 
to undetected tampering; foods that are the most widely disseminated or 
spread; and the least supervised food production areas and processes.
    Other national governments, including Australia, China, France, 
Germany, and the United Kingdom, also have issued guidelines to assist 
their food industry stakeholders in protecting food against intentional 
adulteration (Ref. 5, Ref. 36, Ref. 37, Ref. 38, Ref. 39).

III. Legal Authority

    FDA is proposing this regulation under the FD&C Act as amended by 
FSMA. Under sections 103 and 106 of FSMA, FDA is proposing the 
requirements applicable to the owner, operator, or agent in charge of a 
facility required to register under section 415 of the FD&C Act. Under 
section 106 of FSMA, FDA is proposing the requirements applicable to 
activities at some facilities not covered by section 103 of FSMA (i.e., 
activities subject to and in compliance with the juice and seafood 
HACCP regulations in parts 120 and 123 (21 CFR parts 120 and 123) and 
the manufacturing, processing, packing, or holding of a dietary 
supplement in compliance with certain requirements). Under section 
701(a) of the FD&C Act (21 U.S.C. 371(a)), FDA is authorized to issue 
regulations for the efficient enforcement of the FD&C Act.

A. Section 103 of FSMA

    Section 103 of FSMA, Hazard Analysis and Risk-Based Preventive 
Controls, amends the FD&C Act to create a new section 418 that mandates 
rulemaking. Section 418(n)(1)(A) of the FD&C Act requires that the 
Secretary of Health and Human Services issue regulations ``to establish 
science-based minimum standards for conducting a hazard analysis, 
documenting hazards, implementing preventive controls, and documenting 
the implementation of the preventive controls . . ..'' Section 
418(n)(1)(B) of the FD&C Act requires that the regulations define the 
terms ``small business'' and ``very small business,'' taking into 
consideration the study of the food processing sector required by 
section 418(l)(5) of the FD&C Act. Further, section 103(e) of FSMA 
creates a new section 301(uu) in the FD&C Act (21 U.S.C. 331(uu)) to 
prohibit ``[t]he operation of a facility that manufactures, processes, 
packs, or holds food for sale in the United States if the owner, 
operator, or agent in charge of such facility is not in compliance with 
section 418 [of the FD&C Act].''
    In addition to rulemaking requirements, section 418 of the FD&C Act 
contains requirements applicable to the owner, operator, or agent in 
charge of a facility required to register under section 415 of the FD&C 
Act. Section 418(a) of the FD&C Act is a general provision that 
requires the owner, operator, or agent in charge of a facility to 
evaluate the hazards that could affect food manufactured, processed, 
packed, or held by the facility, identify and implement preventive 
controls, monitor the performance of those controls, and maintain 
records of the monitoring. In addition to the general requirements in 
section 418(a) of the FD&C Act, sections 418(b) to (i) of the FD&C Act 
contain more specific requirements applicable to facilities, including 
several provisions explicitly directed at intentional adulteration. For 
example, section 418(b)(2) of the FD&C Act specifies that the owner, 
operator, or

[[Page 78024]]

agent in charge of a facility shall identify and evaluate hazards that 
may be intentionally introduced, including by acts of terrorism. 
Section 418(c)(2) of the FD&C Act specifies that the owner, operator, 
or agent in charge of a facility shall identify and implement 
preventive controls to provide assurances that any hazards that relate 
to intentional adulteration will be significantly minimized or 
prevented and addressed, consistent with section 420 of the FD&C Act. 
In sections IV and V of this document, we discuss proposed requirements 
(proposed subparts C and D of part 121) that would implement these 
provisions of section 418 of the FD&C Act.
    Sections 418(j) to (m) of the FD&C Act and sections 103(c)(1)(D) 
and (g) of FSMA provide authority for certain exemptions and 
modifications to the requirements of section 418 of the FD&C Act. These 
include provisions related to seafood and juice HACCP, and low-acid 
canned food (section 418(j) of the FD&C Act); activities of facilities 
subject to section 419 of the FD&C Act (Standards for Produce Safety) 
(section 418(k)); qualified facilities (section 418(l)); facilities 
that are solely engaged in the production of food for animals other 
than man, the storage of raw agricultural commodities (other than 
fruits and vegetables) intended for further distribution or processing, 
or the storage of packaged foods that are not exposed to the 
environment (section 418(m)); facilities engaged only in certain low-
risk on-farm activities on certain foods conducted by small or very 
small businesses (section 103(c)(1)(D) of FSMA), and dietary 
supplements (section 103(g) of FSMA). In sections IV and V of this 
document, we discuss the related proposed provisions that would 
implement these provisions of section 418 of the FD&C Act and section 
103 of FSMA.

B. Section 106 of FSMA

    Section 106 of FSMA, Protection Against Intentional Adulteration, 
amends the FD&C Act to create a new section 420, which mandates 
rulemaking. Section 420 of the FD&C Act requires FDA to issue 
regulations to protect against the intentional adulteration of food. 
Section 420(b)(1) of the FD&C Act requires that such regulations are to 
specify how a person is to assess whether the person is required to 
implement mitigation strategies or measures intended to protect against 
the intentional adulteration of food. Section 420(b)(2) of the FD&C Act 
requires that the regulations specify appropriate science--based 
mitigation strategies or measures to prepare and protect the food 
supply chain at specific vulnerable points, as appropriate. Section 
420(c) of the FD&C Act provides that such regulations are to apply only 
to food for which there is a high risk of intentional adulteration and 
for which such intentional adulteration could cause serious adverse 
health consequences or death to humans or animals. Section 420(c)(1) 
provides that such foods are to include those for which FDA has 
identified clear vulnerabilities. Section 420(d) of the FD&C Act limits 
applicability on farms to farms that produce milk. Further, section 
106(d) of FSMA creates a new section 301(ww) in the FD&C Act to 
prohibit ``[t]he failure to comply with section 420 [of the FD&C 
Act].'' We are proposing all of the provisions under section 420 of the 
FD&C Act.

C. Intrastate Activities

    FDA tentatively concludes that the provisions in the proposed rule 
should be applicable to activities that are intrastate in character. 
Facilities are required to register under section 415 of the FD&C Act 
regardless of whether the food from the facility enters interstate 
commerce (Sec.  1.225(b)). The plain language of section 418 of the 
FD&C Act applies to facilities that are required to register under 
section 415 of the FD&C Act (section 418(o)(2)) and does not exclude a 
facility because food from such a facility is not in interstate 
commerce. Similarly, the plain language of section 420 of the FD&C Act 
requires FDA to issue regulations to protect against the intentional 
adulteration of food and does not include a limitation to interstate 
commerce. Further, the prohibited act provisions in sections 301(uu) 
and (ww) of the FD&C Act (21 U.S.C. 331(uu) and (ww)) do not require an 
interstate commerce nexus. Notably, other subsections in section 301 of 
the FD&C Act, and section 304 of the FD&C Act (21 U.S.C. 334) 
demonstrate that Congress has included a specific interstate commerce 
nexus in the provisions of the FD&C Act when that is its intent. 
Accordingly, it is reasonable to interpret sections 418, 420, 301(uu) 
and (ww) of the FD&C Act as not limiting the application of the 
proposed rule only to those facilities with a direct connection to 
interstate commerce. However, we seek comment on this interpretation 
and potential alternatives.

IV. Regulatory Approach

A. Framework of the Rule

    This proposed regulation implements three provisions of FSMA that 
relate to the intentional adulteration of food. Section 103 of FSMA 
addresses intentional adulteration in the context of facilities that 
manufacture, process, pack, or hold food and are required to register 
under section 415 of the FD&C Act. Section 105 of FSMA addresses 
intentional adulteration in the context of fruits and vegetables that 
are raw agricultural commodities. Section 106 of FSMA addresses 
intentional adulteration in the context of high risk foods and exempts 
farms except for farms that produce milk.
1. Scope of Intentional Adulteration Covered by this Rule
    As noted in section I of this document, acts of intentional 
adulteration may take several forms, including: (1) Acts of terrorism; 
(2) acts of disgruntled employees, consumers, or competitors; and (3) 
economically motivated adulteration. With regard to intentional 
adulteration from acts of terrorism, we are proposing to require 
certain facilities covered by this rule to address significant 
vulnerabilities by implementing focused mitigation strategies at 
actionable process steps. While we refer to the protection of the food 
supply from ``acts of terrorism'' throughout this rule, we expect our 
proposed approach and the proposed implementation of focused mitigation 
strategies would generally address acts intended to cause massive 
public health harm and, to a lesser extent, economic disruption, 
whether committed by terrorists, terrorist organizations, individuals, 
or groups of individuals. For the reasons described in section IV.E of 
this document, we have tentatively concluded not to propose additional 
requirements for the protection of food against intentional 
adulteration caused by acts of disgruntled employees, consumers, or 
competitors. We describe our approach to address economically motivated 
adulteration in section IV.F of this document, and seek comment on our 
current thinking on this issue.
2. Identification of Key Activity Types
    Terrorist attacks on the U.S. food supply have been exceedingly 
rare. However, vulnerability assessments performed by FDA, USDA, DHS, 
and FBI, under the SPPA Initiative (Ref. 21), show that an attack could 
have devastating public health and economic consequences. Because such 
an attack is a low probability but potentially exceedingly high 
consequence event, we have tentatively determined that requirements 
should focus on those facilities and process steps within those 
facilities that pose the greatest risk. To

[[Page 78025]]

assess this risk, FDA and USDA, in collaboration with DHS, FBI, and 
State and local government and industry partners, performed 
vulnerability assessments using the CARVER+Shock methodology. This 
methodology is specifically tailored to assess the risk of a terrorist 
attack and is different from an assessment of risk posed by food safety 
hazards (i.e., unintentional adulteration).
    As discussed in section V.C.2 of this document, based on an 
analysis of the vulnerability assessments that FDA has conducted using 
the CARVER+Shock methodology, we have identified four key activity 
types: Bulk liquid receiving and loading; Liquid storage and handling; 
Secondary ingredient handling; and Mixing and similar activities. FDA 
has tentatively determined that the presence of one or more of these 
key activity types at a process step (e.g., manufacturing, processing, 
packing, or holding of food) indicates a significant vulnerability 
under section 418 of the FD&C Act and that the food is at high risk of 
intentional adulteration caused by acts of terrorism under section 420 
of the FD&C Act. We seek comment on the inclusion of these key activity 
types.
    Designation of these key activity types would serve two purposes. 
First, it would provide a facility with a means to assess whether it is 
required to implement focused mitigation strategies or measures 
intended to protect against intentional adulteration under section 
420(b)(1) of the FD&C Act. Second, it would assist a facility subject 
to section 418 of the FD&C Act with the performance of a hazard 
analysis to identify and evaluate hazards that may be intentionally 
introduced by acts of terrorism, in accordance with section 418(b)(2).
    Facilities would be able to determine whether their operations 
involve one or more of the key activity types or choose to perform a 
vulnerability assessment. Our experience is that the most challenging 
part of developing a system of controls for intentional adulteration 
related to terrorism is identifying the points in the food operation 
that are most vulnerable to attack by performing a vulnerability 
assessment. By using the FDA-identified key activity types, facilities 
would be able to concentrate their efforts on the identification of 
appropriate focused mitigation strategies and the development and 
implementation of the HACCP-type system for ensuring that those 
strategies are consistently and effectively implemented.
3. Requirement for a HACCP-Type System of Controls
    We have tentatively concluded that a preventive controls approach 
like the one we proposed for the systematic control of food safety 
hazards in the PC proposed rule is the most effective means of ensuring 
that the focused mitigation strategies are consistently applied once 
the significant vulnerabilities are identified and appropriate focused 
mitigation strategies are developed. The evolution and advantages of 
this system, derived from the HACCP methodology, is discussed in detail 
in section II.C of the PC proposed rule. The application of HACCP-type 
controls for ensuring the implementation of food defense mitigation 
strategies is consistent with the approach taken in Publicly Available 
Specification (PAS) 96, developed by the Centre for the Protection of 
National Infrastructure in collaboration with the British Standards 
Institution, entitled ``The Threat Assessment Critical Control Point 
(TACCP) Approach'' (Ref. 5). It is also consistent with WHO 
recommendations on protection against intentional adulteration (Ref. 
6). We request comment on the appropriateness of a HACCP-type system to 
ensure that mitigation strategies designed to significantly minimize or 
prevent intentional adulteration related to terrorism and whether there 
are approaches that would be more suitable.
    Section 418 of the FD&C Act exempts several kinds of activities 
(e.g., those related to seafood, juice, dietary supplements, low-acid 
canned food [for certain microbiological hazards]). These activities 
are subject to preventive control-type regulations that address food 
safety, but not food defense, concerns. Section 420 of the FD&C Act 
instructs FDA to issue regulations to require that science-based 
mitigation strategies or measures be applied to foods that are at high 
risk of intentional adulteration. The exemptions set out in section 418 
of the FD&C Act are not applicable to the provisions of section 420 of 
the FD&C Act. We also have tentatively determined that some activities 
that are not subject to section 418 of the FD&C Act that involve 
manufacturing, processing, packing, or holding of food are likely to 
involve one of the key activity types (e.g., juice manufacturing, 
breaded seafood manufacturing, and mixing activity in a low-acid canned 
food process). Based on our tentative conclusion that the HACCP-type 
system in section 418 of the FD&C Act is generally appropriate for 
application to intentional adulteration related to terrorism, this same 
system would be required for these activities. Applying the same 
regulatory framework under sections 418 and 420 of the FD&C Act would 
facilitate a concise and consistent approach to protection against 
intentional adulteration of food and the efficient enforcement of the 
requirements. Further, this approach would be consistent with the 
approach for unintentional adulteration that many of these facilities 
(those subject to section 418 of the FD&C Act relative to the control 
of food safety hazards) would already be required to take for 
unintentional hazards under the PC proposed rule.
    We acknowledge that regulation of entities in the food production 
system (in this case, facilities) to reduce the risk of intentional 
adulteration of food caused by acts of terrorism is, essentially, 
without precedent. Such an endeavor is further complicated by the low 
probability and potentially high impact nature of such an attack which 
makes estimating potential public health benefits and establishing an 
appropriate threshold for requiring action difficult. We are further 
challenged by the paucity of data on the extent to which facilities 
have already implemented programs to mitigate this risk, and the 
effectiveness of various strategies to prevent intentional adulteration 
of food caused by acts of terrorism.
    In developing this proposed rule we have relied on our experience 
in both implementing preventive control schemes targeting unintentional 
food safety hazards as well as working with the U.S. intelligence 
community on the threat of a terrorist attack on the food and 
agriculture sector, including performing vulnerability assessments and 
developing guidance for industry. While these activities have provided 
us with a useful foundation on which to develop this proposed rule, the 
challenges described previously remain. We request comment on our 
proposed approach, including on the following issues:
     From which entities would implementation of measures to 
protect against intentional adulteration derive the greatest benefit to 
public health protection? How could this proposed regulation be 
modified to better target such entities?
     Would it be feasible to require measures to protect 
against intentional adulteration only in the event of a credible 
threat? If so, would such an approach be consistent with the 
intentional adulteration provisions of FSMA? How would such 
requirements

[[Page 78026]]

be communicated to industry in a timely and actionable manner?
     What is an appropriate level of public health protection 
with respect to intentional adulteration, considering the intentional 
adulteration provisions of FSMA?
     Are there other ways to further focus the scope of the 
rule (see also section IV.I of this document)?
4. Compliance Dates
    Section 103(i)(1) of FSMA, General Rule, provides that ``[t]he 
amendments made by this section shall take effect 18 months after the 
date of enactment'' (i.e., by July 4, 2012). Section 103(i)(2) of FSMA, 
Flexibility for Small Businesses, provides that ``[n]otwithstanding 
paragraph (1),'' the amendments made by this section ``shall apply'' to 
a small business and very small business beginning on the date that are 
6 months and 18 months, respectively, ``after the effective date'' of 
FDA's final regulation. Section 106 of FSMA does not contain similar 
language. FDA is implementing the amendments made by sections 103 and 
106 of FSMA to the FD&C Act, as they relate to intentional 
adulteration, through this rulemaking.
    We have tentatively concluded that it is appropriate to provide a 
sufficient time period following publication of the final regulation 
for facilities to come into compliance with proposed part 121. FDA 
recognizes that it can take time to develop and implement a food 
defense plan that would require, among other things, identification of 
actionable process steps, implementation of focused mitigation 
strategies, and monitoring of focused mitigation strategies.
    FDA is proposing that the final rule would be effective 60 days 
after publication in the Federal Register, with staggered compliance 
dates, consistent with the proposed effective dates in the PC proposed 
rule and Produce Safety proposed rule. Similarly, we recognize that 
businesses of all sizes may need more time to comply with the new 
requirements established under FSMA. As noted in section VII of the PC 
proposed rule, FDA believes that it is reasonable to allow for 1 year 
after the date of publication of the final rule for businesses other 
than small and very small businesses to come into compliance with the 
new requirements established under FSMA. FDA also believes that it is 
reasonable to allow for 2 years after the date of publication of the 
final rule for small businesses to come into compliance with the new 
requirements established under FSMA, and 3 years after the date of 
publication of the final rule for very small businesses to come into 
compliance with the new requirements established under FSMA.
    Therefore, as proposed, facilities, other than small and very small 
businesses, that are subject to part 121 would have 1 year after the 
effective date to comply with proposed part 121. Small businesses would 
have 2 years after the effective date to comply with proposed part 121 
(see section V.A of this document for a discussion of the proposed 
definition of a ``small business''). With respect to very small 
businesses, we are proposing to exempt qualified facilities, which 
include very small businesses, from the requirements of proposed part 
121, except that such facilities must, upon request, provide for 
official review documentation that was relied upon to demonstrate that 
the facility meets this exemption. Very small businesses then would 
have 3 years after the effective date to comply with proposed Sec.  
121.5(a). FDA intends to work closely with the food industry, extension 
and education organizations, and State partners to develop any 
necessary additional tools and training programs needed to facilitate 
implementation of this rule.

B. Activities That Occur on Produce Farms

    Section 419 of the FD&C Act requires FDA to issue regulations to 
establish science-based minimum standards for the safe production and 
harvesting of fruits and vegetables. In developing these regulations, 
the Act requires us to consider, among others, those hazards that may 
be intentionally introduced, including by acts of terrorism (section 
419(a)(3)(C) and (c)(1)(A) of the FD&C Act). Note that neither section 
418 of the FD&C Act nor section 420 of the FD&C Act apply to these 
activities. Section 420 of the FD&C Act specifically exempts farms, 
except those that produce milk, and section 418 of the FD&C Act exempts 
activities of facilities subject to section 419 of the FD&C Act.
    In implementing section 419 of the FD&C Act, we considered the 
risks posed by a terrorist attack on the kinds of activities that occur 
on produce farms. We considered those activities that fall within the 
definition of ``farm'' (as defined in 21 CFR 1.227) (e.g., planting, 
tilling, irrigating, treating with pesticides, harvesting, drying for 
purposes of storing or transporting, hydro-cooling, packing, 
refrigerating, waxing, shelling, sifting, removing leaves, stems and 
husks, culling, shelling, and washing). We utilized data gathered from 
vulnerability assessments that we conducted employing the CARVER+Shock 
methodology, and evaluated whether activities that occur on produce 
farms pose significant vulnerabilities (Ref. 40).
    Our evaluation found that activities that are typically performed 
on produce farms are at relatively low risk for intentional 
adulteration of food from acts of terrorism (Ref. 40). Based on this 
evaluation, we have tentatively concluded that requirements for produce 
farms are not necessary to minimize the risk of serious adverse health 
consequences or death from this type of adulteration. Further, we have 
tentatively concluded that requirements relating to this form of 
adulteration are not reasonably necessary to prevent the introduction 
of known or reasonably foreseeable hazards and to provide reasonable 
assurances that the produce is not adulterated under section 402 of the 
FD&C Act. For these reasons, we are not proposing requirements for 
produce farms to specifically address intentional adulteration related 
to terrorism. We seek comment on this tentative conclusion and our 
analysis that informed this tentative decision.
    We acknowledge that there may be activities that occur on produce 
farms for which we are not proposing requirements that are similar to 
off-farm activities for which we are proposing to require the 
implementation of focused mitigation strategies. However, there are 
aspects of the specific on-farm activities that minimize the risk for 
intentional adulteration caused by acts of terrorism. For example, 
waxing is an on-farm activity that is similar to coating and that fits 
within one of the key activity types. However, there are key 
differences that make an on-farm waxing operation less vulnerable 
compared to a coating operation. With waxing, there is difficulty of 
mixing a contaminant into a clear, heated wax in a tank in close 
proximity to the busy packing line in an on-farm packing house. 
Conversely, a coating operation involves an opaque, ambient or 
refrigerated, aqueous coating mix in a tank and occurs in a relatively 
isolated part of the manufacturing plant. In addition, the uncertainty 
about whether the produce leaving the farm is destined for direct 
consumption or for further processing, such as removal of the wax, 
which could inactivate or remove any contaminant intentionally added, 
makes it a relatively less likely target for intentional adulteration.

C. Transportation Carriers

    One of the key activity types that we have tentatively determined 
indicates a significant vulnerability to intentional adulteration 
caused by acts of terrorism

[[Page 78027]]

is Bulk liquid receiving and loading. As proposed, receiving and 
loading of other types of foods (e.g., non-bulk liquids, solid foods, 
gaseous foods) are not identified as key activity types because we 
determined that they do not present this same level of risk. By 
requiring that shippers and receivers of bulk liquids implement focused 
mitigation strategies at actionable process steps involving this key 
activity, as proposed in Sec.  121.135(a), we expect that shippers and 
receivers will institute focused mitigation strategies that will 
significantly minimize or prevent the potential for intention 
adulteration of these foods during transportation. Such mitigation 
strategies may include sealing or locking outbound conveyances of bulk 
liquid, or requiring that inbound conveyances be sealed or locked as a 
condition of receipt of the bulk liquid. Where such measures are 
implemented by the shippers and receivers of bulk liquids, we have 
tentatively concluded that the food would be sufficiently protected 
from intentional adulteration caused by acts of terrorism, and that no 
further actions by a carrier would be needed to ensure the safety of 
the food. For this reason, we are not proposing to cover transportation 
carriers in this proposed rule. We request comment on our analysis of 
this issue, and our tentative conclusion.
    Note that FDA will issue a proposed rule in the near future related 
to transportation carriers and sanitary transportation practices.

D. Food for Animals

    As discussed in section V.B.6 of this document, we are proposing to 
exempt the manufacturing, processing, packing, and holding of animal 
food from this proposed regulation with respect to intentional 
adulteration caused by acts of terrorism.

E. Acts of Disgruntled Employees, Consumers, or Competitors

    While the goals and outcomes of acts of disgruntled employees, 
consumers or competitors can overlap with acts of terrorism, generally, 
the distinction has to do with differences in scale. Disgruntled 
employees are generally understood to be interested primarily in 
attacking the reputation of the company, and otherwise have little 
interest in public health harm. On the other hand, terrorist 
organizations are generally understood to be interested in maximizing 
public health harm and, to a lesser extent, economic disruption (Ref. 
5, Ref. 6).
    Section 420(c) of the FD&C Act requires that the regulation 
prepared under that section apply to ``food for which there is a high 
risk of intentional contamination.'' In the spectrum of risk associated 
with intentional adulteration of food, attacks perpetrated by terrorist 
organizations intent on causing massive casualties and, to a lesser 
extent, economic disruption would be ranked as relatively high risk. On 
the other hand, attacks by disgruntled employees, consumers, or 
competitors would be consistently ranked as relatively low risk; 
although these events occur annually, their public health and economic 
impact would be generally quite small. In general, the target food and 
the point in its production are those of convenience (i.e., a point to 
which the employee, consumer, or competitor has ready access). Should a 
disgruntled employee, consumer, or competitor choose to attack at an 
actionable process step, where the adverse public health and economic 
consequences could be greater, the provisions of this proposed rule 
would be effective in minimizing the opportunity for success. Actions 
taken to mitigate the potential for a terrorist attack against the food 
supply are likely to have collateral benefits in reducing the potential 
for an attack by a disgruntled employee, consumer, or competitor (as 
well as on other security related issues, such as theft and vandalism). 
As a practical matter, hardening the food supply (i.e., reducing the 
opportunity for attack) to attacks by disgruntled employees, consumers, 
or competitors could require taking steps at many more points in the 
food system than would be required to harden the food supply to 
minimize the potential for terrorist attack. We have tentatively 
concluded that the latter can be accomplished by focusing on those 
points in the food system where an attack would be expected to cause 
massive adverse public health impact, and, to a lesser extent, economic 
disruption.

F. Economically Motivated Adulteration

    Efforts to protect against intentional adulteration require a shift 
in perspective from that applied to traditional food safety. In the PC, 
Animal Food PC, and Produce Safety proposed rules, we tentatively 
concluded that hazards associated with intentional adulteration, which 
are not addressed in traditional HACCP or other food safety systems, 
likely will require different kinds of controls, and would be best 
addressed in a separate rulemaking (this proposed rule). However, we 
also explained how in some circumstances economically motivated 
adulteration could be viewed as reasonably likely to occur. Further, we 
requested comment on where to address those hazards that may be 
intentionally introduced for economic gain. After additional 
consideration, we present our current thinking in this section of the 
document.
    For facilities subject to section 418 of the FD&C Act, we have 
tentatively concluded that economically motivated adulteration would be 
best addressed under the regulatory regime described in the PC and 
Animal Food PC proposed rules and thus best addressed in those 
rulemakings. Before we decide to finalize provisions on economically 
motivated adulteration in the PC and Animal Food PC final rules, FDA 
plans to provide new language and an analysis of costs associated with 
these provisions, and seek comment. Under this approach, the owner, 
operator, or agent in charge of a covered facility would be required to 
perform a hazard analysis to identify those hazards related to 
economically motivated adulteration that are reasonably likely to 
occur. Economically motivated adulteration could be reasonably likely 
to occur, for example, when obtaining certain ingredients from a 
country in which economically motivated adulteration has occurred in 
those ingredients in the past. Because of past incidents regarding the 
addition of melamine to certain food products apparently to enhance 
perceived quality and/or protein content, even if there is no known 
history regarding the specific supplier or the specific food product, a 
prudent person would implement preventive controls to address the 
potential presence of this hazard in a food. The goal of the 
perpetrator of economically motivated adulteration is for the 
adulterant to be undetected in the product, so that the perpetrator can 
continue to obtain the desired economic benefits (Ref. 7, Ref. 9). 
Accordingly, unlike with acts of terrorism, such occurrences of 
economic adulteration are expected to be long term, and would not be 
appropriately viewed as a rare occurrence, but rather as reasonably 
likely to occur.
    We have tentatively concluded that this hazard-analysis type 
approach is better suited to address economically motivated 
adulteration than the vulnerability assessment-type approach we are 
proposing to address intentional adulteration related to terrorism. In 
the latter approach, which we are not proposing, significant 
vulnerabilities would be identified based either on the presence of key 
activity types (which reflect FDA-conducted vulnerability assessments) 
or facility-specific vulnerability assessments. Under a vulnerability 
assessment-type approach,

[[Page 78028]]

the assessment would need to consider the degree to which a food is a 
likely target for economically motivated adulteration based on the 
attributes of the food (such as the nature of the food, its production 
system, and its supply chain) and the capabilities of a perpetrator 
(such as availability and access to adulterants that can be readily 
disguised and undetected by currently accepted testing methods). 
Factors to consider could include previous occurrences of economically 
motivated adulteration; a highly complex supply chain; sudden changes 
in commodity prices; known inadequacies in identification and assay 
testing methods for potential adulterants; a highly complex and 
variable food ingredient; the widespread availability of a potential 
adulterant; the lack of organoleptic properties of a potential 
adulterant; the high cost or scarcity of an ingredient; and variation 
in the value of a food based on variations in levels of a high value 
attribute of that food. The nature of economically motivated 
adulteration makes it difficult to identify all relevant factors to be 
considered in a vulnerability assessment to predict when novel events 
of economic adulteration are expected to occur. Moreover, predictive 
tools such as CARVER+Shock are not currently configured to assess the 
risk of economically motivated adulteration, nor have extensive 
vulnerability assessments for economically motivated adulteration in 
food products been conducted by FDA or others. Therefore, we believe 
the most appropriate framework to assess the risk of economically 
motivated adulteration is to consider whether it is reasonably likely 
to occur (such as whether it has occurred under similar circumstances 
with some regularity in the past) as part of a hazard analysis.
    Under this approach, facilities subject to section 418 of the FD&C 
Act would be expected to implement controls against economically 
motivated adulteration under circumstances where there has been a 
pattern of such adulteration in the past, even though the past 
occurrences may not be associated with the specific supplier or the 
specific food product but the pattern suggests a potential for 
intentional adulteration. Further, a system of monitoring, corrective 
action, verification, and recordkeeping that is similar to those in the 
PC and Animal Food PC proposed rules would be appropriate for 
economically motivated adulteration. In addition, the elements of a 
preventive control system, including hazard analysis, preventive 
controls, monitoring, corrective actions, verification, and 
recordkeeping would be documented in a food safety plan that would 
include control of economically motivated adulteration. We believe that 
addressing both of these potential sources for contamination within the 
same framework is likely to streamline requirements and reduce costs to 
industry.
    We seek comment on our tentative conclusions presented above. 
Specifically, we are interested in information on the specific factors 
that are most relevant for determining whether economically motivated 
adulteration is reasonably likely to occur, particularly in instances 
where the specific product or supplier has not been previously 
associated with such adulteration. In addition, we seek comment on 
whether and how these relevant factors may be used to develop 
appropriate predictive tools or establish a standard for when 
preventive controls are necessary.
    Section 418 of the FD&C Act contains certain exemptions related to 
compliance with FDA's seafood and juice HACCP regulations and with 
regard to manufacturing, processing, packing or holding dietary 
supplements that are in compliance with the requirements of sections 
402(g)(2) and 761 of the FD&C Act. Section 420 of the FD&C Act does not 
contain these exemptions and requires FDA to issue regulations to 
protect against the intentional adulteration of food. Seafood and juice 
are currently subject to HACCP-type regulations in Sec. Sec.  123 and 
120, respectively, and our current thinking is that under section 420 
economically motivated adulteration could be addressed through the 
existing frameworks for these foods. Under this option, FDA would amend 
the seafood and juice HACCP regulations to specify that economically 
motivated adulteration is a hazard that must be considered in a hazard 
analysis of these foods, and addressed in a HACCP plan. For example, 
for seafood, we could propose to add ``economically motivated 
adulteration that could result in serious adverse health consequences 
or death'' to the list of hazards to be considered in a hazard analysis 
in accordance with Sec.  123.6(c)(1). Similarly, for juice we could 
propose to add ``economically motivated adulteration that could result 
in serious adverse health consequences or death'' to the list of 
hazards to be considered in a hazard analysis in accordance with Sec.  
120.7(c). Also under this option, FDA would consider proposing to amend 
part 111 (21 CFR part 111), the Dietary Supplements current good 
manufacturing practice (CGMP) rule, to include economically motivated 
adulteration that could result in serious adverse health consequences 
or death. Current Sec.  111.70(b) and (c) require establishing 
component specifications and in-process specifications to ensure the 
identity, purity, strength, and composition of the dietary supplement, 
and we could amend these provisions to cover economically motivated 
adulteration that could result in serious adverse health consequences 
or death.
    We have also tentatively concluded not to require produce farms 
subject to section 419 of the FD&C Act and farms that produce milk 
(also referred to in this document as ``dairy farms'') subject to 
section 420 of the FD&C Act to take measures to address economically 
motivated adulteration. With regard to produce farms subject to section 
419 of the FD&C Act, we have tentatively concluded that there are not 
procedures, processes, or practices that are reasonably necessary to be 
implemented by these entities to prevent the introduction of known or 
reasonably foreseeable biological, chemical, or physical hazards that 
can cause serious adverse health consequences or death as a result of 
economically motivated adulteration. With regard to farms that produce 
milk subject to section 420 of the FD&C Act, we have tentatively 
concluded that there are not appropriate science-based strategies or 
measures intended to protect against economically motivated 
adulteration that can be applied at the farm. These tentative 
conclusions are based on our assessment that preventive controls for 
economically motivated adulteration are suitable to address such 
adulteration when it is perpetrated by the entity's supplier, but not 
when it is perpetrated by the entity itself, as would be the case for 
economically motivated adulteration at a produce farm or a farm that 
produces milk. Actions such as auditing of suppliers or reliance upon 
supplier-supplied test results or production control records are 
generally considered unsuitable to address economically motivated 
adulteration where the supplier, if intentionally adulterating the 
food, would already be violating the law and would be able to subvert 
these controls. For both types of farms, we are not aware of inputs 
into the growing, harvesting, packing, or holding of produce or milk 
(i.e., within our farm definition) that could be subject to 
economically motivated adulteration that could cause serious adverse 
health consequences or death under sections 419 and 420 of the FD&C 
Act. We seek comment on this tentative conclusion.

