Focused Mitigation Strategies To Protect Food Against Intentional Adulteration, 78013-78061 [2013-30373]

Download as PDF Vol. 78 Tuesday, No. 247 December 24, 2013 Part III Department of Health and Human Services sroberts on DSK5SPTVN1PROD with PROPOSALS Food and Drug Administration 21 CFR Parts 16 and 121 Focused Mitigation Strategies To Protect Food Against Intentional Adulteration; Proposed Rule VerDate Mar<15>2010 17:30 Dec 23, 2013 Jkt 232001 PO 00000 Frm 00001 Fmt 4717 Sfmt 4717 E:\FR\FM\24DEP2.SGM 24DEP2 78014 Federal Register / Vol. 78, No. 247 / Tuesday, December 24, 2013 / Proposed Rules DEPARTMENT OF HEALTH AND HUMAN SERVICES Food and Drug Administration 21 CFR Parts 16 and 121 [Docket No. FDA–2013–N–1425] RIN 0910–AG63 Focused Mitigation Strategies To Protect Food Against Intentional Adulteration AGENCY: Food and Drug Administration, HHS. ACTION: Proposed rule. The Food and Drug Administration (FDA or we) is proposing to require domestic and foreign food facilities that are required to register under the Federal Food, Drug, and Cosmetic Act (the FD&C Act) to address hazards that may be intentionally introduced by acts of terrorism. These food facilities would be required to identify and implement focused mitigation strategies to significantly minimize or prevent significant vulnerabilities identified at actionable process steps in a food operation. FDA is proposing these requirements as part of our implementation of the FDA Food Safety Modernization Act (FSMA). Further, as part of the proposal, FDA discusses an approach to addressing economically motivated intentional adulteration. We expect the proposed rule, if finalized as proposed, would help to protect food from intentional adulteration caused by acts of terrorism. DATES: Submit either electronic or written comments on the proposed rule by March 31, 2014. Submit comments on information collection issues under the Paperwork Reduction Act of 1995 by January 23, 2014, (see the ‘‘Paperwork Reduction Act of 1995’’ section of this document). ADDRESSES: You may submit comments, identified by Docket No. FDA–2013–N– 1425 and/or Regulatory Information Number (RIN) 0910–AG63, by any of the following methods, except that comments on information collection issues under the Paperwork Reduction Act of 1995 must be submitted to the Office of Information and Regulatory Affairs, Office of Management and Budget (OMB) (see the ‘‘Paperwork Reduction Act of 1995’’ section of this document). sroberts on DSK5SPTVN1PROD with PROPOSALS SUMMARY: Electronic Submissions Submit electronic comments in the following way: VerDate Mar<15>2010 17:30 Dec 23, 2013 Jkt 232001 • Federal eRulemaking Portal: http:// www.regulations.gov. Follow the instructions for submitting comments. Written Submissions Submit written submissions in the following ways: • Mail/Hand delivery/Courier (for paper or CD–ROM submissions): Division of Dockets Management (HFA– 305), Food and Drug Administration, 5630 Fishers Lane, rm. 1061, Rockville, MD 20852. Instructions: All submissions received must include the Agency name and Docket No. FDA–2013–N–1425 and Regulatory Information Number (RIN) 0910–AG63 for this rulemaking. All comments received may be posted without change to http:// www.regulations.gov, including any personal information provided. For additional information on submitting comments, see the ‘‘Comments’’ heading of the SUPPLEMENTARY INFORMATION section of this document. Docket: For access to the docket to read background documents or comments received, go to http:// www.regulations.gov and insert the docket number, found in brackets in the heading of this document, into the ‘‘Search’’ box and follow the prompts and/or go to the Division of Dockets Management, 5630 Fishers Lane, rm. 1061, Rockville, MD 20852. FOR FURTHER INFORMATION CONTACT: Regarding the provisions with respect to human food: Ryan Newkirk, Center for Food Safety and Applied Nutrition (HFS–005), Food and Drug Administration, 5100 Paint Branch Pkwy., College Park, MD 20740, 240– 402–2428. Regarding the provisions with respect to food for animals: Alfred Montgomery, Center for Veterinary Medicine (HFV–200), Food and Drug Administration, 7519 Standish Pl., Rockville, MD 20855, 240–453–6836. SUPPLEMENTARY INFORMATION: A. Framework of the Rule B. Activities That Occur on Produce Farms C. Transportation Carriers D. Food for Animals E. Acts of Disgruntled Employees, Consumers, or Competitors F. Economically Motivated Adulteration G. Low-Risk Activities at Farm Mixed-Type Facilities H. Activities That Occur on Dairy Farms I. Other Ways To Focus on Foods With a High Risk of Intentional Adulteration Caused by Terrorism V. The Proposal A. Definitions B. Exemptions C. Food Defense Measures D. Requirements Applying to Records That Must Be Established and Maintained E. Compliance VI. Preliminary Regulatory Impact Analysis VII. Analysis of Environmental Impact VIII. Federalism IX. Comments X. References Table of Contents Scope of Coverage of the Proposed Rule The subject of this proposed rule is protection of food against intentional adulteration caused by acts of terrorism. This proposed rule would apply to both domestic and foreign facilities that are required to register under section 415 of the FD&C Act. However, as explained in the remainder of this document and shown in Diagram 1 and Table 1, the proposed rule contains several exemptions. (The diagrams and table below are intended to illustrate the proposed scope and requirements of this rule, and do not include all aspects of the proposed regulation.) These exemptions are: • The proposed rule would not apply to a qualified facility, except that the Executive Summary Scope of Coverage of the Proposed Rule Summary of the Major Provisions of the Proposed Rule Costs and Benefits I. Introduction II. Background A. Incidents of Intentional Adulteration of Food B. Interagency Approach to Food Defense C. Resources for the Food Sector D. Outreach E. Industry Standards F. International Food Defense Guidelines III. Legal Authority A. Section 103 of FSMA B. Section 106 of FSMA C. Intrastate Activities IV. Regulatory Approach PO 00000 Frm 00002 Fmt 4701 Sfmt 4702 Executive Summary This proposed regulation implements three provisions of the Federal Food, Drug, and Cosmetic (FD&C) Act, as amended by the FDA Food Safety Modernization Act (FSMA), that relate to the intentional adulteration of food. Section 418 of the FD&C Act (21 U.S.C. 350g) addresses intentional adulteration in the context of facilities that manufacture, process, pack, or hold food and are required to register under section 415 of the FD&C Act (21 U.S.C. 350d). Section 419 of the FD&C Act (21 U.S.C. 350h) addresses intentional adulteration in the context of fruits and vegetables that are raw agricultural commodities. Section 420 of the FD&C Act (21 U.S.C. 350i) addresses intentional adulteration in the context of high risk foods and exempts farms except for farms that produce milk. FDA is implementing the intentional adulteration provisions in sections 418, 419, and 420 of the FD&C Act in this rulemaking. E:\FR\FM\24DEP2.SGM 24DEP2 Federal Register / Vol. 78, No. 247 / Tuesday, December 24, 2013 / Proposed Rules sroberts on DSK5SPTVN1PROD with PROPOSALS facility would be required to provide for official review, upon request, documentation that was relied upon to demonstrate that the facility qualifies for this exemption. As proposed, a qualified facility would be: (1) A very small business (i.e., a business that has less than $10,000,000 in total annual sales of food, adjusted for inflation), or (2) a facility that meets two requirements, i.e., (a) During the 3-year period preceding the applicable calendar year, the average annual monetary value of the food manufactured, processed, packed or held at such facility that is sold directly VerDate Mar<15>2010 17:30 Dec 23, 2013 Jkt 232001 to qualified end-users (as defined in this part) during such period exceeded the average annual monetary value of the food sold by such facility to all other purchasers; and (b) the average annual monetary value of all food sold during the 3-year period preceding the applicable calendar year was less than $500,000, adjusted for inflation. • This proposed rule would not apply to the holding of food, except the holding of food in liquid storage tanks. • This proposed rule would not apply to the packing, re-packing, labeling, or re-labeling of food where the container that directly contacts the food remains intact. PO 00000 Frm 00003 Fmt 4701 Sfmt 4702 78015 • This proposed rule would not apply to activities of a facility that are subject to section 419 of the Federal Food, Drug, and Cosmetic Act (Standards for Produce Safety). • This proposed rule would not apply with respect to alcoholic beverages at a facility that meets certain conditions. • This proposed rule would not apply to the manufacturing, processing, packing, or holding of food for animals other than man. We seek comment on these exclusions and whether additional exclusions are warranted. BILLING CODE 4160–01–P E:\FR\FM\24DEP2.SGM 24DEP2 Federal Register / Vol. 78, No. 247 / Tuesday, December 24, 2013 / Proposed Rules BILLING CODE 4160–01–C VerDate Mar<15>2010 17:30 Dec 23, 2013 Jkt 232001 PO 00000 Frm 00004 Fmt 4701 Sfmt 4702 E:\FR\FM\24DEP2.SGM 24DEP2 EP24DE13.026</GPH> sroberts on DSK5SPTVN1PROD with PROPOSALS 78016 Federal Register / Vol. 78, No. 247 / Tuesday, December 24, 2013 / Proposed Rules 78017 TABLE 1—SCOPE OF INTENTIONAL ADULTERATION AND PROPOSED EXCLUSIONS AND EXEMPTIONS Coverage within scope of proposed 21 CFR 121 Type of intentional adulteration Brief rationale, and relevant corresponding section of the rule * I. Types of Intentional Adulteration Considered in this Proposed Rulemaking 1. Acts of disgruntled employees, consumers, or competitors intended to attack the reputation of a company, and not to cause public health harm, although public health harm may occur. 2. Economically motivated adulteration (EMA) intended to obtain economic gain, and not to cause public health harm, although public health harm may occur. 3. Acts intended to cause massive public health harm, including acts of terrorism. Not within the scope of intentional adulteration covered under proposed 21 CFR 121. D Not considered ‘‘high risk’’ because not intended to cause widespread, significant public health harm. D See section IV.E of this document. Not within the scope of intentional adulteration covered under proposed 21 CFR 121. D Considering addressing as part of hazard analysis in a preventive controls framework where EMA is ‘‘reasonably likely to occur.’’ D See section IV.F of this document. D Considered ‘‘high risk’’ because intent of the act is to cause widespread, significant public health harm. D See section IV.A of this document. Covered within scope, and is the focus of proposed 21 CFR 121. II. Facilities or Operations Excluded or Exempted from Proposed 21 CFR 121 Facility or Operation Exclusion or Exemption (and any associated modified requirements) Brief rationale, and relevant corresponding section of the rule * Activities that fall within the definition of ‘‘farm’’ (as defined in 21 CFR § 1.227). Excluded .......................................................... Transportation carriers ....................................... Excluded .......................................................... D Activities that occur on produce farms are not considered ‘‘high risk.’’ D Activities that occur on dairy farms are addressed below. D Activities that occur on other farms are outside the scope of 103, 105, and 106 of FSMA. D See section IV.B of this document. D Transportation of bulk liquids is addressed by coverage of shippers and receivers. D Other transportation activities are not considered ‘‘high risk.’’ D See section IV.C of this document. Activities that occur on dairy farms .................... D Fluid milk storage and loading appear to pose a significant vulnerability. D We seek comment on practical and effective approach to address this vulnerability. D See section IV.H of this document. Qualified facility, as defined in proposed § 121.3 Exempt, except must provide for FDA review, upon request, documentation relied on to demonstrate that the facility qualifies for this exemption. Exempt ............................................................. Holding of food, except the holding of food in liquid storage tanks. sroberts on DSK5SPTVN1PROD with PROPOSALS Packing, re-packing, labeling, or re-labeling of food where the container that directly contacts the food remains intact. Exempt ............................................................. Activities of a facility that are subject to Standards for Produce Safety (proposed 21 CFR 112). Alcoholic beverages at certain alcohol-related facilities, and certain prepackaged food sold in limited quantities along with alcoholic beverages at the same facilities (see proposed § 121.5(e)). Manufacturing, processing, packing, or holding of food for animals. Exempt ............................................................. Exempt ............................................................. Exempt ............................................................. D Very small businesses are not considered ‘‘high risk.’’ D See section V.B.1 of this document. D Not considered ‘‘high risk’’ because these activities do not fit within any of the FDAidentified key activity types. D See section V.B.2 of this document. D Not considered ‘‘high risk’’ because these activities do not fit within any of the FDAidentified key activity types. D See section V.B.3 of this document. D Activities that occur on produce farms are not considered ‘‘high risk.’’ D See section V.B.4 of this document. D Alcoholic beverages at these facilities are outside the scope of 103, 105, and 106 of FSMA. D See section V.B.5 of this document. D Not considered ‘‘high risk’’ because unlikely to impact human health. D See section V.B.6 of this document. * Please see the corresponding sections of the rule identified in the column for a complete discussion of our analysis, rationale, and tentative conclusions related to the proposed exclusions or exemption. VerDate Mar<15>2010 17:30 Dec 23, 2013 Jkt 232001 PO 00000 Frm 00005 Fmt 4701 Sfmt 4702 E:\FR\FM\24DEP2.SGM 24DEP2 78018 Federal Register / Vol. 78, No. 247 / Tuesday, December 24, 2013 / Proposed Rules sroberts on DSK5SPTVN1PROD with PROPOSALS Summary of the Major Provisions of the Proposed Rule This proposed rule would establish various food defense measures that an owner, operator, or agent in charge of a facility would be required to implement to protect against the intentional adulteration of food, as summarized in Diagram 2. Specifically: • Prepare and implement a written food defense plan that includes actionable process steps, focused mitigation strategies, and procedures for monitoring, corrective actions, and verification (proposed § 121.126). • Identify any actionable process steps, using one of two procedures. FDA has analyzed vulnerability assessments conducted using the CARVER+Shock methodology and identified four key activity types: Bulk liquid receiving and loading; Liquid storage and handling; Secondary ingredient handling; and Mixing and similar activities. FDA has determined that the presence of one or more of these key activity types at a process step (e.g., manufacturing, processing, packing, or holding of food) indicates a significant vulnerability under section 418 of the FD&C Act and that the food is at high risk of intentional adulteration caused by acts of terrorism under section 420 of the FD&C Act. Facilities may identify actionable process steps using the FDAidentified key activity types as VerDate Mar<15>2010 17:30 Dec 23, 2013 Jkt 232001 described in proposed § 121.130(a) or conduct their own facility-specific vulnerability assessments as provided in proposed § 121.130(b). • Identify and implement focused mitigation strategies at each actionable process step to provide assurances that the significant vulnerability at each step will be significantly minimized or prevented and the food manufactured, processed, packed, or held by the facility will not be adulterated (proposed § 121.135). • Establish and implement procedures, including the frequency with which they are to be performed, for monitoring the focused mitigation strategies (proposed § 121.140). • Establish and implement corrective action procedures that must be taken if focused mitigation strategies are not properly implemented (proposed § 121.145). • Verify that monitoring is being conducted and appropriate decisions about corrective actions are being made; verify that the focused mitigation strategies are consistently implemented and are effectively and significantly minimizing or preventing the significant vulnerabilities; and conduct a reanalysis of the food defense plan (proposed § 121.150). • Ensure that personnel and supervisors assigned to actionable process steps receive appropriate PO 00000 Frm 00006 Fmt 4701 Sfmt 4702 training in food defense awareness and their respective responsibilities in implementing focused mitigation strategies (proposed § 121.160). • Establish and maintain certain records, including the written food defense plan; written identification of actionable process steps and the assessment leading to that identification; written focused mitigation strategies; written procedures for monitoring, corrective actions, and verification; and documentation related to training of personnel (proposed §§ 121.301 to 121.325). As proposed, the effective date is 60 days after a final rule is published. However, we are providing for a longer timeline for facilities to come into compliance. Facilities, other than small and very small businesses, would have one year after the effective date to comply with proposed part 121. Small businesses (i.e., those employing fewer than 500 persons) would have 2 years after the effective date to comply with proposed part 121. Very small businesses (i.e., businesses that have less than $10,000,000 in total annual sales of food, adjusted for inflation) would be considered a qualified facility and would have 3 years after the effective date to comply with proposed § 121.5(a). BILLING CODE 4160–01–P E:\FR\FM\24DEP2.SGM 24DEP2 78019 BILLING CODE 4160–01–C VerDate Mar<15>2010 17:30 Dec 23, 2013 Jkt 232001 PO 00000 Frm 00007 Fmt 4701 Sfmt 4702 E:\FR\FM\24DEP2.SGM 24DEP2 EP24DE13.027</GPH> sroberts on DSK5SPTVN1PROD with PROPOSALS Federal Register / Vol. 78, No. 247 / Tuesday, December 24, 2013 / Proposed Rules 78020 Federal Register / Vol. 78, No. 247 / Tuesday, December 24, 2013 / Proposed Rules In addition, we describe our current thinking and seek comment on other issues, including activities that occur on dairy farms and economically motivated adulteration. Finally, elsewhere in this issue of the Federal Register, FDA is publishing for comment its evaluation that identifies low-risk activities that occur at farm mixed-type facilities, with a specific focus on the risk presented by hazards that may be intentionally introduced by acts of terrorism. Costs and Benefits As described in the Preliminary Regulatory Impact Analysis (PRIA), we estimate the annualized costs of the actions required by this proposed rule to be about $370 million. The benefits of these actions are a reduction in the possibility of illness, death, and economic disruption resulting from intentional adulteration of food. We are unable to quantify these benefits. However, we monetize the damage that various intentional adulteration scenarios might cause, and present a breakeven analysis showing the number of prevented attacks at which the benefits are larger than the costs. ANNUALIZED COST AND BENEFIT OVERVIEW All numbers are USD millions, annualized over 10 years 3% discount 7% discount Costs: Learning about Rule ................................................................................................................................. Mitigation Costs ........................................................................................................................................ Monitoring and Corrective Action ............................................................................................................. Employee Training .................................................................................................................................... Documentation .......................................................................................................................................... $3 59 100 4 6 $3 63 100 5 6 Subtotal (Domestic cost) ................................................................................................................... Cost to Foreign Firms ............................................................................................................................... 172 185 177 190 Total ................................................................................................................................................... 357 367 Benefits: Lower Chance of Intentional Adulteration ........................................................................................ sroberts on DSK5SPTVN1PROD with PROPOSALS I. Introduction The FDA Food Safety Modernization Act (FSMA) (Pub. L. 111–353), signed into law on January 4, 2011, enables FDA to better protect public health by helping to ensure the safety and security of the food supply. FSMA enables us to focus more on preventing food safety problems rather than primarily reacting to problems after they occur. The law also provides us with new enforcement authorities to help us achieve higher rates of compliance with preventionand risk-based safety standards and to better respond to and contain problems when they do occur. In addition, the law gives us important new tools to better ensure the safety of imported foods and directs us to build an integrated national food safety system in partnership with State, local, tribal, and territorial authorities. Section 103 of FSMA directs FDA to issue regulations establishing requirements for facilities that manufacture, process, pack or hold food and requires facilities to consider hazards that may be intentionally introduced, including by acts of terrorism. Section 106 of FSMA requires FDA to issue regulations to protect food for which there is a high risk of intentional contamination and for which such intentional contamination could cause serious adverse health consequences or death to humans or animals. In addition, section 105 of FSMA directs FDA to issue regulations setting forth science-based minimum VerDate Mar<15>2010 17:30 Dec 23, 2013 Jkt 232001 standards for the safe production and harvesting of produce, and requires that the rulemaking consider hazards that may be intentionally introduced, including by acts of terrorism. Efforts to protect against intentional adulteration require a shift in perspective from that applied to traditional food safety. In proposed rules entitled ‘‘Current Good Manufacturing Practice and Hazard Analysis and Risk-Based Preventive Controls for Human Food’’ (78 FR 3646, January 16, 2013) (Docket No. FDA– 2011–N–0920; hereafter referred to as ‘‘the PC proposed rule’’), ‘‘Current Good Manufacturing Practice and Hazard Analysis and Risk-Based Preventive Controls for Food for Animals’’ (78 FR 64736, October 29, 2013) (Docket No. FDA–2011–N–0922; hereafter referred to as ‘‘the Animal Food PC proposed rule’’), and ‘‘Standards for the Growing, Harvesting, Packing and Holding of Produce for Human Consumption’’ (78 FR 3504, January 16, 2013) (Docket No. FDA–2011–N–0921; hereafter referred to as ‘‘the Produce Safety proposed rule’’), FDA tentatively decided not to include requirements to address ‘‘hazards that may be intentionally introduced, including by acts of terrorism’’ (sections 418(b)(2) and 419(a)(3)(C) of the FD&C Act (21 U.S.C. 350g(b)(2) and 350h(a)(3)(C))) and to implement sections 103 and 105 of FSMA regarding such hazards in a separate rulemaking (this proposed rule). As noted in those proposed rules, FDA tentatively concluded that intentional adulteration, PO 00000 Frm 00008 Fmt 4701 Sfmt 4702 Unquantified. which is not addressed by traditional Hazard Analysis and Critical Controls Point (HACCP) or other food safety systems, likely will require different kinds of controls. FDA is taking the action described in this proposed rule to implement the intentional adulteration provisions in sections 103, 105, and 106 of FSMA. II. Background Intentional adulteration of the food supply can result in catastrophic public health consequences, widespread public fear, loss of public confidence in the safety of food and the ability of government to ensure food safety, and significant adverse economic impacts, including disruption of trade (Ref. 1, Ref. 2, Ref. 3, Ref. 4). Acts of intentional adulteration may take several forms, including acts of terrorism; acts of disgruntled employees, consumers, or competitors; and economically motivated adulteration. Acts of terrorism are associated with an intent to cause massive public health harm and, to a lesser extent, economic disruption (Ref. 5, Ref. 2, Ref. 3, Ref. 6). Acts of disgruntled employees, consumers, or competitors are generally understood to be directed at attacking the reputation of the company and not at public health harm. The primary purpose of economically motivated