[[Page 78029]]

G. Low-Risk Activities at Farm Mixed-Type Facilities

    Section 103(c)(1)(C) of FSMA directs the Secretary of Health and 
Human Services to conduct a science-based risk analysis as part of the 
section 103(c) rulemaking. The science-based risk analysis is to cover 
``(i) specific types of on-farm packing or holding of food that is not 
grown, raised, or consumed on such farm or another farm under the same 
ownership, as such packing and holding relates to specific foods; and 
(ii) specific on-farm manufacturing and processing activities as such 
activities relate to specific foods that are not consumed on that farm 
or on another farm under common ownership.'' In section VIII.G of the 
PC proposed rule, we describe a draft Qualitative Risk Assessment (the 
draft RA) we performed to satisfy this requirement. Section 
103(c)(1)(D)(i) of FSMA requires FDA to use the results of this 
analysis to establish exemptions and inspection frequencies, or modify 
requirements, for facilities engaged only in specific types of on-farm 
activities that FDA determines to be low risk.
    Elsewhere in this issue of the Federal Register, FDA is publishing 
a notice announcing the availability for public comment Appendix 4 to 
the draft RA (the draft RA Appendix). The purpose of the draft RA 
Appendix is to provide a science-based risk analysis of those foods 
whose production processes would be considered low risk with respect to 
the risk of intentional adulteration caused by acts of terrorism. FDA 
conducted this evaluation to satisfy the requirement in Section 
103(c)(1)(C) of FSMA to conduct a science-based risk analysis with 
respect to the risk of intentional adulteration caused by acts of 
terrorism. We evaluated the production processes for the types of 
finished foods we expect are produced at farm mixed-type facilities to 
determine whether or not they are low-risk with respect to hazards that 
may be intentionally introduced by acts of terrorism. For the purposes 
of this analysis, we evaluated whether a production process involved 
any of the four FDA-identified key activity types, and identified a 
production process that did not involve any of the four key activity 
types as a ``low risk production process.'' Based on this evaluation, 
we concluded that the production processes for the following finished 
foods are ``low-risk'':
     Eggs (In-Shell)
     Fruits & Vegetables Other Than Pods, Seeds for Direct 
Consumption, and Hesperidia (Fresh, Intact)
     Game Meats (Whole or Cut, Not Ground or Shredded, Without 
Secondary Ingredients)
     Peanuts & Tree Nuts (Raw, In-Shell)
     Sugarcane & Sugar Beets (Fresh, Intact)
    We are considering the results of this analysis in determining any 
specific exemptions or modified requirements. We request comment on 
whether we should exempt on-farm manufacturing, processing, packing, or 
holding of the foods identified as having low-risk production practices 
when conducted by a small or very small business if such activities are 
the only activities conducted by the business that are subject to 
section 418 of the FD&C Act. If we were to take this approach, only 
facilities meeting all of the specified criteria would be exempt as a 
result of being engaged in low-risk activities. Thus, a facility 
located on-farm, that is a small or very small business, and only 
produces fresh, intact apples as a finished product (e.g., by packing 
apples grown on a different farm that is under different ownership) 
would be exempt from this proposed rule. On the other hand, an apple-
packing facility that is off-farm would not be exempt, an apple packing 
facility that is on-farm but that is not a small or very small business 
would not be exempt, and an apple packing facility that also packs 
green beans would not be exempt. We request comment on whether we 
should broaden this potential exemption in any way, such as by removing 
certain of the restrictions mentioned immediately above. We also seek 
comment on whether we should instead establish modified requirements 
for facilities that produce foods identified as having low-risk 
production processes, and if so, what those modified requirements 
should be and the scope of application of the modified requirements. In 
addition, we seek comment on whether and how we should consider the 
results of this analysis in determining whether to exempt or modify the 
inspections frequency requirements under Section 421 of the FD&C Act, 
Targeting of Inspection Resources for Domestic Facilities.

H. Activities That Occur on Dairy Farms

1. Assessment of Vulnerabilities
    Under section 420 of the FD&C Act, we considered whether activities 
that occur on farms that produce milk pose a high risk for intentional 
adulteration of food caused by acts of terrorism that could cause 
significant adverse health consequences or death. A preliminary 
evaluation indicates that fluid milk storage appears to fit within the 
key activity type, Liquid storage and handling, and fluid milk loading 
appears to fit within the key activity type, Bulk liquid receiving and 
holding. The fluid milk storage tank is one of the actionable process 
steps that would be applicable to both of these activities on a dairy 
farm.
    As discussed in section V.C.2 of this document, FDA is proposing to 
require that the owner, operator, or agent in charge of a facility that 
has one or more of the FDA-identified key activity types identify 
actionable process steps for those key activity types and implement 
focused mitigation strategies at any actionable process steps. Because 
dairy farms generally are not facilities as defined in this rule, they 
would not be subject to this requirement. However, section 420 is 
applicable to dairy farms (see Sec.  420(d)) and fluid milk storage and 
loading in a dairy farm operation appear to pose a significant 
vulnerability.
    The risk posed by intentional adulteration of milk on-farm results 
from a number of factors: (1) The system of milk collection from farms 
and subsequent holding and processing serves to distribute contaminants 
added to the milk on the farm into much larger quantities of fluid 
milk, increasing the potential magnitude of an intentional adulteration 
event; (2) in its fluid form milk has a short shelf life, increasing 
the potential for significant adverse public health impacts before 
detection and, once detected, before a public health intervention can 
be implemented; (3) fluid milk is widely consumed across different sub-
populations, including infants and children, increasing the potential 
for significant adverse public health impacts and, because of public 
reaction to child and infant morbidity and mortality, decreasing public 
confidence in the food supply; (4) fluid milk is consumed in a variety 
of food forms, including as a beverage (finished food) and as an 
ingredient in other finished foods, complicating public health 
intervention; and (5) milk storage tanks are commonly left unlocked 
(Ref. 41, Ref. 42, Ref. 43, Ref. 44, Ref. 45, Ref. 46, Ref. 47).
2. Mitigation Strategies
    Farms are not subject to the HACCP-type system of preventive 
controls prescribed in section 418 of the FD&C Act, and our current 
thinking is that, should we include requirements relative to dairy 
farms in the final rule, we would not require HACCP-type controls for 
dairy farms under section 420 of the FD&C Act. Similarly, under section 
419 of the FD&C Act we did not propose to apply such an approach to 
unintentional adulteration on produce

[[Page 78030]]

farms in the Produce Safety proposed rule (see section IV.D of the 
Produce Safety proposed rule). Rather, as with produce farms, a more 
appropriate approach might be a CGMP-type provision that relates 
directly to the significant vulnerability. Generally, CGMPs set out 
mandatory, broad, generally applicable practices and conditions that 
are required to be met, and the criteria and definitions that are 
applicable in determining whether the food is adulterated. For example, 
a CGMP approach would identify the broad, generally applicable 
mitigation strategies that dairy farm operators must implement (e.g., 
limiting access to fluid milk storage tanks), without specifying how 
that strategy must be accomplished and without a further requirement 
for monitoring, recordkeeping or the development of a plan. We seek 
comment on this approach.
    FDA previously provided guidance for the dairy industry, including 
dairy farms, on the potential for intentional contamination and 
identified the types of food defense measures that dairy farms may take 
to minimize the risk that fluid milk under their control will be 
subject to tampering or other malicious, criminal, or terrorist actions 
(Ref. 24). Among other recommendations, FDA's guidance recommends 
``limiting access'' to raw and pasteurized milk storage as a food 
defense preventive measure. We acknowledge the difficulties involved in 
limiting access to many dairy farms, including multiple entries to the 
milk house, multiple visitors with customary access to the milk house 
(e.g., State food safety inspectors, vendors delivering veterinary 
medications, and drivers collecting bulk milk for transport to 
processing and storage facilities); continuous milk piping from the 
milking parlor to the bulk milk tank, providing for access points to 
the bulk milk tank from outside the milk house; open access to the 
milking parlor for workers and cows; and automated milking operations 
where employees are not necessarily present to escort cows into the 
milking parlor.
    In light of these circumstances, we request comment on whether and 
how access to the bulk milk storage tank and associated systems can be 
limited, and the costs and other implications of doing so. In addition, 
we are interested in comment on whether and what types of focused 
mitigation strategies or other measures are currently employed by dairy 
farms. Specifically for fluid milk storage tanks, we seek comment on 
whether and what focused mitigation strategies would be appropriate and 
feasible given current dairy farming practices.
    We also seek comment on whether it would be more appropriate for 
FDA to require that dairy farm operators receive food defense awareness 
training rather than requiring that they implement focused mitigation 
strategies to limit access to certain steps of their operation. If you 
support an approach based on training rather than mandated focused 
mitigation strategies, we are further interested in how such an 
approach would work at those farms where an agent of the farm may not 
be present at all times, given that a system based on awareness 
training is premised on the assumption that such training would provide 
the operator with the tools to report and respond to suspicious 
activity that they observe.
3. Scope of Dairy Farms Subject to any Requirement
    Finally, we seek comment on the scope of farms that produce milk 
that should be subject to any requirements that we may establish in a 
final rule. For example, the scope of dairy farms covered could be 
determined based on the potential for adverse public health outcome 
resulting from consumption of milk produced at a farm, if a contaminant 
were intentionally introduced into the milk from that farm. Farms with 
less than 50 milk-producing cows contribute a relatively small 
proportion to the total volume of milk produced in the United States 
(i.e., approximately 4.2 percent of total milk produced in the United 
States), and the current trend in the dairy farm industry toward 
consolidation (Ref. 48) likely further reduces the percentage of 
production that such farms will contribute in the future. However, milk 
from even very small dairy farms may be pooled with milk from other 
farms in raw milk storage tanks at milk processing and storage 
facilities, potentially resulting in a public health impact from 
intentional adulteration that is disproportionate to the size of the 
farm or its contribution to the milk supply. We request comment on the 
appropriateness of determining the scope of dairy farms covered based 
on the number of cows on a farm. Alternatively, should we consider 
excluding farms based on how the milk from a farm is distributed (e.g., 
direct sale to consumers or other end users; pooling with milk from 
other farms; supplied to the Grade A Milk system for the production of 
fluid milk; or used in the production of cheese and other products that 
have a different risk associated with intentional adulteration caused 
by acts of terrorism)?

I. Other Ways to Focus on Foods With a High Risk of Intentional 
Adulteration Caused by Terrorism

    We are requesting comment on whether, under section 420 of the FD&C 
Act, there are other ways in which the coverage of this proposed 
regulation can be further focused on foods that present a high risk of 
intentional adulteration caused by acts of terrorism. For example, are 
there ways in which a food's shelf life, turnover in the marketplace, 
batch size, serving size and servings per batch, distribution and 
consumption patterns, and intended consumer could be considered in 
providing for an exemption or in setting modified requirements for that 
food. Ordinarily, these considerations are part of a vulnerability 
assessment, and in such assessments the risk reduction aspects of one 
attribute may be offset or exacerbated by those of another attribute, 
and may be very facility-specific. Such attributes specific to the 
food(s) manufactured, processed, packed, or held at the facility can be 
taken into account, should a facility choose to perform its own 
vulnerability assessment and assign actionable process steps, as 
provided for in proposed Sec.  121.130(b). However, as discussed in 
section V.C.2 of this document, facilities would not be required to 
perform a facility-specific vulnerability assessment and, instead, 
would have the option of identifying actionable process steps using the 
procedure in proposed Sec.  121.130(a). We are particularly interested 
in how food-specific attributes can be taken into account in the 
absence of a general requirement for a facility-specific vulnerability 
assessment.

V. The Proposal

A. Definitions

    In subpart A of proposed part 121, under Sec.  121.3, FDA is 
proposing the following definitions and interpretations of terms 
relevant to proposed part 121. The definitions and interpretations of 
terms in section 201 of the FD&C Act (21 U.S.C. 321) are applicable to 
such terms when used in this part. As proposed, several terms in part 
121 have the same definitions as in proposed part 117 and, therefore, 
we have not included an extensive discussion of those terms in this 
proposed rule. See section X.B of the PC proposed rule for a discussion 
of the following terms: facility, farm, holding, manufacturing/
processing, mixed-type facility, packing, qualified end-user, qualified 
facility, and small business.
    FDA is proposing to define the term ``actionable process step'' to 
mean a

[[Page 78031]]

point, step, or procedure in a food process at which food defense 
measures can be applied and are essential to prevent or eliminate a 
significant vulnerability or reduce such vulnerability to an acceptable 
level. The term ``actionable process step'' used in the food defense 
context is analogous to the term ``critical control point'' (CCP), 
which is defined as ``a point, step, or procedure in a food process at 
which control can be applied and is essential to prevent or eliminate a 
food safety hazard or reduce such hazard to an acceptable level.'' 
Similar to a CCP, in proposed part 121, an ``actionable process step'' 
is identified during a vulnerability assessment (analogous to a hazard 
analysis) in relation to a significant vulnerability (analogous to a 
hazard that is reasonably likely to occur), and is facility-specific.
    As discussed in section V.C.2 of this document, based on 
vulnerability assessments, FDA has identified four key activity types 
that we have tentatively concluded pose significant vulnerabilities in 
a food operation. FDA identified and described these key activity types 
(which are not facility-specific) with the expectation that an owner, 
operator, or agent in charge would objectively determine whether the 
processing steps in a facility fit within one or more of these key 
activity types. The processing steps identified by facilities in their 
food operation that fit within the FDA-identified key activity types 
are ``actionable process steps,'' and are steps at which a focused 
mitigation strategy would be employed to prevent or eliminate a 
significant vulnerability or reduce it to an acceptable level. 
Actionable process steps might also be identified in a vulnerability 
assessment (proposed Sec.  121.130(b)). Though we use the term 
``actionable process step'' in FDA's FDPB software tool (Ref. 31), we 
recognize it is a relatively new term and, therefore, we solicit 
comment on its appropriateness and any other more appropriate 
alternative terms.
    FDA is proposing to define the term ``contaminant'' as any 
biological, chemical, physical or radiological agent that may be 
intentionally added to food and that may cause illness, injury or 
death. We based the proposed definition, in part, on the definition of 
``contaminant'' used in Codex Alimentarius guidelines (Ref. 49) that 
refers to any biological or chemical agent, foreign matter or other 
substances not intentionally added to feed or food that may compromise 
feed and food safety or suitability. In this proposal, the term 
``contaminant'' is used in the context of key activity types, which are 
related to intentional acts of adulteration caused by acts of terrorism 
with intent to cause public health harm and, to a lesser extent, 
economic disruption. Therefore, for the purposes of proposed part 121, 
we focused the definition of ``contaminant'' on agents that may be 
intentionally added to food and that may cause illness, injury, or 
death, which is consistent with our determination that the primary goal 
of such an attack would be public health harm (i.e., illness, injury, 
or death). Our proposed definition of ``contaminant'' in proposed 121.3 
would be applicable to proposed part 121 only. We acknowledge that this 
term has a broader meaning in other settings, as evidenced by its use 
in the Codex Alimentarius guidelines.
    FDA is proposing to define the term ``facility'' to mean a domestic 
facility or a foreign facility that is required to register under 
section 415 of the FD&C Act in accordance with the requirements of part 
1, subpart H (21 CFR part 1, subpart H). The proposed definition would 
incorporate the definition in section 418(o)(2) of the FD&C Act.
    FDA is proposing to define the term ``farm'' by reference to the 
definition of that term in proposed Sec.  1.227. We are proposing to 
cross-reference the definition of ``farm'' rather than to define it in 
proposed part 121 because the definition of ``farm,'' under both 
current Sec.  1.227(b)(3) and proposed Sec.  1.227, includes the word 
``facility'' with a meaning that is broader than the meaning of 
``facility'' in section 418(o)(2) of the FD&C Act. Under part 1, 
subpart H, the term ``facility'' is not limited to entities that are 
required to register under section 415 of the FD&C Act. We are 
proposing to cross-reference the definition to reduce the potential 
confusion that could result if we used the term ``facility'' to have 
two different meanings within proposed part 121. See sections X.B and 
VIII of the PC proposed rule for additional information.
    FDA is proposing to define the term ``focused mitigation 
strategies'' to mean those risk-based, reasonably appropriate measures 
that a person knowledgeable about food defense would employ to 
significantly minimize or prevent significant vulnerabilities 
identified at actionable process steps, and that are consistent with 
the current scientific understanding of food defense at the time of the 
analysis. The term ``focused mitigation strategies'' used in the food 
defense context is analogous to the term ``preventive controls'' in a 
HACCP-type framework for food safety.
    As discussed in section V.C.3 of this document, a mitigation 
strategy is a measure taken by a facility to reduce the potential for 
intentional adulteration of food. A ``focused mitigation strategy'' is 
such a strategy applied in response to the identification of a 
significant vulnerability and at an actionable process step. Focused 
mitigation strategies are customized to the processing step at which 
they are applied, tailored to existing facility practices and 
procedures, and depend on an evaluation of the vulnerabilities 
identified in a facility. Because they are applied in response to a 
significant vulnerability, we have determined that focused mitigation 
strategies are essential to ensure that appropriate action is taken to 
protect the food from intentional adulteration caused by acts of 
terrorism.
    While an option to perform a vulnerability assessment is provided 
under proposed Sec.  121.130(b), facilities may choose instead to rely 
on the analysis performed by FDA that resulted in the identification of 
the key activity types listed in proposed Sec.  121.130(a) when 
identifying actionable process steps and, subsequently, focused 
mitigation strategies, eliminating the need for a full vulnerability 
assessment. See section V.C.3 of this document for examples of focused 
mitigation strategies.
    FDA is proposing to define the term ``food defense'' as the effort 
to protect food from intentional acts of adulteration where there is an 
intent to cause public health harm and economic disruption. As 
discussed in section IV.A of this document, acts of intentional 
adulteration may take several forms, including acts of terrorism; acts 
of disgruntled employees, consumers, or competitors; and economically 
motivated adulteration. We are proposing to define the term ``food 
defense'' to refer to the sum of actions and activities (including 
identification of actionable process steps; implementation of focused 
mitigation strategies; monitoring, corrective actions, verification, 
and training activities) taken to protect food from intentional acts of 
adulteration related to terrorism.
    FDA is proposing to define the term ``holding'' to mean the storage 
of food. The proposed definition would also state that holding 
facilities include warehouses, cold storage facilities, storage silos, 
grain elevators, and liquid storage tanks; and that, for farms and farm 
mixed-type facilities, holding also includes activities traditionally 
performed by farms for the safe or effective storage of raw 
agricultural commodities grown or raised on the same farm or another 
farm under the

[[Page 78032]]

same ownership, but does not include activities that transform a raw 
agricultural commodity, as defined in section 201(r) of the FD&C Act, 
into a processed food as defined in section 201(gg) of the FD&C Act. 
For consistency of terminology, we are proposing the same definition of 
``holding'' as in the PC proposed rule (see proposed Sec. Sec.  1.227 
and 117.3). For a detailed discussion of ``holding,'' see sections 
VIII.E and X.B of the PC proposed rule.
    FDA is proposing to define the term ``manufacturing/processing'' to 
mean making food from one or more ingredients, or synthesizing, 
preparing, treating, modifying or manipulating food, including food 
crops or ingredients. The proposed definition would also state that 
examples of manufacturing/processing activities are cutting, peeling, 
trimming, washing, waxing, eviscerating, rendering, cooking, baking, 
freezing, cooling, pasteurizing, homogenizing, mixing, formulating, 
bottling, milling, grinding, extracting juice, distilling, labeling, or 
packaging. The proposed definition would also specify that, for farms 
and farm mixed-type facilities, manufacturing/processing does not 
include activities that are part of harvesting, packing, or holding. 
For consistency of terminology, we are proposing the same definition of 
``manufacturing/processing'' as in the PC proposed rule (see proposed 
Sec. Sec.  1.227 and 117.3). For a detailed discussion of 
``manufacturing/processing,'' see sections VIII.E and X.B of the PC 
proposed rule.
    FDA is proposing to define the term ``mixed-type facility'' to mean 
an establishment that engages in both activities that are exempt from 
registration under section 415 of the FD&C Act and activities that 
require the establishment to be registered. The proposed definition 
would also state that an example of such a facility is a ``farm mixed-
type facility,'' which is an establishment that grows and harvests 
crops or raises animals and may conduct other activities within the 
farm definition, but also conducts activities that require the 
establishment to be registered. For consistency of terminology, we are 
proposing the same definition of ``mixed-type facility'' as in the PC 
proposed rule (see proposed Sec. Sec.  1.227 and 117.3). For a detailed 
discussion of ``mixed-type facilities,'' see sections VIII.E and X.B of 
the PC proposed rule.
    FDA is proposing to define the term ``monitor'' to mean to conduct 
a planned sequence of observations or measurements to assess whether 
focused mitigation strategies are consistently applied and to produce 
an accurate record for use in verification. In the intentional 
adulteration framework, monitoring would be performed to ensure that 
focused mitigation strategies are consistently applied and to provide a 
record for use in verifying consistent application.
    FDA is proposing to define the term ``packing'' to mean placing 
food into a container other than packaging the food. The proposed 
definition would also specify that, for farms and farm mixed-type 
facilities, packing also includes activities traditionally performed by 
farms to prepare raw agricultural commodities grown or raised on the 
same farm or another farm under the same ownership for storage and 
transport, but does not include activities that transform a raw 
agricultural commodity, as defined in section 201(r) of the FD&C Act, 
into a processed food as defined in section 201(gg). We are proposing 
to use the same definition of ``packing'' as in the PC proposed rule 
(see proposed Sec. Sec.  1.227 and 117.3). For a detailed discussion of 
``packing,'' see sections VIII.E and X.B of the PC proposed rule.
    FDA is proposing to define the term ``qualified end-user'' to mean, 
with respect to a food, the consumer of the food (where the term 
consumer does not include a business); or a restaurant or retail food 
establishment (as those terms are defined in Sec.  1.227) that: (1) Is 
located: (i) in the same State as the qualified facility that sold the 
food to such restaurant or establishment; or (ii) not more than 275 
miles from such facility; and (2) is purchasing the food for sale 
directly to consumers at such restaurant or retail food establishment. 
The proposed definition would incorporate the definition in section 
418(l)(4)(B) of the FD&C Act.
    FDA is proposing to define the term ``qualified facility'' to mean 
(when including the sales by any subsidiary; affiliate; or subsidiaries 
or affiliates, collectively, of any entity of which the facility is a 
subsidiary or affiliate) a facility that is: (1) A very small business 
as defined in this part; or (2) a facility to which both of the 
following apply: (i) During the 3-year period preceding the applicable 
calendar year, the average annual monetary value of the food 
manufactured, processed, packed or held at such facility that is sold 
directly to qualified end-users (as defined in this part) during such 
period exceeded the average annual monetary value of the food sold by 
such facility to all other purchasers; and (ii) the average annual 
monetary value of all food sold during the 3-year period preceding the 
applicable calendar year was less than $500,000, adjusted for 
inflation.
    We acknowledge that facilities would not need to consider the 
applicability of previous paragraph (2) because facilities that meet 
this second prong of the definition would be included in our proposed 
definition of a very small business, which is broader.
    The proposed definition would incorporate the description of 
``qualified facility'' in section 418(l)(1) of the FD&C Act with 
editorial changes to improve clarity.
    FDA is proposing to define the term ``significant vulnerability'' 
to mean a vulnerability for which a prudent person knowledgeable about 
food defense would employ food defense measures because of the 
potential for serious adverse health consequences or death and the 
degree of accessibility to that point in the food process. The term 
``significant vulnerability'' is analogous to the term ``hazard that is 
reasonably likely to occur'' in a HACCP-type framework for food safety. 
As proposed, a ``significant vulnerability'' is a type of vulnerability 
for which there is both: (1) The potential for serious adverse health 
consequences or death from the intentional introduction of a 
contaminant at the particular point in the process at which the 
significant vulnerability exists; and (2) a significant degree of 
accessibility at the particular point in the process. Unlike a ``hazard 
that is reasonably likely to occur'' in a HACCP system, a ``significant 
vulnerability'' exists at a particular point in a process (e.g., during 
storage in a bulk tank or during mixing). As discussed in section V.C.2 
of this document, we have determined that significant vulnerabilities 
exist in a food operation at those actionable process steps that fit in 
the FDA-identified key activity types or that are identified as part of 
a vulnerability assessment.
    We have retained in this proposed definition the concept of a 
``prudent person'' used in the definition of a ``hazard that is 
reasonably likely to occur'' in the PC proposed rule. However, because 
intentional adulteration is a potentially high consequence but low 
probability occurrence, the portion of the proposed definition in the 
PC proposed rule that reads, ``experience, illness data, scientific 
reports, or other information provides a basis to conclude that there 
is a reasonable possibility that the hazard will occur in the type of 
food being manufactured, processed, packed, or held in the absence of 
those controls,'' does not appear to be appropriate. Successful 
intentional adulteration caused by an act of

[[Page 78033]]

terrorism requires not only the absence of focused mitigation 
strategies designed to address a significant vulnerability, but also 
simultaneous intent by an attacker to adulterate the food. As such, the 
absence of focused mitigation strategies to address a significant 
vulnerability alone may not present a reasonable possibility of 
intentional adulteration. Instead, as described above, we have 
tentatively concluded that the prudent person would consider the 
potential for public health consequences should intentional 
adulteration occur, and the degree of access by the attacker to commit 
the intentional adulteration, in determining which vulnerabilities are 
significant.
    FDA is proposing to define the term ``significantly minimize'' to 
mean to reduce to an acceptable level, including to eliminate. As noted 
in section X.B of the PC proposed rule, the term ``significantly 
minimize'' is used in FSMA and is consistent with the outcome of a 
``control measure'' as described in the HACCP regulations for seafood 
(part 123), juice (part 120), and meat and poultry (9 CFR part 417). 
Generally, a ``control measure'' is implemented so that hazards are 
prevented, reduced to an acceptable level, or eliminated.
    FDA is proposing to define the term ``small business'' to mean, for 
the purposes of proposed part 121, a business employing fewer than 500 
persons. The proposed limit of 500 employees would include all 
employees of the business rather than be limited to the employees of a 
particular facility. We are proposing to establish the same definition 
for small business as that which has been established by the U.S. Small 
Business Administration under 13 CFR part 121 for most food 
manufacturers.
    FDA is proposing to define the term ``verification'' to mean those 
activities, other than monitoring, that establish that the system is 
operating according to the food defense plan. As discussed in section 
V.C.6 of this document, we are not proposing to require validation of 
the focused mitigation strategies and, therefore, we are not proposing 
to include a determination of the validity of the food defense plan 
within the definition of verification in proposed Sec.  121.3.
    FDA is proposing to define the term ``very small business'' to 
mean, for the purposes of proposed part 121, a business that has less 
than $10,000,000 in total annual sales of food, adjusted for inflation. 
In the discussion on the regulatory framework in section IV.A of this 
document, we discuss our assessment that the goal of terrorist 
organizations is to maximize public health harm and, to a lesser 
extent, economic disruption. It is our assessment that such goals are 
likely to drive terrorist organizations to target the product of 
relatively large facilities, especially those for which the brand is 
nationally or internationally recognizable. An attack on such a target 
would potentially provide the wide-scale consequences desired by a 
terrorist organization and the significant public attention that would 
accompany an attack on a recognizable brand. Such facilities are likely 
to have larger batch sizes, potentially resulting in greater human 
morbidity and mortality. Further, an attack on a well-recognized, 
trusted brand is likely to result in greater loss of consumer 
confidence in the food supply and in the government's ability to ensure 
its safety and, consequently, cause greater economic disruption than a 
relatively unknown brand that is distributed regionally (Ref. 2, Ref. 
50, Ref. 3, Ref. 51, Ref. 6). Therefore, we have set a threshold of 
$10,000,000 in total food sales, adjusted for inflation, as the level 
defining a very small business. Data from the Dun & Bradstreet Global 
Business Database show that businesses with less than $10,000,000 in 
total food sales represent about 3 percent of the market share of food 
commodities, but include the majority of food facilities. Of a total of 
65,900 domestic food facilities that are estimated to have actionable 
process steps, about 51,700 are owned by businesses with less than 
$10,000,000 in total annual sales. We request comment on our proposed 
definition, and whether a dollar amount of sales more than or less than 
$10,000,000 would be more appropriate. We also seek comment on whether 
this threshold should be based on total food sold, as we proposed, or 
on some appropriate proportion of food sales. For example, in the case 
of foreign facilities, would it be more appropriate to consider the 
proportion of food sold for marketing in the United States?
    FDA is proposing to define the term ``vulnerability'' to mean the 
susceptibility of a point, step, or procedure in a facility's food 
process to intentional adulteration. ``Vulnerability'' is used in the 
term ``vulnerability assessment'' in section 420 of the FD&C Act and 
may best be described in the food defense context as analogous to the 
term ``hazard'' in a HACCP-type framework for food safety. While 
hazards in the unintentional adulteration context may also be thought 
of as analogous to agents or contaminants in the intentional 
adulteration context, we have tentatively concluded that focusing on 
individual agents or contaminants is generally not effective or 
efficient in minimizing the risk of intentional adulteration caused by 
acts of terrorism. There are a significant number of potential agents 
or contaminants that could be used in a terrorist attack on food, with 
one or more being suitable for essentially any point in the production 
of any specific food. It would be extremely difficult, if not 
impossible, to consider the multiple combinations of potential 
contaminants, points in a food operation, and food categories, and to 
determine a strategy that would effectively address all possible 
agents. For this reason, determining whether there is an agent that 
could be intentionally introduced to a specific food that would then 
cause serious adverse health consequences or death would not be a 
useful exercise. Further, many agents or contaminants that could be 
used in such an attack are different from those that are associated 
with foodborne illnesses caused by unintentional adulteration and, as 
such, are not expected to be well understood by operators of food 
facilities. Therefore, we have tentatively concluded that in the 
intentional adulteration framework related to acts of terrorism, it is 
appropriate to refer to ``vulnerabilities'' rather than ``hazards''. 
According to the Merriam-Webster dictionary (Ref. 52), vulnerability is 
a ``susceptibility,'' and we believe this concept best captures the 
idea of a point, step, or procedure where someone intent on intentional 
adulteration would focus an attack in a facility's food process. See 
section V.C.2 of this document for a discussion of assessing 
vulnerabilities to identify actionable process steps.
    We solicit comment on the proposed definitions.

B. Exemptions

    In subpart A of proposed part 121, proposed Sec.  121.5 would 
establish exemptions from some or all of the provisions of this 
proposed regulation.
1. Proposed Sec.  121.5(a)--Exemption for Qualified Facilities
    Proposed Sec.  121.5(a) would provide that proposed part 121 does 
not apply to a qualified facility, except that qualified facilities 
must, upon request, provide for official review documentation that was 
relied upon to demonstrate that the facility meets this exemption. Such 
documentation must be retained for 2 years.
    a. Exemption of qualified facilities. As discussed in section V.A 
of this document, proposed Sec.  121.3 would

[[Page 78034]]

define a qualified facility to mean (when including the sales by any 
subsidiary; affiliate; or subsidiaries or affiliates, collectively, of 
any entity of which the facility is a subsidiary or affiliate) a 
facility that is: (1) A very small business as defined in this part, or 
(2) a facility to which both of the following apply: (i) During the 3-
year period preceding the applicable calendar year, the average annual 
monetary value of the food manufactured, processed, packed or held at 
such facility that is sold directly to qualified end-users (as defined 
in this part) during such period exceeded the average annual monetary 
value of the food sold by such facility to all other purchasers; and 
(ii) the average annual monetary value of all food sold during the 3-
year period preceding the applicable calendar year was less than 
$500,000, adjusted for inflation. In addition, we are proposing to 
define very small business to mean a business that has less than 
$10,000,000 in total annual sales of food, adjusted for inflation.
    Section 418(l)(2)(A) of the FD&C Act provides that a qualified 
facility ``shall not be subject to the requirements under [sections 
418(a) through (i) and (n) of the FD&C Act].'' We have tentatively 
concluded that we should include the exemption provided in section 
418(l)(2)(A) of the FD&C Act in proposed Sec.  121.5(a) to establish by 
regulation the reach of the provision.
    Section 418(l)(5) of the FD&C Act requires the Secretary of Health 
and Human Services, in consultation with the Secretary of Agriculture, 
to conduct a study of the food processing sector regulated by the 
Secretary of Health and Human Services and to make determinations in 
five areas. These areas include, in part: (1) Distribution of food 
production by type and size of operation; (2) the proportion of food 
produced by each type and size of operation; (3) the number and types 
of food facilities co-located on farms; (4) the incidence of foodborne 
illness originating from each size and type of operation; and (5) the 
effect on foodborne illness risk associated with certain activities 
regarding food.
    Section 418(n)(1)(B) of the FD&C Act requires that the regulations 
define the terms ``small business'' and ``very small business,'' taking 
into consideration the study of the food processing sector required by 
section 418(l)(5) of the FD&C Act. Consistent with section 418(l)(5) of 
the FD&C Act, we have consulted with USDA during our study of the food 
processing sector. The study is available in the docket established for 
this proposed rule (Ref. 53). We request comment on that study. We will 
consider comments regarding the study, as well as comments regarding 
our proposed definition for very small business, in any final rule 
based on this proposed rule.
    We note that section 420 of the FD&C Act does not contain an 
explicit size-based exemption, such as the qualified facility provision 
in section 418 of the FD&C Act. In section IV.A of this document, we 
discuss our assessment that the goal of terrorist organizations is to 
maximize public health harm and, to a lesser extent, economic 
disruption. We have tentatively concluded that such goals are likely to 
drive terrorist organizations to target the product of relatively large 
facilities, especially those for which the brand is nationally or 
internationally recognizable. The regulations issued under section 420 
of the FD&C Act are to apply to food for which there is a high risk of 
intentional contamination. We have tentatively concluded that 
designating businesses with less than $10,000,000 in total annual sales 
of food as very small businesses, resulting in their exemption from 
proposed part 121, is consistent with the requirement in section 420 of 
the FD&C Act that the regulation be limited to foods at high risk of 
intentional adulteration.
    We acknowledge that the amount of food sales in the proposed 
definition of very small business (total annual sales of food of less 
than $10,000,000) is significantly higher than the threshold in the PC 
proposed rule, in which we co-proposed three amounts ($250,000, 
$500,000, and $1,000,000 in total annual sales of food). The higher 
amount proposed here reflects the difference in the nature of risk 
related to intentional adulteration covered by this rule and is 
consistent with the requirement in section 418(n)(3)(C) of the FD&C Act 
that this regulation ``acknowledge differences in risk and minimize, as 
appropriate, the number of separate standards that apply to separate 
foods.''
    There are some facilities that are not subject to section 418 of 
the FD&C Act but are subject to section 420 of the FD&C Act, and would 
be subject to this rulemaking because their activities would likely 
involve one of the key activity types (e.g., juice manufacturing and 
breaded seafood manufacturing). However, under proposed Sec.  121.5(a), 
such facilities would be exempt from proposed part 121 if they are part 
of businesses with less than $10,000,000 in total annual sales of food, 
adjusted for inflation.
    b. Documentation requirement for qualified facilities. Sections 
418(l)(2)(A) and (l)(2)(B) of the FD&C Act provide that a qualified 
facility is exempt from the requirements of sections 418(a) through (i) 
and (n) (i.e., the requirements for hazard analysis and risk-based 
preventive controls), but must instead submit two types of 
documentation to the Secretary of Health and Human Services. The first 
type of required documentation relates to food safety practices at the 
facility, and section 418(l)(2)(B)(i) of the FD&C Act provides two 
options for satisfying this documentation requirement. Under section 
418(l)(2)(B)(i)(I) of the FD&C Act, the qualified facility may choose 
to submit documentation that demonstrates that the owner, operator, or 
agent in charge of the facility has identified potential hazards 
associated with the food being produced, is implementing preventive 
controls to address the hazards, and is monitoring the preventive 
controls to ensure that such controls are effective. Alternatively, 
under section 418(l)(2)(B)(i)(II) of the FD&C Act, the qualified 
facility may choose to submit documentation (which may include 
licenses, inspection reports, certificates, permits, credentials, 
certification by an appropriate agency (such as a State department of 
agriculture), or other evidence of oversight), as specified by the 
Secretary of Health and Human Services, that the facility is in 
compliance with State, local, county, or other applicable non-Federal 
food safety law.
    The second type of required documentation relates to whether the 
facility satisfies the definition of a qualified facility. Under 
section 418(l)(2)(B)(ii) of the FD&C Act, the facility must submit 
documentation, as specified by the Secretary of Health and Human 
Services in a guidance document, that the facility is a qualified 
facility under section 418(l)(1)(B) or section 418(l)(1)(C).
    Section 418(l)(7)(A) of the FD&C Act requires that a qualified 
facility that is exempt from the requirements under sections 418(a) 
through (i) and subsection (n), and that does not prepare documentation 
under section 418(l)(2)(B)(i)(I), provide notification to consumers by 
one of two procedures, depending on whether a food packaging label is 
required on the food. With respect to a food for which a food packaging 
label is required by the Secretary of Health and Human Services under 
any other provision of the FD&C Act, section 418(l)(7)(A)(i) of the 
FD&C Act requires that a qualified facility include prominently and 
conspicuously on such label the name and business address of the 
facility where the food was manufactured or processed. With

[[Page 78035]]

respect to a food for which a food packaging label is not required by 
the Secretary of Health and Human Services under any other provisions 
of the FD&C Act, section 418(l)(7)(A)(ii) of the FD&C Act requires that 
a qualified facility prominently and conspicuously display, at the 
point of purchase, the name and business address of the facility where 
the food was manufactured or processed, on a label, poster, sign, 
placard, or documents delivered contemporaneously with the food in the 
normal course of business, or, in the case of Internet sales, in an 
electronic notice.
    Section XIII.A of the PC proposed rule describes our proposed 
requirements pursuant to the above described modified requirements for 
qualified facilities in that proposed rule. In summary, in the PC 
proposed rule, we proposed codified language to require submission of 
the following to FDA: (1) Documentation that the facility is a 
qualified facility; and (2) documentation that demonstrates that the 
owner, operator, or agent in charge of the facility has identified the 
potential hazards associated with the food being produced, is 
implementing preventive controls to address the hazards, and is 
monitoring the performance of the preventive controls to ensure that 
such controls are effective; or documentation (which may include 
licenses, inspection reports, certificates, permits, credentials, 
certification by an appropriate agency (such as a State department of 
agriculture), or other evidence of oversight) that the facility is in 
compliance with State, local, county, or other applicable non-Federal 
food safety law, including relevant laws and regulations of foreign 
countries. In Section XIII.A of the PC proposed rule, we clarified that 
the following submission of information would be satisfactory: (1) A 
statement from the owner, operator, or agent in charge of a qualified 
facility certifying that the facility is a very small business, 
otherwise meets the definition of a qualified facility under proposed 
Sec.  117.3, or both; and (2) a statement from the owner, operator, or 
agent in charge of a qualified facility certifying that the facility 
(a) has identified the potential hazards associated with the food being 
produced, is implementing preventive controls to address the hazards, 
and is monitoring the implementation of the preventive controls to 
ensure that such controls are effective; or (b) is in compliance with 
State, local, county, or other applicable non-Federal food safety law, 
including relevant laws and regulations of foreign countries. We 
tentatively concluded that we would not, for example, require that a 
facility submit documentation to FDA demonstrating the content of their 
hazard identification, preventive controls, or monitoring of the 
implementation of preventive controls; or copies of their non-Federal 
licenses, inspection reports, certificates, permits, credentials, or 
certifications. We proposed to require that the information be 
resubmitted to FDA at least every 2 years, or whenever there is a 
material change to the information. Finally, we proposed to require 
that a qualified facility maintain records relied upon to support their 
assertion of meeting the requirements of the qualified exemption. We 
tentatively concluded that it is appropriate to require that the 
records relied upon to support a self-certified statement be retained 
and made available to FDA upon request.
    Proposed Sec.  121.5(a) would require that qualified facilities, 
upon request, provide for official review documentation that was relied 
upon to demonstrate that the facility meets this exemption. In 
addition, proposed Sec.  121.5(a) would provide that such documentation 
must be retained for 2 years. We are not proposing to apply all of the 
modified requirements described in proposed Sec.  117.201 in the PC 
proposed rule to qualified facilities that would be covered under this 
rule. We have tentatively concluded that such an approach is 
reasonable, considering the context and wording of the statutory 
provision as it relates to intentional adulteration caused by acts of 
terrorism.
    c. Withdrawal of exemption for qualified facilities. Section 
418(l)(3) of the FD&C Act provides that the Secretary of Health and 
Human Services may withdraw the exemption provided in section 
418(l)(2)(A) under certain circumstances. We discuss the withdrawal 
provisions of section 418(l)(3) of the FD&C Act, and the process we 
propose to use to withdraw an exemption for a qualified facility 
subject to that rule in section XIV.E of the PC proposed rule. We ask 
for comment on the appropriateness of those proposed procedures to 
withdraw an exemption for a qualified facility subject to this proposed 
rule. We also seek input on whether we should include the process for 
such withdrawal within proposed part 121 or whether those provisions 
might be best placed in a separate part and cross-referenced in 
proposed part 121 in order to reduce duplication, given these 
provisions also appear in the PC and the Produce Safety proposed rules.
2. Proposed Sec.  121.5(b)--Exemption for Holding of Food
    a. Requirement of section 418 of the FD&C Act. Section 418(m) of 
the FD&C Act provides in relevant part that FDA may by regulation 
``exempt or modify the requirements for compliance under [section 418 
of the FD&C Act] with respect to facilities that are solely engaged in 
. . . the storage of raw agricultural commodities (other than fruits 
and vegetables) intended for further distribution or processing or the 
storage of packaged foods that are not exposed to the environment.'' In 
the PC proposed rule, we proposed exemptions and modified requirements 
based on this provision (see proposed Sec. Sec.  117.5(j), 117.7, and 
117.206).
    b. Petition relevant to section 418(m) of the FD&C Act. In a letter 
dated July 22, 2011, an industry coalition of the American Bakers 
Association, the American Frozen Food Institute, the Grocery 
Manufacturers Association, the International Bottled Water Association, 
the International Dairy Foods Association, the International Warehouse 
Logistics Association, the Peanut and Tree Nut Processors Association, 
and the Snack Food Association (the section 418(m) petitioners) 
submitted a citizen petition (Docket No. FDA-2011-P-0561). The petition 
requests that FDA issue regulations under section 418(m) of the FD&C 
Act ``to exempt from compliance or modify the requirements for 
compliance under section 418 [of the FD&C Act] for facilities that are 
solely engaged in the storage of packaged foods that are not exposed to 
the environment, by allowing such facilities to satisfy the 
requirements of that section through compliance with the [CGMPs] 
mandated for such facilities by [current] Sec.  110.93.'' The section 
418(m) petitioners assert that the food safety issues presented by 
facilities used only to store packaged foods that are not exposed to 
the environment are essentially the same, regardless of the type of 
food. As such, trade associations representing a variety of product 
sectors are signatories to the petition and are supportive of the 
request to exempt such facilities from the provisions of section 418 of 
the FD&C Act.
    The section 418(m) petitioners stated, ``As an initial matter, the 
risk of intentional adulteration at facilities solely engaged in the 
storage of packaged foods not exposed to the environment is quite 
remote. The food in these facilities is stored in unit packaging, 
meaning any effort to adulterate the food would be laborious and likely 
ineffective.'' They further

[[Page 78036]]

asserted that, ``Members of the food industry have implemented a number 
of precautions against intentional adulteration. Most importantly, 
these facilities are locked and secured against unauthorized entry. 
Access is restricted to the employees of the manufacturer dropping off 
food, any staff employed at the facility, and the persons who deliver 
food to retailers and other customers. Food is often held in such 
facilities for a short period of time, which would not be conducive to 
attempts at intentional adulteration. Further, we note that the 
continual activity in these facilities during pickup and drop-off hours 
serves as a deterrent for anyone attempting to gain unauthorized 
access.''
    c. Proposed exemption for the holding of food. Proposed Sec.  
121.5(b) would exempt from the requirements in proposed part 121 the 
holding of food, except the holding of food in liquid storage tanks. 
This provision is broader in scope than exemptions in proposed 
Sec. Sec.  117.5(j) and 117.7 in the PC proposed rule, and would 
exempt, for example, storage of whole grains, shell eggs, fruits and 
vegetables, and packaged foods (including packaged milk and orange 
juice). It would not exempt, for example, storage in bulk storage tanks 
of milk or liquid orange juice.
    As discussed in section V.C.2 of this document, based on an 
analysis of the vulnerability assessments that FDA has conducted using 
the CARVER+Shock methodology, we identified four key activity types 
(Bulk liquid receiving and loading; Liquid storage and handling; 
Secondary ingredient handling; and Mixing and similar activities) as 
production processes that require focused mitigation strategies. With 
the exception of the holding of food in liquid storage tanks, which is 
not included in the proposed exemption, we are not aware of activities 
performed during the holding of food that fit within any of these four 
key activity types.
    We acknowledge that our proposed exemption in Sec.  121.5(b) is not 
identical to the exemption in section 418(m) of the FD&C Act. However, 
as explained above, the holding of food that would be exempt does not 
include any of the four key activity types associated with actionable 
process steps under proposed Sec.  121.130(a). Consequently, even 
without an exemption, this holding of food would not require the 
implementation of focused mitigation strategies under proposed Sec.  
121.130(a) to protect food against intentional adulteration. The only 
requirement related to holding activities would be for a written 
assessment that would conclude that no focused mitigation strategies 
are necessary with regard to the holding activities. Under these 
circumstances, we have tentatively concluded that an exemption is 
appropriate. Accordingly, we propose to exempt the holding of food, 
except the holding of food in liquid storage tanks, from the 
requirements of this proposed regulation. Although we are not 
responding to the merits of the arguments of the section 418(m) 
petitioners with regard to precautions against intentional 
adulteration, we believe that this proposed exemption meets the request 
of the section 418(m) petitioners.
3. Proposed Sec.  121.5(c)--Exemption for Packing, Re-Packing, 
Labeling, and Re-labeling of Food
    Proposed Sec.  121.5(c) would exempt from the requirements in 
proposed part 121 the packing, re-packing, labeling, or re-labeling of 
food where the container that directly contacts the food remains 
intact. As discussed in section V.C.2 of this document, based on an 
analysis of the vulnerability assessments that FDA has conducted using 
the CARVER+Shock methodology, we identified four key activity types 
(Bulk liquid receiving and loading; Liquid storage and handling; 
Secondary ingredient handling; and Mixing and similar activities) as 
production processes that require focused mitigation strategies. We are 
not aware of activities performed during the packing, re-packing, 
labeling, or re-labeling of food where the immediate package or 
container of the food remains intact that fit within any of these four 
key activity types.
    As discussed in section V.A of this document, the proposed rule 
would not require a facility that chooses to identify its actionable 
process steps under proposed Sec.  121.30(a) to implement focused 
mitigation strategies for a food process that does not include any of 
the four key activity types. Even without the exemption, a facility 
that conducts packing, re-packing, labeling, or re-labeling activities 
would be able to conclude that it has no key activity types and, 
therefore, would not be required to implement focused mitigation 
strategies. However, without an exemption, under proposed Sec.  
121.130, such a facility would be required to perform a written 
assessment to make this determination. We have tentatively concluded 
that requiring such an assessment is unnecessary. Consequently, we 
propose to exempt the packing, re-packing, labeling, or re-labeling of 
food where the container that directly contacts the food remains intact 
from the requirements of this proposed regulation.
4. Proposed Sec.  121.5(d)--Exemption for Produce Farms
    Proposed Sec.  121.5(d) would exempt from the requirements in 
proposed part 121 the activities of a facility that are subject to 
section 419 of the FD&C Act (Standards for Produce Safety). We discuss 
our tentative decision not to cover produce farms under section 419 of 
the FD&C Act in sections IV.B and IV.F, respectively, of this document.
    Section 418(k) of the FD&C Act provides that section 418 ``shall 
not apply to activities of a facility that are subject to section 
419''. Section 419 of the FD&C Act, ``Standards for Produce Safety,'' 
requires FDA to establish by regulation ``science-based minimum 
standards for the safe production and harvesting of those types of 
fruits and vegetables, including specific mixes or categories of fruits 
and vegetables, that are raw agricultural commodities for which [FDA] 
has determined that such standards minimize the risk of serious adverse 
health consequences or death.'' Section 419(h) of the FD&C Act provides 
that section 419 ``shall not apply to activities of a facility that are 
subject to section 418.''
    Establishments that are exempt from registration under section 415 
of the FD&C Act as ``farms'' would not be subject to section 418 of the 
FD&C Act when conducting activities within the farm definition. Farm 
mixed-type facilities would be subject to section 418 of the FD&C Act 
when conducting those activities that trigger the section 415 
registration requirement. We have tentatively concluded that 
Congressional intent regarding the reach of section 418(k) of the FD&C 
Act is unambiguous in that section 418(k) directly limits the exemption 
to activities of the facility that are subject to section 419 of the 
FD&C Act. We have also tentatively concluded that we should include a 
provision implementing section 418(k) of the FD&C Act in the proposed 
regulation to establish by regulation the reach of the exemption. 
Therefore, in proposed Sec.  121.5(d), we are proposing that proposed 
part 121 would not apply to activities of a facility that are subject 
to section 419 of the FD&C Act (Standards for Produce Safety).
    At the time FDA developed the farm definition and its 
interpretations of that definition, the practical impact of an 
activity's classification as inside or outside that definition was 
limited to the potential to trigger the section 415 registration 
regulations and the section 414 recordkeeping regulations. With the

[[Page 78037]]

advent of FSMA, the scope of the farm definition has taken on more 
importance because, for example, activities within the farm definition 
are not subject to section 418 of the FD&C Act, but activities outside 
the farm definition are subject to section 418. Therefore, FDA proposed 
to clarify and adjust the scope of the farm definition, including the 
classification of manufacturing, processing, packing, and holding 
activities relevant to that definition, in the proposed preventive 
controls regulations for human food. In section VIII.D of the PC 
proposed rule, we described a set of organizing principles that would 
form the basis for our proposal for classifying activities to more 
accurately reflect the scope of activities traditionally conducted by 
farms and to allow for more certainty among industry with regard to how 
their activities will be regulated.
5. Proposed Sec.  121.5(e)--Exemption for Alcoholic Beverages
    Proposed Sec.  121.5(e)(1) would provide that proposed part 121 
does not apply with respect to alcoholic beverages at a facility that 
meets the following two conditions: (i) Under the Federal Alcohol 
Administration Act (27 U.S.C. 201 et seq.) or chapter 51 of subtitle E 
of the Internal Revenue Code of 1986 (26 U.S.C. 5001 et seq.) the 
facility is required to obtain a permit from, register with, or obtain 
approval of a notice or application from the Secretary of the Treasury 
as a condition of doing business in the United States, or is a foreign 
facility of a type that would require such a permit, registration, or 
approval if it were a domestic facility; and (ii) Under section 415 of 
the Federal Food, Drug, and Cosmetic Act (21 U.S.C. 350d) the facility 
is required to register as a facility because it is engaged in 
manufacturing, processing, packing, or holding one or more alcoholic 
beverages.
    Proposed Sec.  121.5(e)(2) would provide that proposed part 121 
does not apply with respect to food other than alcoholic beverages at a 
facility described in paragraph (e)(1) of this section, provided such 
food: (i) Is in prepackaged form that prevents any direct human contact 
with such food; and (ii) Constitutes not more than 5 percent of the 
overall sales of the facility, as determined by the Secretary of the 
Treasury.
    In section X.C.7 of the PC proposed rule, we explain in detail our 
interpretation of section 116 of FSMA and our consideration of hazards 
and preventive controls for the manufacturing, processing, packing, and 
holding of alcoholic beverages. Based on that analysis, we proposed, in 
proposed Sec.  117.5(i), to exempt certain facilities engaged in the 
manufacturing, processing, packing, or holding of alcoholic beverages 
and other food. Consistent with that analysis, we are proposing similar 
exemptions related to alcoholic beverages in this proposed rule on 
focused mitigation strategies for the protection of food against 
intentional adulteration caused by acts of terrorism.
    We have tentatively concluded that we should include a provision 
implementing section 116 of FSMA in the proposed rule to establish by 
regulation the reach of the provision. We request comment on our 
interpretation of section 116 of FSMA, described in section X.C.7 of 
the PC proposed rule, and its application to the proposed exemption in 
Sec.  121.5(e).
6. Proposed Sec.  121.5(f)--Exemption for Food for Animals
    Proposed Sec.  121.5(f) would exempt from the requirements of 
proposed part 121 the manufacturing, processing, packing, and holding 
of food for animals other than man. In the Animal Food PC proposed 
rule, we proposed to require that facilities that manufacture, process, 
pack, or hold animal food and that are not otherwise covered by certain 
exemptions, design and implement a system of preventive controls to 
address food safety issues. In that proposed rulemaking, we tentatively 
concluded that hazards associated with intentional adulteration would 
likely require different kinds of controls and would be best addressed 
in a separate rulemaking.
    We also requested comment in that rulemaking on whether to include 
in those regulations potential hazards that may be intentionally 
introduced for economic reasons, which we refer to as economically 
motivated adulteration, a type of intentional adulteration. Our current 
thinking regarding economically motivated adulteration is discussed in 
section IV.F of this document.
    Section 418(m) of the FD&C Act authorizes FDA to exempt or modify 
the requirements for compliance with section 418 with regard to 
facilities that engage solely in the production of animal food. 
Further, section 420(c) of the FD&C Act requires that regulations that 
FDA issues under that section apply only to food for which there is a 
high risk of intentional contamination. In section IV.A of this 
document, we discuss how FDA is proposing to implement the provisions 
of sections 418 and 420 of the FD&C Act with regard to circumstances 
under which a facility subject to either of these sections would be 
required to have and implement focused mitigation strategies under a 
HACCP-like system to address intentional adulteration related to 
terrorism. In summary, this proposed rule would require a facility to 
implement focused mitigation strategies if one or more of four key 
activity types are applicable to its food operation or if a facility 
conducts its own vulnerability assessment and identifies actionable 
process steps for significant vulnerabilities in its food operation.
    The identification of a production step for a food as necessitating 
focused mitigation strategies is premised upon an analysis, based on 
CARVER+Shock methodology, that an attack at these points in the 
production of a food would likely result in an outcome that is 
consistent with our understanding of the goal of terrorist 
organizations (i.e., maximizing adverse public health impacts and, to a 
lesser extent, economic disruption) (Ref. 54). For human foods, our 
analyses show the potential for significant human morbidity and 
mortality should intentional adulteration occur at any one or more of 
these points in a food operation. (Significant economic harm is also 
likely, related to the human morbidity and mortality as well as 
disruption in the food supply as a result of loss of consumer 
confidence in its safety.) In contrast, for animal food, our analysis 
shows only minimal potential for human morbidity or mortality as a 
result of attacks at key activity types or other points in an animal 
food operation. Significantly, our CARVER+Shock vulnerability 
assessments of animal food have had to focus entirely on economic 
consequences because of the lack of potential for human morbidity and 
mortality.
    In considering whether to provide an exemption related to animal 
food, we evaluated three types of possible attack scenarios: (1) 
Incorporation of a contaminant into feed to be used for muscle meat-
producing animals; (2) incorporation of a contaminant into feed to be 
used for egg-producing or milk-producing animals; and (3) incorporation 
of a contaminant into pet food. With regard to the two former 
scenarios, we are not aware of contaminants that could be incorporated 
into feed at levels that would not produce noticeable clinical signs 
and/or mortality in animals but would result in significant human 
morbidity or mortality among consumers that subsequently eat the meat, 
eggs or milk (Ref. 55). While contaminants can increase the risk of 
chronic disease, such as cancer, among consumers (Ref. 56), such an 
outcome is not consistent

[[Page 78038]]

with our understanding of the goals of terrorist organizations, which 
include a more immediate impact. We recognize that such an attack could 
result in significant economic disruption because of the loss of 
consumer confidence in the safety of the food supply. While important, 
attacks of that nature fall significantly below those involving human 
morbidity and mortality when placed on a scale of risk with regard to 
targeting by terrorist organizations.
    Regarding the third attack scenario (incorporation of a contaminant 
into pet food), we are aware of contaminants that could be incorporated 
into feed or pet food that could result in significant animal 
(including pet) morbidity and mortality, including some which could 
result in secondary infectious spread of disease (because some 
infectious agents can be transmitted orally as well as through 
aerosol). Again, such attacks could be significant from an economic and 
societal standpoint. However, the risk that they pose with regard to 
targeting by terrorist organizations appears to be significantly lower 
than those involving human morbidity and mortality. We request comment 
on this assessment of risk.
    Therefore, notwithstanding the likely presence of one or more of 
the four key activity types in the production of many animal foods, we 
have tentatively concluded that animal food (regardless of whether it 
is produced at a facility solely engaged in the production of animal 
food or at a facility engaged in the production of both animal and 
human food) does not involve significant vulnerabilities that require 
focused mitigation strategies under section 418 of the FD&C Act and is 
not at high risk for intentional adulteration related to terrorism 
under section 420 of the FD&C Act. Consequently, we are proposing to 
exempt the manufacturing, processing, packing, and holding of food for 
animals other than man. We request comment on these tentative 
conclusions.