adulteration is to obtain economic gain, and not to impact public health (Ref. 7, Ref. 8, Ref. 9), although public health harm may occur (Ref. 10, Ref. 11). E:\FR\FM\24DEP2.SGM 24DEP2 Federal Register / Vol. 78, No. 247 / Tuesday, December 24, 2013 / Proposed Rules sroberts on DSK5SPTVN1PROD with PROPOSALS ‘‘Food defense’’ and ‘‘food security’’ are terms that are sometimes used interchangeably. We use the term ‘‘food defense’’ to refer to the effort to protect food from acts of intentional adulteration where there is an intent to cause public health harm and economic disruption. ‘‘Food security’’ is defined by the World Health Organization (WHO) to mean ‘‘when all people at all times have access to sufficient, safe, nutritious food to maintain a healthy and active life’’ (Ref. 12). To avoid confusion, we use the term ‘‘food defense’’ and not the term ‘‘food security’’ in the context of intentional adulteration. A. Incidents of Intentional Adulteration of Food Several cases of intentional adulteration with the intent to cause public health harm and economic disruption in the United States have been documented. For example, in 1984, in an attempt to prevent the general public from voting in the local elections, members of a local religious commune in The Dalles, OR, intentionally contaminated food in restaurants with Salmonella. A total of 751 people became ill and 45 were hospitalized (Ref. 4). In another incident, in 1996, 12 laboratory workers at a large medical facility in Texas became ill from consuming anonymously donated pastries that were intentionally contaminated with Shigella dysenteriae type 2, which was later discovered to have originated from the facility’s stock culture (Ref. 13). In 2009, two related incidents resulted in 49 individuals reporting rapid and acute onset of gastrointestinal and neurological symptoms after eating meals at a restaurant in Lenexa, KS. Investigations concluded that the illnesses were caused by methomyl (an insecticide) poisoning associated with the consumption of salsa at the restaurant. Two former employees of the restaurant were found guilty of intentionally contaminating the salsa (Ref. 14). A widespread incident of economically motivated adulteration occurred in China in 2008. Some Chinese milk firms added melamine, a nitrogen-rich industrial by-product, to diluted dairy products to increase the apparent protein content. This adulteration resulted in significant public health consequences, with more than 290,000 ill infants and 6 deaths in China. In addition, this incident caused significant economic disruption within the Chinese dairy industry, with estimates approaching $3 billion in loss to industry (Ref. 10, Ref. 11). VerDate Mar<15>2010 17:30 Dec 23, 2013 Jkt 232001 B. Interagency Approach to Food Defense 1. Homeland Security Presidential Directives and Presidential Policy Directives for the Food and Agriculture Sector Intelligence gathered since the attacks on the United States on September 11, 2001, indicates that terrorist organizations have discussed contamination of the food supply as a means to harm U.S. citizens and disrupt the global economy (Ref. 15). In response, FDA, along with the Centers for Disease Control and Prevention (CDC), the United States Department of Agriculture (USDA), the Department of Homeland Security (DHS), the Federal Bureau of Investigation (FBI), the Environmental Protection Agency (EPA), the Department of Defense, the Department of Energy, the Department of Commerce, and the Department of the Interior, as well as with State, local, tribal, territorial, and private sector partners have coordinated efforts to prevent, prepare for, and respond to threats against the food supply. Many of these efforts were accomplished in accordance with applicable Homeland Security Presidential Directives (HSPD), specifically HSPD–7, HSPD–8, and HSPD–9, and Presidential Policy Directives (PPD), specifically PPD–8 and PPD–21 (Ref. 16, Ref. 17, Ref. 18, Ref. 19, Ref. 20). In accordance with these directives, FDA, USDA, DHS, State and local governments and the food industry collaborated to conduct vulnerability assessments of a variety of products and processes within the food and agriculture sector. 2. The Evolution of Vulnerability Assessments Initially, FDA used Operational Risk Management (ORM), which is a vulnerability assessment methodology that uses a six-step sequence of identifying hazards and reducing the potential for negative public health consequences. The ORM process resulted in three main outcomes: (1) A calculation of risk by combining assessments of severity and probability of an attack on a specific food; (2) calculations for specific contaminants and specific food processes or related activities; and (3) a categorization of specific food/contaminant/food process or related activity into a high, medium, or low risk scheme. At first, ORM-based assessments were focused on reducing large public health consequences of attacks on the food supply. FDA realized that other significant considerations (i.e., large economic disruptions, public alarm, PO 00000 Frm 00009 Fmt 4701 Sfmt 4702 78021 loss of confidence in the food supply, and interruption of the food stream) warranted incorporation into the vulnerability assessment calculus. To incorporate these considerations, FDA and USDA’s Food Safety and Inspection Service (FSIS) adapted a military targeting tool known as CARVER to assess vulnerabilities of the food and agriculture sector. CARVER is an acronym for the following six attributes used to evaluate the attractiveness of a target for attack: • Criticality—measure of public health and economic impacts of an attack; • Accessibility—ability to physically access and egress from target; • Recuperability—ability of a system to recover from an attack; • Vulnerability—ease of accomplishing an attack; • Effect—amount of direct loss from an attack as measured by loss in production; and • Recognizability—ease of identifying a target. A seventh attribute, ‘‘Shock’’, was added to the original six attributes to assess the combined health, economic, and psychological impacts of an attack on the food industry. ORM and CARVER+Shock assessment conclusions were consistent; however, the CARVER+Shock methodology improved vulnerability assessment efforts because its process allowed for the identification and estimation of economic and psychological impacts throughout the food system. In 2005, the Strategic Partnership Program Agroterrorism (SPPA), a public-private cooperative effort was established by FDA, USDA, FBI, and DHS, in partnership with State and industry partners. The intent of the SPPA Initiative was to collect the necessary data to identify food and agriculture sector-specific vulnerabilities using the CARVER+Shock method, develop mitigation strategies, identify research gaps, and increase coordination between government and industry partners. The SPPA initiative ran from 2005 to 2008, resulting in vulnerability assessments of 36 food products and processes (Ref. 21). The SPPA Initiative was a significant step towards identifying vulnerabilities, mitigation strategies, and research needs within the food and agriculture industries. This initiative also provided Federal, State, and local government agencies with an in-depth look at the vulnerabilities that may be associated with the food and agriculture industry, and helped enhance communication among industry, government, and law enforcement E:\FR\FM\24DEP2.SGM 24DEP2 78022 Federal Register / Vol. 78, No. 247 / Tuesday, December 24, 2013 / Proposed Rules sroberts on DSK5SPTVN1PROD with PROPOSALS stakeholders concerned with the protection of the U.S. food supply. Since the conclusion of the SPPA Initiative, we have conducted additional vulnerability assessments, which continue to help inform our research and policy. C. Resources for the Food Sector FDA has issued guidance documents and developed other resources to assist industry in their efforts to protect the food supply against intentional adulteration. In 2003, FDA issued five guidance documents covering food defense preventive measures for various segments of the food and cosmetic industry: (1) Guidance for Industry: Food Producers, Processors, and Transporters: Food Security Preventive Measures Guidance (Ref. 22); (2) Guidance for Industry: Importers and Filers: Food Security Preventive Measures Guidance (Ref. 23); (3) Guidance for Industry: Dairy Farms, Bulk Milk Transporters, Bulk Milk Transfer Stations and Fluid Milk Processors: Food Security Preventive Measures Guidance (Ref. 24); (4) Retail Food Stores and Food Service Establishments: Food Security Preventive Measures Guidance (Ref. 25); and(5) Cosmetics Processors and Transporters of Cosmetics Security Preventive Measures Guidance (Ref. 26). These guidance documents provide FDA’s recommendations for best practices in food defense, and describe preventive measures that establishments can take to minimize the risk of intentional adulteration of food. We updated the guidance documents in 2007 to include a self-assessment tool that guides the user through an assessment of recommended preventive measures to identify those most applicable to the facility. FDA also has made available other resources to help industry identify and mitigate potential vulnerabilities for intentional adulteration. These include: • The ‘‘ALERT’’ program, • The ‘‘Employees FIRST’’ training tool, • The ‘‘CARVER+Shock Vulnerability Assessment’’ software tool, • The ‘‘Mitigations Strategies Database,’’ • The ‘‘Food Defense Plan Builder’’ software tool, • The Food Related Emergency Exercise Bundle, and • The ‘‘Food Defense 101’’ training courses. We describe each briefly in this section of the document. The ALERT program, originally released in 2006, is an educational program intended to raise the awareness VerDate Mar<15>2010 17:30 Dec 23, 2013 Jkt 232001 of State and local governments and industry regarding food defense (Ref. 27). ALERT identifies five key elements that industry can use in food defense planning: • A—How do you ASSURE that the supplies and ingredients you use are from safe and secure sources? • L—How do you LOOK after the security of the products and ingredients in your facility? • E—What do you know about your EMPLOYEES and people coming in and out of your facility? • R—Could you provide REPORTS about the security of your products while under your control? • T—What do you do and who do you notify if you have a THREAT or issue at your facility, including suspicious behavior? Similarly, the Employees FIRST educational tool, originally released in 2008, is a food defense awareness training program for front-line food industry workers about the risk of intentional adulteration and the actions they can take to identify and reduce these risks (Ref. 28). This tool identifies the following five key elements: • F—Follow company food defense plan and procedures; • I—Inspect your work area and surrounding areas; • R—Recognize anything out of the ordinary; • S—Secure all ingredients, supplies, and finished product; and • T—Tell management if you notice anything unusual or suspicious. The CARVER+Shock Vulnerability Assessment software tool, originally released in 2007, helps users conduct vulnerability assessments for their establishments to identify and prioritize the ‘‘critical nodes,’’ (also known as critical process steps) the potential targets vulnerable to intentional adulteration attacks (Ref. 29). It guides users through a series of questions to determine the vulnerability of each of the nodes within their facility. After the vulnerabilities are identified, the software helps users to identify mitigation strategies for reducing the risk of intentional adulteration. Using the software tool, the user can focus resources on protecting the most susceptible points in their system. The Mitigation Strategies Database (MSD), originally released in 2011, is a database of mitigation strategies that can be applied to different steps in a food operation to reduce the risk of intentional adulteration (Ref. 30). The database is searchable by key words and processing steps common to agriculture and food operations (e.g., growing, harvesting, packing, manufacturing, PO 00000 Frm 00010 Fmt 4701 Sfmt 4702 processing, and holding). See also the discussion in section V.C.3 of this document. The Food Defense Plan Builder (FDPB) software tool, released in 2013, is a user-friendly computer software program designed to assist owners and operators of food facilities in developing food defense plans for their facilities (Ref. 31). In addition to providing new functionality for food defense planning and implementation, the FDPB software tool harnesses our food defense guidance documents, CARVER+Shock Vulnerability Assessment software tool, and the MSD into a single application. The Food Related Emergency Exercise Bundle (FREE–B), which FDA released in 2011 and developed in collaboration with CDC and FSIS and USDA’s Animal and Plant Health Inspection Service (APHIS), is a compilation of scenarios based on both intentional and unintentional food contamination events. The FREE–B is designed to assist the food industry, government regulatory agencies, and public health organizations in assessing existing food emergency response plans, protocols, and procedures (Ref. 32). The FREE–B tool is designed to allow an individual agency or industry entity to test its own plans, protocols, and procedures independently. Additionally, the tool allows multiple jurisdictions and organizations (e.g., medical community, private sector, law enforcement, and first responder communities) to jointly conduct exercises. The tool is a set of five scenarios, each of which contains a Facilitator’s Guide, a Lead Planner’s guide, and a Situation Manual. Finally, our food defense training courses, entitled ‘‘Food Defense 101’’ and released in 2013, reflect FDA’s current thinking on how to minimize the likelihood and impact of incidents of intentional adulteration (Ref. 27). Four courses integrated into one module include: (1) Food Defense Awareness for Professionals, (2) Food Defense Awareness for Frontline Employees, (3) FDA Regulations, and (4) ALERT for owners and operators of food facilities. The ALERT program is described previously. The other programs are described in section V.C.7 of this document. D. Outreach We have conducted food defense awareness outreach to international and domestic stakeholders. Beginning in 2008, under the auspices of the AsiaPacific Economic Cooperation (APEC), we collaborated with the U.S. Department of State, USDA’s Foreign Agricultural Service, and FSIS to launch the Food Defense Pilot Program for the E:\FR\FM\24DEP2.SGM 24DEP2 Federal Register / Vol. 78, No. 247 / Tuesday, December 24, 2013 / Proposed Rules sroberts on DSK5SPTVN1PROD with PROPOSALS APEC member countries. The Pilot Program was developed with the intent to implement the food defense principles endorsed by the APEC Counter Terrorism Task Force. The goal of the program was to build and foster global capacity to prevent and protect against deliberate tampering and intentional contamination of the food supply through information sharing, outreach, and technical assistance on food defense, thereby safeguarding food trade and public health across the APEC member countries. In addition, to support the international capacity building goals of FSMA, we conducted several workshops in various countries to discuss topics such as increasing food defense awareness, developing food defense plans, conducting vulnerability assessments, and implementing mitigation strategies. In 2013, we increased our domestic outreach activities with a series of workshops in the United States. Using a similar format and agenda as the international workshops, we conducted 1-day food defense awareness workshops to provide industry, State and local governments, and academic partners with information on food defense, and share tools and resources. During these workshops, we shared information on how to use the new FDPB software tool to develop a comprehensive food defense plan. These workshops also served as a forum to discuss food defense concerns, understand industry’s current practices, and share ideas for collaboration to better protect the food supply against intentional adulteration. We plan to continue to hold additional workshops in 2014. E. Industry Standards Guidelines accompanying industry standards in the United States have addressed intentional adulteration of food. For example, the Global Food Safety Initiative’s (GFSI) Guidance Document Sixth Edition (Ref. 33) addresses food defense. Some organizations that own and manage industry standards have worked or are working to incorporate food defense requirements into their standards to meet this GFSI guideline. For example, the Safe Quality Foods (SQF) Code, edition 7.1, issued in 2013, is a process and product certification standard that specifies various food defense elements, including that the methods, responsibility, and criteria for preventing food adulteration caused by a deliberate act of sabotage or terroristlike incident shall be documented, implemented and maintained (Ref. 34). Another example of industry standards VerDate Mar<15>2010 17:30 Dec 23, 2013 Jkt 232001 that incorporate food defense elements is the International Featured Standards (IFS) Food Version 6 Standard, which specifies that areas critical to security be identified, food defense hazard analysis and assessment of associated risks be conducted annually or upon changes that affect food integrity, and an appropriate alert system be defined and periodically tested for effectiveness (Ref. 35). F. International Food Defense Guidelines In 2008, WHO issued its ‘‘Terrorist Threats to Food—Guidelines for Establishing and Strengthening Prevention and Response Systems’’ to provide policy guidance to its Member States for integrating consideration of deliberate acts of sabotage of food into existing prevention and response programs (Ref. 6). WHO uses the term ‘‘food terrorism’’ and defines it as ‘‘an act or threat of deliberate contamination of food for human consumption with biological, chemical and physical agents or radionuclear materials for the purpose of causing injury or death to civilian populations and/or disrupting social, economic or political stability.’’ Focusing on the two key strategies of prevention and response, WHO recommends that all segments of the food industry consider the development of security and response plans for their establishments, proportional to the threat and their resources. The guidelines state that the key to preventing food terrorism is enhancing existing food safety programs and implementing reasonable security measures on the basis of vulnerability assessments. The guidelines further state that the most vulnerable foods, food ingredients, and food processes should be identified, including: the most readily accessible food processes; foods that are most vulnerable to undetected tampering; foods that are the most widely disseminated or spread; and the least supervised food production areas and processes. Other national governments, including Australia, China, France, Germany, and the United Kingdom, also have issued guidelines to assist their food industry stakeholders in protecting food against intentional adulteration (Ref. 5, Ref. 36, Ref. 37, Ref. 38, Ref. 39). III. Legal Authority FDA is proposing this regulation under the FD&C Act as amended by FSMA. Under sections 103 and 106 of FSMA, FDA is proposing the requirements applicable to the owner, operator, or agent in charge of a facility required to register under section 415 of PO 00000 Frm 00011 Fmt 4701 Sfmt 4702 78023 the FD&C Act. Under section 106 of FSMA, FDA is proposing the requirements applicable to activities at some facilities not covered by section 103 of FSMA (i.e., activities subject to and in compliance with the juice and seafood HACCP regulations in parts 120 and 123 (21 CFR parts 120 and 123) and the manufacturing, processing, packing, or holding of a dietary supplement in compliance with certain requirements). Under section 701(a) of the FD&C Act (21 U.S.C. 371(a)), FDA is authorized to issue regulations for the efficient enforcement of the FD&C Act. A. Section 103 of FSMA Section 103 of FSMA, Hazard Analysis and Risk-Based Preventive Controls, amends the FD&C Act to create a new section 418 that mandates rulemaking. Section 418(n)(1)(A) of the FD&C Act requires that the Secretary of Health and Human Services issue regulations ‘‘to establish science-based minimum standards for conducting a hazard analysis, documenting hazards, implementing preventive controls, and documenting the implementation of the preventive controls . . ..’’ Section 418(n)(1)(B) of the FD&C Act requires that the regulations define the terms ‘‘small business’’ and ‘‘very small business,’’ taking into consideration the study of the food processing sector required by section 418(l)(5) of the FD&C Act. Further, section 103(e) of FSMA creates a new section 301(uu) in the FD&C Act (21 U.S.C. 331(uu)) to prohibit ‘‘[t]he operation of a facility that manufactures, processes, packs, or holds food for sale in the United States if the owner, operator, or agent in charge of such facility is not in compliance with section 418 [of the FD&C Act].’’ In addition to rulemaking requirements, section 418 of the FD&C Act contains requirements applicable to the owner, operator, or agent in charge of a facility required to register under section 415 of the FD&C Act. Section 418(a) of the FD&C Act is a general provision that requires the owner, operator, or agent in charge of a facility to evaluate the hazards that could affect food manufactured, processed, packed, or held by the facility, identify and implement preventive controls, monitor the performance of those controls, and maintain records of the monitoring. In addition to the general requirements in section 418(a) of the FD&C Act, sections 418(b) to (i) of the FD&C Act contain more specific requirements applicable to facilities, including several provisions explicitly directed at intentional adulteration. For example, section 418(b)(2) of the FD&C Act specifies that the owner, operator, or E:\FR\FM\24DEP2.SGM 24DEP2 78024 Federal Register / Vol. 78, No. 247 / Tuesday, December 24, 2013 / Proposed Rules sroberts on DSK5SPTVN1PROD with PROPOSALS agent in charge of a facility shall identify and evaluate hazards that may be intentionally introduced, including by acts of terrorism. Section 418(c)(2) of the FD&C Act specifies that the owner, operator, or agent in charge of a facility shall identify and implement preventive controls to provide assurances that any hazards that relate to intentional adulteration will be significantly minimized or prevented and addressed, consistent with section 420 of the FD&C Act. In sections IV and V of this document, we discuss proposed requirements (proposed subparts C and D of part 121) that would implement these provisions of section 418 of the FD&C Act. Sections 418(j) to (m) of the FD&C Act and sections 103(c)(1)(D) and (g) of FSMA provide authority for certain exemptions and modifications to the requirements of section 418 of the FD&C Act. These include provisions related to seafood and juice HACCP, and low-acid canned food (section 418(j) of the FD&C Act); activities of facilities subject to section 419 of the FD&C Act (Standards for Produce Safety) (section 418(k)); qualified facilities (section 418(l)); facilities that are solely engaged in the production of food for animals other than man, the storage of raw agricultural commodities (other than fruits and vegetables) intended for further distribution or processing, or the storage of packaged foods that are not exposed to the environment (section 418(m)); facilities engaged only in certain lowrisk on-farm activities on certain foods conducted by small or very small businesses (section 103(c)(1)(D) of FSMA), and dietary supplements (section 103(g) of FSMA). In sections IV and V of this document, we discuss the related proposed provisions that would implement these provisions of section 418 of the FD&C Act and section 103 of FSMA. B. Section 106 of FSMA Section 106 of FSMA, Protection Against Intentional Adulteration, amends the FD&C Act to create a new section 420, which mandates rulemaking. Section 420 of the FD&C Act requires FDA to issue regulations to protect against the intentional adulteration of food. Section 420(b)(1) of the FD&C Act requires that such regulations are to specify how a person is to assess whether the person is required to implement mitigation strategies or measures intended to protect against the intentional adulteration of food. Section 420(b)(2) of the FD&C Act requires that the regulations specify appropriate science—based mitigation strategies or VerDate Mar<15>2010 17:30 Dec 23, 2013 Jkt 232001 measures to prepare and protect the food supply chain at specific vulnerable points, as appropriate. Section 420(c) of the FD&C Act provides that such regulations are to apply only to food for which there is a high risk of intentional adulteration and for which such intentional adulteration could cause serious adverse health consequences or death to humans or animals. Section 420(c)(1) provides that such foods are to include those for which FDA has identified clear vulnerabilities. Section 420(d) of the FD&C Act limits applicability on farms to farms that produce milk. Further, section 106(d) of FSMA creates a new section 301(ww) in the FD&C Act to prohibit ‘‘[t]he failure to comply with section 420 [of the FD&C Act].’’ We are proposing all of the provisions under section 420 of the FD&C Act. C. Intrastate Activities FDA tentatively concludes that the provisions in the proposed rule should be applicable to activities that are intrastate in character. Facilities are required to register under section 415 of the FD&C Act regardless of whether the food from the facility enters interstate commerce (§ 1.225(b)). The plain language of section 418 of the FD&C Act applies to facilities that are required to register under section 415 of the FD&C Act (section 418(o)(2)) and does not exclude a facility because food from such a facility is not in interstate commerce. Similarly, the plain language of section 420 of the FD&C Act requires FDA to issue regulations to protect against the intentional adulteration of food and does not include a limitation to interstate commerce. Further, the prohibited act provisions in sections 301(uu) and (ww) of the FD&C Act (21 U.S.C. 331(uu) and (ww)) do not require an interstate commerce nexus. Notably, other subsections in section 301 of the FD&C Act, and section 304 of the FD&C Act (21 U.S.C. 334) demonstrate that Congress has included a specific interstate commerce nexus in the provisions of the FD&C Act when that is its intent. Accordingly, it is reasonable to interpret sections 418, 420, 301(uu) and (ww) of the FD&C Act as not limiting the application of the proposed rule only to those facilities with a direct connection to interstate commerce. However, we seek comment on this interpretation and potential alternatives. IV. Regulatory Approach A. Framework of the Rule This proposed regulation implements three provisions of FSMA that relate to PO 00000 Frm 00012 Fmt 4701 Sfmt 4702 the intentional adulteration of food. Section 103 of FSMA addresses intentional adulteration in the context of facilities that manufacture, process, pack, or hold food and are required to register under section 415 of the FD&C Act. Section 105 of FSMA addresses intentional adulteration in the context of fruits and vegetables that are raw agricultural commodities. Section 106 of FSMA addresses intentional adulteration in the context of high risk foods and exempts farms except for farms that produce milk. 1. Scope of Intentional Adulteration Covered by this Rule As noted in section I of this document, acts of intentional adulteration may take several forms, including: (1) Acts of terrorism; (2) acts of disgruntled employees, consumers, or competitors; and (3) economically motivated adulteration. With regard to intentional adulteration from acts of terrorism, we are proposing to require certain facilities covered by this rule to address significant vulnerabilities by implementing focused mitigation strategies at actionable process steps. While we refer to the protection of the food supply from ‘‘acts of terrorism’’ throughout this rule, we expect our proposed approach and the proposed implementation of focused mitigation strategies would generally address acts intended to cause massive public health harm and, to a lesser extent, economic disruption, whether committed by terrorists, terrorist organizations, individuals, or groups of individuals. For the reasons described in section IV.E of this document, we have tentatively concluded not to propose additional requirements for the protection of food against intentional adulteration caused by acts of disgruntled employees, consumers, or competitors. We describe our approach to address economically motivated adulteration in section IV.F of this document, and seek comment on our current thinking on this issue. 2. Identification of Key Activity Types Terrorist attacks on the U.S. food supply have been exceedingly rare. However, vulnerability assessments performed by FDA, USDA, DHS, and FBI, under the SPPA Initiative (Ref. 21), show that an attack could have devastating public health and economic consequences. Because such an attack is a low probability but potentially exceedingly high consequence event, we have tentatively determined that requirements should focus on those facilities and process steps within those facilities that pose the greatest risk. To E:\FR\FM\24DEP2.SGM 24DEP2 sroberts on DSK5SPTVN1PROD with PROPOSALS Federal Register / Vol. 78, No. 247 / Tuesday, December 24, 2013 / Proposed Rules assess this risk, FDA and USDA, in collaboration with DHS, FBI, and State and local government and industry partners, performed vulnerability assessments using the CARVER+Shock methodology. This methodology is specifically tailored to assess the risk of a terrorist attack and is different from an assessment of risk posed by food safety hazards (i.e., unintentional adulteration). As discussed in section V.C.2 of this document, based on an analysis of the vulnerability assessments that FDA has conducted using the CARVER+Shock methodology, we have identified four key activity types: Bulk liquid receiving and loading; Liquid storage and handling; Secondary ingredient handling; and Mixing and similar activities. FDA has tentatively determined that the presence of one or more of these key activity types at a process step (e.g., manufacturing, processing, packing, or holding of food) indicates a significant vulnerability under section 418 of the FD&C Act and that the food is at high risk of intentional adulteration caused by acts of terrorism under section 420 of the FD&C Act. We seek comment on the inclusion of these key activity types. Designation of these key activity types would serve two purposes. First, it would provide a facility with a means to assess whether it is required to implement focused mitigation strategies or measures intended to protect against intentional adulteration under section 420(b)(1) of the FD&C Act. Second, it would assist a facility subject to section 418 of the FD&C Act with the performance of a hazard analysis to identify and evaluate hazards that may be intentionally introduced by acts of terrorism, in accordance with section 418(b)(2). Facilities would be able to determine whether their operations involve one or more of the key activity types or choose to perform a vulnerability assessment. Our experience is that the most challenging part of developing a system of controls for intentional adulteration related to terrorism is identifying the points in the food operation that are most vulnerable to attack by performing a vulnerability assessment. By using the FDA-identified key activity types, facilities would be able to concentrate their efforts on the identification of appropriate focused mitigation strategies and the development and implementation of the HACCP-type system for ensuring that those strategies are consistently and effectively implemented. VerDate Mar<15>2010 17:30 Dec 23, 2013 Jkt 232001 3. Requirement for a HACCP-Type System of Controls We have tentatively concluded that a preventive controls approach like the one we proposed for the systematic control of food safety hazards in the PC proposed rule is the most effective means of ensuring that the focused mitigation strategies are consistently applied once the significant vulnerabilities are identified and appropriate focused mitigation strategies are developed. The evolution and advantages of this system, derived from the HACCP methodology, is discussed in detail in section II.C of the PC proposed rule. The application of HACCP-type controls for ensuring the implementation of food defense mitigation strategies is consistent with the approach taken in Publicly Available Specification (PAS) 96, developed by the Centre for the Protection of National Infrastructure in collaboration with the British Standards Institution, entitled ‘‘The Threat Assessment Critical Control Point (TACCP) Approach’’ (Ref. 5). It is also consistent with WHO recommendations on protection against intentional adulteration (Ref. 6). We request comment on the appropriateness of a HACCP-type system to ensure that mitigation strategies designed to significantly minimize or prevent intentional adulteration related to terrorism and whether there are approaches that would be more suitable. Section 418 of the FD&C Act exempts several kinds of activities (e.g., those related to seafood, juice, dietary supplements, low-acid canned food [for certain microbiological hazards]). These activities are subject to preventive control-type regulations that address food safety, but not food defense, concerns. Section 420 of the FD&C Act instructs FDA to issue regulations to require that science-based mitigation strategies or measures be applied to foods that are at high risk of intentional adulteration. The exemptions set out in section 418 of the FD&C Act are not applicable to the provisions of section 420 of the FD&C Act. We also have tentatively determined that some activities that are not subject to section 418 of the FD&C Act that involve manufacturing, processing, packing, or holding of food are likely to involve one of the key activity types (e.g., juice manufacturing, breaded seafood manufacturing, and mixing activity in a low-acid canned food process). Based on our tentative conclusion that the HACCP-type system in section 418 of the FD&C Act is generally appropriate for application to intentional PO 00000 Frm 00013 Fmt 4701 Sfmt 4702 78025 adulteration related to terrorism, this same system would be required for these activities. Applying the same regulatory framework under sections 418 and 420 of the FD&C Act would facilitate a concise and consistent approach to protection against intentional adulteration of food and the efficient enforcement of the requirements. Further, this approach would be consistent with the approach for unintentional adulteration that many of these facilities (those subject to section 418 of the FD&C Act relative to the control of food safety hazards) would already be required to take for unintentional hazards under the PC proposed rule. We acknowledge that regulation of entities in the food production system (in this case, facilities) to reduce the risk of intentional adulteration of food caused by acts of terrorism is, essentially, without precedent. Such an endeavor is further complicated by the low probability and potentially high impact nature of such an attack which makes estimating potential public health benefits and establishing an appropriate threshold for requiring action difficult. We are further challenged by the paucity of data on the extent to which facilities have already implemented programs to mitigate this risk, and the effectiveness of various strategies to prevent intentional adulteration of food caused by acts of terrorism. In developing this proposed rule we have relied on our experience in both implementing preventive control schemes targeting unintentional food safety hazards as well as working with the U.S. intelligence community on the threat of a terrorist attack on the food and agriculture sector, including performing vulnerability assessments and developing guidance for industry. While these activities have provided us with a useful foundation on which to develop this proposed rule, the challenges described previously remain. We request comment on our proposed approach, including on the following issues: • From which entities would implementation of measures to protect against intentional adulteration derive the greatest benefit to public health protection? How could this proposed regulation be modified to better target such entities? • Would it be feasible to require measures to protect against intentional adulteration only in the event of a credible threat? If so, would such an approach be consistent with the intentional adulteration provisions of FSMA? How would such requirements E:\FR\FM\24DEP2.SGM 24DEP2 78026 Federal Register / Vol. 78, No. 247 / Tuesday, December 24, 2013 / Proposed Rules sroberts on DSK5SPTVN1PROD with PROPOSALS be communicated to industry in a timely and actionable manner? • What is an appropriate level of public health protection with respect to intentional adulteration, considering the intentional adulteration provisions of FSMA? • Are there other ways to further focus the scope of the rule (see also section IV.I of this document)? 4. Compliance Dates Section 103(i)(1) of FSMA, General Rule, provides that ‘‘[t]he amendments made by this section shall take effect 18 months after the date of enactment’’ (i.e., by July 4, 2012). Section 103(i)(2) of FSMA, Flexibility for Small Businesses, provides that ‘‘[n]otwithstanding paragraph (1),’’ the amendments made by this section ‘‘shall apply’’ to a small business and very small business beginning on the date that are 6 months and 18 months, respectively, ‘‘after the effective date’’ of FDA’s final regulation. Section 106 of FSMA does not contain similar language. FDA is implementing the amendments made by sections 103 and 106 of FSMA to the FD&C Act, as they relate to intentional adulteration, through this rulemaking. We have tentatively concluded that it is appropriate to provide a sufficient time period following publication of the final regulation for facilities to come into compliance with proposed part 121. FDA recognizes that it can take time to develop and implement a food defense plan that would require, among other things, identification of actionable process steps, implementation of focused mitigation strategies, and monitoring of focused mitigation strategies. FDA is proposing that the final rule would be effective 60 days after publication in the Federal Register, with staggered compliance dates, consistent with the proposed effective dates in the PC proposed rule and Produce Safety proposed rule. Similarly, we recognize that businesses of all sizes may need more time to comply with the new requirements established under FSMA. As noted in section VII of the PC proposed rule, FDA believes that it is reasonable to allow for 1 year after the date of publication of the final rule for businesses other than small and very small businesses to come into compliance with the new requirements established under FSMA. FDA also believes that it is reasonable to allow for 2 years after the date of publication of the final rule for small businesses to come into compliance with the new requirements established under FSMA, and 3 years after the date of publication VerDate Mar<15>2010 17:30 Dec 23, 2013 Jkt 232001 of the final rule for very small businesses to come into compliance with the new requirements established under FSMA. Therefore, as proposed, facilities, other than small and very small businesses, that are subject to part 121 would have 1 year after the effective date to comply with proposed part 121. Small businesses would have 2 years after the effective date to comply with proposed part 121 (see section V.A of this document for a discussion of the proposed definition of a ‘‘small business’’). With respect to very small businesses, we are proposing to exempt qualified facilities, which include very small businesses, from the requirements of proposed part 121, except that such facilities must, upon request, provide for official review documentation that was relied upon to demonstrate that the facility meets this exemption. Very small businesses then would have 3 years after the effective date to comply with proposed § 121.5(a). FDA intends to work closely with the food industry, extension and education organizations, and State partners to develop any necessary additional tools and training programs needed to facilitate implementation of this rule. B. Activities That Occur on Produce Farms Section 419 of the FD&C Act requires FDA to issue regulations to establish science-based minimum standards for the safe production and harvesting of fruits and vegetables. In developing these regulations, the Act requires us to consider, among others, those hazards that may be intentionally introduced, including by acts of terrorism (section 419(a)(3)(C) and (c)(1)(A) of the FD&C Act). Note that neither section 418 of the FD&C Act nor section 420 of the FD&C Act apply to these activities. Section 420 of the FD&C Act specifically exempts farms, except those that produce milk, and section 418 of the FD&C Act exempts activities of facilities subject to section 419 of the FD&C Act. In implementing section 419 of the FD&C Act, we considered the risks posed by a terrorist attack on the kinds of activities that occur on produce farms. We considered those activities that fall within the definition of ‘‘farm’’ (as defined in 21 CFR 1.227) (e.g., planting, tilling, irrigating, treating with pesticides, harvesting, drying for purposes of storing or transporting, hydro-cooling, packing, refrigerating, waxing, shelling, sifting, removing leaves, stems and husks, culling, shelling, and washing). We utilized data gathered from vulnerability assessments that we conducted employing the PO 00000 Frm 00014 Fmt 4701 Sfmt 4702 CARVER+Shock methodology, and evaluated whether activities that occur on produce farms pose significant vulnerabilities (Ref. 40). Our evaluation found that activities that are typically performed on produce farms are at relatively low risk for intentional adulteration of food from acts of terrorism (Ref. 40). Based on this evaluation, we have tentatively concluded that requirements for produce farms are not necessary to minimize the risk of serious adverse health consequences or death from this type of adulteration. Further, we have tentatively concluded that requirements relating to this form of adulteration are not reasonably necessary to prevent the introduction of known or reasonably foreseeable hazards and to provide reasonable assurances that the produce is not adulterated under section 402 of the FD&C Act. For these reasons, we are not proposing requirements for produce farms to specifically address intentional adulteration related to terrorism. We seek comment on this tentative conclusion and our analysis that informed this tentative decision. We acknowledge that there may be activities that occur on produce farms for which we are not proposing requirements that are similar to off-farm activities for which we are proposing to require the implementation of focused mitigation strategies. However, there are aspects of the specific on-farm activities that minimize the risk for intentional adulteration caused by acts of terrorism. For example, waxing is an on-farm activity that is similar to coating and that fits within one of the key activity types. However, there are key differences that make an on-farm waxing operation less vulnerable compared to a coating operation. With waxing, there is difficulty of mixing a contaminant into a clear, heated wax in a tank in close proximity to the busy packing line in an on-farm packing house. Conversely, a coating operation involves an opaque, ambient or refrigerated, aqueous coating mix in a tank and occurs in a relatively isolated part of the manufacturing plant. In addition, the uncertainty about whether the produce leaving the farm is destined for direct consumption or for further processing, such as removal of the wax, which could inactivate or remove any contaminant intentionally added, makes it a relatively less likely target for intentional adulteration. C. Transportation Carriers One of the key activity types that we have tentatively determined indicates a significant vulnerability to intentional adulteration caused by acts of terrorism E:\FR\FM\24DEP2.SGM 24DEP2 Federal Register / Vol. 78, No. 247 / Tuesday, December 24, 2013 / Proposed Rules is Bulk liquid receiving and loading. As proposed, receiving and loading of other types of foods (e.g., non-bulk liquids, solid foods, gaseous foods) are not identified as key activity types because we determined that they do not present this same level of risk. By requiring that shippers and receivers of bulk liquids implement focused mitigation strategies at actionable process steps involving this key activity, as proposed in § 121.135(a), we expect that shippers and receivers will institute focused mitigation strategies that will significantly minimize or prevent the potential for intention adulteration of these foods during transportation. Such mitigation strategies may include sealing or locking outbound conveyances of bulk liquid, or requiring that inbound conveyances be sealed or locked as a condition of receipt of the bulk liquid. Where such measures are implemented by the shippers and receivers of bulk liquids, we have tentatively concluded that the food would be sufficiently protected from intentional adulteration caused by acts of terrorism, and that no further actions by a carrier would be needed to ensure the safety of the food. For this reason, we are not proposing to cover transportation carriers in this proposed rule. We request comment on our analysis of this issue, and our tentative conclusion. Note that FDA will issue a proposed rule in the near future related to transportation carriers and sanitary transportation practices. sroberts on DSK5SPTVN1PROD with PROPOSALS D. Food for Animals As discussed in section V.B.6 of this document, we are proposing to exempt the manufacturing, processing, packing, and holding of animal food from this proposed regulation with respect to intentional adulteration caused by acts of terrorism. E. Acts of Disgruntled Employees, Consumers, or Competitors While the goals and outcomes of acts of disgruntled employees, consumers or competitors can overlap with acts of terrorism, generally, the distinction has to do with differences in scale. Disgruntled employees are generally understood to be interested primarily in attacking the reputation of the company, and otherwise have little interest in public health harm. On the other hand, terrorist organizations are generally understood to be interested in maximizing public health harm and, to a lesser extent, economic disruption (Ref. 5, Ref. 6). Section 420(c) of the FD&C Act requires that the regulation prepared VerDate Mar<15>2010 17:30 Dec 23, 2013 Jkt 232001 under that section apply to ‘‘food for which there is a high risk of intentional contamination.’’ In the spectrum of risk associated with intentional adulteration of food, attacks perpetrated by terrorist organizations intent on causing massive casualties and, to a lesser extent, economic disruption would be ranked as relatively high risk. On the other hand, attacks by disgruntled employees, consumers, or competitors would be consistently ranked as relatively low risk; although these events occur annually, their public health and economic impact would be generally quite small. In general, the target food and the point in its production are those of convenience (i.e., a point to which the employee, consumer, or competitor has ready access). Should a disgruntled employee, consumer, or competitor choose to attack at an actionable process step, where the adverse public health and economic consequences could be greater, the provisions of this proposed rule would be effective in minimizing the opportunity for success. Actions taken to mitigate the potential for a terrorist attack against the food supply are likely to have collateral benefits in reducing the potential for an attack by a disgruntled employee, consumer, or competitor (as well as on other security related issues, such as theft and vandalism). As a practical matter, hardening the food supply (i.e., reducing the opportunity for attack) to attacks by disgruntled employees, consumers, or competitors could require taking steps at many more points in the food system than would be required to harden the food supply to minimize the potential for terrorist attack. We have tentatively concluded that the latter can be accomplished by focusing on those points in the food system where an attack would be expected to cause massive adverse public health impact, and, to a lesser extent, economic disruption. F. Economically Motivated Adulteration Efforts to protect against intentional adulteration require a shift in perspective from that applied to traditional food safety. In the PC, Animal Food PC, and Produce Safety proposed rules, we tentatively concluded that hazards associated with intentional adulteration, which are not addressed in traditional HACCP or other food safety systems, likely will require different kinds of controls, and would be best addressed in a separate rulemaking (this proposed rule). However, we also explained how in some circumstances economically motivated adulteration could be viewed as reasonably likely to occur. Further, PO 00000 Frm 00015 Fmt 4701 Sfmt 4702 78027 we requested comment on where to address those hazards that may be intentionally introduced for economic gain. After additional consideration, we present our current thinking in this section of the document. For facilities subject to section 418 of the FD&C Act, we have tentatively concluded that economically motivated adulteration would be best addressed under the regulatory regime described in the PC and Animal Food PC proposed rules and thus best addressed in those rulemakings. Before we decide to finalize provisions on economically motivated adulteration in the PC and Animal Food PC final rules, FDA plans to provide new language and an analysis of costs associated with these provisions, and seek comment. Under this approach, the owner, operator, or agent in charge of a covered facility would be required to perform a hazard analysis to identify those hazards related to economically motivated adulteration that are reasonably likely to occur. Economically motivated adulteration could be reasonably likely to occur, for example, when obtaining certain ingredients from a country in which economically motivated adulteration has occurred in those ingredients in the past. Because of past incidents regarding the addition of melamine to certain food products apparently to enhance perceived quality and/or protein content, even if there is no known history regarding the specific supplier or the specific food product, a prudent person would implement preventive controls to address the potential presence of this hazard in a food. The goal of the perpetrator of economically motivated adulteration is for the adulterant to be undetected in the product, so that the perpetrator can continue to obtain the desired economic benefits (Ref. 7, Ref. 9). Accordingly, unlike with acts of terrorism, such occurrences of economic adulteration are expected to be long term, and would not be appropriately viewed as a rare occurrence, but rather as reasonably likely to occur. We have tentatively concluded that this hazard-analysis type approach is better suited to address economically motivated adulteration than the vulnerability assessment-type approach we are proposing to address intentional adulteration related to terrorism. In the latter approach, which we are not proposing, significant vulnerabilities would be identified based either on the presence of key activity types (which reflect FDA-conducted vulnerability assessments) or facility-specific vulnerability assessments. Under a vulnerability assessment-type approach, E:\FR\FM\24DEP2.SGM 24DEP2 sroberts on DSK5SPTVN1PROD with PROPOSALS 78028 Federal Register / Vol. 78, No. 247 / Tuesday, December 24, 2013 / Proposed Rules the assessment would need to consider the degree to which a food is a likely target for economically motivated adulteration based on the attributes of the food (such as the nature of the food, its production system, and its supply chain) and the capabilities of a perpetrator (such as availability and access to adulterants that can be readily disguised and undetected by currently accepted testing methods). Factors to consider could include previous occurrences of economically motivated adulteration; a highly complex supply chain; sudden changes in commodity prices; known inadequacies in identification and assay testing methods for potential adulterants; a highly complex and variable food ingredient; the widespread availability of a potential adulterant; the lack of organoleptic properties of a potential adulterant; the high cost or scarcity of an ingredient; and variation in the value of a food based on variations in levels of a high value attribute of that food. The nature of economically motivated adulteration makes it difficult to identify all relevant factors to be considered in a vulnerability assessment to predict when novel events of economic adulteration are expected to occur. Moreover, predictive tools such as CARVER+Shock are not currently configured to assess the risk of economically motivated adulteration, nor have extensive vulnerability assessments for economically motivated adulteration in food products been conducted by FDA or others. Therefore, we believe the most appropriate framework to assess the risk of economically motivated adulteration is to consider whether it is reasonably likely to occur (such as whether it has occurred under similar circumstances with some regularity in the past) as part of a hazard analysis. Under this approach, facilities subject to section 418 of the FD&C Act would be expected to implement controls against economically motivated adulteration under circumstances where there has been a pattern of such adulteration in the past, even though the past occurrences may not be associated with the specific supplier or the specific food product but the pattern suggests a potential for intentional adulteration. Further, a system of monitoring, corrective action, verification, and recordkeeping that is similar to those in the PC and Animal Food PC proposed rules would be appropriate for economically motivated adulteration. In addition, the elements of a preventive control system, including hazard analysis, preventive controls, VerDate Mar<15>2010 17:30 Dec 23, 2013 Jkt 232001 monitoring, corrective actions, verification, and recordkeeping would be documented in a food safety plan that would include control of economically motivated adulteration. We believe that addressing both of these potential sources for contamination within the same framework is likely to streamline requirements and reduce costs to industry. We seek comment on our tentative conclusions presented above. Specifically, we are interested in information on the specific factors that are most relevant for determining whether economically motivated adulteration is reasonably likely to occur, particularly in instances where the specific product or supplier has not been previously associated with such adulteration. In addition, we seek comment on whether and how these relevant factors may be used to develop appropriate predictive tools or establish a standard for when preventive controls are necessary. Section 418 of the FD&C Act contains certain exemptions related to compliance with FDA’s seafood and juice HACCP regulations and with regard to manufacturing, processing, packing or holding dietary supplements that are in compliance with the requirements of sections 402(g)(2) and 761 of the FD&C Act. Section 420 of the FD&C Act does not contain these exemptions and requires FDA to issue regulations to protect against the intentional adulteration of food. Seafood and juice are currently subject to HACCP-type regulations in §§ 123 and 120, respectively, and our current thinking is that under section 420 economically motivated adulteration could be addressed through the existing frameworks for these foods. Under this option, FDA would amend the seafood and juice HACCP regulations to specify that economically motivated adulteration is a hazard that must be considered in a hazard analysis of these foods, and addressed in a HACCP plan. For example, for seafood, we could propose to add ‘‘economically motivated adulteration that could result in serious adverse health consequences or death’’ to the list of hazards to be considered in a hazard analysis in accordance with § 123.6(c)(1). Similarly, for juice we could propose to add ‘‘economically motivated adulteration that could result in serious adverse health consequences or death’’ to the list of hazards to be considered in a hazard analysis in accordance with § 120.7(c). Also under this option, FDA would consider proposing to amend part 111 (21 CFR part 111), the Dietary Supplements current good PO 00000 Frm 00016 Fmt 4701 Sfmt 4702 manufacturing practice (CGMP) rule, to include economically motivated adulteration that could result in serious adverse health consequences or death. Current § 111.70(b) and (c) require establishing component specifications and in-process specifications to ensure the identity, purity, strength, and composition of the dietary supplement, and we could amend these provisions to cover economically motivated adulteration that could result in serious adverse health consequences or death. We have also tentatively concluded not to require produce farms subject to section 419 of the FD&C Act and farms that produce milk (also referred to in this document as ‘‘dairy farms’’) subject to section 420 of the FD&C Act to take measures to address economically motivated adulteration. With regard to produce farms subject to section 419 of the FD&C Act, we have tentatively concluded that there are not procedures, processes, or practices that are reasonably necessary to be implemented by these entities to prevent the introduction of known or reasonably foreseeable biological, chemical, or physical hazards that can cause serious adverse health consequences or death as a result of economically motivated adulteration. With regard to farms that produce milk subject to section 420 of the FD&C Act, we have tentatively concluded that there are not appropriate science-based strategies or measures intended to protect against economically motivated adulteration that can be applied at the farm. These tentative conclusions are based on our assessment that preventive controls for economically motivated adulteration are suitable to address such adulteration when it is perpetrated by the entity’s supplier, but not when it is perpetrated by the entity itself, as would be the case for economically motivated adulteration at a produce farm or a farm that produces milk. Actions such as auditing of suppliers or reliance upon suppliersupplied test results or production control records are generally considered unsuitable to address economically motivated adulteration where the supplier, if intentionally adulterating the food, would already be violating the law and would be able to subvert these controls. For both types of farms, we are not aware of inputs into the growing, harvesting, packing, or holding of produce or milk (i.e., within our farm definition) that could be subject to economically motivated adulteration that could cause serious adverse health consequences or death under sections 419 and 420 of the FD&C Act. We seek comment on this tentative conclusion. E:\FR\FM\24DEP2.SGM 24DEP2 Federal Register / Vol. 78, No. 247 / Tuesday, December 24, 2013 / Proposed Rules sroberts on DSK5SPTVN1PROD with PROPOSALS G. Low-Risk Activities at Farm MixedType Facilities Section 103(c)(1)(C) of FSMA directs the Secretary of Health and Human Services to conduct a science-based risk analysis as part of the section 103(c) rulemaking. The science-based risk analysis is to cover ‘‘(i) specific types of on-farm packing or holding of food that is not grown, raised, or consumed on such farm or another farm under the same ownership, as such packing and holding relates to specific foods; and (ii) specific on-farm manufacturing and processing activities as such activities relate to specific foods that are not consumed on that farm or on another farm under common ownership.’’ In section VIII.G of the PC proposed rule, we describe a draft Qualitative Risk Assessment (the draft RA) we performed to satisfy this requirement. Section 103(c)(1)(D)(i) of FSMA requires FDA to use the results of this analysis to establish exemptions and inspection frequencies, or modify requirements, for facilities engaged only in specific types of on-farm activities that FDA determines to be low risk. Elsewhere in this issue of the Federal Register, FDA is publishing a notice announcing the availability for public comment Appendix 4 to the draft RA (the draft RA Appendix). The purpose of the draft RA Appendix is to provide a science-based risk analysis of those foods whose production processes would be considered low risk with respect to the risk of intentional adulteration caused by acts of terrorism. FDA conducted this evaluation to satisfy the requirement in Section 103(c)(1)(C) of FSMA to conduct a science-based risk analysis with respect to the risk of intentional adulteration caused by acts of terrorism. We evaluated the production processes for the types of finished foods we expect are produced at farm mixed-type facilities to determine whether or not they are low-risk with respect to hazards that may be intentionally introduced by acts of terrorism. For the purposes of this analysis, we evaluated whether a production process involved any of the four FDA-identified key activity types, and identified a production process that did not involve any of the four key activity types as a ‘‘low risk production process.’’ Based on this evaluation, we concluded that the production processes for the following finished foods are ‘‘low-risk’’: • Eggs (In-Shell) • Fruits & Vegetables Other Than Pods, Seeds for Direct Consumption, and Hesperidia (Fresh, Intact) VerDate Mar<15>2010 17:30 Dec 23, 2013 Jkt 232001 • Game Meats (Whole or Cut, Not Ground or Shredded, Without Secondary Ingredients) • Peanuts & Tree Nuts (Raw, In-Shell) • Sugarcane & Sugar Beets (Fresh, Intact) We are considering the results of this analysis in determining any specific exemptions or modified requirements. We request comment on whether we should exempt on-farm manufacturing, processing, packing, or holding of the foods identified as having low-risk production practices when conducted by a small or very small business if such activities are the only activities conducted by the business that are subject to section 418 of the FD&C Act. If we were to take this approach, only facilities meeting all of the specified criteria would be exempt as a result of being engaged in low-risk activities. Thus, a facility located on-farm, that is a small or very small business, and only produces fresh, intact apples as a finished product (e.g., by packing apples grown on a different farm that is under different ownership) would be exempt from this proposed rule. On the other hand, an apple-packing facility that is off-farm would not be exempt, an apple packing facility that is on-farm but that is not a small or very small business would not be exempt, and an apple packing facility that also packs green beans would not be exempt. We request comment on whether we should broaden this potential exemption in any way, such as by removing certain of the restrictions mentioned immediately above. We also seek comment on whether we should instead establish modified requirements for facilities that produce foods identified as having lowrisk production processes, and if so, what those modified requirements should be and the scope of application of the modified requirements. In addition, we seek comment on whether and how we should consider the results of this analysis in determining whether to exempt or modify the inspections frequency requirements under Section 421 of the FD&C Act, Targeting of Inspection Resources for Domestic Facilities. H. Activities That Occur on Dairy Farms 1. Assessment of Vulnerabilities Under section 420 of the FD&C Act, we considered whether activities that occur on farms that produce milk pose a high risk for intentional adulteration of food caused by acts of terrorism that could cause significant adverse health consequences or death. A preliminary evaluation indicates that fluid milk storage appears to fit within the key PO 00000 Frm 00017 Fmt 4701 Sfmt 4702 78029 activity type, Liquid storage and handling, and fluid milk loading appears to fit within the key activity type, Bulk liquid receiving and holding. The fluid milk storage tank is one of the actionable process steps that would be applicable to both of these activities on a dairy farm. As discussed in section V.C.2 of this document, FDA is proposing to require that the owner, operator, or agent in charge of a facility that has one or more of the FDA-identified key activity types identify actionable process steps for those key activity types and implement focused mitigation strategies at any actionable process steps. Because dairy farms generally are not facilities as defined in this rule, they would not be subject to this requirement. However, section 420 is applicable to dairy farms (see § 420(d)) and fluid milk storage and loading in a dairy farm operation appear to pose a significant vulnerability. The risk posed by intentional adulteration of milk on-farm results from a number of factors: (1) The system of milk collection from farms and subsequent holding and processing serves to distribute contaminants added to the milk on the farm into much larger quantities of fluid milk, increasing the potential magnitude of an intentional adulteration event; (2) in its fluid form milk has a short shelf life, increasing the potential for significant adverse public health impacts before detection and, once detected, before a public health intervention can be implemented; (3) fluid milk is widely consumed across different sub-populations, including infants and children, increasing the potential for significant adverse public health impacts and, because of public reaction to child and infant morbidity and mortality, decreasing public confidence in the food supply; (4) fluid milk is consumed in a variety of food forms, including as a beverage (finished food) and as an ingredient in other finished foods, complicating public health intervention; and (5) milk storage tanks are commonly left unlocked (Ref. 41, Ref. 42, Ref. 43, Ref. 44, Ref. 45, Ref. 46, Ref. 47). 2. Mitigation Strategies Farms are not subject to the HACCPtype system of preventive controls prescribed in section 418 of the FD&C Act, and our current thinking is that, should we include requirements relative to dairy farms in the final rule, we would not require HACCP-type controls for dairy farms under section 420 of the FD&C Act. Similarly, under section 419 of the FD&C Act we did not propose to apply such an approach to unintentional adulteration on produce E:\FR\FM\24DEP2.SGM 24DEP2 sroberts on DSK5SPTVN1PROD with PROPOSALS 78030 Federal Register / Vol. 78, No. 247 / Tuesday, December 24, 2013 / Proposed Rules farms in the Produce Safety proposed rule (see section IV.D of the Produce Safety proposed rule). Rather, as with produce farms, a more appropriate approach might be a CGMP-type provision that relates directly to the significant vulnerability. Generally, CGMPs set out mandatory, broad, generally applicable practices and conditions that are required to be met, and the criteria and definitions that are applicable in determining whether the food is adulterated. For example, a CGMP approach would identify the broad, generally applicable mitigation strategies that dairy farm operators must implement (e.g., limiting access to fluid milk storage tanks), without specifying how that strategy must be accomplished and without a further requirement for monitoring, recordkeeping or the development of a plan. We seek comment on this approach. FDA previously provided guidance for the dairy industry, including dairy farms, on the potential for intentional contamination and identified the types of food defense measures that dairy farms may take to minimize the risk that fluid milk under their control will be subject to tampering or other malicious, criminal, or terrorist actions (Ref. 24). Among other recommendations, FDA’s guidance recommends ‘‘limiting access’’ to raw and pasteurized milk storage as a food defense preventive measure. We acknowledge the difficulties involved in limiting access to many dairy farms, including multiple entries to the milk house, multiple visitors with customary access to the milk house (e.g., State food safety inspectors, vendors delivering veterinary medications, and drivers collecting bulk milk for transport to processing and storage facilities); continuous milk piping from the milking parlor to the bulk milk tank, providing for access points to the bulk milk tank from outside the milk house; open access to the milking parlor for workers and cows; and automated milking operations where employees are not necessarily present to escort cows into the milking parlor. In light of these circumstances, we request comment on whether and how access to the bulk milk storage tank and associated systems can be limited, and the costs and other implications of doing so. In addition, we are interested in comment on whether and what types of focused mitigation strategies or other measures are currently employed by dairy farms. Specifically for fluid milk storage tanks, we seek comment on whether and what focused mitigation strategies would be appropriate and feasible given current dairy farming practices. VerDate Mar<15>2010 17:30 Dec 23, 2013 Jkt 232001 We also seek comment on whether it would be more appropriate for FDA to require that dairy farm operators receive food defense awareness training rather than requiring that they implement focused mitigation strategies to limit access to certain steps of their operation. If you support an approach based on training rather than mandated focused mitigation strategies, we are further interested in how such an approach would work at those farms where an agent of the farm may not be present at all times, given that a system based on awareness training is premised on the assumption that such training would provide the operator with the tools to report and respond to suspicious activity that they observe. 3. Scope of Dairy Farms Subject to any Requirement Finally, we seek comment on the scope of farms that produce milk that should be subject to any requirements that we may establish in a final rule. For example, the scope of dairy farms covered could be determined based on the potential for adverse public health outcome resulting from consumption of milk produced at a farm, if a contaminant were intentionally introduced into the milk from that farm. Farms with less than 50 milk-producing cows contribute a relatively small proportion to the total volume of milk produced in the United States (i.e., approximately 4.2 percent of total milk produced in the United States), and the current trend in the dairy farm industry toward consolidation (Ref. 48) likely further reduces the percentage of production that such farms will contribute in the future. However, milk from even very small dairy farms may be pooled with milk from other farms in raw milk storage tanks at milk processing and storage facilities, potentially resulting in a public health impact from intentional adulteration that is disproportionate to the size of the farm or its contribution to the milk supply. We request comment on the appropriateness of determining the scope of dairy farms covered based on the number of cows on a farm. Alternatively, should we consider excluding farms based on how the milk from a farm is distributed (e.g., direct sale to consumers or other end users; pooling with milk from other farms; supplied to the Grade A Milk system for the production of fluid milk; or used in the production of cheese and other products that have a different risk associated with intentional adulteration caused by acts of terrorism)? PO 00000 Frm 00018 Fmt 4701 Sfmt 4702 I. Other Ways to Focus on Foods With a High Risk of Intentional Adulteration Caused by Terrorism We are requesting comment on whether, under section 420 of the FD&C Act, there are other ways in which the coverage of this proposed regulation can be further focused on foods that present a high risk of intentional adulteration caused by acts of terrorism. For example, are there ways in which a food’s shelf life, turnover in the marketplace, batch size, serving size and servings per batch, distribution and consumption patterns, and intended consumer could be considered in providing for an exemption or in setting modified requirements for that food. Ordinarily, these considerations are part of a vulnerability assessment, and in such assessments the risk reduction aspects of one attribute may be offset or exacerbated by those of another attribute, and may be very facilityspecific. Such attributes specific to the food(s) manufactured, processed, packed, or held at the facility can be taken into account, should a facility choose to perform its own vulnerability assessment and assign actionable process steps, as provided for in proposed § 121.130(b). However, as discussed in section V.C.2 of this document, facilities would not be required to perform a facility-specific vulnerability assessment and, instead, would have the option of identifying actionable process steps using the procedure in proposed § 121.130(a). We are particularly interested in how foodspecific attributes can be taken into account in the absence of a general requirement for a facility-specific vulnerability assessment. V. The Proposal A. Definitions In subpart A of proposed part 121, under § 121.3, FDA is proposing the following definitions and interpretations of terms relevant to proposed part 121. The definitions and interpretations of terms in section 201 of the FD&C Act (21 U.S.C. 321) are applicable to such terms when used in this part. As proposed, several terms in part 121 have the same definitions as in proposed part 117 and, therefore, we have not included an extensive discussion of those terms in this proposed rule. See section X.B of the PC proposed rule for a discussion of the following terms: facility, farm, holding, manufacturing/processing, mixed-type facility, packing, qualified end-user, qualified facility, and small business. FDA is proposing to define the term ‘‘actionable process step’’ to mean a E:\FR\FM\24DEP2.SGM 24DEP2 sroberts on DSK5SPTVN1PROD with PROPOSALS Federal Register / Vol. 78, No. 247 / Tuesday, December 24, 2013 / Proposed Rules point, step, or procedure in a food process at which food defense measures can be applied and are essential to prevent or eliminate a significant vulnerability or reduce such vulnerability to an acceptable level. The term ‘‘actionable process step’’ used in the food defense context is analogous to the term ‘‘critical control point’’ (CCP), which is defined as ‘‘a point, step, or procedure in a food process at which control can be applied and is essential to prevent or eliminate a food safety hazard or reduce such hazard to an acceptable level.’’ Similar to a CCP, in proposed part 121, an ‘‘actionable process step’’ is identified during a vulnerability assessment (analogous to a hazard analysis) in relation to a significant vulnerability (analogous to a hazard that is reasonably likely to occur), and is facility-specific. As discussed in section V.C.2 of this document, based on vulnerability assessments, FDA has identified four key activity types that we have tentatively concluded pose significant vulnerabilities in a food operation. FDA identified and described these key activity types (which are not facilityspecific) with the expectation that an owner, operator, or agent in charge would objectively determine whether the processing steps in a facility fit within one or more of these key activity types. The processing steps identified by facilities in their food operation that fit within the FDA-identified key activity types are ‘‘actionable process steps,’’ and are steps at which a focused mitigation strategy would be employed to prevent or eliminate a significant vulnerability or reduce it to an acceptable level. Actionable process steps might also be identified in a vulnerability assessment (proposed § 121.130(b)). Though we use the term ‘‘actionable process step’’ in FDA’s FDPB software tool (Ref. 31), we recognize it is a relatively new term and, therefore, we solicit comment on its appropriateness and any other more appropriate alternative terms. FDA is proposing to define the term ‘‘contaminant’’ as any biological, chemical, physical or radiological agent that may be intentionally added to food and that may cause illness, injury or death. We based the proposed definition, in part, on the definition of ‘‘contaminant’’ used in Codex Alimentarius guidelines (Ref. 49) that refers to any biological or chemical agent, foreign matter or other substances not intentionally added to feed or food that may compromise feed and food safety or suitability. In this proposal, the term ‘‘contaminant’’ is used in the context of key activity types, which are VerDate Mar<15>2010 17:30 Dec 23, 2013 Jkt 232001 related to intentional acts of adulteration caused by acts of terrorism with intent to cause public health harm and, to a lesser extent, economic disruption. Therefore, for the purposes of proposed part 121, we focused the definition of ‘‘contaminant’’ on agents that may be intentionally added to food and that may cause illness, injury, or death, which is consistent with our determination that the primary goal of such an attack would be public health harm (i.e., illness, injury, or death). Our proposed definition of ‘‘contaminant’’ in proposed 121.3 would be applicable to proposed part 121 only. We acknowledge that this term has a broader meaning in other settings, as evidenced by its use in the Codex Alimentarius guidelines. FDA is proposing to define the term ‘‘facility’’ to mean a domestic facility or a foreign facility that is required to register under section 415 of the FD&C Act in accordance with the requirements of part 1, subpart H (21 CFR part 1, subpart H). The proposed definition would incorporate the definition in section 418(o)(2) of the FD&C Act. FDA is proposing to define the term ‘‘farm’’ by reference to the definition of that term in proposed § 1.227. We are proposing to cross-reference the definition of ‘‘farm’’ rather than to define it in proposed part 121 because the definition of ‘‘farm,’’ under both current § 1.227(b)(3) and proposed § 1.227, includes the word ‘‘facility’’ with a meaning that is broader than the meaning of ‘‘facility’’ in section 418(o)(2) of the FD&C Act. Under part 1, subpart H, the term ‘‘facility’’ is not limited to entities that are required to register under section 415 of the FD&C Act. We are proposing to cross-reference the definition to reduce the potential confusion that could result if we used the term ‘‘facility’’ to have two different meanings within proposed part 121. See sections X.B and VIII of the PC proposed rule for additional information. FDA is proposing to define the term ‘‘focused mitigation strategies’’ to mean those risk-based, reasonably appropriate measures that a person knowledgeable about food defense would employ to significantly minimize or prevent significant vulnerabilities identified at actionable process steps, and that are consistent with the current scientific understanding of food defense at the time of the analysis. The term ‘‘focused mitigation strategies’’ used in the food defense context is analogous to the term ‘‘preventive controls’’ in a HACCP-type framework for food safety. As discussed in section V.C.3 of this document, a mitigation strategy is a PO 00000 Frm 00019 Fmt 4701 Sfmt 4702 78031 measure taken by a facility to reduce the potential for intentional adulteration of food. A ‘‘focused mitigation strategy’’ is such a strategy applied in response to the identification of a significant vulnerability and at an actionable process step. Focused mitigation strategies are customized to the processing step at which they are applied, tailored to existing facility practices and procedures, and depend on an evaluation of the vulnerabilities identified in a facility. Because they are applied in response to a significant vulnerability, we have determined that focused mitigation strategies are essential to ensure that appropriate action is taken to protect the food from intentional adulteration caused by acts of terrorism. While an option to perform a vulnerability assessment is provided under proposed § 121.130(b), facilities may choose instead to rely on the analysis performed by FDA that resulted in the identification of the key activity types listed in proposed § 121.130(a) when identifying actionable process steps and, subsequently, focused mitigation strategies, eliminating the need for a full vulnerability assessment. See section V.C.3 of this document for examples of focused mitigation strategies. FDA is proposing to define the term ‘‘food defense’’ as the effort to protect food from intentional acts of adulteration where there is an intent to cause public health harm and economic disruption. As discussed in section IV.A of this document, acts of intentional adulteration may take several forms, including acts of terrorism; acts of disgruntled employees, consumers, or competitors; and economically motivated adulteration. We are proposing to define the term ‘‘food defense’’ to refer to the sum of actions and activities (including identification of actionable process steps; implementation of focused mitigation strategies; monitoring, corrective actions, verification, and training activities) taken to protect food from intentional acts of adulteration related to terrorism. FDA is proposing to define the term ‘‘holding’’ to mean the storage of food. The proposed definition would also state that holding facilities include warehouses, cold storage facilities, storage silos, grain elevators, and liquid storage tanks; and that, for farms and farm mixed-type facilities, holding also includes activities traditionally performed by farms for the safe or effective storage of raw agricultural commodities grown or raised on the same farm or another farm under the E:\FR\FM\24DEP2.SGM 24DEP2 sroberts on DSK5SPTVN1PROD with PROPOSALS 78032 Federal Register / Vol. 78, No. 247 / Tuesday, December 24, 2013 / Proposed Rules same ownership, but does not include activities that transform a raw agricultural commodity, as defined in section 201(r) of the FD&C Act, into a processed food as defined in section 201(gg) of the FD&C Act. For consistency of terminology, we are proposing the same definition of ‘‘holding’’ as in the PC proposed rule (see proposed §§ 1.227 and 117.3). For a detailed discussion of ‘‘holding,’’ see sections VIII.E and X.B of the PC proposed rule. FDA is proposing to define the term ‘‘manufacturing/processing’’ to mean making food from one or more ingredients, or synthesizing, preparing, treating, modifying or manipulating food, including food crops or ingredients. The proposed definition would also state that examples of manufacturing/processing activities are cutting, peeling, trimming, washing, waxing, eviscerating, rendering, cooking, baking, freezing, cooling, pasteurizing, homogenizing, mixing, formulating, bottling, milling, grinding, extracting juice, distilling, labeling, or packaging. The proposed definition would also specify that, for farms and farm mixed-type facilities, manufacturing/processing does not include activities that are part of harvesting, packing, or holding. For consistency of terminology, we are proposing the same definition of ‘‘manufacturing/processing’’ as in the PC proposed rule (see proposed §§ 1.227 and 117.3). For a detailed discussion of ‘‘manufacturing/processing,’’ see sections VIII.E and X.B of the PC proposed rule. FDA is proposing to define the term ‘‘mixed-type facility’’ to mean an establishment that engages in both activities that are exempt from registration under section 415 of the FD&C Act and activities that require the establishment to be registered. The proposed definition would also state that an example of such a facility is a ‘‘farm mixed-type facility,’’ which is an establishment that grows and harvests crops or raises animals and may conduct other activities within the farm definition, but also conducts activities that require the establishment to be registered. For consistency of terminology, we are proposing the same definition of ‘‘mixed-type facility’’ as in the PC proposed rule (see proposed §§ 1.227 and 117.3). For a detailed discussion of ‘‘mixed-type facilities,’’ see sections VIII.E and X.B of the PC proposed rule. FDA is proposing to define the term ‘‘monitor’’ to mean to conduct a planned sequence of observations or measurements to assess whether VerDate Mar<15>2010 17:30 Dec 23, 2013 Jkt 232001 focused mitigation strategies are consistently applied and to produce an accurate record for use in verification. In the intentional adulteration framework, monitoring would be performed to ensure that focused mitigation strategies are consistently applied and to provide a record for use in verifying consistent application. FDA is proposing to define the term ‘‘packing’’ to mean placing food into a container other than packaging the food. The proposed definition would also specify that, for farms and farm mixedtype facilities, packing also includes activities traditionally performed by farms to prepare raw agricultural commodities grown or raised on the same farm or another farm under the same ownership for storage and transport, but does not include activities that transform a raw agricultural commodity, as defined in section 201(r) of the FD&C Act, into a processed food as defined in section 201(gg). We are proposing to use the same definition of ‘‘packing’’ as in the PC proposed rule (see proposed §§ 1.227 and 117.3). For a detailed discussion of ‘‘packing,’’ see sections VIII.E and X.B of the PC proposed rule. FDA is proposing to define the term ‘‘qualified end-user’’ to mean, with respect to a food, the consumer of the food (where the term consumer does not include a business); or a restaurant or retail food establishment (as those terms are defined in § 1.227) that: (1) Is located: (i) in the same State as the qualified facility that sold the food to such restaurant or establishment; or (ii) not more than 275 miles from such facility; and (2) is purchasing the food for sale directly to consumers at such restaurant or retail food establishment. The proposed definition would incorporate the definition in section 418(l)(4)(B) of the FD&C Act. FDA is proposing to define the term ‘‘qualified facility’’ to mean (when including the sales by any subsidiary; affiliate; or subsidiaries or affiliates, collectively, of any entity of which the facility is a subsidiary or affiliate) a facility that is: (1) A very small business as defined in this part; or (2) a facility to which both of the following apply: (i) During the 3-year period preceding the applicable calendar year, the average annual monetary value of the food manufactured, processed, packed or held at such facility that is sold directly to qualified end-users (as defined in this part) during such period exceeded the average annual monetary value of the food sold by such facility to all other purchasers; and (ii) the average annual monetary value of all food sold during the 3-year period preceding the PO 00000 Frm 00020 Fmt 4701 Sfmt 4702 applicable calendar year was less than $500,000, adjusted for inflation. We acknowledge that facilities would not need to consider the applicability of previous paragraph (2) because facilities that meet this second prong of the definition would be included in our proposed definition of a very small business, which is broader. The proposed definition would incorporate the description of ‘‘qualified facility’’ in section 418(l)(1) of the FD&C Act with editorial changes to improve clarity. FDA is proposing to define the term ‘‘significant vulnerability’’ to mean a vulnerability for which a prudent person knowledgeable about food defense would employ food defense measures because of the potential for serious adverse health consequences or death and the degree of accessibility to that point in the food process. The term ‘‘significant vulnerability’’ is analogous to the term ‘‘hazard that is reasonably likely to occur’’ in a HACCP-type framework for food safety. As proposed, a ‘‘significant vulnerability’’ is a type of vulnerability for which there is both: (1) The potential for serious adverse health consequences or death from the intentional introduction of a contaminant at the particular point in the process at which the significant vulnerability exists; and (2) a significant degree of accessibility at the particular point in the process. Unlike a ‘‘hazard that is reasonably likely to occur’’ in a HACCP system, a ‘‘significant vulnerability’’ exists at a particular point in a process (e.g., during storage in a bulk tank or during mixing). As discussed in section V.C.2 of this document, we have determined that significant vulnerabilities exist in a food operation at those actionable process steps that fit in the FDA-identified key activity types or that are identified as part of a vulnerability assessment. We have retained in this proposed definition the concept of a ‘‘prudent person’’ used in the definition of a ‘‘hazard that is reasonably likely to occur’’ in the PC proposed rule. However, because intentional adulteration is a potentially high consequence but low probability occurrence, the portion of the proposed definition in the PC proposed rule that reads, ‘‘experience, illness data, scientific reports, or other information provides a basis to conclude that there is a reasonable possibility that the hazard will occur in the type of food being manufactured, processed, packed, or held in the absence of those controls,’’ does not appear to be appropriate. Successful intentional adulteration caused by an act of E:\FR\FM\24DEP2.SGM 24DEP2 sroberts on DSK5SPTVN1PROD with PROPOSALS Federal Register / Vol. 78, No. 247 / Tuesday, December 24, 2013 / Proposed Rules terrorism requires not only the absence of focused mitigation strategies designed to address a significant vulnerability, but also simultaneous intent by an attacker to adulterate the food. As such, the absence of focused mitigation strategies to address a significant vulnerability alone may not present a reasonable possibility of intentional adulteration. Instead, as described above, we have tentatively concluded that the prudent person would consider the potential for public health consequences should intentional adulteration occur, and the degree of access by the attacker to commit the intentional adulteration, in determining which vulnerabilities are significant. FDA is proposing to define the term ‘‘significantly minimize’’ to mean to reduce to an acceptable level, including to eliminate. As noted in section X.B of the PC proposed rule, the term ‘‘significantly minimize’’ is used in FSMA and is consistent with the outcome of a ‘‘control measure’’ as described in the HACCP regulations for seafood (part 123), juice (part 120), and meat and poultry (9 CFR part 417). Generally, a ‘‘control measure’’ is implemented so that hazards are prevented, reduced to an acceptable level, or eliminated. FDA is proposing to define the term ‘‘small business’’ to mean, for the purposes of proposed part 121, a business employing fewer than 500 persons. The proposed limit of 500 employees would include all employees of the business rather than be limited to the employees of a particular facility. We are proposing to establish the same definition for small business as that which has been established by the U.S. Small Business Administration under 13 CFR part 121 for most food manufacturers. FDA is proposing to define the term ‘‘verification’’ to mean those activities, other than monitoring, that establish that the system is operating according to the food defense plan. As discussed in section V.C.6 of this document, we are not proposing to require validation of the focused mitigation strategies and, therefore, we are not proposing to include a determination of the validity of the food defense plan within the definition of verification in proposed § 121.3. FDA is proposing to define the term ‘‘very small business’’ to mean, for the purposes of proposed part 121, a business that has less than $10,000,000 in total annual sales of food, adjusted for inflation. In the discussion on the regulatory framework in section IV.A of this document, we discuss our assessment that the goal of terrorist VerDate Mar<15>2010 17:30 Dec 23, 2013 Jkt 232001 organizations is to maximize public health harm and, to a lesser extent, economic disruption. It is our assessment that such goals are likely to drive terrorist organizations to target the product of relatively large facilities, especially those for which the brand is nationally or internationally recognizable. An attack on such a target would potentially provide the widescale consequences desired by a terrorist organization and the significant public attention that would accompany an attack on a recognizable brand. Such facilities are likely to have larger batch sizes, potentially resulting in greater human morbidity and mortality. Further, an attack on a well-recognized, trusted brand is likely to result in greater loss of consumer confidence in the food supply and in the government’s ability to ensure its safety and, consequently, cause greater economic disruption than a relatively unknown brand that is distributed regionally (Ref. 2, Ref. 50, Ref. 3, Ref. 51, Ref. 6). Therefore, we have set a threshold of $10,000,000 in total food sales, adjusted for inflation, as the level defining a very small business. Data from the Dun & Bradstreet Global Business Database show that businesses with less than $10,000,000 in total food sales represent about 3 percent of the market share of food commodities, but include the majority of food facilities. Of a total of 65,900 domestic food facilities that are estimated to have actionable process steps, about 51,700 are owned by businesses with less than $10,000,000 in total annual sales. We request comment on our proposed definition, and whether a dollar amount of sales more than or less than $10,000,000 would be more appropriate. We also seek comment on whether this threshold should be based on total food sold, as we proposed, or on some appropriate proportion of food sales. For example, in the case of foreign facilities, would it be more appropriate to consider the proportion of food sold for marketing in the United States? FDA is proposing to define the term ‘‘vulnerability’’ to mean the susceptibility of a point, step, or procedure in a facility’s food process to intentional adulteration. ‘‘Vulnerability’’ is used in the term ‘‘vulnerability assessment’’ in section 420 of the FD&C Act and may best be described in the food defense context as analogous to the term ‘‘hazard’’ in a HACCP-type framework for food safety. While hazards in the unintentional adulteration context may also be thought of as analogous to agents or contaminants in the intentional PO 00000 Frm 00021 Fmt 4701 Sfmt 4702 78033 adulteration context, we have tentatively concluded that focusing on individual agents or contaminants is generally not effective or efficient in minimizing the risk of intentional adulteration caused by acts of terrorism. There are a significant number of potential agents or contaminants that could be used in a terrorist attack on food, with one or more being suitable for essentially any point in the production of any specific food. It would be extremely difficult, if not impossible, to consider the multiple combinations of potential contaminants, points in a food operation, and food categories, and to determine a strategy that would effectively address all possible agents. For this reason, determining whether there is an agent that could be intentionally introduced to a specific food that would then cause serious adverse health consequences or death would not be a useful exercise. Further, many agents or contaminants that could be used in such an attack are different from those that are associated with foodborne illnesses caused by unintentional adulteration and, as such, are not expected to be well understood by operators of food facilities. Therefore, we have tentatively concluded that in the intentional adulteration framework related to acts of terrorism, it is appropriate to refer to ‘‘vulnerabilities’’ rather than ‘‘hazards’’. According to the Merriam-Webster dictionary (Ref. 52), vulnerability is a ‘‘susceptibility,’’ and we believe this concept best captures the idea of a point, step, or procedure where someone intent on intentional adulteration would focus an attack in a facility’s food process. See section V.C.2 of this document for a discussion of assessing vulnerabilities to identify actionable process steps. We solicit comment on the proposed definitions. B. Exemptions In subpart A of proposed part 121, proposed § 121.5 would establish exemptions from some or all of the provisions of this proposed regulation. 1. Proposed § 121.5(a)—Exemption for Qualified Facilities Proposed § 121.5(a) would provide that proposed part 121 does not apply to a qualified facility, except that qualified facilities must, upon request, provide for official review documentation that was relied upon to demonstrate that the facility meets this exemption. Such documentation must be retained for 2 years. a. Exemption of qualified facilities. As discussed in section V.A of this document, proposed § 121.3 would E:\FR\FM\24DEP2.SGM 24DEP2 sroberts on DSK5SPTVN1PROD with PROPOSALS 78034 Federal Register / Vol. 78, No. 247 / Tuesday, December 24, 2013 / Proposed Rules define a qualified facility to mean (when including the sales by any subsidiary; affiliate; or subsidiaries or affiliates, collectively, of any entity of which the facility is a subsidiary or affiliate) a facility that is: (1) A very small business as defined in this part, or (2) a facility to which both of the following apply: (i) During the 3-year period preceding the applicable calendar year, the average annual monetary value of the food manufactured, processed, packed or held at such facility that is sold directly to qualified end-users (as defined in this part) during such period exceeded the average annual monetary value of the food sold by such facility to all other purchasers; and (ii) the average annual monetary value of all food sold during the 3-year period preceding the applicable calendar year was less than $500,000, adjusted for inflation. In addition, we are proposing to define very small business to mean a business that has less than $10,000,000 in total annual sales of food, adjusted for inflation. Section 418(l)(2)(A) of the FD&C Act provides that a qualified facility ‘‘shall not be subject to the requirements under [sections 418(a) through (i) and (n) of the FD&C Act].’’ We have tentatively concluded that we should include the exemption provided in section 418(l)(2)(A) of the FD&C Act in proposed § 121.5(a) to establish by regulation the reach of the provision. Section 418(l)(5) of the FD&C Act requires the Secretary of Health and Human Services, in consultation with the Secretary of Agriculture, to conduct a study of the food processing sector regulated by the Secretary of Health and Human Services and to make determinations in five areas. These areas include, in part: (1) Distribution of food production by type and size of operation; (2) the proportion of food produced by each type and size of operation; (3) the number and types of food facilities co-located on farms; (4) the incidence of foodborne illness originating from each size and type of operation; and (5) the effect on foodborne illness risk associated with certain activities regarding food. Section 418(n)(1)(B) of the FD&C Act requires that the regulations define the terms ‘‘small business’’ and ‘‘very small business,’’ taking into consideration the study of the food processing sector required by section 418(l)(5) of the FD&C Act. Consistent with section 418(l)(5) of the FD&C Act, we have consulted with USDA during our study of the food processing sector. The study is available in the docket established for this proposed rule (Ref. 53). We request comment on that study. We will VerDate Mar<15>2010 17:30 Dec 23, 2013 Jkt 232001 consider comments regarding the study, as well as comments regarding our proposed definition for very small business, in any final rule based on this proposed rule. We note that section 420 of the FD&C Act does not contain an explicit sizebased exemption, such as the qualified facility provision in section 418 of the FD&C Act. In section IV.A of this document, we discuss our assessment that the goal of terrorist organizations is to maximize public health harm and, to a lesser extent, economic disruption. We have tentatively concluded that such goals are likely to drive terrorist organizations to target the product of relatively large facilities, especially those for which the brand is nationally or internationally recognizable. The regulations issued under section 420 of the FD&C Act are to apply to food for which there is a high risk of intentional contamination. We have tentatively concluded that designating businesses with less than $10,000,000 in total annual sales of food as very small businesses, resulting in their exemption from proposed part 121, is consistent with the requirement in section 420 of the FD&C Act that the regulation be limited to foods at high risk of intentional adulteration. We acknowledge that the amount of food sales in the proposed definition of very small business (total annual sales of food of less than $10,000,000) is significantly higher than the threshold in the PC proposed rule, in which we co-proposed three amounts ($250,000, $500,000, and $1,000,000 in total annual sales of food). The higher amount proposed here reflects the difference in the nature of risk related to intentional adulteration covered by this rule and is consistent with the requirement in section 418(n)(3)(C) of the FD&C Act that this regulation ‘‘acknowledge differences in risk and minimize, as appropriate, the number of separate standards that apply to separate foods.’’ There are some facilities that are not subject to section 418 of the FD&C Act but are subject to section 420 of the FD&C Act, and would be subject to this rulemaking because their activities would likely involve one of the key activity types (e.g., juice manufacturing and breaded seafood manufacturing). However, under proposed § 121.5(a), such facilities would be exempt from proposed part 121 if they are part of businesses with less than $10,000,000 in total annual sales of food, adjusted for inflation. b. Documentation requirement for qualified facilities. Sections 418(l)(2)(A) and (l)(2)(B) of the FD&C Act provide PO 00000 Frm 00022 Fmt 4701 Sfmt 4702 that a qualified facility is exempt from the requirements of sections 418(a) through (i) and (n) (i.e., the requirements for hazard analysis and risk-based preventive controls), but must instead submit two types of documentation to the Secretary of Health and Human Services. The first type of required documentation relates to food safety practices at the facility, and section 418(l)(2)(B)(i) of the FD&C Act provides two options for satisfying this documentation requirement. Under section 418(l)(2)(B)(i)(I) of the FD&C Act, the qualified facility may choose to submit documentation that demonstrates that the owner, operator, or agent in charge of the facility has identified potential hazards associated with the food being produced, is implementing preventive controls to address the hazards, and is monitoring the preventive controls to ensure that such controls are effective. Alternatively, under section 418(l)(2)(B)(i)(II) of the FD&C Act, the qualified facility may choose to submit documentation (which may include licenses, inspection reports, certificates, permits, credentials, certification by an appropriate agency (such as a State department of agriculture), or other evidence of oversight), as specified by the Secretary of Health and Human Services, that the facility is in compliance with State, local, county, or other applicable non-Federal food safety law. The second type of required documentation relates to whether the facility satisfies the definition of a qualified facility. Under section 418(l)(2)(B)(ii) of the FD&C Act, the facility must submit documentation, as specified by the Secretary of Health and Human Services in a guidance document, that the facility is a qualified facility under section 418(l)(1)(B) or section 418(l)(1)(C). Section 418(l)(7)(A) of the FD&C Act requires that a qualified facility that is exempt from the requirements under sections 418(a) through (i) and subsection (n), and that does not prepare documentation under section 418(l)(2)(B)(i)(I), provide notification to consumers by one of two procedures, depending on whether a food packaging label is required on the food. With respect to a food for which a food packaging label is required by the Secretary of Health and Human Services under any other provision of the FD&C Act, section 418(l)(7)(A)(i) of the FD&C Act requires that a qualified facility include prominently and conspicuously on such label the name and business address of the facility where the food was manufactured or processed. With E:\FR\FM\24DEP2.SGM 24DEP2 sroberts on DSK5SPTVN1PROD with PROPOSALS Federal Register / Vol. 78, No. 247 / Tuesday, December 24, 2013 / Proposed Rules respect to a food for which a food packaging label is not required by the Secretary of Health and Human Services under any other provisions of the FD&C Act, section 418(l)(7)(A)(ii) of the FD&C Act requires that a qualified facility prominently and conspicuously display, at the point of purchase, the name and business address of the facility where the food was manufactured or processed, on a label, poster, sign, placard, or documents delivered contemporaneously with the food in the normal course of business, or, in the case of Internet sales, in an electronic notice. Section XIII.A of the PC proposed rule describes our proposed requirements pursuant to the above described modified requirements for qualified facilities in that proposed rule. In summary, in the PC proposed rule, we proposed codified language to require submission of the following to FDA: (1) Documentation that the facility is a qualified facility; and (2) documentation that demonstrates that the owner, operator, or agent in charge of the facility has identified the potential hazards associated with the food being produced, is implementing preventive controls to address the hazards, and is monitoring the performance of the preventive controls to ensure that such controls are effective; or documentation (which may include licenses, inspection reports, certificates, permits, credentials, certification by an appropriate agency (such as a State department of agriculture), or other evidence of oversight) that the facility is in compliance with State, local, county, or other applicable non-Federal food safety law, including relevant laws and regulations of foreign countries. In Section XIII.A of the PC proposed rule, we clarified that the following submission of information would be satisfactory: (1) A statement from the owner, operator, or agent in charge of a qualified facility certifying that the facility is a very small business, otherwise meets the definition of a qualified facility under proposed § 117.3, or both; and (2) a statement from the owner, operator, or agent in charge of a qualified facility certifying that the facility (a) has identified the potential hazards associated with the food being produced, is implementing preventive controls to address the hazards, and is monitoring the implementation of the preventive controls to ensure that such controls are effective; or (b) is in compliance with State, local, county, or other applicable non-Federal food safety law, including relevant laws and regulations of foreign VerDate Mar<15>2010 17:30 Dec 23, 2013 Jkt 232001 countries. We tentatively concluded that we would not, for example, require that a facility submit documentation to FDA demonstrating the content of their hazard identification, preventive controls, or monitoring of the implementation of preventive controls; or copies of their non-Federal licenses, inspection reports, certificates, permits, credentials, or certifications. We proposed to require that the information be resubmitted to FDA at least every 2 years, or whenever there is a material change to the information. Finally, we proposed to require that a qualified facility maintain records relied upon to support their assertion of meeting the requirements of the qualified exemption. We tentatively concluded that it is appropriate to require that the records relied upon to support a selfcertified statement be retained and made available to FDA upon request. Proposed § 121.5(a) would require that qualified facilities, upon request, provide for official review documentation that was relied upon to demonstrate that the facility meets this exemption. In addition, proposed § 121.5(a) would provide that such documentation must be retained for 2 years. We are not proposing to apply all of the modified requirements described in proposed § 117.201 in the PC proposed rule to qualified facilities that would be covered under this rule. We have tentatively concluded that such an approach is reasonable, considering the context and wording of the statutory provision as it relates to intentional adulteration caused by acts of terrorism. c. Withdrawal of exemption for qualified facilities. Section 418(l)(3) of the FD&C Act provides that the Secretary of Health and Human Services may withdraw the exemption provided in section 418(l)(2)(A) under certain circumstances. We discuss the withdrawal provisions of section 418(l)(3) of the FD&C Act, and the process we propose to use to withdraw an exemption for a qualified facility subject to that rule in section XIV.E of the PC proposed rule. We ask for comment on the appropriateness of those proposed procedures to withdraw an exemption for a qualified facility subject to this proposed rule. We also seek input on whether we should include the process for such withdrawal within proposed part 121 or whether those provisions might be best placed in a separate part and cross-referenced in proposed part 121 in order to reduce duplication, given these provisions also appear in the PC and the Produce Safety proposed rules. PO 00000 Frm 00023 Fmt 4701 Sfmt 4702 78035 2. Proposed § 121.5(b)—Exemption for Holding of Food a. Requirement of section 418 of the FD&C Act. Section 418(m) of the FD&C Act provides in relevant part that FDA may by regulation ‘‘exempt or modify the requirements for compliance under [section 418 of the FD&C Act] with respect to facilities that are solely engaged in . . . the storage of raw agricultural commodities (other than fruits and vegetables) intended for further distribution or processing or the storage of packaged foods that are not exposed to the environment.’’ In the PC proposed rule, we proposed exemptions and modified requirements based on this provision (see proposed §§ 117.5(j), 117.7, and 117.206). b. Petition relevant to section 418(m) of the FD&C Act. In a letter dated July 22, 2011, an industry coalition of the American Bakers Association, the American Frozen Food Institute, the Grocery Manufacturers Association, the International Bottled Water Association, the International Dairy Foods Association, the International Warehouse Logistics Association, the Peanut and Tree Nut Processors Association, and the Snack Food Association (the section 418(m) petitioners) submitted a citizen petition (Docket No. FDA–2011–P–0561). The petition requests that FDA issue regulations under section 418(m) of the FD&C Act ‘‘to exempt from compliance or modify the requirements for compliance under section 418 [of the FD&C Act] for facilities that are solely engaged in the storage of packaged foods that are not exposed to the environment, by allowing such facilities to satisfy the requirements of that section through compliance with the [CGMPs] mandated for such facilities by [current] § 110.93.’’ The section 418(m) petitioners assert that the food safety issues presented by facilities used only to store packaged foods that are not exposed to the environment are essentially the same, regardless of the type of food. As such, trade associations representing a variety of product sectors are signatories to the petition and are supportive of the request to exempt such facilities from the provisions of section 418 of the FD&C Act. The section 418(m) petitioners stated, ‘‘As an initial matter, the risk of intentional adulteration at facilities solely engaged in the storage of packaged foods not exposed to the environment is quite remote. The food in these facilities is stored in unit packaging, meaning any effort to adulterate the food would be laborious and likely ineffective.’’ They further E:\FR\FM\24DEP2.SGM 24DEP2 sroberts on DSK5SPTVN1PROD with PROPOSALS 78036 Federal Register / Vol. 78, No. 247 / Tuesday, December 24, 2013 / Proposed Rules asserted that, ‘‘Members of the food industry have implemented a number of precautions against intentional adulteration. Most importantly, these facilities are locked and secured against unauthorized entry. Access is restricted to the employees of the manufacturer dropping off food, any staff employed at the facility, and the persons who deliver food to retailers and other customers. Food is often held in such facilities for a short period of time, which would not be conducive to attempts at intentional adulteration. Further, we note that the continual activity in these facilities during pickup and drop-off hours serves as a deterrent for anyone attempting to gain unauthorized access.’’ c. Proposed exemption for the holding of food. Proposed § 121.5(b) would exempt from the requirements in proposed part 121 the holding of food, except the holding of food in liquid storage tanks. This provision is broader in scope than exemptions in proposed §§ 117.5(j) and 117.7 in the PC proposed rule, and would exempt, for example, storage of whole grains, shell eggs, fruits and vegetables, and packaged foods (including packaged milk and orange juice). It would not exempt, for example, storage in bulk storage tanks of milk or liquid orange juice. As discussed in section V.C.2 of this document, based on an analysis of the vulnerability assessments that FDA has conducted using the CARVER+Shock methodology, we identified four key activity types (Bulk liquid receiving and loading; Liquid storage and handling; Secondary ingredient handling; and Mixing and similar activities) as production processes that require focused mitigation strategies. With the exception of the holding of food in liquid storage tanks, which is not included in the proposed exemption, we are not aware of activities performed during the holding of food that fit within any of these four key activity types. We acknowledge that our proposed exemption in § 121.5(b) is not identical to the exemption in section 418(m) of the FD&C Act. However, as explained above, the holding of food that would be exempt does not include any of the four key activity types associated with actionable process steps under proposed § 121.130(a). Consequently, even without an exemption, this holding of food would not require the implementation of focused mitigation strategies under proposed § 121.130(a) to protect food against intentional adulteration. The only requirement related to holding activities would be for a written assessment that would conclude that no focused mitigation VerDate Mar<15>2010 17:30 Dec 23, 2013 Jkt 232001 strategies are necessary with regard to the holding activities. Under these circumstances, we have tentatively concluded that an exemption is appropriate. Accordingly, we propose to exempt the holding of food, except the holding of food in liquid storage tanks, from the requirements of this proposed regulation. Although we are not responding to the merits of the arguments of the section 418(m) petitioners with regard to precautions against intentional adulteration, we believe that this proposed exemption meets the request of the section 418(m) petitioners. 3. Proposed § 121.5(c)—Exemption for Packing, Re-Packing, Labeling, and Relabeling of Food Proposed § 121.5(c) would exempt from the requirements in proposed part 121 the packing, re-packing, labeling, or re-labeling of food where the container that directly contacts the food remains intact. As discussed in section V.C.2 of this document, based on an analysis of the vulnerability assessments that FDA has conducted using the CARVER+Shock methodology, we identified four key activity types (Bulk liquid receiving and loading; Liquid storage and handling; Secondary ingredient handling; and Mixing and similar activities) as production processes that require focused mitigation strategies. We are not aware of activities performed during the packing, re-packing, labeling, or relabeling of food where the immediate package or container of the food remains intact that fit within any of these four key activity types. As discussed in section V.A of this document, the proposed rule would not require a facility that chooses to identify its actionable process steps under proposed § 121.30(a) to implement focused mitigation strategies for a food process that does not include any of the four key activity types. Even without the exemption, a facility that conducts packing, re-packing, labeling, or relabeling activities would be able to conclude that it has no key activity types and, therefore, would not be required to implement focused mitigation strategies. However, without an exemption, under proposed § 121.130, such a facility would be required to perform a written assessment to make this determination. We have tentatively concluded that requiring such an assessment is unnecessary. Consequently, we propose to exempt the packing, re-packing, labeling, or re-labeling of food where the container that directly contacts the food PO 00000 Frm 00024 Fmt 4701 Sfmt 4702 remains intact from the requirements of this proposed regulation. 4. Proposed § 121.5(d)—Exemption for Produce Farms Proposed § 121.5(d) would exempt from the requirements in proposed part 121 the activities of a facility that are subject to section 419 of the FD&C Act (Standards for Produce Safety). We discuss our tentative decision not to cover produce farms under section 419 of the FD&C Act in sections IV.B and IV.F, respectively, of this document. Section 418(k) of the FD&C Act provides that section 418 ‘‘shall not apply to activities of a facility that are subject to section 419’’. Section 419 of the FD&C Act, ‘‘Standards for Produce Safety,’’ requires FDA to establish by regulation ‘‘science-based minimum standards for the safe production and harvesting of those types of fruits and vegetables, including specific mixes or categories of fruits and vegetables, that are raw agricultural commodities for which [FDA] has determined that such standards minimize the risk of serious adverse health consequences or death.’’ Section 419(h) of the FD&C Act provides that section 419 ‘‘shall not apply to activities of a facility that are subject to section 418.’’ Establishments that are exempt from registration under section 415 of the FD&C Act as ‘‘farms’’ would not be subject to section 418 of the FD&C Act when conducting activities within the farm definition. Farm mixed-type facilities would be subject to section 418 of the FD&C Act when conducting those activities that trigger the section 415 registration requirement. We have tentatively concluded that Congressional intent regarding the reach of section 418(k) of the FD&C Act is unambiguous in that section 418(k) directly limits the exemption to activities of the facility that are subject to section 419 of the FD&C Act. We have also tentatively concluded that we should include a provision implementing section 418(k) of the FD&C Act in the proposed regulation to establish by regulation the reach of the exemption. Therefore, in proposed § 121.5(d), we are proposing that proposed part 121 would not apply to activities of a facility that are subject to section 419 of the FD&C Act (Standards for Produce Safety). At the time FDA developed the farm definition and its interpretations of that definition, the practical impact of an activity’s classification as inside or outside that definition was limited to the potential to trigger the section 415 registration regulations and the section 414 recordkeeping regulations. With the E:\FR\FM\24DEP2.SGM 24DEP2 Federal Register / Vol. 78, No. 247 / Tuesday, December 24, 2013 / Proposed Rules sroberts on DSK5SPTVN1PROD with PROPOSALS advent of FSMA, the scope of the farm definition has taken on more importance because, for example, activities within the farm definition are not subject to section 418 of the FD&C Act, but activities outside the farm definition are subject to section 418. Therefore, FDA proposed to clarify and adjust the scope of the farm definition, including the classification of manufacturing, processing, packing, and holding activities relevant to that definition, in the proposed preventive controls regulations for human food. In section VIII.D of the PC proposed rule, we described a set of organizing principles that would form the basis for our proposal for classifying activities to more accurately reflect the scope of activities traditionally conducted by farms and to allow for more certainty among industry with regard to how their activities will be regulated. 5. Proposed § 121.5(e)—Exemption for Alcoholic Beverages Proposed § 121.5(e)(1) would provide that proposed part 121 does not apply with respect to alcoholic beverages at a facility that meets the following two conditions: (i) Under the Federal Alcohol Administration Act (27 U.S.C. 201 et seq.) or chapter 51 of subtitle E of the Internal Revenue Code of 1986 (26 U.S.C. 5001 et seq.) the facility is required to obtain a permit from, register with, or obtain approval of a notice or application from the Secretary of the Treasury as a condition of doing business in the United States, or is a foreign facility of a type that would require such a permit, registration, or approval if it were a domestic facility; and (ii) Under section 415 of the Federal Food, Drug, and Cosmetic Act (21 U.S.C. 350d) the facility is required to register as a facility because it is engaged in manufacturing, processing, packing, or holding one or more alcoholic beverages. Proposed § 121.5(e)(2) would provide that proposed part 121 does not apply with respect to food other than alcoholic beverages at a facility described in paragraph (e)(1) of this section, provided such food: (i) Is in prepackaged form that prevents any direct human contact with such food; and (ii) Constitutes not more than 5 percent of the overall sales of the facility, as determined by the Secretary of the Treasury. In section X.C.7 of the PC proposed rule, we explain in detail our interpretation of section 116 of FSMA and our consideration of hazards and preventive controls for the manufacturing, processing, packing, and holding of alcoholic beverages. Based on VerDate Mar<15>2010 17:30 Dec 23, 2013 Jkt 232001 that analysis, we proposed, in proposed § 117.5(i), to exempt certain facilities engaged in the manufacturing, processing, packing, or holding of alcoholic beverages and other food. Consistent with that analysis, we are proposing similar exemptions related to alcoholic beverages in this proposed rule on focused mitigation strategies for the protection of food against intentional adulteration caused by acts of terrorism. We have tentatively concluded that we should include a provision implementing section 116 of FSMA in the proposed rule to establish by regulation the reach of the provision. We request comment on our interpretation of section 116 of FSMA, described in section X.C.7 of the PC proposed rule, and its application to the proposed exemption in § 121.5(e). 