C. Food Defense Measures

    In subpart C of proposed part 121, FDA is proposing various food 
defense measures, including requirements for a food defense plan, 
identification of actionable process steps, implementation of focused 
mitigation strategies and related monitoring, corrective actions, and 
verification, and training of certain personnel. We discuss the 
provisions of proposed subpart C in this section.
1. Food Defense Plan
    a. Proposed Sec.  121.126(a)--Requirement for a Food Defense Plan. 
Proposed Sec.  121.126(a) would require that the owner, operator, or 
agent in charge of a facility prepare, or have prepared, and implement 
a written food defense plan. To make clear that the written plan is 
related to food defense rather than to other plans a facility may have 
(such as quality control plans or food safety plans), for purposes of 
this rulemaking, we have designated the ``written plan'' to be a ``food 
defense plan.'' A written food defense plan is essential for a facility 
covered by this rule to implement the plan consistently, train its 
employees, and periodically reanalyze and update the plan. It is also 
essential to auditors, and to inspectors, in the same way written plans 
are essential to ensuring food safety. A written food defense plan 
addressing vulnerabilities associated with intentional adulteration is 
analogous to a written HACCP or food safety plan for hazards associated 
with unintentional contamination.
    Proposed Sec.  121.126(a) would provide flexibility for the owner, 
operator, or agent in charge of the facility to either prepare the 
written food defense plan or have that plan prepared, in whole or in 
part, on its behalf. In addition, proposed Sec.  121.126 would provide 
flexibility for facilities in the development of their food defense 
plans by allowing facilities to group food types or production method 
types if the vulnerabilities, focused mitigation strategies, and other 
required procedures, such as monitoring, are essentially identical.
    Proposed Sec.  121.126(a) would require that the owner, operator, 
or agent in charge of a facility implement the written food defense 
plan. Our proposed requirement to develop and implement a food defense 
plan, which includes the identification of actionable process steps and 
implementation of focused mitigation strategies, reflects our tentative 
conclusion that such actions are measures necessary to prepare and 
protect the food supply from intentional adulteration caused by acts of 
terrorism. Proposed Sec.  121.126(a) implements sections 418(b), (c), 
(d), (e), (f), and (h), and 420(b) of the FD&C Act. We seek comment on 
these tentative conclusions.
    b. Proposed Sec.  121.126(b)--Contents of a food defense plan. 
Proposed Sec.  121.126(b)(1) through (b)(5) would require that the 
contents of a food defense plan include:
     The written identification of actionable process steps as 
required by proposed Sec.  121.130;
     The written focused mitigation strategies as required by 
proposed Sec.  121.135(b);
     The written procedures for monitoring as required by 
proposed Sec.  121.140(a);
     The written corrective action procedures as required by 
proposed Sec.  121.145(a)(1); and
     The written verification procedures as required by 
proposed Sec.  121.150(e).
    Although we are proposing to require that the contents of food 
defense plan include only the specific elements described above, the 
food defense plan can be used as a resource for facilities to capture 
additional food defense-related information. For example, facilities 
may also wish to include information, such as process flow diagrams, an 
evaluation of broad mitigation strategies, emergency contact 
information, crisis management plans, action plans for implementation 
of broad mitigation strategies, results of supplier audits, and other 
documents, analysis, reviews, or information the facility finds 
relevant to its food defense program. FDA has developed and publicly 
released the user-friendly FDPB software tool that can be used to 
assist a facility to develop a robust food defense plan. This free tool 
is available on the FDA Web site at https://www.fda.gov/Food/FoodDefense/ToolsEducationalMaterials/ucm349888.htm.
    Proposed Sec.  121.126, if finalized, would establish a requirement 
for every facility covered by this rule to have its own written food 
defense plan. Like the food safety plan, this facility-based nature of 
the written food defense plan is consistent with the overall framework 
of section 418 of the FD&C Act, which is directed to a facility rather 
than, for example, a corporate entity that may have multiple 
facilities.
    Proposed Sec.  117.126(c) of the PC proposed rule would require 
that the food safety plan be prepared by (or its preparation overseen 
by) a qualified individual (See the discussion in section XII.A.4 of 
the PC proposed rule). We are proposing to require that the 
vulnerability assessment be performed by an individual qualified by 
experience and/or training only when facilities choose to identify 
actionable process steps in their food defense plans using the 
provisions of proposed Sec.  121.130(b), whereby they would perform 
their own vulnerability assessment. Our proposal is based on two 
considerations. First, we anticipate that most facilities will develop 
their food defense plan using the procedure in proposed Sec.  
121.130(a) for identification of actionable process steps. Here, FDA 
has performed much of the scientific analysis required and identified 
the key activity types (see section V.C.2 of this document for

[[Page 78039]]

further discussion). Second, we believe that the identification of 
focused mitigation strategies, and the monitoring, corrective action 
and verification activities to implement them requires less technical 
expertise than required for preventive controls and implementation 
procedures for those controls. The former usually involve focused 
mitigation strategies to limit access to specific steps in the 
production process with simple visual checks to monitor them, while the 
latter often involve scientific studies to establish critical limits 
with process control instruments to monitor them.
    Proposed Sec.  121.126(b) implements sections 418(h) and 420(b)(2) 
of the FD&C Act.
    We seek comment on our proposed provisions related to the written 
food defense plan and its contents.
2. Identification of Actionable Process Steps
    a. FDA's vulnerability assessments and FDA-identified key activity 
types. As noted in section II.B of this document, under the SPPA 
Initiative, FDA, along with USDA, FBI, and DHS, conducted vulnerability 
assessments on products and processes in the food and agriculture 
sector. After conclusion of the initiative, FDA continued conducting 
assessments for products and processes not previously assessed. To 
implement section 420(a)(1)(A), FDA combined and analyzed data from a 
subset of these assessments (i.e., those relevant to the food 
manufacturing and distribution segments of the food system) and 
identified activities which consistently ranked high for vulnerability 
to intentional adulteration. FDA published the results of this analysis 
in April, 2013 (April 2013 Report) (Ref. 54).
    CARVER+Shock methodology is a tool for assessing the 
vulnerabilities within a food system and determining the most 
vulnerable points, and focusing resources on protecting the most 
susceptible points. Using the CARVER+Shock methodology, FDA, in 
collaboration with other U.S. government partners conducted over 50 
vulnerability assessments on a wide range of food products and 
processes. Based on these assessments, we identified the processing 
steps with the greatest vulnerability to intentional adulteration 
caused by acts of terrorism. Through this review, we determined that 
the processing steps we identified fit into one of four groups of 
activities occurring at those processing steps. We refer to these as 
``key activity types.'' The key activity types that we have identified 
are: (1) Bulk liquid receiving and loading, (2) Liquid storage and 
handling, (3) Secondary ingredient handling, and (4) Mixing and similar 
activities. In this proposed rule we have modified the activity type 
names and descriptions from those in the April 2013 Report for clarity.
    Providing these key activity types to facilities for their use in 
identifying actionable process steps and developing focused mitigation 
strategies provides some advantages over other approaches that we might 
have taken, such as identifying points in the production of specific 
foods at increased risk for intentional adulteration caused by an acts 
of terrorism, or requiring each facility to perform its own 
vulnerability assessment. First, publicly providing a list of key 
activity types does not disclose sensitive information, as might be the 
case if we provided CARVER+Shock scores derived from our vulnerability 
assessments for process steps for specific foods.
    Second, providing a list of key activity types rather than 
requiring facilities to perform their own facility-specific 
vulnerability assessments relieves the burden upon the facility to 
assemble a team of individuals with the diverse expertise needed to 
properly self-score the steps in their process (using the CARVER+Shock 
Vulnerability Assessment software tool or another suitable tool). When 
we performed vulnerability assessments during the SPPA initiative our 
teams included individuals with expertise in the production of the food 
under study, law enforcement, food science, food regulatory systems, 
and public health. We expect that such an effort is likely beyond the 
capacity of many facilities. Further, by providing a list of key 
activity types, we eliminate the need to identify a CARVER+Shock score, 
for example, as the threshold for the implementation of focused 
mitigation strategies. This is important because CARVER+Shock scores 
are somewhat subjective and difficult to correlate across food types, 
making identification of a universal threshold score challenging.
    b. Proposed Sec.  121.130--Requirement for written identification 
of actionable process steps. Proposed Sec.  121.130 would require that 
the owner, operator, or agent in charge of a facility identify any 
actionable process steps, using the procedures in either proposed Sec.  
121.130(a) or proposed Sec.  121.130(b). A facility would be required 
to follow either one of the two specified procedures, but not both.
    Proposed Sec.  121.130 would also require that the identification 
of actionable process steps and the assessment leading to that 
identification be written. A written assessment of whether the facility 
has one or more of the key activity types (under proposed Sec.  
121.130(a)) or a written vulnerability assessment (under proposed Sec.  
121.130(b)) would help the facility organize its assessment, and fully 
understand the nature of the vulnerabilities. In addition, it is 
essential for auditors and inspectors to assess the adequacy of the 
facility's assessment. This written identification of actionable 
process steps would also be essential during reanalysis of the food 
defense plan, as would be required by proposed Sec.  121.150(d). Such a 
written document would also be useful for training purposes as a tool 
to make employees aware of the elements of the facility's food defense 
plan.
    The written identification of actionable process steps must include 
the justification for whatever conclusion the owner, operator, or agent 
in charge of a facility reaches. Proposed Sec.  121.130 would not limit 
the requirement for a written identification of actionable process 
steps to only those circumstances where the owner, operator, or agent 
in charge of a facility identifies one or more actionable process 
steps. Rather, under proposed Sec.  121.130, a written analysis would 
be required even if the conclusion of the analysis is that there are no 
actionable process step.
    If a facility chooses to identify actionable process steps using 
the procedure in proposed Sec.  121.130(a), the written documentation 
would not need to include the procedures for assessing the 
vulnerabilities associated with identified actionable process steps. If 
a facility chooses to identify actionable process steps using the 
procedure in proposed Sec.  121.130(b), the written identification of 
actionable process steps must include information about the appropriate 
methods used to conduct the vulnerability assessment and identify 
actionable process steps, and the experience and training of the 
person(s) who conducted that assessment (see also discussion in section 
V.C.2.d of this document).
    Proposed Sec.  121.130 implements sections 418(b)(2), 418(b)(3), 
420(a)(1), and 420(b)(1) of the FD&C Act.
    c. Proposed Sec.  121.130(a)--Identification of actionable process 
steps using FDA-identified key activity types. Proposed Sec.  
121.130(a) would specify the first of two procedures by which the 
proposed requirement for identification of actionable process steps in 
proposed Sec.  121.130 can be met, i.e., using the FDA-identified key 
activity types.

[[Page 78040]]

    Proposed Sec.  121.130(a) would state that the owner, operator, or 
agent in charge of a facility must assess, for each type of food 
manufactured, processed, packed or held at the facility, whether the 
facility has one or more of the following key activity types and 
identify the actionable process steps associated with any key activity 
types present:
    1. Bulk liquid receiving and loading--a step in which a bulk liquid 
is received and unloaded from an inbound conveyance or loaded into an 
outbound conveyance where a contaminant can be intentionally introduced 
and, if it is, it is likely that the contaminant will be distributed 
throughout the liquid due to sloshing, movement, or turbulence caused 
by the receiving and unloading or loading activity;
    2. Liquid storage and handling--a step in which a liquid is 
contained in bulk storage tanks or in holding, surge, or metering tanks 
where a contaminant can be intentionally introduced and, if it is, it 
is likely that the contaminant will be distributed into the food;
    3. Secondary ingredient handling--a staging, preparation, addition, 
or rework step where a contaminant can be intentionally introduced into 
a relatively small amount of ingredient or rework and, if it is, it is 
likely that the contaminant will be distributed into a larger volume of 
food; and
    4. Mixing and similar activities--a step, such as mixing, blending, 
homogenizing, or grinding where a contaminant can be intentionally 
introduced and, if it is, it is likely that the contaminant will be 
distributed into the food.
    The owner, operator, or agent in charge would be required to assess 
whether the facility has a food process that involves any one or more 
of the specified four key activity types. If the food process is found 
to involve any key activity types, the owner, operator, or agent would 
be required to identify actionable process step(s) that are associated 
with each key activity type that is present.
    For example, based on proposed Sec.  121.130(a), a facility may 
identify a mixing tank as involving the key activity type, Mixing and 
similar activities, in its operation because the mixing tank has an 
unsecured lid and several sample ports which provide direct access to 
the food product and because a contaminant can be introduced into the 
tank through the lid or one of the sampling ports and, if it is, the 
contaminant would be distributed into the food. The owner would 
conclude that the mixing tank is an actionable process step. We would 
expect that this conclusion would be reached for virtually all steps 
that involve mixing, blending, homogenizing, or grinding because these 
kinds of process steps generally: (1) Present an opportunity for access 
to the product at or just prior to the equipment (e.g., in-feed 
conveyor); and (2) would cause a contaminant, if intentionally added, 
to be distributed into the food. We expect this conclusion to be 
reached regardless of whether the facility may already have mitigation 
strategies in place to impede access to the mixing tank (e.g., a 
``buddy system'' that ensures that at least two employees were present 
at the mixing tank at all times or a lock on the mixing tank access 
ports). The presence of mitigation strategies should not be considered 
when assessing whether a facility has a process step that involves one 
of the key activity types. Any existing mitigation strategies and their 
adequacy to significantly minimize or prevent the significant 
vulnerability should be considered at a later step when identifying 
appropriate focused mitigation strategies, in accordance with proposed 
Sec.  121.135.
    We acknowledge the possibility, although not likely, that 
circumstances may exist where access at or just prior to the equipment 
is not possible (i.e., because the equipment is fully enclosed, with no 
access ports), and that in such a situation this process step would not 
be identified as fitting within the key activity type. For example, the 
owner of the same facility may assess a second mixing tank that is part 
of an entirely closed system, with no direct access points into the 
system, such that an individual attempting to access this mixing tank 
would likely cause a major disruption to the line, foiling any 
attempted intentional adulteration. Based on this assessment, the owner 
may conclude that the enclosed nature of this second mixing tank 
renders the product inaccessible at this step and, therefore, it does 
not fit within the key activity type. In this circumstance, there would 
be no requirement to identify an actionable process step associated 
with this mixing tank (in which case, there also would be no 
requirement to implement a focused mitigation strategy at this step). 
Under proposed Sec.  121.130, the owner would be required to document 
the basis for the determination that the second mixing tank does not 
fit within the key activity type. The second mixing tank would continue 
to be subject to the requirement for reanalysis of a food defense plan, 
as proposed in Sec.  121.150(d) and the facility would consider the 
applicability of the four key activity types during reanalysis. We 
request comment on whether there are specific process steps for 
specific products that otherwise fit within one of the four key 
activity types but for which access to the equipment is not possible 
(i.e., because the equipment is fully enclosed, with no access ports).
    If the owner, operator, or agent in charge determines that the food 
operation does not involve any of the key activity types, there would 
be no need to identify actionable process steps. Such a facility, 
however, would still be required to document its finding that none of 
the key activity types apply to its food processes, under proposed 
Sec.  121.130. The documentation would be a part of the written food 
defense plan required under proposed Sec.  121.126. Such a facility 
would continue to be subject to the requirement for reanalysis of a 
food defense plan, as proposed in Sec.  121.150(d).
    Proposed Sec.  121.130(a) would require that the process of 
identification of actionable process steps be done ``for each type of 
food manufactured, processed, packed, or held at the facility.'' The 
vulnerability of a food to intentional contamination may differ based 
on the type of food and associated process, practices, and conditions 
at the facility. Therefore, we are proposing that the facility assess 
whether it has any of the key activity types for each type of food that 
is manufactured, processed, packed, or held at that facility. A 
facility may find that its operation related to one type of food 
manufactured at that facility involves one or more of the key activity 
types, but all other types of food manufactured at that facility do not 
involve any of the key activity types. In such an instance, actionable 
process steps would need to be identified and focused mitigation 
strategies implemented only for the food type that involved the key 
activity types.
    Description of key activity types--As discussed in section V.C.2.a 
of this document, our vulnerability assessments revealed four key 
activity types that most commonly rank high: Bulk liquid receiving and 
loading; Liquid storage and handling; Secondary ingredient handling; 
and Mixing and similar activities. We have tentatively concluded that 
the presence of any of these four key activity types in a food 
operation indicates a significant vulnerability for intentional 
contamination caused by acts of terrorism. Based on our assessments, we 
believe that these four key activity types capture the significant 
vulnerabilities in a food operation. However, although generally 
unlikely, a vulnerability

[[Page 78041]]

assessment of a specific food at a specific facility conducted under 
proposed Sec.  121.130(b) may identify significant vulnerabilities at 
actionable process steps that are not associated with one of these four 
key activity types. We seek comment on our tentative conclusion.
    Proposed Sec.  121.130(a)(1) would identify ``Bulk liquid receiving 
and loading'' as a key activity type, based on our finding that this 
activity type commonly ranked high in our vulnerability assessments. 
Proposed Sec.  121.130(a) would describe this key activity type as a 
step in which a bulk liquid is received and unloaded from an inbound 
conveyance or loaded into an outbound conveyance where a contaminant 
can be intentionally introduced and, if it is, it is likely that the 
contaminant will be distributed throughout the liquid due to sloshing, 
movement, or turbulence caused by the receiving and unloading or 
loading activity. Bulk liquid receiving refers to the inbound movement 
of liquid product into a facility for its use in the food production 
process, whereas bulk liquid loading refers to the outbound movement of 
liquid product from a facility for further processing or use by an end 
customer/consumer. Examples of products that may be received or loaded 
in bulk include juices, high fructose corn syrup and other sweeteners, 
milk, animal fats, syrups, and vegetable oils.
    Bulk liquid receiving and loading refers to any processing step 
where a liquid ingredient is being received and unloaded at a facility 
or a liquid intermediate or finished product is being loaded into an 
outbound shipping transport vehicle and for which there is an 
opportunity for a contaminant to be intentionally introduced into the 
food. This key activity type incorporates the actions of opening the 
transport vehicle, attaching any pumping equipment or hoses, and 
opening any venting hatches. The characteristics associated with these 
activities are such that there is a high probability of a contaminant, 
if intentionally added, mixing within the liquid, due to significant 
sloshing, movement, and turbulence associated with the receiving or 
loading activity. In addition, the need for worker activity associated 
with these processing steps provides access to hoses, the transport 
vessel, and potentially the product as it is being received or loaded.
    Proposed Sec.  121.130(a)(2) would identify ``Liquid storage and 
handling'' as a key activity type, based on our finding that this 
activity type ranked high in our vulnerability assessments. Proposed 
Sec.  121.130(a) would describe this key activity type as a step in 
which a liquid is contained in bulk storage tanks or in holding, surge, 
or metering tanks where a contaminant can be intentionally introduced 
and, if it is, it is likely that the contaminant will be distributed 
into the food. This key activity type refers to any processing step 
where a liquid ingredient or intermediate or finished liquid product is 
stored in either bulk storage tanks or smaller secondary, non-bulk 
holding tanks or surge tanks and for which there is an opportunity for 
a contaminant to be intentionally introduced into the food. Bulk liquid 
storage refers to any storage silo or tank where liquid product may be 
stored prior to introduction into the product stream or prior to 
loading for outbound shipping. Non-bulk tanks can be used to store non-
bulk liquid ingredients (e.g., fats, oils, vitamin mixes, and 
sweeteners), hold liquid product for sample testing and other quality 
control activity, or to control flow rates of liquid ingredients or 
product through the production system. Non-bulk storage tanks also 
include tanks or totes where the tamper evident seals are opened and 
the container itself is used for holding. Both categories of liquid 
storage can be considered key processing steps because if a contaminant 
were successfully introduced, there is a high probability of a 
contaminant mixing within the liquid due to the agitation commonly used 
to prevent separation within the liquid medium. Access necessary for 
the introduction of a contaminant is generally available through 
hatches, sample ports, and the container lid (in the case of a tanker 
or tote for which the tamper evident seal has been broken).
    Proposed Sec.  121.130(a)(3) would identify ``Secondary ingredient 
handling'' as a key activity type, based on our finding that this 
activity type commonly ranked high in our vulnerability assessments. 
Proposed Sec.  121.130(a) would describe this key activity type as the 
staging, preparation, addition, or rework step where a contaminant can 
be intentionally introduced into a relatively small amount of 
ingredient or rework and, if it is, it is likely that the contaminant 
will be distributed into a larger volume of food. This key activity 
type refers to any processing step where ingredients (either dry or 
liquid) are manipulated prior to or during addition to the product 
stream by human contact and for which there is an opportunity for a 
contaminant to be intentionally introduced into the food. ``Staging'' 
refers to the process of opening the tamper evident packaging of a 
secondary ingredient and moving the ingredient to the production area 
in advance of being added into the primary product stream. 
``Preparation'' refers to any act of measuring, weighing, premixing, or 
otherwise manipulating the ingredient prior to addition to the product 
stream. ``Addition'' refers to any act of physically adding ingredient 
directly into the product stream or into surge or meter hoppers in 
order to deliver the ingredient into the product stream. ``Rework'' 
refers to clean, unadulterated food that has been removed from 
processing for reasons other than insanitary conditions or that has 
been successfully reconditioned by reprocessing and that is suitable 
for use as food. Staging, preparation, addition, and rework involving 
secondary ingredients are key activities because a contaminant added to 
a relatively small volume of product would be distributed into the 
large product flow as the ingredient or rework is combined with the 
other components of the food. Secondary ingredient staging, 
preparation, addition, and rework are generally open and accessible and 
that accessibility is an inherent component of the activity. Thus, 
these key activities provide a potential point of access where a 
contaminant could be introduced into the product stream.
    Proposed Sec.  121.130(a)(4) would identify ``Mixing and similar 
activities'' as a key activity type, based on our finding that the 
activities commonly ranked high in our vulnerability assessments. 
Proposed Sec.  121.130(a) would describe this key activity type as a 
step, such as mixing, blending, homogenizing, coating, glazing, or 
grinding where a contaminant can be intentionally introduced and, if it 
is, it is likely that the contaminant will be distributed into the 
food. This key activity type refers to any processing step where there 
is an opportunity for a contaminant to be intentionally introduced into 
the food, and the primary purpose or result of the processing step is: 
(1) Coating, i.e., to layer a powder or liquid onto the surface of a 
product, such as a batter, breading, glazing or flavoring; (2) mixing, 
i.e., to blend a powder, dough, or liquid ingredient together; (3) 
grinding, i.e., to reduce the particle size of a solid ingredient or 
mass to a smaller granularity; or (4) homogenizing, i.e., to reduce the 
particle size of an ingredient and disperse it throughout a liquid.
    These are key activities because a potential contaminant 
successfully added at one of these steps would generally be readily 
dispersed throughout the product. Further, access is generally 
available through access ports, lids, and in-feed conveyors or

[[Page 78042]]

flumes. Examples of equipment associated with these activities include: 
Mixers, blenders, homogenizers, cascade breaders, mills, grinders, and 
pulverizers.
    We seek comment on these key activity types, and whether they are 
each appropriate to include and whether there are additional activities 
that present significant vulnerability to intentional adulteration 
caused by acts of terrorism.
    Proposed Sec.  121.130(a) implements sections 418(a) through (c) 
and 420(a)(1)(A) of the FD&C Act.
    d. Proposed Sec.  121.130(b)--Identification of actionable process 
steps by conducting a vulnerability assessment. Proposed Sec.  
121.130(b) would provide the second of two options for identification 
of actionable process steps. Proposed Sec.  121.130(b) would specify 
that the owner, operator, or agent in charge of a facility must conduct 
or have conducted, for each food type manufactured, processed, packed 
or held at the facility, an evaluation to identify and prioritize the 
points, steps, and procedures in a food operation based on their 
vulnerability to intentional adulteration and to identify actionable 
process steps.
    Proposed Sec.  121.130(b) would provide flexibility to the owner, 
operator, or agent in charge of a facility covered by this rule to 
conduct, or have conducted, their own vulnerability assessment of the 
food operations at a facility, rather than assessing their food 
operation against the FDA-identified key activity types. We are 
proposing that a vulnerability assessment conducted under proposed 
Sec.  121.130(b) must be performed by an individual(s) qualified by 
experience and/or training using appropriate methods. Training or job 
experience is essential to the effective evaluation of vulnerabilities 
and identification of actionable process steps. Only a trained 
individual or individual qualified by job experience using appropriate 
methods would be capable of effectively conducting a vulnerability 
assessment, including assessing the various points, steps, or 
procedures in a food process; identifying and prioritizing those 
points, steps, or procedures in a food process that are susceptible to 
intentional contamination; and identifying actionable process steps 
where food defense measures are essential to address significant 
vulnerabilities. Our proposed definition of significant vulnerability 
(in proposed Sec.  121.3), too, reflects the need for a qualified 
individual to make such assessments where focused mitigation strategies 
would be necessary to protect the food from intentional adulteration 
caused by acts of terrorism. As noted above, when we performed 
vulnerability assessments during the SPPA initiative our teams included 
individuals with expertise in the production of the food under study, 
law enforcement, food science, food regulatory systems, and public 
health. While we are not proposing to specify the particular training 
or experience requirements of the individual(s) qualified to conduct 
such vulnerability assessments, or the particular methods that must be 
used to conduct these assessments, facilities choosing this procedure 
in proposed Sec.  121.130(b) would be required to employ appropriate 
methods and use a qualified individual(s) to conduct a robust and 
scientifically sound vulnerability assessment of the facility's food 
operation. FDA's resources available online, such as the CARVER+Shock 
Vulnerability Assessment software tool and the FDPB software tool may 
be helpful.
    Finally, as in the case of proposed Sec.  121.130(a), proposed 
Sec.  121.130(b) would require that the process of identification of 
actionable process steps be done ``for each type of food manufactured, 
processed, packed, or held at the facility.'' See discussion in section 
V.C.2 of this document.
    Elements of a Facility-Specific Vulnerability Assessment--The 
elements of an approach to conducting a facility-specific vulnerability 
assessment are:
     Planning to conduct a vulnerability assessment--collect 
and evaluate appropriate background information on biological, 
chemical, physical, and radiological agents of concern, such as those 
found in the CDC's Select Agents and Toxins List (Ref. 57);
     Assembling the vulnerability assessment team--identify 
appropriate individuals within the organization to assist in the 
vulnerability assessment process. This may include personnel working in 
the areas of security, food safety/quality assurance or control, human 
resources, operations, maintenance, and other individuals deemed 
necessary to facilitate the formation of a vulnerability assessment;
     Developing a process flow diagram--list out each of the 
steps in the food process to be evaluated;
     Identifying significant vulnerabilities--evaluate each 
process step to prioritize vulnerabilities and identify significant 
vulnerabilities. For each process step, the evaluation should consider, 
at a minimum: (1) The potential public health impact if a contaminant 
were added; (2) whether downstream processing steps would eliminate or 
remove agents of concern; (3) the degree of physical access to product; 
(4) the ability of an aggressor to successfully contaminate the 
product; and (5) the volume of product impacted. This evaluation should 
also include the rationale or justification for which process steps 
were and were not identified as significant vulnerabilities; and
     Identifying actionable process steps--for identified 
significant vulnerabilities, indicate where actionable process steps 
exist in the food process and where associated focused mitigation 
strategies would be required to be implemented, under proposed Sec.  
121.135.
    Facilities that choose this alternative may need assistance from 
outside experts who are knowledgeable in food defense and vulnerability 
assessments. Some facilities may not have the resources or the 
necessary expertise on site and expert advice may be obtained when 
necessary from other sources, such as trade and industry associations, 
independent experts, and regulatory authorities.
    We seek comment on the need for, and appropriateness of, proposed 
Sec.  121.130(b), including whether, in a final rule, we should specify 
the particular qualifications of individual(s) performing the 
vulnerability assessment or the methods that must be used under this 
alternative procedure, and whether the vulnerability assessment 
elements, we described previously, provide sufficient direction 
regarding appropriate methodology.
    Proposed Sec.  121.130(b) implements sections 418(a) to (c) and 
420(a)(1)(A) of the FD&C Act.
3. Focused Mitigation Strategies
    a. Requirements of sections 418 and 420 of the FD&C Act. Section 
418(c)(2) of the FD&C Act, in relevant part, specifies that the owner, 
operator, or agent in charge of a facility shall identify and implement 
preventive controls to provide assurances that hazards identified in 
the hazard analysis conducted under section 418(b)(2) of the FD&C Act 
will be significantly minimized or prevented and addressed, consistent 
with section 420 of the FD&C Act, as applicable. Section 418(c)(1)(3) 
of the FD&C Act, in relevant part, specifies that the preventive 
controls must also provide assurances that the food manufactured, 
processed, packed, or held by such facility will not be adulterated 
under section 402 of the FD&C Act. Section 418(h) of the FD&C Act 
requires that the owner, operator, or agent in charge of a facility 
prepare a written food safety plan that, among

[[Page 78043]]

other things, identifies the preventive controls within the plan. 
Section 420(b) of the FD&C Act requires FDA to issue regulations to 
protect against the intentional adulteration of food. Such regulations 
are to specify appropriate science-based mitigation strategies or 
measures to prepare and protect the food supply chain at specific 
vulnerable points, as appropriate (section 420(b)(2) of the FD&C Act).
    Section 418(o)(3) of the FD&C Act defines preventive controls as 
``those risk-based, reasonably appropriate procedures, practices, and 
processes that a person knowledgeable about the safe manufacturing, 
processing, packing, or holding of food would employ to significantly 
minimize or prevent the hazards identified under the hazard analysis 
conducted under [section 418(b) of the FD&C Act] and that are 
consistent with the current scientific understanding of safe food 
manufacturing, processing, packing or holding at the time of the 
analysis.'' The definition provides that ``those procedures, practices, 
and processes may include the following: (A) Sanitation procedures for 
food-contact surfaces and utensils and food-contact surfaces of 
equipment; (B) Supervisor, manager, and employee hygiene training; (C) 
An environmental monitoring program to verify the effectiveness of 
pathogen controls in processes where a food is exposed to a potential 
contaminant in the environment; (D) A food allergen control program; 
(E) A recall plan; (F) Current Good Manufacturing Practices (cGMPs) 
under part 110 of title 21, Code of Federal Regulations (or any 
successor regulations); (G) Supplier verification activities that 
relate to the safety of food.'' (emphasis added)
    In section V.A.2 of this document, we discuss our proposed 
definition of focused mitigation strategy and its relationship to the 
definition of preventive controls in section 418(o)(3) of the FD&C Act. 
We are not proposing requirements for sanitation procedures, hygiene 
training, environmental monitoring, food allergen control, and CGMPs 
because these examples are relevant to food safety, but not to food 
defense. We considered proposing to require a recall plan (as we did in 
the PC proposed rule in proposed Sec.  117.135(d)(4); see sections 
XII.C.8 and XII.D of that document). However, we tentatively conclude 
that the usefulness of a recall plan is greatly reduced in the context 
of preventive controls for intentional adulteration. The relationship 
between an implementation failure and the status of the food is 
different in intentional adulteration and food safety contexts. An act 
of intentional adulteration caused by terrorism, historically, has been 
a rare event. In the vast majority of cases, the failure to properly 
implement a focused mitigation strategy would not be expected to result 
in intentional adulteration. With intentional adulteration, 
adulteration of food requires not just the opportunity for a 
contamination event (i.e., failure of a mitigation strategy to limit 
access to an actionable process step), but also someone with intent to 
cause harm at that same moment. As such, it is unlikely that a 
deviation from the provisions of this proposed rule would necessitate a 
recall. In contrast, the failure to properly implement a preventive 
control for a food safety hazard (for example, where proper cook 
temperatures are not reached in a process) would be expected to more 
likely result in a situation where the food becomes adulterated (e.g., 
because the pathogen reasonably likely to be present in the raw food 
would not be eliminated from the food by the inadequate cooking 
process), potentially necessitating a recall.
    b. General description of mitigation strategies. Mitigation 
strategies are measures taken by a facility to reduce the potential for 
intentional adulteration of food. Based on these vulnerability 
assessments, FDA previously developed recommendations for mitigation 
strategies that can be implemented, as appropriate, to minimize or 
prevent intentional contamination of food. These mitigation strategies 
are presented in our guidance documents (Ref. 22, Ref. 23, Ref. 24, 
Ref. 25, Ref. 26), the CARVER+Shock Vulnerability Assessment software 
tool (Ref. 29), the MSD (Ref. 30), and the FDPB software tool (Ref. 
31). FDA divides mitigation strategies into two types: Broad Mitigation 
Strategies and Focused Mitigation Strategies. We explain each of these 
types in this section of the document.
    i. Broad mitigation strategies. Broad mitigation strategies are 
general facility-level measures that are intended to minimize a 
facility's vulnerability, as a whole, to potential acts of intentional 
contamination. Examples of broad mitigation strategies are: (1) 
Physical security, such as perimeter security fencing, locking exterior 
doors, penetration alarms; (2) personnel security, such as pre-hire 
background, reference checks, identification badges, and controlled 
visitor access; (3) securing hazardous materials, such as cleaning 
products, laboratory materials, and pesticides; (4) management 
practices, such as ingredient storage inventory procedures; key 
security procedures, PINs or passwords; procedures to restrict personal 
items from all food production areas; procedures requiring IDs and 
uniforms to be returned when a person's employment ends; and supplier 
verification or certification procedures; and (5) crisis management 
planning, such as maintenance of updated emergency contact information, 
procedures for responding to reported threats, and establishment of a 
designated food defense leadership team.
    Broad mitigation strategies, by nature, are generally applicable to 
a facility, regardless of the type of food being processed, and, as 
such, are not targeted to a specific processing step in a food 
operation. Broad mitigation strategies address facility-wide 
vulnerabilities that may present an opportunity for an attacker to 
access the facility and intentionally adulterate food. Broad mitigation 
strategies serve as foundational actions or procedures that improve a 
facility's overall defense against intentional contamination caused by 
acts of terrorism.
    We are proposing to require the implementation of focused 
mitigation strategies only. However, as set out in our guidance 
documents (Ref. 22, Ref. 23, Ref. 24, Ref. 25, Ref. 26), we think it is 
prudent for facilities to review our guidance and implement those broad 
mitigation strategies that are appropriate to minimize the risk for 
intentional adulteration of food.
    ii. Focused mitigation strategies. As discussed in section V.A of 
this document, we are proposing to define focused mitigation strategies 
as those risk-based, reasonably appropriate measures that a person 
knowledgeable about food defense would employ to significantly minimize 
or prevent significant vulnerabilities identified at actionable process 
steps, and that are consistent with the current scientific 
understanding of food defense at the time of the analysis.
    Focused mitigation strategies are specific to an actionable process 
step in a food operation where a significant vulnerability is 
identified. They represent reasonably appropriate measures that are 
necessary to reduce the likelihood of intentional contamination caused 
by an act of terrorism at that process step. Focused mitigation 
strategies are customized to the processing step at which they are 
applied, tailored to existing facility practices and procedures, and 
depend on an evaluation of the vulnerabilities identified in a 
vulnerability assessment. When properly implemented, focused

[[Page 78044]]

mitigation strategies by themselves are sufficient to significantly 
minimize or eliminate the chances that an attacker would be successful 
if an act of intentional adulteration were attempted at the specific 
process step. Focused mitigation strategies focus on minimizing either 
the accessibility of an attacker to the product at a particular process 
step or the opportunity for the attacker to successfully contaminate 
the product at that process step, or both.
    Based on our vulnerability assessments, we tentatively conclude 
that the implementation of focused mitigation strategies at actionable 
process steps in a food operation is necessary to minimize or prevent 
the significant vulnerabilities that are identified in a vulnerability 
assessment (Ref. 21, Ref. 54, Ref. 58), regardless of the existence of 
broad mitigation strategies. Although broad mitigation strategies are 
important to further reduce the vulnerability for intentional 
contamination, they are not sufficient to significantly minimize the 
risk of intentional contamination caused by an act of terrorism because 
broad mitigation strategies are not specific enough, for example, to 
counter the actions of an attacker who has legitimate access to the 
facility (i.e., insider attack) or an attacker who circumvents 
perimeter protections (e.g., scaling a fence), with the goal of 
intentionally contaminating the food. Focused mitigation strategies, on 
the other hand, are targeted to actionable process steps identified in 
a food operation to reduce the likelihood of intentional contamination 
at those process steps and, therefore, are essential to ensure that 
appropriate food defense measures are taken to protect the food from 
intentional contamination caused by acts of terrorism. In contrast to 
broad mitigation strategies, focused mitigation strategies are targeted 
to actionable process steps and, therefore, are more effective at 
countering an attacker who has legitimate access to the facility. We 
have tentatively concluded that we will continue to encourage the 
implementation of broad mitigation strategies on a voluntary basis, but 
we will require the implementation of focused mitigation strategies at 
actionable process steps. We request comment on this tentative 
conclusion, and on whether we should include, in a final rule, a 
requirement for the implementation of any broad mitigation strategies.
    iii. Examples of focused mitigation strategies for FDA-identified 
key activity types. For the FDA-identified key activity types, a 
variety of focused mitigation strategies may be applicable, dependent 
both on the food manufactured, processed, packed, or held at the 
facility and on the practices and processes employed at that facility. 
We list in this section some examples of focused mitigation strategies 
that may be appropriate to implement at actionable process steps for 
each of these four key activity types. While the decision of which and 
how many focused mitigation strategies would be appropriate to employ 
at an actionable process step is dependent upon the physical layout and 
operation at a specific facility, the examples presented in the section 
immediately below illustrate the decision-making process to identify 
and determine appropriate focused mitigation strategies at an 
actionable process step.
    Bulk liquid receiving and loading--Examples of focused mitigation 
strategies that may be appropriate include the following:
    1. Controlling access to the receiving or loading area, 
conveyances, and equipment, including hoses and pumping machinery, to 
prevent an unauthorized person from gaining access to the food during 
receiving or loading. Access controls may include: strategies to easily 
identify authorized persons, such as color-coded uniforms or badges; 
restricting conveyance drivers to areas away from the receiving or 
loading area (e.g., restricting them to a lounge or break room); 
securing hoses with locking caps or in cabinets; and ensuring that 
conveyance access hatches, vents, and inspection ports are secured;
    2. Ensuring adequate lighting in the receiving or loading area, 
which reduces the ability of an attacker to disguise his or her 
actions. Adequate lighting in and around vulnerable areas of a food 
operation increases the likelihood that other staff will witness the 
actions of an attacker and enable them to take steps to prevent or 
react to contamination;
    3. Increasing observation of the receiving or loading area, which 
reduces the ability of an attacker to disguise his or her actions. For 
example, maximizing the line of sight by removing boxes, crates, or 
other obstructions from the area; positioning quality control personnel 
in the receiving or loading area to supervise operations; or utilizing 
closed-circuit TV systems or other monitoring devices;
    4. Verifying that seals on a shipping conveyance are intact prior 
to receiving or after loading a bulk liquid to reduce the likelihood 
that the shipping conveyance was or is accessed during transport to 
introduce a contaminant into the product;
    5. Establishing and implementing a policy for driver check-in and 
identification to help confirm driver identity and verify the 
individual is authorized, through verification of shipping 
documentation or other means, to deliver or pick-up the shipment and 
reduce the likelihood that an attacker could fraudulently pose as a 
driver as a means of gaining access to the facility; and
    6. Inspecting the shipping conveyance prior to loading bulk liquids 
to help ensure that no contaminant has been introduced to the 
conveyance chamber that could then contaminate the product once the 
product is loaded.
    Liquid storage and handling--Examples of focused mitigation 
strategies that may be appropriate include the following:
    1. Controlling access to liquid storage, holding, surge, or 
metering tanks, similar to the strategies that may be applied for 
controlling access to bulk liquid receiving and holding;
    2. Ensuring that the area around liquid storage, holding, surge, or 
metering tanks is free of unrelated materials, such as personal items 
(backpacks, purses, or packages), and other items that are not directly 
related to the food operation, to reduce the likelihood of a 
contaminant being brought into the area for introduction into the tank;
    3. Ensuring adequate lighting in and around liquid storage, 
holding, surge or metering tanks, similar to the strategies that may be 
applied for ensuring adequate lighting at bulk liquid receiving and 
loading;
    4. Installing one-way sample ports in liquid storage, holding, 
surge, or metering tanks , so that food product can be drawn out of the 
equipment but a contaminant cannot be inserted into the tank;
    5. Inspecting tanks prior to filling to help ensure that no 
contaminant has been introduced into the empty tank that could then 
contaminate the product once loaded;
    6. Inspecting pumping or metering equipment prior to use to help 
ensure that no contaminant has been introduced into the equipment that 
could contaminate the product;
    7. Using enclosed tanks and transfer systems to move materials to 
reduce the potential for an attacker to access the product and 
introduce a contaminant; and
    8. Positioning holding, surge, or metering tanks to increase 
visibility, such that frequent observation is facilitated and 
visibility of activity around the tank is improved. This

[[Page 78045]]

focused mitigation strategy may be less practical for longer term 
storage tanks.
    Secondary ingredient handling--Examples of focused mitigation 
strategies that may be appropriate include the following:
    1. Controlling access to ingredient handling areas, including where 
secondary ingredients or rework are staged, prepared, or added to the 
product stream, to prevent an unauthorized person from gaining access 
to the ingredients or rework during these processes. As with other key 
activity types, access controls may include strategies to easily 
identify authorized persons, such as with color coded uniforms or 
badges, or conducting ingredient handling activities in areas behind 
locking gates, doors, or other barriers;
    2. Ensuring the secondary ingredient handling area is free of 
unrelated materials, such as personal items or other items not directly 
related to the activity, to help ensure that a contaminant is not 
brought into the area for introduction into the ingredient during 
staging, preparation, or addition;
    3. Ensuring adequate lighting and increasing visibility in and 
around ingredient staging and handling areas, similar to the strategies 
that may be employed to ensure adequate lighting at bulk liquid 
receiving and holding;
    4. Reducing staging time to reduce the opportunity for intentional 
adulteration. Any time sealed or tamper-evident containers are breached 
provides a potential opportunity for an attacker to introduce a 
contaminant into the ingredient or rework. Reducing the time 
ingredients and rework are staged in unsecured containers reduces the 
opportunity for an attacker to adulterate the ingredient or rework;
    5. Restricting secondary ingredient handling to senior staff to 
reduce the accessibility and opportunity for intentional adulteration;
    6. Using peer monitoring in the ingredient handling area, because 
requiring at least two staff members to be in the area at any given 
time during operations can reduce the opportunity for a contaminant to 
be discreetly introduced into the food;
    7. Using automated and enclosed ingredient handling equipment, such 
as automated computer weighing, measuring, and addition equipment, to 
reduce human contact with secondary ingredients or rework and thereby 
reduce the opportunity for introduction of a contaminant; and
    8. Inspecting secondary ingredients held in staging and 
investigating any irregularities in the amount, condition, or 
organization of items in secondary ingredient handling areas to 
identify circumstances that suggest product contamination before a 
contaminated ingredient is added to the product stream.
    Mixing and similar activities--Examples of focused mitigation 
strategies that may be appropriate include the following:
    1. Controlling access to processing areas where mixing and similar 
activities are conducted to prevent an unauthorized person from gaining 
access to the product and equipment. Access controls may include: 
strategies to easily identify authorized persons, such as with color 
coded uniforms or badges; conducting these activities in areas behind 
locking gates, doors, or other barriers; securing access to overhead 
gangways and sampling platforms; and securing hatches, ports, and lids 
with locks or access alarm devices;
    2. Ensuring that the area is free of unrelated materials, such as 
personal items and other items that are not directly related to the 
activity, to reduce the likelihood of a contaminant being brought into 
the area for introduction into the ingredient during mixing and similar 
activities;
    3. Ensuring adequate lighting and increasing visibility in and 
around mixing and similar activities areas, similar to the strategies 
that may be employed to ensure adequate lighting at bulk receiving and 
loading;
    4. Positioning mixing and similar equipment in a manner that 
maximizes visibility, similar to the strategies that may be employed to 
maximize visibility for liquid storage and handling;
    5. Using one-way sample ports that prohibit introduction of a 
contaminant into the mixing or similar equipment, similar to the 
strategies that may be employed for liquid storage and handling;
    6. Conducting inspections of mixing and similar equipment prior to 
use to help ensure no contaminant has been introduced that could 
contaminate the product once loaded;
    7. Restricting mixing and similar activities to senior staff, 
similar to the strategies that may be employed for secondary ingredient 
handling;
    8. Using peer monitoring in this area to ensure that at least two 
staff members are in this area at any given time during operations, 
reducing the opportunity for a contaminant to be discreetly introduced 
into the food; and
    9. Using automated, self-contained, enclosed equipment to reduce 
human contact with the product and reduce the opportunity for 
introduction of a contaminant.
    These examples of focused mitigation strategies are consistent with 
measures included in the MSD. The examples are not intended to be an 
exhaustive list of appropriate focused mitigation strategies. For 
additional guidance on identifying appropriate focused mitigation 
strategies, see our guidance documents, the MSD, and other resources 
(see section II.D of this document).
    iv. Specific examples of determining appropriate focused mitigation 
strategies. In this section, we discuss specific examples of the 
decision-making process to identify and determine appropriate focused 
mitigation strategies at an actionable process step for each of the 
FDA-identified key activity types.
    Bulk liquid receiving and loading--Unloading at Facility A's bulk 
tanker truck unloading bay is an actionable process step for this key 
activity type. Facility A has a significant vulnerability related to 
access to the food during the unloading of the bulk liquid. At Facility 
A, the tanker truck drives into the unloading bay without passing 
through any security check-in procedures. A single facility employee is 
assigned to this area and takes a facility-owned hose from an open 
shelving unit in the unloading bay and attaches it to the tanker 
truck's unloading port. The driver of the tanker truck assists in 
unloading by opening the venting hatch at the top of the tanker truck 
while the facility employee is attaching the hose. The driver then 
waits in the unloading bay area while the truck is being unloaded. Upon 
completion of unloading activities, the driver gets back in the truck 
and exits the facility.
    Facility A is not implementing focused mitigation strategies at 
this actionable process step such that access to the food during 
unloading of the bulk liquid is significantly minimized or eliminated. 
The food is significantly vulnerable to an attacker (in this case, 
potentially the driver, the facility employee, or a third party) who 
could intentionally add a contaminant to the product to adulterate the 
food. One approach for Facility A to significantly minimize or 
eliminate the significant vulnerability at this actionable process step 
is to implement the following focused mitigation strategies:
     Establish a receiving check-in and verification procedure 
to ensure that the shipment is being delivered by the proper firm and 
that the driver is properly identified. The procedure would be 
documented and maintained in a shipping log that records the key 
identifying information about the driver, tanker truck, and shipping

[[Page 78046]]

documentation for the delivered product. The facility would also 
institute a policy requiring that the shipping documentation include 
the ID numbers of the seals on the unloading ports so that the facility 
employee can verify that seal numbers match the shipping documentation 
and that the seals were not broken, tampered with or replaced during 
transport.
     Implement a procedure to store hoses securely to reduce 
the likelihood an attacker could add a contaminant to the hoses when 
not in use. This would include storing hoses in locking cabinets and 
placing end caps on the hoses. The facility also would issue keys only 
to staff working in the tanker truck receiving bay and use a key 
numbering and tracking system to verify that all keys are accounted 
for.
     Increase active observation of the unloading process to 
reduce the likelihood of an attacker successfully introducing a 
contaminant by requiring two or more production staff members to be 
present during unloading activities (i.e., peer monitoring), or 
requiring the bulk liquid unloading operations be overseen by a 
supervisor or a member of the quality control staff. Alternatively, the 
facility could employ video surveillance of the area. If the truck 
driver is permitted to remain in the area of the receiving bay, the 
introduction of active observation practices ensures that no 
contaminant could be intentionally introduced to the product during 
unloading activities. Alternatively, the facility could limit the 
driver's access to the product by restricting the location of the 
driver to designated areas outside the loading area while the truck is 
being unloaded.
    In this example, the focused mitigation strategies were selected to 
achieve the following goals: Establishing the identity of personnel 
with access to the food; ensuring that equipment that may be used to 
introduce a contaminant is secured when not in use; and providing 
active observation of activities at actionable process steps. By 
implementing these focused mitigation strategies, the facility could 
significantly minimize the significant vulnerability identified at the 
actionable process step.
    Liquid storage and handling--The storage of liquid in Facility B's 
bulk liquid storage tank is an actionable process step for this key 
activity type. Facility B's bulk storage tank holding a primary 
ingredient is located within its building, and a significant 
vulnerability relates to access to the food during such storage. In 
Facility B, a network of gangways, ladders, and platforms surround the 
bulk liquid storage tank so that personnel can gain access to a hatch 
at the top of the tank. Facility B has a procedure for securing this 
hatch with a lock, and the facility stores the key to the hatch in the 
operations manager's office. To access a key, a worker must request the 
key from the operations manager and justify the need to open the lock. 
When an employee checks out the key, the manager's assistant records 
the employee's name, time the key is checked out, and the reason. 
Facility B's bulk liquid storage tank also has a second hatch along the 
side which is used for cleaning the tank when empty and is not locked. 
This secondary hatch is not accessible while product is in the tank 
because it opens inward, and pressure from product in the tank prevents 
the hatch from being opened when product is present.
    In considering the requirement for focused mitigation strategies at 
this actionable process step, Facility B would determine that it has 
sufficient safeguards in place to significantly minimize the likelihood 
of intentional adulteration from an attacker accessing the hatch on the 
top of the bulk storage tank. However, the facility would identify the 
secondary hatch as presenting a significant vulnerability for which 
insufficient focused mitigation strategies are being implemented. While 
food is in the tank, the secondary hatch is secure. However, when the 
tank is empty after cleaning, there is an opportunity for an attacker 
to introduce a contaminant into the tank via the secondary hatch which 
would then contaminate the food when it is added to the tank. To 
significantly minimize or eliminate the significant vulnerability 
presented by the secondary hatch, the facility would implement focused 
mitigation strategies to restrict and document access to the secondary 
hatch as is done for the hatch on the top of the tank. To do this, the 
facility would install a lock on the secondary hatch and incorporate 
the key for the secondary hatch into its existing key management 
system. Alternatively, the facility could implement a procedure of 
monitoring the condition of the tank interior immediately prior to 
reintroducing product to the tank. This monitoring check would be 
recorded in a monitoring log.
    Facility B already has in place some practices that we would 
consider appropriate focused mitigation strategies. The procedures in 
place to control access to the top access hatch on the bulk liquid 
storage tank are sufficient to minimize the significant vulnerability 
presented by this hatch. However, Facility B still has a significant 
vulnerability associated with the secondary access hatch, which 
required additional focused mitigation strategies to significantly 
reduce or eliminate the risk of intentional contamination.
    Another example of an actionable process step for the key activity 
type ``Liquid Storage and Handling'' is liquid storage in a liquid 
surge tank located above an in-line bottling operation at Facility C. 
The surge tank is used to control the flow rate of liquid product into 
the bottling equipment and is enclosed by an unlocked lid. A ladder and 
walkway enable workers to access the surge tank as needed to monitor 
product flow and take quality control samples. Facility C has an 
operations control room, which is equipped with windows to view the 
production floor. However, the view of the bottling operation from the 
operations control room is commonly blocked by pallets of empty bottles 
awaiting introduction into the bottling equipment.
    It is not practical for Facility C to lock the surge tank lid 
because workers need to frequently check the status of product flow and 
take quality control samples. Also, it is not practical to physically 
limit access to the ladder or walkway used to access the surge tank, 
for the same reasons. One approach for Facility C to significantly 
minimize or eliminate the significant vulnerability at this actionable 
process step is to implement the following focused mitigation 
strategies:
     Implement a policy to prohibit all personnel not 
associated with the bottling operation from entering the area and issue 
uniforms of a particular color to the bottling personnel only. The 
staff working in the bottling area would enforce this policy by 
instructing any staff not associated with the bottling operation to 
leave the area.
     Prohibit staff working in the bottling area from bringing 
any items not associated with the bottling operation into the work 
area.
     Train the staff working in the bottling area in a peer 
monitoring program to be attentive to the activity of other staff in 
the area.
     Stage pallets of empty bottles awaiting introduction into 
the bottling equipment in another location to improve line of sight 
from the operations control room.
    By implementing these focused mitigation strategies, the facility 
could significantly minimize or eliminate the significant vulnerability 
associated with the actionable process step at the liquid surge tank.
    Secondary ingredient handling--Ingredient staging at Facility D is 
an actionable process step for this key activity type. Facility D opens 
a

[[Page 78047]]

containerized secondary ingredient's tamper evident package, measures 
out the required amount into a secondary container, and pre-positions 
the ingredient in the production area so that it is readily added to 
the product line. Access to the food during each of these activities at 
this actionable process step presents a significant vulnerability. 
Facility D stages a dry, powdered ingredient near the mixer the night 
before it is intended to be used so that it is ready when the 
production run begins the next morning. Additionally, the staging area 
in Facility D is accessible to all staff and is an open area on the 
production floor.
    One approach for Facility D to significantly minimize or eliminate 
the significant vulnerability at this actionable process step is to 
implement the following focused mitigation strategies:
     Reduce staging time, by revising its procedures so that 
ingredients are staged immediately before they are added into the 
product stream. This strategy would reduce the time ingredients are 
accessible.
     Change its staffing procedures to ensure that only senior 
or long-term employees are assigned to measuring and staging secondary 
ingredients. Assigning the most trusted employees to work in sensitive 
areas reduces the risk of intentional contamination.
     Increase its observation of this area by installing 
closed-circuit TV cameras to monitor the actions of staff in the 
secondary ingredient staging area.
    By its nature, the action of ingredient staging is an open and 
accessible process step. Focused mitigation strategies must address 
personnel access so that the likelihood of an intentional contamination 
at this step is significantly reduced or eliminated. By implementing 
these focused mitigation strategies, the facility could significantly 
minimize the significant vulnerability identified at the actionable 
process step.
    Mixing and similar activities--Blending in Facility E's dough mixer 
is an actionable process step for this key activity type. Facility E 
operates a dough mixer to combine several dry and liquid ingredients. 
This mixer is not enclosed and is located in an open area of the 
facility where it is under regular--though not dedicated--human 
observation. While a batch of product is being mixed, the staff member 
assigned to the mixer may leave the area to retrieve and prepare 
ingredients for the next production batch. The line of sight in this 
area is clear, and management in the operations control room located 
above the production floor has a clear view of the mixer through an 
observation window.
    The mixer is vulnerable to an attacker who could intentionally 
introduce a contaminant into the food because of the open nature of the 
mixer, the lack of constant and dedicated observation, and the lack of 
physical access control to the area where it is located. One approach 
for Facility E to significantly minimize or eliminate the significant 
vulnerability at this actionable process step is to implement the 
following focused mitigation strategies:
     Install a lid on the mixer that must be opened to add 
anything to the mixer. If Facility E determines that it would be 
disruptive to the production schedule to install a lock on the lid, the 
facility could install an access alarm that would indicate that the lid 
has been opened. This alarm would sound in the operation control room 
where a manager supervises production operations.
     Assign another member of staff the responsibility of 
preparing and securely staging ingredients for later production 
batches. This would alleviate the need for the mixer operator to leave 
the area, leaving the mixer unattended.
    With the introduction of these two focused mitigation strategies, 
the facility would have taken steps to enclose the mixer, making it 
more difficult for an attacker to introduce a contaminant without 
alerting management (by the sounding of the alarm), and increased the 
dedicated observation of this otherwise vulnerable process step by 
ensuring that the mixer operator is not required to leave the area 
unattended.
    Mixing at Facility F's rotating air dryer is another example of an 
actionable process step for the key activity type ``Mixing and similar 
activities.'' In Facility F, product, such as crackers or breakfast 
cereals, are fed through drum-like equipment, where warm air is blown 
across it while the drum rotates. Although the goal of this process is 
to dry the product, it also could distribute any contaminant introduced 
into the dryer evenly across the product. Facility F's rotating air 
dryer is located alongside a commonly used walkway, but is behind a 
guard rail to prevent employees from coming in contact with the hot 
exterior of the dryer. Product is fed into the top of the dryer via a 
pneumatic conveyor. There is sufficient space between the dryer opening 
and the pneumatic conveyor discharge to enable an attacker to introduce 
a contaminant to the dryer at this point. That opening is about six 
feet above the ground, accessible from the floor of the facility. 
Product leaves the dryer through a gravity fed line. The connection 
between the dryer and the discharge line is sealed.
    To goal of focused mitigation strategies at this actionable process 
step would be to reduce access to this equipment to significantly 
reduce the likelihood an attacker could introduce a contaminant into 
the rotating air dryer. One way Facility F could do this would be to 
install a clear plastic shield that would be affixed to and extend from 
the discharge of the pneumatic conveyor to the opening of the dryer 
where it would also be tightly affixed to the housing of the dryer. A 
clear plastic shield would enable workers to supervise the product flow 
into the dryer while posing as an effective barrier to an attacker 
wishing to introduce a contaminant into the product at the dryer. This 
engineering improvement would significantly minimize or eliminate 
access to the food in the dryer and thereby significantly reduce or 
eliminate the likelihood of a successful act of intentional 
adulteration at this process step. The installation of physical 
barriers to access of equipment at actionable process steps can be one 
of the most effective focused mitigation strategies because it does not 
require restricting personnel or maintaining active observation of an 
area. The implementation of this engineering improvement would be 
detailed in the facility's food defense plan.
    c. Proposed Sec.  121.135(a)--Requirement to identify and implement 
focused mitigation strategies for actionable process steps. Proposed 
Sec.  121.135(a) would require that the owner, operator, or agent in 
charge of a facility identify and implement focused mitigation 
strategies at each actionable process step to provide assurances that 
the significant vulnerability at each step will be significantly 
minimized or prevented and the food manufactured, processed, packed or 
held by such facility will not be adulterated under section 402 of the 
FD&C Act. Under Sec.  121.135, we are proposing that, for each of the 
identified actionable process steps, the owner, operator, or agent in 
charge of a facility covered by this rule identify and implement 
focused mitigation strategies. Focused mitigation strategies would be 
required only for actionable process steps.
    Because a focused mitigation strategy that would be necessary at an 
actionable process step must be tailored to address the significant 
vulnerability applicable to the specific actionable process step, we 
are not proposing to specify the particular focused mitigation 
strategies that would be appropriate. Rather, we expect the owner, 
operator, or agent in charge of the facility covered by this

[[Page 78048]]

rule to identify the specific focused mitigation strategy(s) that would 
be appropriate, considering the facility and food it produces, and to 
ensure the proper implementation of those strategies to provide 
assurances that the significant vulnerability at each identified 
actionable process step is significantly minimized or prevented and the 
food is not adulterated. In section V.C.3.b of this document, we list 
examples of focused mitigation strategies and describe scenarios for 
determining appropriate focused mitigation strategies at actionable 
process steps for each of the FDA-identified key activity types.
    A facility would have the flexibility to identify and implement 
focused mitigation strategies from among all procedures, practices, and 
processes available to the facility that would provide the assurances 
that would be required by proposed Sec.  121.135. The flexibility 
provided under this proposed provision acknowledges the existing 
expertise within the food industry in this regard, and recognizes the 
complex and varied nature of operations in food facilities. 
Additionally, to the extent facilities may already be engaging in 
practices that constitute focused mitigation strategies, facilities 
should consider whether those measures satisfy the requirements of 
proposed Sec.  121.135, such that the implementation of additional 
focused mitigation strategies may not be necessary. (Note that 
associated requirements, such as monitoring and verification, would 
apply).
    FDA's existing guidance documents and other resources (discussed in 
section II.D of this document) include guidance for industry on a range 
of focused mitigation strategies. In particular, the MSD includes a 
list of mitigation strategies that can be applied to different steps in 
a food operation to reduce the risk of intentional adulteration. The 
database is searchable by key words and processing steps common to food 
operations (e.g., packing, manufacturing, processing and holding).
    Proposed Sec.  121.135(a) implements the provisions in sections 
418(c)(2) and 420(b)(2) of the FD&C Act. FDA requests comments on our 
analysis and proposed provisions related to mitigation strategies 
necessary to protect against intentional adulteration of food caused by 
acts of terrorism. We also seek input on whether and, to what extent, 
facilities currently employ broad mitigation strategies and focused 
mitigation strategies.
    d. Proposed Sec.  121.135(b)--Requirement for written focused 
mitigation strategies. Proposed Sec.  121.135(b) would require that 
focused mitigation strategies for actionable process steps be written. 
The focused mitigation strategy(ies) selected for each actionable 
process step identified in accordance with proposed Sec.  121.130, and 
a justification for how the strategy significantly reduces or 
eliminates the risk of intentional adulteration at that actionable 
process step(s) must be documented. Similar to preventive controls in a 
food safety plan, written focused mitigation strategies in a food 
defense plan are essential for the facility to implement the focused 
mitigation strategies consistently, and essential for the facility and 
inspectors. Written focused mitigation strategies also would be 
essential for training purposes and during reanalysis and updates of 
the focused mitigation strategies.
    Proposed Sec.  121.135(b) implements the provisions in sections 
418(h) and 420(b)(2) of the FD&C Act.
    e. Proposed Sec.  121.135(c)--Applicability of monitoring, 
corrective actions, and verification. Proposed Sec.  121.135(c) would 
specify that the focused mitigation strategies required under this 
section would be subject to monitoring as would be required by proposed 
Sec.  121.140; corrective actions as would be required by proposed 
Sec.  121.145; and verification as would be required by proposed Sec.  
121.150. Proposed Sec.  121.135(c)(1) through (c)(3) would restate the 
requirements of proposed Sec. Sec.  121.140, 121.145, and 121.150 to 
clearly communicate the applicability of proposed Sec. Sec.  121.140, 
121.145, and 121.150 to the focused mitigation strategies that would be 
required under proposed Sec.  121.135 and would establish no new 
requirements.
4. Monitoring
    a. General description of monitoring. Proposed Sec.  121.3 would 
define ``monitor'' to mean ``to conduct a planned sequence of 
observations or measurements to assess whether focused mitigation 
strategies are consistently applied and to produce an accurate record 
for use in verification.'' In developing the proposed monitoring 
requirements related to food defense, we considered our proposed 
monitoring requirements related to food safety, which are described in 
section XII.E of the PC proposed rule. For the same reasons outlined in 
the PC proposed rule, we have tentatively concluded that monitoring is 
necessary to establish the performance of the implementation of the 
focused mitigation strategies. The proposed provisions in Sec.  121.140 
implement section 418(h) of the FD&C Act.
    b. Proposed Sec.  121.140(a)--Requirement for written procedures 
for monitoring. Proposed Sec.  121.140(a) would require that the owner, 
operator, or agent in charge of a facility establish and implement 
written procedures, including the frequency with which they are to be 
performed, for monitoring the focused mitigation strategies. Monitoring 
the performance of focused mitigation strategies at specified 
frequencies would facilitate tracking the implementation of the focused 
mitigation strategies to provide assurance that they are consistently 
applied in a facility covered by this rule. If monitoring shows that a 
focused mitigation strategy is frequently not implemented, a facility 
can consider whether another focused mitigation strategy would be more 
appropriate. For example, if an ingredient storeroom door is to be kept 
locked when not in use, but the door is frequently left unlocked 
because access to the room is needed for other purposes, the facility 
may replace the previous focused mitigation strategy with video 
monitoring. Further, if monitoring is conducted with sufficient 
frequency, it will detect if a focused mitigation strategy is not 
properly implemented (e.g., if access to a particular area of a 
facility is not being appropriately restricted or a bulk liquid tank is 
not being visually inspected prior to filling), indicating a problem 
and signaling the need for an appropriate corrective action. In 
addition, the proposed monitoring requirement would result in written 
documentation for use in verification.
    c. Proposed Sec.  121.140(b)--Frequency of monitoring. Proposed 
Sec.  121.140(b) would require that the owner, operator, or agent in 
charge of a facility monitor the focused mitigation strategies with 
sufficient frequency to provide assurances that they are consistently 
applied. Proposed Sec.  121.140(b) does not specify a single monitoring 
frequency applicable to all facilities and processes. Rather, it 
requires monitoring with ``sufficient frequency'' to ensure that the 
focused mitigation strategies are consistently applied in a facility 
covered by this rule. We note that for food defense that many focused 
mitigation strategies may be monitored over longer timeframes (non-
continuous monitoring) than preventive controls for food safety, which 
are often monitored continuously. In large part preventive controls for 
food safety are monitored continuously because they relate to physical 
or chemical parameters of the process, such as the temperature of a 
pasteurizer, which both lend themselves

[[Page 78049]]

to continuous monitoring and necessitate that level of monitoring to 
ensure that the process is under control. As discussed in greater 
detail in section V.C.3 of this document, most focused mitigation 
strategies for food defense are not related to physical or chemical 
parameters of the process. They tend to have more in common with 
sanitation preventive controls for food safety in that they relate to 
conditions around the food process, such as access to the equipment. A 
focused mitigation strategy such as ``adequate lighting at an 
actionable process step'' or ``secure air vents on a cooling tank with 
one-way valves'' would not require continuous monitoring. Management 
may choose to monitor lighting on a weekly basis to ensure that 
everything is working properly and monitoring of the security of air 
vents with one-way valves on a cooling tank might be done monthly. 
Frequency is not prescribed in this proposed rule. More frequent (e.g., 
daily) monitoring would be appropriate for mitigation strategies that 
relate to conditions or practices that are more likely to change more 
rapidly, such as keeping the access door to an actionable process step 
closed when not in use or ensuring that employees with color coded 
uniforms are staying in the areas designated by the color code.
    d. Proposed Sec.  121.140(c)--Requirement for records. To implement 
section 418(g) of the FD&C Act, proposed Sec.  121.140(c) would require 
that all monitoring of focused mitigation strategies in accordance with 
this section must be documented in records that are subject to 
verification in accordance with Sec.  121.150(a) and records review in 
accordance with proposed Sec.  121.150(c).
    The monitoring records would be used to verify that the focused 
mitigation strategies are being monitored, as would be required by 
proposed Sec.  121.150(a), and to verify that the focused mitigations 
strategies are consistently implemented and are effective at 
significantly minimizing or preventing the significant vulnerabilities, 
as would be required by proposed Sec.  121.150(c). Further, they are 
necessary to facilitate regulatory review of the system of controls. 
Together, proposed Sec. Sec.  121.140(a), (b), and (c) and 121.150(a), 
(c), and (e) would establish a system that would provide assurances 
that the significant vulnerabilities identified for a food operation 
are being significantly minimized or prevented.
5. Corrective Actions
    a. General description of corrective actions. When a HACCP-type 
system is applied to ensure food safety, the term ``corrective 
actions'' is used to describe procedures that are in place to correct 
the cause of a deviation to ensure that a critical control point is 
under control and to ensure that the product produced under that 
deviation is safe, since total adherence to a planned process may not 
always occur. This concept is discussed in detail in section XII.F of 
the PC proposed rule.
    This same concept can be applied to the control of intentional 
adulteration related to acts of terrorism. Monitoring may detect a 
deviation from implementation of a focused mitigation strategy; 
corrective actions are implemented to re-establish control. In 
developing the proposed corrective actions requirements related to food 
defense, we considered our proposed relevant requirements related to 
food safety. The proposed provisions in Sec.  121.145 implement 
sections 418(e), 418(h), and 420(b)(2) of the FD&C Act.
    b. Proposed Sec.  127.145(a)--Corrective action procedures. 
Proposed Sec.  121.145(a)(1) would require that the owner, operator, or 
agent in charge of a facility establish and implement written 
corrective action procedures that must be taken if focused mitigation 
strategies are not properly implemented. Having written procedures in 
place would enable facilities covered by this rule to act quickly and 
appropriately when focused mitigation strategies are not properly 
implemented--e.g., a situation where a work station at an actionable 
process step requires two staff at all times in a ``buddy system'' but 
is only staffed by one person for a period of time.
    The benefits of identifying corrective action procedures before 
corrective action is needed largely derive from having written 
procedures. Written corrective action procedures would be essential to 
the facility's management, to auditors, and to inspectors. The 
facility's management will be responsible for ensuring that appropriate 
corrective actions are taken if focused mitigation strategies are not 
properly implemented. Having access to appropriate, written corrective 
action procedures determined in advance of the need for such action can 
ensure that correct and complete actions are taken in a timely fashion. 
Having written corrective action procedures available for auditors and 
for inspectors is essential for them to assess the adequacy of the food 
defense plan; the procedures a facility will use to address 
implementation failures are essential to proper, consistent 
implementation, and without them a complete assessment cannot be made. 
Written corrective action procedures also will be useful for training 
purposes, so that employees who would need to implement the corrective 
action procedures will be prepared for what they would need to do.
    Proposed Sec.  121.145(a)(2) would require that corrective action 
procedures describe the steps to be taken to ensure that appropriate 
action is taken to identify and correct a problem with implementation 
of a focused mitigation strategy to reduce the likelihood that the 
problem will recur. In the previous example in which two staff are 
required to be at a work station at all times, the corrective action 
could be speaking with the employees to ensure they understand the 
importance of remaining at the work station together, sending staff to 
a refresher course on food defense awareness, and ensuring that the 
supervisor knows that there must be adequate staff present on a shift 
so two people can be at the work station at all times. If the problem 
recurs, management may need to consider other measures for preventing 
access at that process step.
    c. Proposed Sec.  121.145(b)--Documentation. Proposed Sec.  
121.145(b) would require that all corrective actions taken in 
accordance with this section be documented in records that are subject 
to verification in accordance with proposed Sec.  121.150(b) and 
records review in accordance with proposed Sec.  121.150(c). The 
records that document corrective actions would be used to verify that 
appropriate decisions about corrective actions are being made and 
appropriate corrective actions are being taken in facilities covered by 
this rule.
    d. Corrective actions proposed to be required by part 117 but not 
part 121. Unlike in proposed part 117, in proposed part 121, we have 
not proposed a requirement to ensure that all affected food is 
evaluated for food safety if focused mitigation strategies are not 
properly implemented or are found to be ineffective. An act of 
intentional adulteration or attempted intentional adulteration has 
historically been a rare event and, as a result, in the vast majority 
of cases, the failure to properly implement a focused mitigation 
strategy would not be expected to result in contaminated food. This is 
because intentional adulteration requires not just the opportunity for 
contamination (i.e., failure of a mitigation strategy to limit access 
to an actionable process step), but also someone with intent to cause 
harm at that same moment. In contrast, the failure to properly 
implement a preventive control for a food safety hazard, such as proper 
cook temperatures, is more likely to result in adulterated food (e.g., 
because the

[[Page 78050]]

pathogen reasonably likely to be present in the raw food would not be 
eliminated from the food by the inadequate cooking process). However, 
our decision not to propose these requirements does not absolve an 
owner, operator, or agent in charge of a facility from their 
responsibility to ensure that food is not adulterated. In addition, 
food firms would continue to be subject to the reporting requirements 
under section 417 of the FD&C Act. Moreover, the introduction or 
delivery for introduction into interstate commerce of any food that is 
adulterated is a prohibited act under section 301(a) of the FD&C Act.
    The PC proposed rule also contains requirements for corrective 
actions that must be taken in the event of an unanticipated problem. 
Unlike in proposed part 117, in proposed part 121, we are not proposing 
a requirement related to unanticipated problems because we are not 
aware of circumstances where this would be relevant. Because of the 
nature of the focused mitigation strategies, we expect that the 
outcomes of monitoring will be binary, either the focused mitigation 
strategy will be in place or it will not be in place. For this reason, 
we expect that corrective action plans will be straightforward, with no 
provision needed for unanticipated corrective actions. This contrasts 
with the circumstances of food safety preventive measures, where 
controls are often more complex, presenting opportunities for a more 
nuanced corrective action, which may not be possible to fully 
anticipate in advance.
    We ask for comment on our rationale and tentative conclusion not to 
propose these requirements.
6. Verification
    a. General description of verification. In the preventive controls 
framework, ``verification'' involves activities that help determine 
whether the focused mitigation strategies are valid and are implemented 
according to the food defense plan. Verification includes confirming 
that monitoring and corrective actions are being implemented as 
planned, through review of records and periodic reanalysis of the food 
defense plan. This concept as applied to food safety is discussed in 
detail in section XII.G of the PC proposed rule.
    We have tentatively concluded that this same concept applies to the 
control of intentional adulteration related to acts of terrorism. 
Efforts must be made to ensure that the system of mitigation strategies 
is in place and functioning as designed. The proposed provisions in 
Sec.  121.150 implement sections 418(f) and 420(b)(2) of the FD&C Act.
    b. Proposed Sec.  121.150(a)--Verification of monitoring. Proposed 
Sec.  121.150(a) would require that the owner, operator, or agent in 
charge of a facility verify that monitoring is being conducted. 
Verification of monitoring can be conducted in a number of ways. One 
example of verification of monitoring is a periodic observation of the 
monitoring activity, e.g., by a supervisor. Another example is an 
independent test made by a person other than the person doing the 
monitoring. For example, if a shift supervisor is assigned to check at 
the end of each shift that chemicals are properly stored and secured, 
another supervisor may be responsible for checking periodically (e.g., 
once a week) that this is occurring. In another example, if an alarm is 
supposed to sound if a mixing tank is accessed without authorization 
and the monitoring procedures provide for weekly testing of the alarm, 
a supervisor may be responsible for performing the same test monthly to 
ensure that the alarm and the monitoring procedure are both working 
properly. Proposed Sec.  121.150(a) would not specify the verification 
activities that must be conducted for monitoring. We request comment on 
whether proposed Sec.  121.150(a) should do so, and if so, what 
verification activities should be required.
    c. Proposed Sec.  121.150(b)--Verification of corrective actions. 
Proposed Sec.  121.150(b) would require that the owner, operator, or 
agent in charge of a facility verify that appropriate decisions about 
corrective actions are being made. An example of verification that 
appropriate decisions about corrective actions are being made is 
observation of the corrective actions being taken, e.g., by a 
supervisor. Proposed Sec.  121.150(b) would not specify the 
verification activities that must be conducted for corrective actions. 
We request comment on whether proposed Sec.  121.150(b) should do so, 
and if so, what verification activities should be required.
    d. Proposed Sec.  121.150(c)--Implementation and effectiveness. 
Proposed Sec.  121.150(c) would require that the owner, operator, or 
agent in charge of a facility verify that the focused mitigation 
strategies are consistently implemented and are effectively and 
significantly minimizing or preventing the significant vulnerabilities. 
As appropriate to the facility and the food, this must include review 
of the monitoring and corrective action records within appropriate 
timeframes to ensure that the records are complete, the activities 
reflected in the records occurred in accordance with the food defense 
plan, the focused mitigation strategies are effective, and appropriate 
decisions were made about corrective actions.
    Proposed Sec.  121.150(c) would establish that the purpose of the 
review of records is to ensure that the records are complete, the 
activities reflected in the records occurred in accordance with the 
food defense plan, the focused mitigation strategies are effective, and 
appropriate decisions are made about corrective actions. We tentatively 
conclude that review of the records required by proposed Sec.  
121.150(c) would accomplish these purposes. Reviewing monitoring 
records can reveal whether they contain information on all of the 
activities or measures that were to be monitored to determine whether a 
focused mitigation strategy is being consistently implemented in 
accordance with the food defense plan. For example, a review of 
monitoring records can show if the shift supervisor is consistently 
storing and securing chemicals at the end of each shift as may be 
required by a food defense plan. Review of monitoring records also can 
reveal whether any information is missing--e.g., a date or time--so 
that the missing information can be quickly identified and added to the 
record if necessary.
    Review of records also can reveal whether appropriate decisions 
were made about corrective actions. The review would determine whether 
all the corrective action procedures required by proposed Sec.  121.145 
have been followed to prevent recurrence of the problem. For example, 
in the previous example on corrective actions, a review of records 
could reveal that the supervisor spoke to the staff about always having 
two staff present at the work station as required in the food defense 
plan and, as appropriate, enrolled the staff in a refresher course on 
food defense awareness.
    Proposed Sec.  121.150(c) would require review of the monitoring 
and corrective action records within an appropriate time after the 
records are made. We are not proposing to require review of records 
within a specified timeframe. While the PC proposed rule contains a 
requirement that monitoring and corrective action records be reviewed 
within a week after the records are made, in the case of food defense, 
we do not believe specifying a timeframe for records review is 
necessary. As discussed previously, some focused mitigation strategies 
may be monitored less frequently than are preventive controls for food 
safety. In a HACCP-

[[Page 78051]]

type system for food safety, monitoring and corrective action records 
are often reviewed a short time after their creation to enable action 
to be taken relative to food that may be adulterated (e.g., recall). It 
is unlikely that an improperly implemented focused mitigation strategy 
would result in adulterated food (i.e., because adulteration of food 
would require not only opportunity but also a simultaneous intent to 
cause adulteration). A focused mitigation strategy such as ``adequate 
lighting at the bulk truck unloading bay'' or ``secure air vents on a 
cooling tank with one-way valves'' may be monitored on a weekly or 
monthly basis. Because the focused mitigation strategies may be 
monitored less frequently and because these frequencies may vary 
significantly from one focused mitigation strategy to another, we 
believe it is appropriate for owners, operators, or agents in charge of 
a facility to determine when review of the monitoring and corrective 
action records is best performed.
    e. Proposed Sec.  121.150(d)--Reanalysis. To implement section 
418(i) of the FD&C Act, proposed Sec.  121.150(d)(1) would require that 
the owner, operator, or agent in charge of a facility conduct a 
reanalysis of the food defense plan as follows:
    1. At least once every 3 years (proposed Sec.  121.150(d)(1)(i)).
    2. Whenever a significant change is made in the activities 
conducted at a facility operated by such owner, operator, or agent in 
charge if the change creates a reasonable potential for a new 
vulnerability or a significant increase in a previously identified 
vulnerability (proposed Sec.  121.150(d)(1)(ii)). For example, if a 
facility adds a new product line, then the food defense plan must be 
reanalyzed to consider whether it includes one of the key activity 
types, and, if so to implement appropriate focused mitigation 
strategies.
    3. Whenever such owner, operator or agent in charge becomes aware 
of new information about potential vulnerabilities associated with the 
food operation or facility (proposed Sec.  121.150(d)(1)(iii)). For 
example, an owner, operator, or agent in charge of a facility may 
become aware that access to a particular piece of equipment is greater 
than was thought to be the case when they initially considered whether 
a key activity type is applicable to their food process.
    4. Whenever a focused mitigation strategy is found to be 
ineffective (proposed Sec.  121.150(d)(1)(iv)). Proposed Sec.  
121.150(d)(1)(iv) would require that the owner, operator, or agent in 
charge of a facility reanalyze the food defense plan to determine 
whether modification of the plan is required if a focused mitigation 
strategy is found to be ineffective. For example, if the owner, 
operator, or agent in charge of a facility finds that color coding of 
employee hard hats according to their assigned work stations or areas 
is not effective in preventing employees from crossing into areas where 
they are not assigned because employees have found that adhering to the 
system adversely affects product, the owner, operator, or agent in 
charge may need to consider other focused mitigation strategies to 
ensure that staff access at actionable process steps is controlled.
    5. Whenever FDA requires reanalysis to respond to new 
vulnerabilities and developments in scientific understanding including, 
as appropriate, results from a DHS biological, chemical, radiological, 
or other terrorism risk assessment (proposed Sec.  121.150(d)(1)(v)). 
Risk assessments or vulnerability assessments conducted by DHS or 
others may reveal a significant vulnerability in process steps in 
addition to the significant vulnerabilities associated with the key 
activity types that FDA has identified. FDA would require reanalysis of 
food defense plans, as necessary, to respond to any new knowledge about 
threats or vulnerabilities to food operations based on information 
available to the agency. This requirement for reanalysis could involve 
a requirement to consider whether a new key activity type is relevant 
to a facility's food processes. It could also involve a requirement to 
reconsider existing key activity types in light of a credible threat of 
terrorist attack on a specific food type, product, brand, or company.
    Proposed Sec.  121.150(d)(2) would require that the owner, 
operator, or agent in charge of a facility complete the required 
reanalysis and implement any additional focused mitigation strategies 
needed to address the significant vulnerabilities identified, if any, 
before the change in activities at the facility is operative or, when 
necessary, during the first six weeks of production. The purpose of the 
reanalysis is to identify the need for, and implement, focused 
mitigation strategies in light of a reasonable potential for a new 
significant vulnerability, or a significant increase in a previously 
identified significant vulnerability.
    Proposed Sec.  121.150(d)(3) would require that the owner, 
operator, or agent in charge of a facility revise the written plan if a 
significant change is made or document the basis for the conclusion 
that no additional or revised focused mitigation strategies are needed. 
It is important to document that a reanalysis has been conducted and 
the plan has been revised accordingly or that no change has been made. 
Such documentation demonstrates that a facility has considered all 
relevant information on the defense of the operation, including new 
information that has become available since the last analysis. The 
documentation further demonstrates that appropriate changes have been 
made or that current procedures for implementing focused mitigation 
strategies are adequate to significantly minimize or prevent 
significant vulnerabilities.
    f. Proposed Sec.  121.150(e)--Requirement for records for 
verification. To implement sections 418(g) and 420(b)(2) of the FD&C 
Act, proposed Sec.  121.150(e) would require that all verification 
activities taken in accordance with this section be documented in 
records.
    g. Verification proposed to be required by part 117 but not part 
121. In the PC proposed rule, we proposed to require, as part of 
verification, the validation of the adequacy of the preventive controls 
implemented to control the hazards identified in the hazard analysis as 
reasonably likely to occur. In this proposed rule, we are not including 
a similar proposed requirement. Unlike preventive controls, which often 
involve processing parameters that can be scientifically validated, 
focused mitigations strategies for food defense (which correspond to 
preventive controls for food safety) often are not of a nature that 
they can be scientifically validated. For example, it would not be 
practical for a facility to attempt to validate the effectiveness of a 
lock on a tank or the use of a `buddy system' at a particular process 
step to prevent or significantly minimize intentional adulteration of 
food caused by a terrorist attack. Most of the recommended mitigation 
strategies in the MSD (Ref. 30) are similar in nature to the two 
mentioned in the example above in that validation would be impractical. 
Therefore, we have tentatively concluded not to propose a requirement 
for validation of focused mitigation strategies.
    However, if a facility chooses to use a processing parameter (e.g., 
thermal kill step) as a focused mitigation strategy, the facility 
should employ such a processing parameter if it has been demonstrated 
to be effective in significantly minimizing or preventing the 
associated significant vulnerability. In many circumstances it is not 
appropriate to use such strategies

[[Page 78052]]

because they are usually effective against one or several, but not all, 
potential contaminants. See section XII.G of the PC proposed rule for 
additional discussion of validation.
    The PC proposed rule also includes proposed requirements for 
calibration of process monitoring instruments and verification 
instruments and also records associated with these activities. As 
discussed previously, it is our expectation that most of the focused 
mitigation strategies will not be continuously monitored and will not 
require process monitoring instruments or instruments to verification 
purposes. Therefore, we do not believe it would be necessary to include 
those requirements in this part.
    We ask for comment on our tentative decision not to include 
validation of the focused mitigation strategies and calibration of 
monitoring and verification instruments in codified requirements in 
proposed Sec.  121.150.
7. Training of Personnel
    Proposed Sec.  121.160 would establish requirements related to 
training of certain personnel working in a food operation. Proposed 
Sec.  121.160(a) would require that personnel and supervisors assigned 
to actionable process steps receive appropriate training in food 
defense awareness and their respective responsibilities in implementing 
focused mitigation strategies. Because the effectiveness of a 
mitigation strategy, which is applied at an actionable process step, is 
dependent on the proper implementation by personnel and supervisors of 
the strategy, we are proposing to require that personnel and 
supervisors assigned to actionable process steps be appropriately 
trained in food defense. The purpose of training a supervisor, in 
addition to personnel at actionable process steps, is so that the 
supervisor can help train employees, recognize conditions that could 
lead to intentional contamination, and take necessary actions to 
correct those conditions.
    We are proposing that training required under this provision must 
cover food defense awareness and the respective responsibilities of 
personnel and supervisors assigned to actionable steps in implementing 
focused mitigation strategies. At a minimum, such training must include 
the general principles of food defense, including simple procedures for 
employees to follow to adhere to those principles in their jobs. We 
have tentatively concluded that completion of FDA's training course on 
Food Defense Awareness for the Front-line Employee (described in this 
section of the document), which takes about 20 minutes to complete, 
would be sufficient to satisfy this element of the proposed training 
requirement. Additionally, training must contain specifics about the 
actionable process steps where employees are working and their roles in 
the proper implementation of the focused mitigation strategy(ies) 
applied at those actionable process steps. Training on the application 
of focused mitigation strategies, which is likely to be specific to 
each facility or actionable process step, may be added to existing on-
the-job training programs or provided separately.
    FDA has developed training tools that are available for use by the 
industry. FDA revamped its online food defense courses in 2013, and the 
revamped courses, entitled ``Food Defense 101'' (Ref. 27), address the 
types of intentional contamination that have occurred in the United 
States in recent years and reflect FDA's current thinking on how to 
minimize the likelihood and impact of such incidents. The courses 
included in Food Defense 101 are: (1) Food Defense Awareness for the 
Food Professional; (2) Food Defense Awareness for the Front-line 
Employee; (3) Food Defense Regulations; and (4) ALERT, for owners and 
operators of food facilities. The course on Food Defense Awareness for 
the Food Professional provides an understanding of food defense and 
information for professionals in the food industry. The course modules 
progress through food defense planning including broad mitigation 
strategies, vulnerability assessments, focused mitigation strategies, 
and food defense plans. The course on Food Defense Awareness for Front-
line Employees provides information specific to front-line workers and 
simple procedures for these employees to follow in food defense. The 
course on Food Defense Regulations presents an overview of the Public 
Health Security and Bioterrorism Preparedness and Response Act of 2002 
(the Bioterrorism Act), FSMA, and FDA's Reportable Food Registry. 
Finally, the course on ALERT, which was developed by FDA to help 
stakeholders better understand food defense and how food defense 
applies to the food industry, provides specific examples of ways to 
protect a firm from the threat of intentional contamination. FDA's Food 
Defense 101 online courses are available free-of-charge on our Web site 
at https://www.fda.gov/Food/FoodDefense/default.htm.
    We expect these existing courses will assist industry to comply 
with this training requirement, if finalized as proposed. We are also 
aware of training seminars and programs offered by private sector 
entities (Ref. 59, Ref. 60, Ref. 61, Ref. 62) that may also assist 
industry to comply with this training requirement. We seek comment on 
the adequacy of FDA's Food Defense 101 training materials, and whether 
there is a need for revisions to these existing FDA courses or the 
development of additional FDA training materials.
    FDA also previously issued guidance documents for industry on food 
defense (Ref. 22, Ref. 23, Ref. 24, Ref. 25, Ref. 26), which include 
recommendations related to personnel training. In these guidance 
documents, we recommended that all employees have training in food 
defense awareness, including information on how to prevent, detect, and 
respond to an intentional contamination incident at their facility. As 
noted in these guidance documents, we recommended incorporating 
periodic reminders of the importance of food defense procedures into 
routine facility communications, such as brochures, staff meetings or 
payroll stuffers. We further recommended that facilities encourage all 
employees to report unusual or suspicious individuals or activities to 
management. We reiterate these recommendations described in our 
guidance documents. However, in this proposed rule, we are not 
proposing to include additional specific training requirements to 
reflect all of those recommendations. For example, although we are not 
requiring that all employees at a facility receive training in food 
defense, we recognize the importance of training as a measure to 
protect against intentional adulteration of food and, therefore, 
reiterate our recommendation that all personnel working in a food 
operation receive training in food defense awareness. We request 
comment on this issue, including on whether we should require, in a 
final rule, that basic food defense awareness training be completed by 
all employees at a facility. We also request comment on whether we 
should require training to be repeated periodically, including when 
significant changes are made to food defense plans.
    Proposed Sec.  121.160(b) would require that all training received 
in accordance with section Sec.  121.160 be documented in records. 
Under proposed Sec.  121.305, records would include such information as 
the date of the training, the topics covered, and the person(s) 
trained. An example of records that would comply with proposed Sec.  
121.160(b) is an attendance sheet with the date, list of those in 
attendance, and the particular topics covered (such as an overview of 
food defense principles or food defense

[[Page 78053]]

planning). The records required by proposed Sec.  121.160(b) would 
enable a facility to track the training that personnel received, 
thereby enabling identification of personnel that have the prerequisite 
awareness training for an assignment at an actionable process step. 
Such records could be used to document that a person has, as would be 
required under proposed Sec.  121.160(a), successfully completed 
training appropriate to the person's duties at an actionable process 
step.
    We recognize that industry has already begun to implement food 
defense measures to meet certain industry standards, which include 
guidelines for food defense training (Ref. 63, Ref. 33, Ref. 35). Our 
proposed minimum requirements for training are consistent with these 
standards, as well as with WHO recommendations for personnel training 
in its guidance on food defense (Ref. 6). We seek comment on the 
feasibility of our proposed training requirements, in light of the 
current state of food defense awareness in the industry and available 
training resources.

D. Requirements Applying to Records That Must Be Established and 
Maintained

    When a HACCP-type system is implemented for food safety, records 
are a critical part of the system because they aid facilities in 
compliance with the requirements, including all the elements of a food 
safety plan as proposed in Part 117, and allow facilities to show, and 
FDA to determine, compliance with the requirements. This concept is 
discussed in detail in section XV of the PC proposed rule. We have 
tentatively concluded that records are critical to protect food from 
intentional adulteration caused by acts of terrorism.
    In subpart D of proposed part 121, FDA is proposing to establish 
requirements applying to records that must be established and 
maintained according to the requirements of this proposed rule. This 
subpart implements numerous provisions in section 418 of the FD&C Act, 
including sections 418(a), (b)(3), (g), (h), and (n)(1)(A), as well as 
section 420(b) of the FD&C Act.
1. Proposed Sec.  121.301--Records Subject to the Requirements of this 
Subpart D
    Proposed Sec.  121.301(a) would establish that, except as provided 
by proposed Sec.  121.301(b), all records required by proposed subpart 
C of part 121 would be subject to all requirements of proposed subpart 
D. We have tentatively concluded that the requirements in subpart D 
describing how records must be established and maintained, including 
the general requirements, record retention requirements, and 
requirements for official review and public disclosure, are applicable 
to all records that would be required under subpart C. Such records 
would aid facilities in compliance with the requirements of proposed 
part 121, and allow facilities to show, and FDA to determine, 
compliance with the requirements of part 121. The proposed requirements 
of subpart D are discussed in this document.
    Proposed Sec.  121.301(b) would establish that the requirements of 
proposed Sec.  121.310 apply only to the written food defense plan and 
is discussed in more detail in section V.D.3 of this document.
2. Proposed Sec.  121.305--General Requirements Applying to Records
    Proposed Sec.  121.305 contains general requirements that would 
apply to records that would be required under proposed part 121, 
including the format for required records, the recording of actual 
values and observations obtained during monitoring, when records must 
be created, and information that must be included in each record.
    a. Proposed Sec.  121.305(a). Proposed Sec.  121.305(a) would 
require that the records be kept as original records, true copies (such 
as photocopies, pictures, scanned copies, microfilm, microfiche, or 
other accurate reproductions of the original records), or electronic 
records. True copies of records should be of sufficient quality to 
detect whether the original record was changed or corrected in a manner 
that obscured the original entry (e.g., through the use of white-out). 
Proposed Sec.  121.305(a) would provide flexibility for mechanisms for 
keeping records while maintaining the integrity of the recordkeeping 
system. The proposed requirement allowing true copies provides options 
that may be compatible with the way records are currently being kept in 
facilities.
    Proposed Sec.  121.305(a) also would require that electronic 
records be kept in accordance with part 11 (21 CFR part 11). Part 11 
provides criteria for acceptance by FDA, under certain circumstances, 
of electronic records, electronic signatures, and handwritten 
signatures executed to electronic records as equivalent to paper 
records and handwritten signatures executed on paper. The proposed 
requirement clarifies and acknowledges that records required by 
proposed part 121 may be retained electronically, provided that they 
comply with part 11.
    In the PC proposed rule, FDA tentatively concluded that it would be 
appropriate to apply the requirements of part 11 to the records that 
would be required to be kept under proposed part 117. However, we 
requested comment on whether there are any circumstances that would 
warrant not applying part 11 to records that would be kept under 
proposed part 117. In section XV.C of that document, we provided 
examples of circumstances in which we exempted records from the 
requirements of part 11 (21 CFR 1.329(b)) to avoid the necessity of 
establishing new recordkeeping systems as long as current practices 
would satisfy the requirements of the Act. In the PC proposed rule, we 
also asked for comment on whether we should allow additional time for 
electronic records to be kept in accordance with part 11. We seek 
similar comment with regard to circumstances that would warrant not 
applying part 11 to records that would be kept under proposed part 121 
and whether we should allow additional time for electronic records to 
be kept in accordance with part 11. Comments should provide the basis 
for any view that the requirements of part 11 are not warranted.
    b. Proposed Sec.  121.305(b). Proposed Sec.  121.305(b) would 
require that records contain the actual values and observations 
obtained during monitoring. For example, monitoring of the locking of 
an access door to an actionable process step could be recorded as 
``locked'' or ``unlocked'' (or ``yes'' or ``no'') and the monitoring of 
the presence of staff with only appropriate color uniforms in a 
designated area could be recorded as ``100% staff (or 10 of 10 staff) 
with blue uniforms'' or conversely ``80% staff (or 8 of 10 staff) with 
blue uniforms'' in the case of an improperly implemented focused 
mitigation strategy. In the case of an improperly implemented focused 
mitigation strategy, it is important to document the extent to which 
the strategy was incorrectly applied, as monitoring data can show a 
trend toward loss of control at an actionable process step. So, in the 
example in which 8 of 10 staff have blue uniforms, a facility may also 
consider documenting what color the remaining two staff were wearing if 
such information would be valuable in establishing a trend. If the 
recording of numerical values is possible in the monitoring of a 
focused mitigation strategy (e.g., if a facility is using a processing 
parameter such as heat treatment), then the actual times and 
temperatures or other appropriate processing data should be recorded.
    c. Proposed Sec.  121.305(c), (d) and (e). Proposed Sec.  
121.305(c), (d) and (e) would require that records be accurate, 
indelible, and legible (proposed

[[Page 78054]]

Sec.  121.305(c)); be created concurrently with performance of the 
activity documented (proposed Sec.  121.305(d)); and be as detailed as 
necessary to provide a history of work performed (proposed Sec.  
121.305(e)). Proposed Sec.  121.305(c) and (d) would ensure that the 
records are useful to the owner, operator, or agent in charge of a 
facility in complying with the requirements of proposed part 121, for 
example, in documenting compliance with monitoring requirements and 
verifying compliance with the food defense plan. These proposed 
requirements would also ensure that the records would be useful to FDA 
in determining compliance with the requirements of proposed part 121. 
Proposed Sec.  121.305(e) would provide flexibility to facilities to 
tailor the amount of detail to the nature of the record.
    d. Proposed Sec.  121.305(f). Proposed Sec.  121.305(f) would 
require that the records include the following: (1) The name and 
location of the facility; (2) the date and time of the activity 
documented; (3) the signature or initials of the person performing the 
activity; and (4) where appropriate, the identity of the product and 
the production code, if any. The name and location of the facility and 
the date and time would allow the owner, operator, or agent in charge 
of a facility (and, during inspection, an FDA investigator) to assess 
whether the record is current, to identify when and where any deviation 
occurred, and to track corrective actions. The signature of the 
individual who made the observation would ensure responsibility and 
accountability. In addition, if there is a question about the record, a 
signature would ensure that the source of the record will be known. 
Linking a record to a specific product (and, when applicable, the 
production code) would enable the owner, operator, or agent in charge 
of a facility covered by this rule to isolate product if there is a 
question that food has been adulterated. We seek comment on the scope 
and potential burden associated with these proposed requirements.
    The proposed requirement (proposed Sec.  121.305(f)(4)) for the 
identity of the product and production code, if any, is important in 
the context of food safety, where the production of potentially 
adulterated product may result from loss of control during processing, 
such as an improper cook temperature, and a recall may be necessary. It 
is also especially applicable for food safety in cases of continuous 
monitoring, when the loss of control can be associated with a 
particular product or production code. Consistent with the PC proposed 
rule, we have qualified the proposed requirement to indicate that the 
identity of the product and the production code should be included as 
part of the record ``where appropriate.'' We note that, in many cases, 
it will likely be more difficult to include this information for a 
focused mitigation strategy. As noted in the discussion on monitoring 
in section V.C.5 of this proposed rule, some focused mitigation 
strategies may be monitored weekly or monthly. In that case, it may not 
be appropriate to include all of the products and production codes that 
may have been affected by an improperly implemented focused mitigation 
strategy. Further, in many cases the identity of the product and the 
production code will not be relevant because the monitoring will be 
performed in the area surrounding one or more production lines, used 
for one or more products, rather than of processing parameters on a 
production line for a specific lot of product. On the other hand, if 
control of processing parameters, such as pasteurization time and 
temperature, are used as a focused mitigation strategy, it would be 
appropriate to document the product and production code, if any, that 
was being processed at the time of monitoring. The nature of the 
focused mitigation strategy should drive the decision by an owner, 
operator, or agent in charge of a facility regarding whether or not to 
include the identity of the product and the production code, if any, in 
records.
3. Proposed Sec.  121.310--Additional Requirements Applying to the Food 
Defense Plan
    Proposed Sec.  121.310 would require that the owner, operator, or 
agent in charge of a facility sign and date the food defense plan upon 
initial completion (proposed Sec.  121.310(a)) and upon any 
modification (proposed Sec.  121.310(b)). Such a signature would 
provide direct evidence of the owner, operator, or agent's acceptance 
of the plan and commitment to implementation of the plan. Additionally, 
the signature, along with the date of signing, would serve to minimize 
potential confusion over the authenticity of any differing versions or 
editions of the document that might exist.
4. Proposed Sec.  121.315--Requirements for Record Retention
    Proposed Sec.  121.315 contains requirements on the length of time 
records that would be required under proposed part 121 must be retained 
and allowances for offsite storage of records under certain 
circumstances.
    a. Proposed Sec.  121.315(a) and (b). Proposed Sec.  121.315(a) 
would require that all records that would be required by proposed part 
121 be retained at the facility for at least 2 years after the date 
they were prepared. Proposed Sec.  121.315(b) would require that the 
food defense plan be retained at the facility for at least 2 years 
after its use is discontinued (e.g., because the facility has updated 
the written food defense plan. The 2-year timeframe for all records 
required by proposed part 121 is consistent with the length of time 
that nonperishable food products, on average, can be expected to be in 
commercial distribution plus a reasonable time thereafter to ensure 
that the records are available for verification activities. This 
proposed requirement is similar to the proposed records retention 
requirement in the PC proposed rule, which contains a discussion of 
similar requirements found in other FDA regulations and in particular 
the proposed and final rules implementing the recordkeeping 
requirements of the Bioterrorism Act. This 2-year retention period 
would run from either the date the record is prepared, for day-to-day 
operational records, or the date at which use of the record is 
discontinued, for the food defense plan. We seek comment on this 
proposal.
    b. Proposed Sec.  121.315(c). Proposed Sec.  121.315(c) would 
provide that, except for the food defense plan, use of offsite storage 
for records is permitted after 6 months following the date that the 
record was made if such records can be retrieved and provided onsite 
within 24 hours of request for official review. The food defense plan 
would be required to remain onsite. FDA realizes that the proposed 
requirements for recordkeeping could require some facilities to store a 
significant quantity of records, and that there may not be adequate 
storage space in the facility for all of these records. Providing for 
offsite storage of most records after 6 months would enable a facility 
to comply with the proposed requirements for record retention while 
reducing the amount of space needed for onsite storage of the records 
without interfering with the purpose of record retention, because the 
records will be readily available.
    Proposed Sec.  121.315(c) also would provide that electronic 
records are considered to be onsite if they are accessible from an 
onsite location. Computerized systems within corporations can be 
networked, allowing for the sending and receiving of information in a 
secure fashion to all of the different food processing facilities of 
that corporation worldwide. This

[[Page 78055]]

type of system can be used to provide access at multiple locations to 
records from multiple facilities.
    c. Proposed Sec.  121.315(d). Proposed Sec.  121.315(d) would 
provide that if the facility is closed for a prolonged period, the 
records may be transferred to some other reasonably accessible location 
but must be returned to the facility within 24 hours for official 
review upon request. Allowing for transfer of records will give 
practical storage relief to seasonal operations or those closed for 
other reasons for prolonged periods.
5. Proposed Sec.  121.320--Requirements for Official Review
    Proposed Sec.  121.320 would require that all records required by 
proposed part 121 be made promptly available to a duly authorized 
representative of the Secretary of Health and Human Services upon oral 
or written request.
6. Proposed Sec.  121.325--Public Disclosure
    Proposed Sec.  121.325 would establish that all records required by 
proposed part 121 will be protected from public disclosure to the 
extent allowable under part 20 of this chapter. Our general policies, 
procedures, and practices relating to the protection of confidential or 
otherwise protected information received from third parties would apply 
to information received under this rule.

E. Compliance

    Section 103(e) of FSMA amends section 301 of the FD&C Act (21 
U.S.C. 331) by adding a new section--(uu)--to the list of acts and the 
causing thereof that are prohibited. Under section 301(uu) of the FD&C 
Act, the following act, and the causing thereof, are prohibited: 
``[t]he operation of a facility that manufactures, processes, packs, or 
holds food for sale in the United States if the owner, operator, or 
agent in charge of such facility is not in compliance with section 418 
[of the FD&C Act].'' To clearly communicate that failure to comply with 
the regulations established under section 418 of the FD&C Act is a 
prohibited act, proposed Sec.  121.401(a) in subpart E would establish 
that the operation of a facility that manufactures, processes, packs, 
or holds food for sale in the United States if the owner, operator, or 
agent in charge of such facility is required to comply with, and is not 
in compliance with, section 418 or subparts C or D of part 121 is a 
prohibited act under section 301(uu) of the FD&C Act.
    Section 106(d) of FSMA amends section 301 of the FD&C Act by adding 
a new section--(ww)--to the list of acts and the causing thereof that 
are prohibited. Under section 301(ww) of the FD&C Act, the following 
act, and the causing thereof, are prohibited: ``[t]he failure to comply 
with section 420 [of the FD&C Act].'' To clearly communicate that 
failure to comply with the regulations established under section 420 of 
the FD&C Act is a prohibited act, proposed Sec.  121.401(b) would 
establish that the failure to comply with section 420 of the FD&C Act 
or subparts C or D of part 121 is a prohibited act under section 
301(ww) of the FD&C Act.

VI. Preliminary Regulatory Impact Analysis

A. Overview

    FDA has examined the impacts of the proposed rule under Executive 
Order 12866, Executive Order 13563, the Regulatory Flexibility Act (5 
U.S.C. 601-612), and the Unfunded Mandates Reform Act of 1995 (Pub. L. 
104-4). Executive Orders 12866 and 13563 direct Agencies to assess all 
costs and benefits of available regulatory alternatives and, when 
regulation is necessary, to select regulatory approaches that maximize 
net benefits (including potential economic, environmental, public 
health and safety, and other advantages; distributive impacts; and 
equity). We believe that this proposed rule is a significant regulatory 
action under Executive Order 12866.

B. Regulatory Flexibility Act

    The Regulatory Flexibility Act requires Agencies to analyze 
regulatory options that would minimize any significant impact of a rule 
on small entities. The annualized costs per entity due to this proposed 
rule are about $13,000 for a one-facility firm with 100 employees, and 
there are about 4,100 small businesses that would be affected by the 
proposed rule, so we tentatively conclude that the proposed rule could 
have a significant economic impact on a substantial number of small 
entities.

C. Small Business Regulatory Enforcement Fairness Act of 1996

    The Small Business Regulatory Enforcement Fairness Act of 1996 
(Pub. L. 104-121) defines a major rule for the purpose of congressional 
review as having caused or being likely to cause one or more of the 
following: An annual effect on the economy of $100 million or more; a 
major increase in costs or prices; significant adverse effects on 
competition, employment, productivity, or innovation; or significant 
adverse effects on the ability of U.S.-based enterprises to compete 
with foreign-based enterprises in domestic or export markets. In 
accordance with the Small Business Regulatory Enforcement Fairness Act, 
the Office of Management and Budget (OMB) has determined that this 
proposed rule is a major rule for the purpose of congressional review.

D. Unfunded Mandates Reform Act of 1995

    Section 202(a) of the Unfunded Mandates Reform Act of 1995 requires 
that Agencies prepare a written statement, which includes an assessment 
of anticipated costs and benefits, before proposing ``any rule that 
includes any Federal mandate that may result in the expenditure by 
State, local, and tribal governments, in the aggregate, or by the 
private sector, of $100,000,000 or more (adjusted annually for 
inflation) in any one year.'' The current threshold after adjustment 
for inflation is $141 million, using the most current (2012) Implicit 
Price Deflator for the Gross Domestic Product. We expect this proposed 
rule may result in a 1-year expenditure that would meet or exceed this 
amount.

E. Paperwork Reduction Act of 1995

    This proposed rule contains information collection requirements 
that are subject to review by the Office of Management and Budget (OMB) 
under the Paperwork Reduction Act of 1995 (PRA) (44 U.S.C. 3501-3520). 
A description of these provisions is given in the Description section 
of this document with an estimate of the annual reporting, 
recordkeeping, and third-party disclosure burden. Included in the 
estimate is the time for reviewing instructions, searching existing 
data sources, gathering and maintaining the data needed, and completing 
and reviewing each collection of information.
    FDA invites comments on: (1) Whether the proposed collection of 
information is necessary for the proper performance of FDA's functions, 
including whether the information will have practical utility; (2) the 
accuracy of FDA's estimate of the burden of the proposed collection of 
information, including the validity of the methodology and assumptions 
used; (3) ways to enhance the quality, utility, and clarity of the 
information to be collected; and (4) ways to minimize the burden of the 
collection of information on respondents, including through the use of 
automated collection techniques, when appropriate, and other forms of 
information technology.
    To ensure that comments on information collection are received, OMB 
recommends that written

[[Page 78056]]

comments be faxed to the Office of Information and Regulatory Affairs, 
OMB, Attn: FDA Desk Officer, FAX: 202-395-7285, or emailed to oira_submission@omb.eop.gov. All comments should be identified with the 
title ``Focused Mitigation Strategies to Protect Food Against 
Intentional Adulteration.''
    In compliance with the Paperwork Reduction Act of 1995 (44. U.S.C. 
3407(d)), the agency has submitted the information collection 
provisions of this proposed rule to OMB for review. Interested persons 
are requested to send comments regarding information collection by 
January 23, 2014 to the Office of Information and Regulatory Affairs, 
OMB. To ensure that comments on information collection are received, 
OMB recommends that written comments be faxed to the Office of 
Information and Regulatory Affairs, OMB, Attn: FDA Desk Officer, FAX: 
202-395-6974, or emailed to oira_submission@omb.eop.gov. All comments 
should be identified with the title, ``Focused Mitigation Strategies to 
Protect Food Against Intentional Adulteration.''

F. Public Access to the Analyses

    The analyses that we have performed to examine the impacts of this 
proposed rule under Executive Order 12866, Executive Order 13563, the 
Regulatory Flexibility Act (5 U.S.C. 601-612), the Unfunded Mandates 
Reform Act of 1995 (Pub. L. 104-4), and the Paperwork Reduction Act of 
1995 (44 U.S.C. 3501-3520) are available to the public in the docket 
for this final rule (Ref. 64).

VII. Analysis of Environmental Impact

    The Agency has determined under 21 CFR 25.30(h) that this action is 
of a type that does not individually or cumulatively have a significant 
effect on the human environment (Ref. 65). Therefore, neither an 
environmental assessment nor an environmental impact statement is 
required.

VIII. Federalism

    FDA has analyzed this proposed rule in accordance with the 
principles set forth in Executive Order 13132. FDA has determined that 
the proposed rule, if finalized, would not contain policies that would 
have substantial direct effects on the States, on the relationship 
between the National Government and the States, or on the distribution 
of power and responsibilities among the various levels of government. 
Accordingly, the Agency tentatively concludes that the proposed rule 
does not contain policies that have federalism implications as defined 
in the Executive order and, consequently, a federalism summary impact 
statement is not required.

IX. Comments

    We invite public comment on the matters specified in this document 
as well as any other matters concerning this proposed rule that are of 
interest. Interested persons may submit either electronic comments 
regarding this document to https://www.regulations.gov or written 
comments to the Division of Dockets Management (see ADDRESSES). It is 
only necessary to send one set of comments. Identify comments with the 
docket number found in brackets in the heading of this document. 
Received comments may be seen in the Division of Dockets Management 
between 9 a.m. and 4 p.m., Monday through Friday, and will be posted to 
the docket at https://www.regulations.gov.

X. References

    The following references have been placed on display in the 
Division of Dockets Management (see ADDRESSES) and may be seen by 
interested persons between 9 a.m. and 4 p.m., Monday through Friday. 
(FDA has verified the Web site addresses, but FDA is not responsible 
for any subsequent changes to the Web sites after this document 
publishes in the Federal Register.)

    1. Kennedy, S.K. and F.F. Busta, ``Chapter 5 Biosecurity: Food 
Protection and Defense,'' Food Microbiology: Fundamentals and 
Frontiers, Edited by M.P. Doyle and L.R. Beuchat, American Society 
for Microbiology Press: Washington, DC, pp. 87-102, 2007. Accessed 
October 30, 2013.
    2. Khan A.S., D.L. Swerdlow, and D.D. Juranek, ``Precautions 
Against Biological and Chemical Terrorism Directed at Food and Water 
Supplies,'' Public Health Reports, 116(1):3-14, 2001.
    3. Sobel, J., A.S. Khan, and D.L. Swerdlow, ``Threat of a 
Biological Terrorist Attack on the US Food Supply: The CDC 
Perspective,'' The Lancet, 359(9309):874-880, March 9, 2002.
    4. T[ouml]r[ouml]k, T.J., R.V. Tauxe, R.P. Wise, et al., ``A 
Large Community Outbreak of Salmonellosis Caused by Intentional 
Contamination of Restaurant Salad Bars,'' Journal of American 
Medical Association, 278(5):389-395, August 1997.
    5. British Standards Institute and Centre for the Protection of 
National Infrastructure. ``Publicly Available Specification 96:2010 
Defending Food and Drink,'' March 2010. https://www.cpni.gov.uk/documents/publications/non-cpni_pubs/pas96_vis14.pdf. Accessed 
September 25, 2013.
    6. World Health Organization. ``Terrorist Threats to Food: 
Guidance for Establishing and Strengthening Prevention and Response 
Systems,'' Food Safety Issues, Revision May 2008. https://www.who.int/foodsafety/publications/general/en/terrorist.pdf. 
Accessed September 23, 2013.
    7. Everstine, K., S. Kennedy, and J. Spink, ``Economically 
Motivated Adulteration (EMA) of Food: Common Characteristics of EMA 
Incidents,'' Journal of Food Protection, 76(4):723-735, 2013.
    8. U.S. Food and Drug Administration. ``Economically Motivated 
Adulteration; Public Meeting; Request for Comment,'' Federal 
Register, 74(64):15497-15499, 2009. https://www.gpo.gov/fdsys/pkg/FR-2009-04-06/pdf/E9-7843.pdf. Accessed September 23, 2013.
    9. Spink, J. and DC Moyer, ``Defining the Public Health Threat 
of Food Fraud,'' Journal of Food Science, 75(9):R157-R163, 2011.
    10. Ingelfinger, J.R., ``Melamine and the Global Implications of 
Food Contamination,'' New England Journal of Medicine, 359(26):2745-
2748, 2008.
    11. Xiu, C. and K.K. Klein, ``Melamine in Milk Products in 
China: Examining the Factors That Led to Deliberate Use of the 
Contaminant,'' Food Policy, 35(5):463-470, 2010.
    12. World Health Organization. Food Security Page. https://www.who.int/trade/glossary/story028/en. Accessed September 23, 2013
    13. Kolavic, S., A. Kimura, S. Simons, L. Slutsker, S. Barth, 
and C. Haley, ``An Outbreak of Shigella dysenteriae Type 2 Among 
Laboratory Workers Due to Intentional Food Contamination,'' Journal 
of American Medical Association, 278(5):396-398, August 1997.
    14. Anderson, S., J. DeMent, C.B. Ocfemia, and D.C. Hunt, 
Outbreaks of Methomyl Poisoning Caused by the Intentional 
Contamination of Salsa at the Mi Ranchito Restaurant in Lenexa, KS--
August 2009, Kansas Department of Health and Environment, April 12, 
2011. https://www.kdheks.gov/epi/download/Final_Mi_Ranchito_Report.pdf. Accessed October 22, 2013.
    15. U.S. Government Printing Office. Senate Hearing 108-491, 
``Agroterrorism: The Threat to America's Breadbasket,'' p. 1, 
November 19, 2003. https://www.gpo.gov/fdsys/pkg/CHRG-108shrg91045/html/CHRG-108shrg91045.htm. Accessed September 23, 2013.
    16. The White House, Office of the Press Secretary. Homeland 
Security Presidential Directive/HSPD-8, December, 17, 2003. https://www.fas.org/irp/offdocs/nspd/hspd-8.html. Accessed October 17, 2013.
    17. The White House, Office of the Press Secretary. Homeland 
Security Presidential Directive 7: Critical Infrastructure 
Identification, Prioritization, and Protection, December, 17, 2003. 
https://www.dhs.gov/homeland-security-presidential-directive-7. 
Accessed October 17, 2013.
    18. The White House, Office of the Press Secretary. Homeland 
Security Presidential Directive/HSPD-9, January, 30, 2004. https://www.fas.org/irp/offdocs/nspd/hspd-9.html. Accessed October 17, 2013.
    19. The White House, Office of the Press Secretary. Presidential 
Policy Directive/PPD-8: National Preparedness, March 30, 2011. 
https://www.dhs.gov/presidential-policy-directive-8-national-preparedness. Accessed October 17, 2013.
    20. The White House, Office of the Press Secretary. Presidential 
Policy Directive 21:

[[Page 78057]]

Critical Infrastructure Security and Resilience, February 12, 2013. 
https://www.whitehouse.gov/the-press-office/2013/02/12/presidential-policy-directive-critical-infrastructure-security-and-resil. 
Accessed October 7, 2013.
    21. U.S. Food and Drug Administration. Strategic Partnership 
Program Agroterrorism (SPPA) Initiative: Final Summary Report 
September 2005--September 2008, December 2008. https://www.fda.gov/Food/FoodDefense/FoodDefensePrograms/ucm170509.htm. Accessed 
September 23, 2013.
    22. U.S. Food and Drug Administration, Center for Food Safety 
and Applied Nutrition. ``Guidance for Industry: Food Producers, 
Processors, and Transporters: Food Security Preventive Measures 
Guidance,'' March 2003, Revision October 2007. https://www.fda.gov/Food/GuidanceRegulation/GuidanceDocumentsRegulatoryInformation/FoodDefense/ucm083075.htm. Accessed September 23, 2013.
    23. U.S. Food and Drug Administration, Center for Food Safety 
and Applied Nutrition. ``Guidance for Industry: Importers and 
Filers: Food Security Preventive Measures Guidance,'' March 2003, 
Revision October 2007. https://www.fda.gov/Food/GuidanceRegulation/GuidanceDocumentsRegulatoryInformation/FoodDefense/ucm078978.htm. 
Accessed September 23, 2013.
    24. U.S. Food and Drug Administration, Center for Food Safety 
and Applied Nutrition. ``Guidance for Industry: Dairy Farms, Bulk 
Milk Transporters, Bulk Milk Transfer Stations and Fluid Milk 
Processors: Food Security Preventive Measures Guidance,'' July 2003, 
Revision October 2007. https://www.fda.gov/Food/GuidanceRegulation/GuidanceDocumentsRegulatoryInformation/FoodDefense/ucm078978.htm. 
Accessed September 23, 2013.
    25. U.S. Food and Drug Administration, Center for Food Safety 
and Applied Nutrition. ``Guidance for Industry: Retail Food Stores 
and Food Service Establishments: Food Security Preventive Measures 
Guidance,'' December 2003, Revision October 2007. https://www.fda.gov/Food/GuidanceRegulation/GuidanceDocumentsRegulatoryInformation/FoodDefense/ucm082751.htm. 
Accessed September 23, 2013.
    26. U.S. Food and Drug Administration, Center for Food Safety 
and Applied Nutrition. ``Guidance for Industry: Cosmetics Processors 
and Transporters of Cosmetics Security Preventive Measures 
Guidance,'' November 2003, Revision October 2007. https://www.fda.gov/Food/GuidanceRegulation/GuidanceDocumentsRegulatoryInformation/FoodDefense/ucm082716.htm. 
Accessed September 23, 2013.
    27. U.S. Food and Drug Administration. Food Defense 101 Page. 
https://www.fda.gov/Food/FoodDefense/ToolsEducationalMaterials/ucm353774.htm. Accessed October 17, 2013.
    28. U.S. Food and Drug Administration. Employees FIRST Page. 
https://www.fda.gov/Food/FoodDefense/ToolsEducationalMaterials/ucm295997.htm. Accessed and printed on October 17, 2013.
    29. U.S. Food and Drug Administration. Vulnerability Assessment 
Software Page, Version 2.4, November 2011. https://www.fda.gov/Food/FoodDefense/ToolsEducationalMaterials/ucm295900.htm. Accessed 
September 25, 2013.
    30. U.S. Food and Drug Administration. Mitigation Strategies 
Database Page. https://www.fda.gov/Food/FoodDefense/ToolsEducationalMaterials/ucm295898.htm. Accessed September 25, 
2013.
    31. U.S. Food and Drug Administration. Food Defense Plan Builder 
Software Page. https://www.fda.gov/Food/FoodDefense/ToolsEducationalMaterials/ucm349888.htm. Accessed September 25, 
2013.
    32. U.S. Food and Drug Administration. Food Related Emergency 
Exercise Bundle (FREE-B) Page. https://www.fda.gov/Food/FoodDefense/ToolsEducationalMaterials/ucm295902.htm. Accessed October 17, 2013.
    33. Global Food Safety Initiative. GFSI Guidance Document, 
Version 6.1, 6(2), August 2011. https://www.mygfsi.com/gfsifiles/Guidance_Document_Sixth_Edition_Version_6.1.pdf. Accessed 
September 23, 2013.
    34. Safe Quality Food Institute. SQF Code: A HACCP-Based 
Supplier Assurance Code for the Food Industry, Edition 7.1, April 
2013. https://www.sqfi.com/wp-content/uploads/SQF-Code-Ed-7.1-4-3-13.pdf. Accessed October 17, 2013.
    35. International Featured Standards. Events and Academy Page. 
https://www.ifs-certification.us/events. Accessed November 5, 2013.
    36. China Inspection and Quarantine Service, Administrative 
Provisions on Filing of Export Food Production Enterprises Page. 
https://en.ciqcid.com/Zjl/Comprehensives/51829.htm. Accessed 
September 25, 2013.
    37. German Federal Office of Consumer Protection and Food 
Safety. ``General Recommendations for Protection of Animal Feed and 
Food Supply Chain From the Intentional Release of Agents,'' February 
2011. Accessed October 22, 2013.
    38. French Republic. Guide Containing Recommendations for the 
Protection of the Food Chain From Threats of Malevolent, Criminal, 
or Terrorist Acts, May 2007. https://www.frenchfoodintheus.org/IMG/pdf/I07008308-imtnea-Guide_des_recommandations-ENG_3_.pdf. 
Accessed and printed on September 23, 2013.
    39. Trusted Information Sharing Network for Critical 
Infrastructure Protection. A National Strategy for Enhancing the 
Safety and Security of our Food Supply, March 2006. https://www.daff.gov.au/__data/assets/pdf_file/0004/183325/enhancing_safety_security_strategy.pdf. Accessed September 23, 2013.
    40. U.S. Food and Drug Administration. Memorandum to the File: 
Evaluation of the potential for intentional adulteration of produce 
during activities that occur on produce farms, September 2013.
    41. Buttars, N.K., A.J. Young, D. Bailey, ``Adoption of Security 
Systems by Dairy Farms To Address Bioterrorist Threats in the 
Intermountain United States,'' Journal of Dairy Science, 89:1822-
1829, 2006. Accessed October 22, 2013.
    42. International Dairy Foods Association. Global Markets Page. 
https://www.idfa.org/key-issues/category/global-markets/map/#us. 
Accessed October 23, 2013.
    43. Newkirk, R., C. Hedberg, and J. Bender, ``Establishing a 
Milkborne Disease Outbreak Profile: Potential Food Defense 
Implications,'' Foodborne Pathogens and Disease, 8(3):433-437, 2011.
    44. Popkin, B., ``Patterns of Beverage Use Across the 
Lifecycle,'' Physiology and Behavior, 100(1):4-9, 2010.
    45. Sebastian, R.S., J.D. Goldman, C.W. Enns, and R.P. LaComb, 
``Fluid Milk Consumption in the United States: What We Eat In 
America, NHANES 2005-2006,'' Food Surveys Research Group Dietary 
Data Brief No. 3, September 2010. https://ars.usda.gov/SP2UserFiles/Place/12355000/pdf/DBrief/3_milk_consumption_0506.pdf. Accessed 
October 23, 2013.
    46. U.S. Department of Agriculture and Economic Research 
Service. Dairy Products: Per capita consumption, United States 
(Annual), 2013. https://www.ers.usda.gov/data-products/dairy-data.aspx. Accessed October 23, 2013.
    47. Wein, L.M. and Y. Lui, ``Analyzing a Bioterror Attack on the 
Food Supply: The Case of Botulinum Toxin in Milk,'' Proceedings of 
the National Academy of Sciences of the United States of America, 
102(28):9984-9989, 2005.
    48. Blayney, D.P., ``The Changing Landscape of U.S. Milk 
Production,'' Statistical Bulletin No. 978, U.S. Department of 
Agriculture, June 2002. https://usda.mannlib.cornell.edu/usda/nass/sb/sb978.pdf. Accessed October 23, 2013.
    49. Codex Alimentarius Commission. General Principles of Food 
Hygiene, CAC/RCP 1-1969, 2003.
    50. Sobel J. and J. Watson, ``Chapter 10: Intentional Terrorism 
Contamination of Food and Water,'' Beyond Anthrax, Springer Link, 
2009.
    51. Stinson, T.F., J. Kinsey, D. Degeneffe, and K. Ghosh, How 
Should America's Anti-Terrorism Budget Be Allocated? Findings From a 
National Survey of Attitudes of U.S. Residents About Terrorism, The 
Food Industry Center, March 2006. https://ageconsearch.umn.edu/bitstream/14351/1/tr06-01.pdf. Accessed October 21, 2013.
    52. Merriam-Webster. Vulnerability Page. https://www.merriam-webster.com/dictionary/vulnerability. Accessed October 21, 2013.
    53. U.S. Food and Drug Administration, Study and Report on the 
Food Processing Sector, 2011.
    54. U.S. Food and Drug Administration. Analysis of Results for 
FDA Food Defense Vulnerability Assessments and Identification of 
Activity Types, April 2013. https://www.fda.gov/food/guidanceregulation/fsma/ucm347023.htm. Accessed September 25, 2013.
    55. U.S. Food and Drug Administration. Memorandum to the File: 
Evaluation of the potential for intentional adulteration of animal 
feed from acts of terrorism, December 2013.
    56. U.S. Department of Health and Human Services, Public Health 
Service, and National

[[Page 78058]]

Toxicology Program. Report on Carcinogens, 12th Edition, 2011.
    57. U.S. Department of Health and Human Services, Centers for 
Disease Control and Prevention, and U.S. Department of Agriculture. 
HHS and USDA Select Agents and Toxins 7 CFR Part 331, 9 CFR Part 
121, and 42 CFR Part 73, September 10, 2013. https://www.selectagents.gov/resources/List_of_Select_Agents_and_Toxins_2013-09-10.pdf. Accessed October 21, 2013.
    58. U.S. Food and Drug Administration. Vulnerability Assessments 
of Food Systems: Final Summary Report, June 2009-February 2012. 
https://www.fda.gov/downloads/Food/FoodDefense/UCM317547.pdf. 
Accessed September 23, 2013.
    59. AIB International. Food Safety and Food Defense Education 
Page. https://www.aibonline.org/foodsafetyeducation/. 
Accessed October 17, 2013.
    60. Center for Agriculture and Food Security and Preparedness 
and University of Tennessee Knoxville. Instructor-Led Courses Page: 
Agriculture and Food Vulnerability Assessment Training. https://www.vet.utk.edu/cafsp/courses.php. Accessed October 17, 2013.
    61. International Featured Standards. IFS Food: Standard for 
Auditing Quality and Food Safety of Food Products, Version 6, 
January 2012. https://www.ifs-certification.com/images/ifs_standards/ifs6/IFS_Food_V6_en.pdf. Accessed September 23, 2013.
    62. National Center for Food Protection and Defense. Food 
Defense Online Modules Page. https://www.ncfpd.umn.edu/index.cfm/education/food-defense-online-modules/. Accessed October 17, 2013.
    63. AIB International. The AIB International Consolidated 
Standards for Inspection: Prerequisite and Food Safety Programs, 
January 2013. https://www.aibonline.org/Standards/2013FoodSafety_web_ENG.pdf. Accessed October 17, 2013.
    64. U.S. Food and Drug Administration. FDA's Preliminary 
Regulatory Impact Analysis, Preliminary Regulatory Flexibility 
Analysis, Preliminary Unfunded Mandates Reform Act Analysis, 
Preliminary Paperwork Reduction Act Analysis, December 2013.
    65. U.S. Food and Drug Administration. Memorandum to the File: 
Environmental analysis related to the proposed rule on focused 
mitigation strategies to protect food against intentional 
adulteration, November 2013.

List of Subjects in 21 CFR Part 121

    Food packaging, Foods.
    Therefore, under the Federal Food, Drug, and Cosmetic Act and under 
authority delegated to the Commissioner of Food and Drugs, it is 
proposed that 21 CFR chapter I be amended by adding part 121 to read as 
follows:

PART 121--FOCUSED MITIGATION STRATEGIES TO PROTECT FOOD AGAINST 
INTENTIONAL ADULTERATION

Subpart A--General Provisions
Sec.
121.3 Definitions.
121.5 Exemptions.
Subpart B--[Reserved]
Subpart C--Food Defense Measures
121.126 Requirement for a food defense plan.
121.130 Identification of actionable process steps.
121.135 Focused mitigation strategies for actionable process steps.
121.140 Monitoring.
121.145 Corrective actions.
121.150 Verification.
121.160 Training.
Subpart D--Requirements Applying to Records That Must Be Established 
and Maintained
121.301 Records subject to the requirements of this subpart.
121.305 General requirements applying to records.
121.310 Additional requirements applying to the food defense plan.
121.315 Requirements for record retention.
121.320 Requirements for official review.
121.325 Public disclosure.
Subpart E--Compliance
121.401 Compliance.

    Authority:  21 U.S.C. 331, 342, 350g, 350(i), 371, 374.

Subpart A--General Provisions


Sec.  121.3  Definitions.

    The definitions and interpretations of terms in section 201 of the 
Federal Food, Drug, and Cosmetic Act are applicable to such terms when 
used in this part. The following definitions also apply:
    Actionable process step means a point, step, or procedure in a food 
process at which food defense measures can be applied and are essential 
to prevent or eliminate a significant vulnerability or reduce such 
vulnerability to an acceptable level.
    Contaminant means any biological, chemical, physical or 
radiological agent that may be intentionally added to food and that may 
cause illness, injury or death.
    Facility means a domestic facility or a foreign facility that is 
required to register under section 415 of the Federal Food, Drug, and 
Cosmetic Act (21 U.S.C. 350d), in accordance with the requirements of 
21 CFR part 1, subpart H.
    Farm means farm as defined in Sec.  1.227 of this chapter.
    FDA means the Food and Drug Administration.
    Focused mitigation strategies mean those risk-based, reasonably 
appropriate measures that a person knowledgeable about food defense 
would employ to significantly minimize or prevent significant 
vulnerabilities identified at actionable process steps, and that are 
consistent with the current scientific understanding of food defense at 
the time of the analysis.
    Food means food as defined in section 201(f) of the Federal Food, 
Drug, and Cosmetic Act (21 U.S.C. 321(f)) and includes raw materials 
and ingredients.
    Food defense means the effort to protect food from intentional acts 
of adulteration where there is an intent to cause public health harm 
and economic disruption.
    Holding means storage of food. Holding facilities include 
warehouses, cold storage facilities, storage silos, grain elevators, 
and liquid storage tanks. For farms and farm mixed-type facilities, 
holding also includes activities traditionally performed by farms for 
the safe or effective storage of raw agricultural commodities grown or 
raised on the same farm or another farm under the same ownership, but 
does not include activities that transform a raw agricultural 
commodity, as defined in section 201(r) of the Federal Food, Drug, and 
Cosmetic Act, into a processed food as defined in section 201(gg).
    Manufacturing/processing means making food from one or more 
ingredients, or synthesizing, preparing, treating, modifying or 
manipulating food, including food crops or ingredients. Examples of 
manufacturing/processing activities are cutting, peeling, trimming, 
washing, waxing, eviscerating, rendering, cooking, baking, freezing, 
cooling, pasteurizing, homogenizing, mixing, formulating, bottling, 
milling, grinding, extracting juice, distilling, labeling, or 
packaging. For farms and farm mixed-type facilities, manufacturing/
processing does not include activities that are part of harvesting, 
packing, or holding.
    Mixed-type facility means an establishment that engages in both 
activities that are exempt from registration under section 415 of the 
Federal Food, Drug, and Cosmetic Act and activities that require the 
establishment to be registered. An example of such a facility is a 
``farm mixed-type facility,'' which is an establishment that grows and 
harvests crops or raises animals and may conduct other activities 
within the farm definition, but also conducts activities that require 
the establishment to be registered.
    Monitor means to conduct a planned sequence of observations or 
measurements to assess whether focused mitigation strategies are 
consistently applied and to produce an accurate record for use in 
verification.

[[Page 78059]]

    Packing means placing food into a container other than packaging 
the food. For farms and farm mixed-type facilities, packing also 
includes activities traditionally performed by farms to prepare raw 
agricultural commodities grown or raised on the same farm or another 
farm under the same ownership for storage and transport, but does not 
include activities that transform a raw agricultural commodity, as 
defined in section 201(r) of the Federal Food, Drug, and Cosmetic Act, 
into a processed food as defined in section 201(gg).
    Qualified end-user, with respect to a food, means the consumer of 
the food (where the term consumer does not include a business); or a 
restaurant or retail food establishment (as those terms are defined in 
Sec.  1.227 of this chapter) that:
    (1) Is located:
    (i) In the same State as the qualified facility that sold the food 
to such restaurant or establishment; or
    (ii) Not more than 275 miles from such facility; and
    (2) Is purchasing the food for sale directly to consumers at such 
restaurant or retail food establishment.
    Qualified facility means (when including the sales by any 
subsidiary; affiliate; or subsidiaries or affiliates, collectively, of 
any entity of which the facility is a subsidiary or affiliate) a 
facility that is:
    (1) A very small business as defined in this part; or
    (2) A facility to which both of the following apply:
    (i) During the 3-year period preceding the applicable calendar 
year, the average annual monetary value of the food manufactured, 
processed, packed or held at such facility that is sold directly to 
qualified end-users (as defined in this part) during such period 
exceeded the average annual monetary value of the food sold by such 
facility to all other purchasers; and
    (ii) The average annual monetary value of all food sold during the 
3-year period preceding the applicable calendar year was less than 
$500,000, adjusted for inflation.
    Significant vulnerability means a vulnerability for which a prudent 
person knowledgeable about food defense would employ food defense 
measures because of the potential for serious adverse health 
consequences or death and the degree of accessibility to that point in 
the food process.
    Significantly minimize means to reduce to an acceptable level, 
including to eliminate.
    Small business means a business employing fewer than 500 persons.
    Verification means those activities, other than monitoring, that 
establish that the system is operating according to the food defense 
plan.
    Very small business means a business that has less than $10,000,000 
in total annual sales of food, adjusted for inflation.
    Vulnerability means the susceptibility of a point, step, or 
procedure in a facility's food process to intentional adulteration.


Sec.  121.5  Exemptions.

    (a) This part does not apply to a qualified facility, except that 
qualified facilities must, upon request, provide for official review 
documentation that was relied upon to demonstrate that the facility 
meets this exemption. Such documentation must be retained for 2 years.
    (b) This part does not apply to the holding of food, except the 
holding of food in liquid storage tanks.
    (c) This part does not apply to the packing, re-packing, labeling, 
or re-labeling of food where the container that directly contacts the 
food remains intact.
    (d) This part does not apply to activities of a facility that are 
subject to section 419 of the Federal Food, Drug, and Cosmetic Act (21 
U.S.C. 350h) (Standards for Produce Safety).
    (e)(1) This part does not apply with respect to alcoholic beverages 
at a facility that meets the following two conditions:
    (i) Under the Federal Alcohol Administration Act (27 U.S.C. 201 et 
seq.) or chapter 51 of subtitle E of the Internal Revenue Code of 1986 
(26 U.S.C. 5001 et seq.) the facility is required to obtain a permit 
from, register with, or obtain approval of a notice or application from 
the Secretary of the Treasury as a condition of doing business in the 
United States, or is a foreign facility of a type that would require 
such a permit, registration, or approval if it were a domestic 
facility; and
    (ii) Under section 415 of the Federal Food, Drug, and Cosmetic Act 
(21 U.S.C. 350d) the facility is required to register as a facility 
because it is engaged in manufacturing, processing, packing, or holding 
one or more alcoholic beverages.
    (2) This part does not apply with respect to food other than 
alcoholic beverages at a facility described in paragraph (e)(1) of this 
section, provided such food:
    (i) Is in prepackaged form that prevents any direct human contact 
with such food; and
    (ii) Constitutes not more than 5 percent of the overall sales of 
the facility, as determined by the Secretary of the Treasury.
    (f) This part does not apply to the manufacturing, processing, 
packing, or holding of food for animals other than man.

Subpart B--[Reserved]

Subpart C--Food Defense Measures


Sec.  121.126  Requirement for a food defense plan.

    (a) Food defense plan. The owner, operator, or agent in charge of a 
facility must prepare, or have prepared, and implement a written food 
defense plan.
    (b) Contents of a food defense plan. The food defense plan must 
include:
    (1) The written identification of actionable process steps as 
required by Sec.  121.130;
    (2) The written focused mitigation strategies as required by Sec.  
121.135(b);
    (3) The written procedures for monitoring as required by Sec.  
121.140(a);
    (4) The written corrective action procedures as required by Sec.  
121.145(a)(1); and
    (5) The written verification procedures as required by Sec.  
121.150(e).


Sec.  121.130  Identification of actionable process steps.

    The owner, operator, or agent in charge of a facility must identify 
any actionable process steps, using the procedures described in either 
paragraph (a) or paragraph (b) of this section. The identification of 
actionable process steps and the assessment leading to that 
identification must be written.
    (a) Key activity types. The owner, operator, or agent in charge of 
a facility must assess, for each type of food manufactured, processed, 
packed or held at the facility, whether the facility has one or more of 
the following key activity types and identify the actionable process 
steps associated with any key activity types present:
    (1) Bulk liquid receiving and loading--a step in which a bulk 
liquid is received and unloaded from an inbound conveyance or loaded 
into an outbound conveyance where a contaminant can be intentionally 
introduced and, if it is, it is likely that the contaminant will be 
distributed throughout the liquid due to sloshing, movement, or 
turbulence caused by the receiving and unloading or loading activity.
    (2) Liquid storage and handling--a step in which a liquid is 
contained in bulk storage tanks or in holding, surge,

[[Page 78060]]

or metering tanks where a contaminant can be intentionally introduced 
and, if it is, it is likely that the contaminant will be distributed 
into the food.
    (3) Secondary ingredient handling--a staging, preparation, 
addition, or rework step where a contaminant can be intentionally 
introduced into a relatively small amount of ingredient or rework and, 
if it is, it is likely that the contaminant will be distributed into a 
larger volume of food.
    (4) Mixing and similar activities--a step, such as mixing, 
blending, homogenizing, or grinding where a contaminant can be 
intentionally introduced and, if it is, it is likely that the 
contaminant will be distributed into the food.
    (b) Vulnerability assessment. The owner, operator, or agent in 
charge of a facility must conduct or have conducted, for each type of 
food manufactured, processed, packed or held at the facility, an 
evaluation to identify and prioritize the points, steps, and procedures 
in a food operation based on their vulnerability to intentional 
adulteration and to identify actionable process steps. Such 
vulnerability assessments must be performed by an individual(s) 
qualified by experience and/or training using appropriate methods.


Sec.  121.135  Focused mitigation strategies for actionable process 
steps.

    (a) The owner, operator, or agent in charge of a facility must 
identify and implement focused mitigation strategies at each actionable 
process step to provide assurances that the significant vulnerability 
at each step will be significantly minimized or prevented and the food 
manufactured, processed, packed, or held by such facility will not be 
adulterated under section 402 of the Federal Food, Drug, and Cosmetic 
Act (21 U.S.C. 342).
    (b) Focused mitigation strategies must be written.
    (c) Focused mitigation strategies required under this section are 
subject to:
    (1) Monitoring as required by Sec.  121.140;
    (2) Corrective actions as required by Sec.  121.145; and
    (3) Verification as required by Sec.  121.150.


Sec.  121.140  Monitoring.

    (a) The owner, operator, or agent in charge of a facility must 
establish and implement written procedures, including the frequency 
with which they are to be performed, for monitoring the focused 
mitigation strategies.
    (b) The owner, operator, or agent in charge of a facility must 
monitor the focused mitigation strategies with sufficient frequency to 
provide assurances that they are consistently applied.
    (c) All monitoring of focused mitigation strategies in accordance 
with this section must be documented in records that are subject to 
verification in accordance with Sec.  121.150(a) and records review in 
accordance with Sec.  121.150(c).


Sec.  121.145  Corrective actions.

    (a) Corrective action procedures. (1) The owner, operator, or agent 
in charge of a facility must establish and implement written corrective 
action procedures that must be taken if focused mitigation strategies 
are not properly implemented.
    (2) The corrective action procedures must describe the steps to be 
taken to ensure that appropriate action is taken to identify and 
correct a problem with implementation of a focused mitigation strategy 
to reduce the likelihood that the problem will recur.
    (b) Documentation. All corrective actions taken in accordance with 
this section must be documented in records that are subject to 
verification in accordance with Sec.  121.150(b) and records review in 
accordance with Sec.  121.150(c).


Sec.  121.150  Verification.

    (a) Monitoring. The owner, operator, or agent in charge of a 
facility must verify that monitoring is being conducted, as required by 
Sec.  121.140.
    (b) Corrective actions. The owner, operator, or agent in charge of 
a facility must verify that appropriate decisions about corrective 
actions are being made, as required by Sec.  121.145.
    (c) Implementation and effectiveness. The owner, operator, or agent 
in charge of a facility must verify that the focused mitigation 
strategies are consistently implemented and are effectively and 
significantly minimizing or preventing the significant vulnerabilities. 
As appropriate to the facility and the food, this must include review 
of the monitoring and corrective actions records within appropriate 
timeframes to ensure that the records are complete, the activities 
reflected in the records occurred in accordance with the food defense 
plan, the focused mitigation strategies are effective, and appropriate 
decisions were made about corrective actions.
    (d) Reanalysis. The owner, operator, or agent in charge of a 
facility must:
    (1) Conduct a reanalysis of the food defense plan:
    (i) At least once every 3 years;
    (ii) Whenever a significant change is made in the activities 
conducted at a facility operated by such owner, operator, or agent in 
charge if the change creates a reasonable potential for a new 
vulnerability or a significant increase in a previously identified 
vulnerability;
    (iii) Whenever such owner, operator or agent in charge becomes 
aware of new information about potential vulnerabilities associated 
with the food operation or facility;
    (iv) Whenever a focused mitigation strategy is found to be 
ineffective; and
    (v) Whenever FDA requires reanalysis to respond to new 
vulnerabilities and developments in scientific understanding including, 
as appropriate, results from the Department of Homeland Security 
biological, chemical, radiological, or other terrorism risk assessment.
    (2) Complete such reanalysis and implement any additional focused 
mitigation strategies needed to address the significant vulnerabilities 
identified, if any, before the change in activities at the facility is 
operative or, when necessary, during the first 6 weeks of production; 
and
    (3) Revise the written plan if a significant change is made or 
document the basis for the conclusion that no additional or revised 
focused mitigation strategies are needed.
    (e) Documentation. All verification activities taken in accordance 
with this section must be documented in records.


Sec.  121.160  Training.

    (a) Personnel and supervisors assigned to actionable process steps 
must receive appropriate training in food defense awareness and their 
respective responsibilities in implementing focused mitigation 
strategies.
    (b) All training received in accordance with this section must be 
documented in records.

Subpart D--Requirements Applying to Records That Must Be 
Established and Maintained


Sec.  121.301  Records subject to the requirements of this subpart D.

    (a) Except as provided by paragraph (b) of this section, all 
records required by subpart C of this part are subject to all 
requirements of this subpart D.
    (b) The requirements of Sec.  121.310 apply only to the written 
food defense plan.


Sec.  121.305  General requirements applying to records.

    Records must:
    (a) Be kept as original records, true copies (such as photocopies, 
pictures, scanned copies, microfilm, microfiche,

[[Page 78061]]

or other accurate reproductions of the original records), or electronic 
records, which must be kept in accordance with part 11 of this chapter;
    (b) Contain the actual values and observations obtained during 
monitoring;
    (c) Be accurate, indelible, and legible;
    (d) Be created concurrently with performance of the activity 
documented;
    (e) Be as detailed as necessary to provide history of work 
performed; and
    (f) Include:
    (1) The name and location of the facility;
    (2) The date and time of the activity documented;
    (3) The signature or initials of the person performing the 
activity; and
    (4) Where appropriate, the identity of the product and the 
production code, if any.


Sec.  121.310  Additional requirements applying to the food defense 
plan.

    The food defense plan must be signed and dated by the owner, 
operator, or agent in charge of the facility:
    (a) Upon initial completion; and
    (b) Upon any modification.


Sec.  121.315  Requirements for record retention.

    (a) All records required by this part must be retained at the 
facility for at least 2 years after the date they were prepared.
    (b) The food defense plan must be retained for at least 2 years 
after its use is discontinued;
    (c) Except for the food defense plan, offsite storage of records is 
permitted after 6 months following the date that the record was made if 
such records can be retrieved and provided onsite within 24 hours of 
request for official review. The food defense plan must remain onsite. 
Electronic records are considered to be onsite if they are accessible 
from an onsite location.
    (d) If the facility is closed for a prolonged period, the records 
may be transferred to some other reasonably accessible location but 
must be returned to the facility within 24 hours for official review 
upon request.


Sec.  121.320  Requirements for official review.

    All records required by this part must be made promptly available 
to a duly authorized representative of the Secretary of Health and 
Human Services upon oral or written request.


Sec.  121.325  Public disclosure.

    Records required by this part will be protected from public 
disclosure to the extent allowable under part 20 of this chapter.

Subpart E--Compliance


Sec.  121.401  Compliance.

    (a) The operation of a facility that manufactures, processes, 
packs, or holds food for sale in the United States if the owner, 
operator, or agent in charge of such facility is required to comply 
with, and is not in compliance with, section 418 of the Federal Food, 
Drug, and Cosmetic Act (21 U.S.C. 350g) or subparts C or D of this part 
is a prohibited act under section 301(uu) of the Federal Food, Drug, 
and Cosmetic Act (21 U.S.C. 331(uu)).
    (b) The failure to comply with section 420 of the Federal Food, 
Drug, and Cosmetic Act (21 U.S.C. 350i) or subparts C or D of this part 
is a prohibited act under section 301(ww) of the Federal Food, Drug, 
and Cosmetic Act.

    Dated: December 13, 2013.
Leslie Kux,
Assistant Commissioner for Policy.
[FR Doc. 2013-30373 Filed 12-20-13; 8:45 am]
BILLING CODE 4160-01-P