6. Proposed § 121.5(f)—Exemption for Food for Animals Proposed § 121.5(f) would exempt from the requirements of proposed part 121 the manufacturing, processing, packing, and holding of food for animals other than man. In the Animal Food PC proposed rule, we proposed to require that facilities that manufacture, process, pack, or hold animal food and that are not otherwise covered by certain exemptions, design and implement a system of preventive controls to address food safety issues. In that proposed rulemaking, we tentatively concluded that hazards associated with intentional adulteration would likely require different kinds of controls and would be best addressed in a separate rulemaking. We also requested comment in that rulemaking on whether to include in those regulations potential hazards that may be intentionally introduced for economic reasons, which we refer to as economically motivated adulteration, a type of intentional adulteration. Our current thinking regarding economically motivated adulteration is discussed in section IV.F of this document. Section 418(m) of the FD&C Act authorizes FDA to exempt or modify the requirements for compliance with section 418 with regard to facilities that engage solely in the production of animal food. Further, section 420(c) of the FD&C Act requires that regulations that FDA issues under that section apply only to food for which there is a high risk of intentional contamination. In section IV.A of this document, we discuss how FDA is proposing to implement the provisions of sections 418 and 420 of the FD&C Act with regard to circumstances under which a facility subject to either of these sections would be required to have and PO 00000 Frm 00025 Fmt 4701 Sfmt 4702 78037 implement focused mitigation strategies under a HACCP-like system to address intentional adulteration related to terrorism. In summary, this proposed rule would require a facility to implement focused mitigation strategies if one or more of four key activity types are applicable to its food operation or if a facility conducts its own vulnerability assessment and identifies actionable process steps for significant vulnerabilities in its food operation. The identification of a production step for a food as necessitating focused mitigation strategies is premised upon an analysis, based on CARVER+Shock methodology, that an attack at these points in the production of a food would likely result in an outcome that is consistent with our understanding of the goal of terrorist organizations (i.e., maximizing adverse public health impacts and, to a lesser extent, economic disruption) (Ref. 54). For human foods, our analyses show the potential for significant human morbidity and mortality should intentional adulteration occur at any one or more of these points in a food operation. (Significant economic harm is also likely, related to the human morbidity and mortality as well as disruption in the food supply as a result of loss of consumer confidence in its safety.) In contrast, for animal food, our analysis shows only minimal potential for human morbidity or mortality as a result of attacks at key activity types or other points in an animal food operation. Significantly, our CARVER+Shock vulnerability assessments of animal food have had to focus entirely on economic consequences because of the lack of potential for human morbidity and mortality. In considering whether to provide an exemption related to animal food, we evaluated three types of possible attack scenarios: (1) Incorporation of a contaminant into feed to be used for muscle meat-producing animals; (2) incorporation of a contaminant into feed to be used for egg-producing or milkproducing animals; and (3) incorporation of a contaminant into pet food. With regard to the two former scenarios, we are not aware of contaminants that could be incorporated into feed at levels that would not produce noticeable clinical signs and/or mortality in animals but would result in significant human morbidity or mortality among consumers that subsequently eat the meat, eggs or milk (Ref. 55). While contaminants can increase the risk of chronic disease, such as cancer, among consumers (Ref. 56), such an outcome is not consistent E:\FR\FM\24DEP2.SGM 24DEP2 78038 Federal Register / Vol. 78, No. 247 / Tuesday, December 24, 2013 / Proposed Rules sroberts on DSK5SPTVN1PROD with PROPOSALS with our understanding of the goals of terrorist organizations, which include a more immediate impact. We recognize that such an attack could result in significant economic disruption because of the loss of consumer confidence in the safety of the food supply. While important, attacks of that nature fall significantly below those involving human morbidity and mortality when placed on a scale of risk with regard to targeting by terrorist organizations. Regarding the third attack scenario (incorporation of a contaminant into pet food), we are aware of contaminants that could be incorporated into feed or pet food that could result in significant animal (including pet) morbidity and mortality, including some which could result in secondary infectious spread of disease (because some infectious agents can be transmitted orally as well as through aerosol). Again, such attacks could be significant from an economic and societal standpoint. However, the risk that they pose with regard to targeting by terrorist organizations appears to be significantly lower than those involving human morbidity and mortality. We request comment on this assessment of risk. Therefore, notwithstanding the likely presence of one or more of the four key activity types in the production of many animal foods, we have tentatively concluded that animal food (regardless of whether it is produced at a facility solely engaged in the production of animal food or at a facility engaged in the production of both animal and human food) does not involve significant vulnerabilities that require focused mitigation strategies under section 418 of the FD&C Act and is not at high risk for intentional adulteration related to terrorism under section 420 of the FD&C Act. Consequently, we are proposing to exempt the manufacturing, processing, packing, and holding of food for animals other than man. We request comment on these tentative conclusions. C. Food Defense Measures In subpart C of proposed part 121, FDA is proposing various food defense measures, including requirements for a food defense plan, identification of actionable process steps, implementation of focused mitigation strategies and related monitoring, corrective actions, and verification, and training of certain personnel. We discuss the provisions of proposed subpart C in this section. 1. Food Defense Plan a. Proposed § 121.126(a)— Requirement for a Food Defense Plan. VerDate Mar<15>2010 17:30 Dec 23, 2013 Jkt 232001 Proposed § 121.126(a) would require that the owner, operator, or agent in charge of a facility prepare, or have prepared, and implement a written food defense plan. To make clear that the written plan is related to food defense rather than to other plans a facility may have (such as quality control plans or food safety plans), for purposes of this rulemaking, we have designated the ‘‘written plan’’ to be a ‘‘food defense plan.’’ A written food defense plan is essential for a facility covered by this rule to implement the plan consistently, train its employees, and periodically reanalyze and update the plan. It is also essential to auditors, and to inspectors, in the same way written plans are essential to ensuring food safety. A written food defense plan addressing vulnerabilities associated with intentional adulteration is analogous to a written HACCP or food safety plan for hazards associated with unintentional contamination. Proposed § 121.126(a) would provide flexibility for the owner, operator, or agent in charge of the facility to either prepare the written food defense plan or have that plan prepared, in whole or in part, on its behalf. In addition, proposed § 121.126 would provide flexibility for facilities in the development of their food defense plans by allowing facilities to group food types or production method types if the vulnerabilities, focused mitigation strategies, and other required procedures, such as monitoring, are essentially identical. Proposed § 121.126(a) would require that the owner, operator, or agent in charge of a facility implement the written food defense plan. Our proposed requirement to develop and implement a food defense plan, which includes the identification of actionable process steps and implementation of focused mitigation strategies, reflects our tentative conclusion that such actions are measures necessary to prepare and protect the food supply from intentional adulteration caused by acts of terrorism. Proposed § 121.126(a) implements sections 418(b), (c), (d), (e), (f), and (h), and 420(b) of the FD&C Act. We seek comment on these tentative conclusions. b. Proposed § 121.126(b)—Contents of a food defense plan. Proposed § 121.126(b)(1) through (b)(5) would require that the contents of a food defense plan include: • The written identification of actionable process steps as required by proposed § 121.130; • The written focused mitigation strategies as required by proposed § 121.135(b); PO 00000 Frm 00026 Fmt 4701 Sfmt 4702 • The written procedures for monitoring as required by proposed § 121.140(a); • The written corrective action procedures as required by proposed § 121.145(a)(1); and • The written verification procedures as required by proposed § 121.150(e). Although we are proposing to require that the contents of food defense plan include only the specific elements described above, the food defense plan can be used as a resource for facilities to capture additional food defenserelated information. For example, facilities may also wish to include information, such as process flow diagrams, an evaluation of broad mitigation strategies, emergency contact information, crisis management plans, action plans for implementation of broad mitigation strategies, results of supplier audits, and other documents, analysis, reviews, or information the facility finds relevant to its food defense program. FDA has developed and publicly released the user-friendly FDPB software tool that can be used to assist a facility to develop a robust food defense plan. This free tool is available on the FDA Web site at http:// www.fda.gov/Food/FoodDefense/ ToolsEducationalMaterials/ ucm349888.htm. Proposed § 121.126, if finalized, would establish a requirement for every facility covered by this rule to have its own written food defense plan. Like the food safety plan, this facility-based nature of the written food defense plan is consistent with the overall framework of section 418 of the FD&C Act, which is directed to a facility rather than, for example, a corporate entity that may have multiple facilities. Proposed § 117.126(c) of the PC proposed rule would require that the food safety plan be prepared by (or its preparation overseen by) a qualified individual (See the discussion in section XII.A.4 of the PC proposed rule). We are proposing to require that the vulnerability assessment be performed by an individual qualified by experience and/or training only when facilities choose to identify actionable process steps in their food defense plans using the provisions of proposed § 121.130(b), whereby they would perform their own vulnerability assessment. Our proposal is based on two considerations. First, we anticipate that most facilities will develop their food defense plan using the procedure in proposed § 121.130(a) for identification of actionable process steps. Here, FDA has performed much of the scientific analysis required and identified the key activity types (see section V.C.2 of this document for E:\FR\FM\24DEP2.SGM 24DEP2 Federal Register / Vol. 78, No. 247 / Tuesday, December 24, 2013 / Proposed Rules sroberts on DSK5SPTVN1PROD with PROPOSALS further discussion). Second, we believe that the identification of focused mitigation strategies, and the monitoring, corrective action and verification activities to implement them requires less technical expertise than required for preventive controls and implementation procedures for those controls. The former usually involve focused mitigation strategies to limit access to specific steps in the production process with simple visual checks to monitor them, while the latter often involve scientific studies to establish critical limits with process control instruments to monitor them. Proposed § 121.126(b) implements sections 418(h) and 420(b)(2) of the FD&C Act. We seek comment on our proposed provisions related to the written food defense plan and its contents. 2. Identification of Actionable Process Steps a. FDA’s vulnerability assessments and FDA-identified key activity types. As noted in section II.B of this document, under the SPPA Initiative, FDA, along with USDA, FBI, and DHS, conducted vulnerability assessments on products and processes in the food and agriculture sector. After conclusion of the initiative, FDA continued conducting assessments for products and processes not previously assessed. To implement section 420(a)(1)(A), FDA combined and analyzed data from a subset of these assessments (i.e., those relevant to the food manufacturing and distribution segments of the food system) and identified activities which consistently ranked high for vulnerability to intentional adulteration. FDA published the results of this analysis in April, 2013 (April 2013 Report) (Ref. 54). CARVER+Shock methodology is a tool for assessing the vulnerabilities within a food system and determining the most vulnerable points, and focusing resources on protecting the most susceptible points. Using the CARVER+Shock methodology, FDA, in collaboration with other U.S. government partners conducted over 50 vulnerability assessments on a wide range of food products and processes. Based on these assessments, we identified the processing steps with the greatest vulnerability to intentional adulteration caused by acts of terrorism. Through this review, we determined that the processing steps we identified fit into one of four groups of activities occurring at those processing steps. We refer to these as ‘‘key activity types.’’ The key activity types that we have identified are: (1) Bulk liquid receiving VerDate Mar<15>2010 17:30 Dec 23, 2013 Jkt 232001 and loading, (2) Liquid storage and handling, (3) Secondary ingredient handling, and (4) Mixing and similar activities. In this proposed rule we have modified the activity type names and descriptions from those in the April 2013 Report for clarity. Providing these key activity types to facilities for their use in identifying actionable process steps and developing focused mitigation strategies provides some advantages over other approaches that we might have taken, such as identifying points in the production of specific foods at increased risk for intentional adulteration caused by an acts of terrorism, or requiring each facility to perform its own vulnerability assessment. First, publicly providing a list of key activity types does not disclose sensitive information, as might be the case if we provided CARVER+Shock scores derived from our vulnerability assessments for process steps for specific foods. Second, providing a list of key activity types rather than requiring facilities to perform their own facilityspecific vulnerability assessments relieves the burden upon the facility to assemble a team of individuals with the diverse expertise needed to properly self-score the steps in their process (using the CARVER+Shock Vulnerability Assessment software tool or another suitable tool). When we performed vulnerability assessments during the SPPA initiative our teams included individuals with expertise in the production of the food under study, law enforcement, food science, food regulatory systems, and public health. We expect that such an effort is likely beyond the capacity of many facilities. Further, by providing a list of key activity types, we eliminate the need to identify a CARVER+Shock score, for example, as the threshold for the implementation of focused mitigation strategies. This is important because CARVER+Shock scores are somewhat subjective and difficult to correlate across food types, making identification of a universal threshold score challenging. b. Proposed § 121.130—Requirement for written identification of actionable process steps. Proposed § 121.130 would require that the owner, operator, or agent in charge of a facility identify any actionable process steps, using the procedures in either proposed § 121.130(a) or proposed § 121.130(b). A facility would be required to follow either one of the two specified procedures, but not both. Proposed § 121.130 would also require that the identification of actionable process steps and the PO 00000 Frm 00027 Fmt 4701 Sfmt 4702 78039 assessment leading to that identification be written. A written assessment of whether the facility has one or more of the key activity types (under proposed § 121.130(a)) or a written vulnerability assessment (under proposed § 121.130(b)) would help the facility organize its assessment, and fully understand the nature of the vulnerabilities. In addition, it is essential for auditors and inspectors to assess the adequacy of the facility’s assessment. This written identification of actionable process steps would also be essential during reanalysis of the food defense plan, as would be required by proposed § 121.150(d). Such a written document would also be useful for training purposes as a tool to make employees aware of the elements of the facility’s food defense plan. The written identification of actionable process steps must include the justification for whatever conclusion the owner, operator, or agent in charge of a facility reaches. Proposed § 121.130 would not limit the requirement for a written identification of actionable process steps to only those circumstances where the owner, operator, or agent in charge of a facility identifies one or more actionable process steps. Rather, under proposed § 121.130, a written analysis would be required even if the conclusion of the analysis is that there are no actionable process step. If a facility chooses to identify actionable process steps using the procedure in proposed § 121.130(a), the written documentation would not need to include the procedures for assessing the vulnerabilities associated with identified actionable process steps. If a facility chooses to identify actionable process steps using the procedure in proposed § 121.130(b), the written identification of actionable process steps must include information about the appropriate methods used to conduct the vulnerability assessment and identify actionable process steps, and the experience and training of the person(s) who conducted that assessment (see also discussion in section V.C.2.d of this document). Proposed § 121.130 implements sections 418(b)(2), 418(b)(3), 420(a)(1), and 420(b)(1) of the FD&C Act. c. Proposed § 121.130(a)— Identification of actionable process steps using FDA-identified key activity types. Proposed § 121.130(a) would specify the first of two procedures by which the proposed requirement for identification of actionable process steps in proposed § 121.130 can be met, i.e., using the FDA-identified key activity types. E:\FR\FM\24DEP2.SGM 24DEP2 sroberts on DSK5SPTVN1PROD with PROPOSALS 78040 Federal Register / Vol. 78, No. 247 / Tuesday, December 24, 2013 / Proposed Rules Proposed § 121.130(a) would state that the owner, operator, or agent in charge of a facility must assess, for each type of food manufactured, processed, packed or held at the facility, whether the facility has one or more of the following key activity types and identify the actionable process steps associated with any key activity types present: 1. Bulk liquid receiving and loading— a step in which a bulk liquid is received and unloaded from an inbound conveyance or loaded into an outbound conveyance where a contaminant can be intentionally introduced and, if it is, it is likely that the contaminant will be distributed throughout the liquid due to sloshing, movement, or turbulence caused by the receiving and unloading or loading activity; 2. Liquid storage and handling—a step in which a liquid is contained in bulk storage tanks or in holding, surge, or metering tanks where a contaminant can be intentionally introduced and, if it is, it is likely that the contaminant will be distributed into the food; 3. Secondary ingredient handling—a staging, preparation, addition, or rework step where a contaminant can be intentionally introduced into a relatively small amount of ingredient or rework and, if it is, it is likely that the contaminant will be distributed into a larger volume of food; and 4. Mixing and similar activities—a step, such as mixing, blending, homogenizing, or grinding where a contaminant can be intentionally introduced and, if it is, it is likely that the contaminant will be distributed into the food. The owner, operator, or agent in charge would be required to assess whether the facility has a food process that involves any one or more of the specified four key activity types. If the food process is found to involve any key activity types, the owner, operator, or agent would be required to identify actionable process step(s) that are associated with each key activity type that is present. For example, based on proposed § 121.130(a), a facility may identify a mixing tank as involving the key activity type, Mixing and similar activities, in its operation because the mixing tank has an unsecured lid and several sample ports which provide direct access to the food product and because a contaminant can be introduced into the tank through the lid or one of the sampling ports and, if it is, the contaminant would be distributed into the food. The owner would conclude that the mixing tank is an actionable process step. We would expect that this conclusion would be VerDate Mar<15>2010 17:30 Dec 23, 2013 Jkt 232001 reached for virtually all steps that involve mixing, blending, homogenizing, or grinding because these kinds of process steps generally: (1) Present an opportunity for access to the product at or just prior to the equipment (e.g., in-feed conveyor); and (2) would cause a contaminant, if intentionally added, to be distributed into the food. We expect this conclusion to be reached regardless of whether the facility may already have mitigation strategies in place to impede access to the mixing tank (e.g., a ‘‘buddy system’’ that ensures that at least two employees were present at the mixing tank at all times or a lock on the mixing tank access ports). The presence of mitigation strategies should not be considered when assessing whether a facility has a process step that involves one of the key activity types. Any existing mitigation strategies and their adequacy to significantly minimize or prevent the significant vulnerability should be considered at a later step when identifying appropriate focused mitigation strategies, in accordance with proposed § 121.135. We acknowledge the possibility, although not likely, that circumstances may exist where access at or just prior to the equipment is not possible (i.e., because the equipment is fully enclosed, with no access ports), and that in such a situation this process step would not be identified as fitting within the key activity type. For example, the owner of the same facility may assess a second mixing tank that is part of an entirely closed system, with no direct access points into the system, such that an individual attempting to access this mixing tank would likely cause a major disruption to the line, foiling any attempted intentional adulteration. Based on this assessment, the owner may conclude that the enclosed nature of this second mixing tank renders the product inaccessible at this step and, therefore, it does not fit within the key activity type. In this circumstance, there would be no requirement to identify an actionable process step associated with this mixing tank (in which case, there also would be no requirement to implement a focused mitigation strategy at this step). Under proposed § 121.130, the owner would be required to document the basis for the determination that the second mixing tank does not fit within the key activity type. The second mixing tank would continue to be subject to the requirement for reanalysis of a food defense plan, as proposed in § 121.150(d) and the facility would consider the applicability of the four PO 00000 Frm 00028 Fmt 4701 Sfmt 4702 key activity types during reanalysis. We request comment on whether there are specific process steps for specific products that otherwise fit within one of the four key activity types but for which access to the equipment is not possible (i.e., because the equipment is fully enclosed, with no access ports). If the owner, operator, or agent in charge determines that the food operation does not involve any of the key activity types, there would be no need to identify actionable process steps. Such a facility, however, would still be required to document its finding that none of the key activity types apply to its food processes, under proposed § 121.130. The documentation would be a part of the written food defense plan required under proposed § 121.126. Such a facility would continue to be subject to the requirement for reanalysis of a food defense plan, as proposed in § 121.150(d). Proposed § 121.130(a) would require that the process of identification of actionable process steps be done ‘‘for each type of food manufactured, processed, packed, or held at the facility.’’ The vulnerability of a food to intentional contamination may differ based on the type of food and associated process, practices, and conditions at the facility. Therefore, we are proposing that the facility assess whether it has any of the key activity types for each type of food that is manufactured, processed, packed, or held at that facility. A facility may find that its operation related to one type of food manufactured at that facility involves one or more of the key activity types, but all other types of food manufactured at that facility do not involve any of the key activity types. In such an instance, actionable process steps would need to be identified and focused mitigation strategies implemented only for the food type that involved the key activity types. Description of key activity types—As discussed in section V.C.2.a of this document, our vulnerability assessments revealed four key activity types that most commonly rank high: Bulk liquid receiving and loading; Liquid storage and handling; Secondary ingredient handling; and Mixing and similar activities. We have tentatively concluded that the presence of any of these four key activity types in a food operation indicates a significant vulnerability for intentional contamination caused by acts of terrorism. Based on our assessments, we believe that these four key activity types capture the significant vulnerabilities in a food operation. However, although generally unlikely, a vulnerability E:\FR\FM\24DEP2.SGM 24DEP2 sroberts on DSK5SPTVN1PROD with PROPOSALS Federal Register / Vol. 78, No. 247 / Tuesday, December 24, 2013 / Proposed Rules assessment of a specific food at a specific facility conducted under proposed § 121.130(b) may identify significant vulnerabilities at actionable process steps that are not associated with one of these four key activity types. We seek comment on our tentative conclusion. Proposed § 121.130(a)(1) would identify ‘‘Bulk liquid receiving and loading’’ as a key activity type, based on our finding that this activity type commonly ranked high in our vulnerability assessments. Proposed § 121.130(a) would describe this key activity type as a step in which a bulk liquid is received and unloaded from an inbound conveyance or loaded into an outbound conveyance where a contaminant can be intentionally introduced and, if it is, it is likely that the contaminant will be distributed throughout the liquid due to sloshing, movement, or turbulence caused by the receiving and unloading or loading activity. Bulk liquid receiving refers to the inbound movement of liquid product into a facility for its use in the food production process, whereas bulk liquid loading refers to the outbound movement of liquid product from a facility for further processing or use by an end customer/consumer. Examples of products that may be received or loaded in bulk include juices, high fructose corn syrup and other sweeteners, milk, animal fats, syrups, and vegetable oils. Bulk liquid receiving and loading refers to any processing step where a liquid ingredient is being received and unloaded at a facility or a liquid intermediate or finished product is being loaded into an outbound shipping transport vehicle and for which there is an opportunity for a contaminant to be intentionally introduced into the food. This key activity type incorporates the actions of opening the transport vehicle, attaching any pumping equipment or hoses, and opening any venting hatches. The characteristics associated with these activities are such that there is a high probability of a contaminant, if intentionally added, mixing within the liquid, due to significant sloshing, movement, and turbulence associated with the receiving or loading activity. In addition, the need for worker activity associated with these processing steps provides access to hoses, the transport vessel, and potentially the product as it is being received or loaded. Proposed § 121.130(a)(2) would identify ‘‘Liquid storage and handling’’ as a key activity type, based on our finding that this activity type ranked high in our vulnerability assessments. Proposed § 121.130(a) would describe this key activity type as a step in which VerDate Mar<15>2010 17:30 Dec 23, 2013 Jkt 232001 a liquid is contained in bulk storage tanks or in holding, surge, or metering tanks where a contaminant can be intentionally introduced and, if it is, it is likely that the contaminant will be distributed into the food. This key activity type refers to any processing step where a liquid ingredient or intermediate or finished liquid product is stored in either bulk storage tanks or smaller secondary, non-bulk holding tanks or surge tanks and for which there is an opportunity for a contaminant to be intentionally introduced into the food. Bulk liquid storage refers to any storage silo or tank where liquid product may be stored prior to introduction into the product stream or prior to loading for outbound shipping. Non-bulk tanks can be used to store non-bulk liquid ingredients (e.g., fats, oils, vitamin mixes, and sweeteners), hold liquid product for sample testing and other quality control activity, or to control flow rates of liquid ingredients or product through the production system. Non-bulk storage tanks also include tanks or totes where the tamper evident seals are opened and the container itself is used for holding. Both categories of liquid storage can be considered key processing steps because if a contaminant were successfully introduced, there is a high probability of a contaminant mixing within the liquid due to the agitation commonly used to prevent separation within the liquid medium. Access necessary for the introduction of a contaminant is generally available through hatches, sample ports, and the container lid (in the case of a tanker or tote for which the tamper evident seal has been broken). Proposed § 121.130(a)(3) would identify ‘‘Secondary ingredient handling’’ as a key activity type, based on our finding that this activity type commonly ranked high in our vulnerability assessments. Proposed § 121.130(a) would describe this key activity type as the staging, preparation, addition, or rework step where a contaminant can be intentionally introduced into a relatively small amount of ingredient or rework and, if it is, it is likely that the contaminant will be distributed into a larger volume of food. This key activity type refers to any processing step where ingredients (either dry or liquid) are manipulated prior to or during addition to the product stream by human contact and for which there is an opportunity for a contaminant to be intentionally introduced into the food. ‘‘Staging’’ refers to the process of opening the tamper evident packaging of a secondary ingredient and moving the PO 00000 Frm 00029 Fmt 4701 Sfmt 4702 78041 ingredient to the production area in advance of being added into the primary product stream. ‘‘Preparation’’ refers to any act of measuring, weighing, premixing, or otherwise manipulating the ingredient prior to addition to the product stream. ‘‘Addition’’ refers to any act of physically adding ingredient directly into the product stream or into surge or meter hoppers in order to deliver the ingredient into the product stream. ‘‘Rework’’ refers to clean, unadulterated food that has been removed from processing for reasons other than insanitary conditions or that has been successfully reconditioned by reprocessing and that is suitable for use as food. Staging, preparation, addition, and rework involving secondary ingredients are key activities because a contaminant added to a relatively small volume of product would be distributed into the large product flow as the ingredient or rework is combined with the other components of the food. Secondary ingredient staging, preparation, addition, and rework are generally open and accessible and that accessibility is an inherent component of the activity. Thus, these key activities provide a potential point of access where a contaminant could be introduced into the product stream. Proposed § 121.130(a)(4) would identify ‘‘Mixing and similar activities’’ as a key activity type, based on our finding that the activities commonly ranked high in our vulnerability assessments. Proposed § 121.130(a) would describe this key activity type as a step, such as mixing, blending, homogenizing, coating, glazing, or grinding where a contaminant can be intentionally introduced and, if it is, it is likely that the contaminant will be distributed into the food. This key activity type refers to any processing step where there is an opportunity for a contaminant to be intentionally introduced into the food, and the primary purpose or result of the processing step is: (1) Coating, i.e., to layer a powder or liquid onto the surface of a product, such as a batter, breading, glazing or flavoring; (2) mixing, i.e., to blend a powder, dough, or liquid ingredient together; (3) grinding, i.e., to reduce the particle size of a solid ingredient or mass to a smaller granularity; or (4) homogenizing, i.e., to reduce the particle size of an ingredient and disperse it throughout a liquid. These are key activities because a potential contaminant successfully added at one of these steps would generally be readily dispersed throughout the product. Further, access is generally available through access ports, lids, and in-feed conveyors or E:\FR\FM\24DEP2.SGM 24DEP2 sroberts on DSK5SPTVN1PROD with PROPOSALS 78042 Federal Register / Vol. 78, No. 247 / Tuesday, December 24, 2013 / Proposed Rules flumes. Examples of equipment associated with these activities include: Mixers, blenders, homogenizers, cascade breaders, mills, grinders, and pulverizers. We seek comment on these key activity types, and whether they are each appropriate to include and whether there are additional activities that present significant vulnerability to intentional adulteration caused by acts of terrorism. Proposed § 121.130(a) implements sections 418(a) through (c) and 420(a)(1)(A) of the FD&C Act. d. Proposed § 121.130(b)— Identification of actionable process steps by conducting a vulnerability assessment. Proposed § 121.130(b) would provide the second of two options for identification of actionable process steps. Proposed § 121.130(b) would specify that the owner, operator, or agent in charge of a facility must conduct or have conducted, for each food type manufactured, processed, packed or held at the facility, an evaluation to identify and prioritize the points, steps, and procedures in a food operation based on their vulnerability to intentional adulteration and to identify actionable process steps. Proposed § 121.130(b) would provide flexibility to the owner, operator, or agent in charge of a facility covered by this rule to conduct, or have conducted, their own vulnerability assessment of the food operations at a facility, rather than assessing their food operation against the FDA-identified key activity types. We are proposing that a vulnerability assessment conducted under proposed § 121.130(b) must be performed by an individual(s) qualified by experience and/or training using appropriate methods. Training or job experience is essential to the effective evaluation of vulnerabilities and identification of actionable process steps. Only a trained individual or individual qualified by job experience using appropriate methods would be capable of effectively conducting a vulnerability assessment, including assessing the various points, steps, or procedures in a food process; identifying and prioritizing those points, steps, or procedures in a food process that are susceptible to intentional contamination; and identifying actionable process steps where food defense measures are essential to address significant vulnerabilities. Our proposed definition of significant vulnerability (in proposed § 121.3), too, reflects the need for a qualified individual to make such assessments where focused mitigation strategies would be necessary to protect VerDate Mar<15>2010 17:30 Dec 23, 2013 Jkt 232001 the food from intentional adulteration caused by acts of terrorism. As noted above, when we performed vulnerability assessments during the SPPA initiative our teams included individuals with expertise in the production of the food under study, law enforcement, food science, food regulatory systems, and public health. While we are not proposing to specify the particular training or experience requirements of the individual(s) qualified to conduct such vulnerability assessments, or the particular methods that must be used to conduct these assessments, facilities choosing this procedure in proposed § 121.130(b) would be required to employ appropriate methods and use a qualified individual(s) to conduct a robust and scientifically sound vulnerability assessment of the facility’s food operation. FDA’s resources available online, such as the CARVER+Shock Vulnerability Assessment software tool and the FDPB software tool may be helpful. Finally, as in the case of proposed § 121.130(a), proposed § 121.130(b) would require that the process of identification of actionable process steps be done ‘‘for each type of food manufactured, processed, packed, or held at the facility.’’ See discussion in section V.C.2 of this document. Elements of a Facility-Specific Vulnerability Assessment—The elements of an approach to conducting a facility-specific vulnerability assessment are: • Planning to conduct a vulnerability assessment—collect and evaluate appropriate background information on biological, chemical, physical, and radiological agents of concern, such as those found in the CDC’s Select Agents and Toxins List (Ref. 57); • Assembling the vulnerability assessment team—identify appropriate individuals within the organization to assist in the vulnerability assessment process. This may include personnel working in the areas of security, food safety/quality assurance or control, human resources, operations, maintenance, and other individuals deemed necessary to facilitate the formation of a vulnerability assessment; • Developing a process flow diagram—list out each of the steps in the food process to be evaluated; • Identifying significant vulnerabilities—evaluate each process step to prioritize vulnerabilities and identify significant vulnerabilities. For each process step, the evaluation should consider, at a minimum: (1) The potential public health impact if a contaminant were added; (2) whether downstream processing steps would PO 00000 Frm 00030 Fmt 4701 Sfmt 4702 eliminate or remove agents of concern; (3) the degree of physical access to product; (4) the ability of an aggressor to successfully contaminate the product; and (5) the volume of product impacted. This evaluation should also include the rationale or justification for which process steps were and were not identified as significant vulnerabilities; and • Identifying actionable process steps—for identified significant vulnerabilities, indicate where actionable process steps exist in the food process and where associated focused mitigation strategies would be required to be implemented, under proposed § 121.135. Facilities that choose this alternative may need assistance from outside experts who are knowledgeable in food defense and vulnerability assessments. Some facilities may not have the resources or the necessary expertise on site and expert advice may be obtained when necessary from other sources, such as trade and industry associations, independent experts, and regulatory authorities. We seek comment on the need for, and appropriateness of, proposed § 121.130(b), including whether, in a final rule, we should specify the particular qualifications of individual(s) performing the vulnerability assessment or the methods that must be used under this alternative procedure, and whether the vulnerability assessment elements, we described previously, provide sufficient direction regarding appropriate methodology. Proposed § 121.130(b) implements sections 418(a) to (c) and 420(a)(1)(A) of the FD&C Act. 3. Focused Mitigation Strategies a. Requirements of sections 418 and 420 of the FD&C Act. Section 418(c)(2) of the FD&C Act, in relevant part, specifies that the owner, operator, or agent in charge of a facility shall identify and implement preventive controls to provide assurances that hazards identified in the hazard analysis conducted under section 418(b)(2) of the FD&C Act will be significantly minimized or prevented and addressed, consistent with section 420 of the FD&C Act, as applicable. Section 418(c)(1)(3) of the FD&C Act, in relevant part, specifies that the preventive controls must also provide assurances that the food manufactured, processed, packed, or held by such facility will not be adulterated under section 402 of the FD&C Act. Section 418(h) of the FD&C Act requires that the owner, operator, or agent in charge of a facility prepare a written food safety plan that, among E:\FR\FM\24DEP2.SGM 24DEP2 sroberts on DSK5SPTVN1PROD with PROPOSALS Federal Register / Vol. 78, No. 247 / Tuesday, December 24, 2013 / Proposed Rules other things, identifies the preventive controls within the plan. Section 420(b) of the FD&C Act requires FDA to issue regulations to protect against the intentional adulteration of food. Such regulations are to specify appropriate science–based mitigation strategies or measures to prepare and protect the food supply chain at specific vulnerable points, as appropriate (section 420(b)(2) of the FD&C Act). Section 418(o)(3) of the FD&C Act defines preventive controls as ‘‘those risk-based, reasonably appropriate procedures, practices, and processes that a person knowledgeable about the safe manufacturing, processing, packing, or holding of food would employ to significantly minimize or prevent the hazards identified under the hazard analysis conducted under [section 418(b) of the FD&C Act] and that are consistent with the current scientific understanding of safe food manufacturing, processing, packing or holding at the time of the analysis.’’ The definition provides that ‘‘those procedures, practices, and processes may include the following: (A) Sanitation procedures for food-contact surfaces and utensils and food-contact surfaces of equipment; (B) Supervisor, manager, and employee hygiene training; (C) An environmental monitoring program to verify the effectiveness of pathogen controls in processes where a food is exposed to a potential contaminant in the environment; (D) A food allergen control program; (E) A recall plan; (F) Current Good Manufacturing Practices (cGMPs) under part 110 of title 21, Code of Federal Regulations (or any successor regulations); (G) Supplier verification activities that relate to the safety of food.’’ (emphasis added) In section V.A.2 of this document, we discuss our proposed definition of focused mitigation strategy and its relationship to the definition of preventive controls in section 418(o)(3) of the FD&C Act. We are not proposing requirements for sanitation procedures, hygiene training, environmental monitoring, food allergen control, and CGMPs because these examples are relevant to food safety, but not to food defense. We considered proposing to require a recall plan (as we did in the PC proposed rule in proposed § 117.135(d)(4); see sections XII.C.8 and XII.D of that document). However, we tentatively conclude that the usefulness of a recall plan is greatly reduced in the context of preventive controls for intentional adulteration. The relationship between an implementation failure and the status of the food is different in intentional adulteration and VerDate Mar<15>2010 17:30 Dec 23, 2013 Jkt 232001 food safety contexts. An act of intentional adulteration caused by terrorism, historically, has been a rare event. In the vast majority of cases, the failure to properly implement a focused mitigation strategy would not be expected to result in intentional adulteration. With intentional adulteration, adulteration of food requires not just the opportunity for a contamination event (i.e., failure of a mitigation strategy to limit access to an actionable process step), but also someone with intent to cause harm at that same moment. As such, it is unlikely that a deviation from the provisions of this proposed rule would necessitate a recall. In contrast, the failure to properly implement a preventive control for a food safety hazard (for example, where proper cook temperatures are not reached in a process) would be expected to more likely result in a situation where the food becomes adulterated (e.g., because the pathogen reasonably likely to be present in the raw food would not be eliminated from the food by the inadequate cooking process), potentially necessitating a recall. b. General description of mitigation strategies. Mitigation strategies are measures taken by a facility to reduce the potential for intentional adulteration of food. Based on these vulnerability assessments, FDA previously developed recommendations for mitigation strategies that can be implemented, as appropriate, to minimize or prevent intentional contamination of food. These mitigation strategies are presented in our guidance documents (Ref. 22, Ref. 23, Ref. 24, Ref. 25, Ref. 26), the CARVER+Shock Vulnerability Assessment software tool (Ref. 29), the MSD (Ref. 30), and the FDPB software tool (Ref. 31). FDA divides mitigation strategies into two types: Broad Mitigation Strategies and Focused Mitigation Strategies. We explain each of these types in this section of the document. i. Broad mitigation strategies. Broad mitigation strategies are general facilitylevel measures that are intended to minimize a facility’s vulnerability, as a whole, to potential acts of intentional contamination. Examples of broad mitigation strategies are: (1) Physical security, such as perimeter security fencing, locking exterior doors, penetration alarms; (2) personnel security, such as pre-hire background, reference checks, identification badges, and controlled visitor access; (3) securing hazardous materials, such as cleaning products, laboratory materials, and pesticides; (4) management practices, such as ingredient storage PO 00000 Frm 00031 Fmt 4701 Sfmt 4702 78043 inventory procedures; key security procedures, PINs or passwords; procedures to restrict personal items from all food production areas; procedures requiring IDs and uniforms to be returned when a person’s employment ends; and supplier verification or certification procedures; and (5) crisis management planning, such as maintenance of updated emergency contact information, procedures for responding to reported threats, and establishment of a designated food defense leadership team. Broad mitigation strategies, by nature, are generally applicable to a facility, regardless of the type of food being processed, and, as such, are not targeted to a specific processing step in a food operation. Broad mitigation strategies address facility-wide vulnerabilities that may present an opportunity for an attacker to access the facility and intentionally adulterate food. Broad mitigation strategies serve as foundational actions or procedures that improve a facility’s overall defense against intentional contamination caused by acts of terrorism. We are proposing to require the implementation of focused mitigation strategies only. However, as set out in our guidance documents (Ref. 22, Ref. 23, Ref. 24, Ref. 25, Ref. 26), we think it is prudent for facilities to review our guidance and implement those broad mitigation strategies that are appropriate to minimize the risk for intentional adulteration of food. ii. Focused mitigation strategies. As discussed in section V.A of this document, we are proposing to define focused mitigation strategies as those risk-based, reasonably appropriate measures that a person knowledgeable about food defense would employ to significantly minimize or prevent significant vulnerabilities identified at actionable process steps, and that are consistent with the current scientific understanding of food defense at the time of the analysis. Focused mitigation strategies are specific to an actionable process step in a food operation where a significant vulnerability is identified. They represent reasonably appropriate measures that are necessary to reduce the likelihood of intentional contamination caused by an act of terrorism at that process step. Focused mitigation strategies are customized to the processing step at which they are applied, tailored to existing facility practices and procedures, and depend on an evaluation of the vulnerabilities identified in a vulnerability assessment. When properly implemented, focused E:\FR\FM\24DEP2.SGM 24DEP2 sroberts on DSK5SPTVN1PROD with PROPOSALS 78044 Federal Register / Vol. 78, No. 247 / Tuesday, December 24, 2013 / Proposed Rules mitigation strategies by themselves are sufficient to significantly minimize or eliminate the chances that an attacker would be successful if an act of intentional adulteration were attempted at the specific process step. Focused mitigation strategies focus on minimizing either the accessibility of an attacker to the product at a particular process step or the opportunity for the attacker to successfully contaminate the product at that process step, or both. Based on our vulnerability assessments, we tentatively conclude that the implementation of focused mitigation strategies at actionable process steps in a food operation is necessary to minimize or prevent the significant vulnerabilities that are identified in a vulnerability assessment (Ref. 21, Ref. 54, Ref. 58), regardless of the existence of broad mitigation strategies. Although broad mitigation strategies are important to further reduce the vulnerability for intentional contamination, they are not sufficient to significantly minimize the risk of intentional contamination caused by an act of terrorism because broad mitigation strategies are not specific enough, for example, to counter the actions of an attacker who has legitimate access to the facility (i.e., insider attack) or an attacker who circumvents perimeter protections (e.g., scaling a fence), with the goal of intentionally contaminating the food. Focused mitigation strategies, on the other hand, are targeted to actionable process steps identified in a food operation to reduce the likelihood of intentional contamination at those process steps and, therefore, are essential to ensure that appropriate food defense measures are taken to protect the food from intentional contamination caused by acts of terrorism. In contrast to broad mitigation strategies, focused mitigation strategies are targeted to actionable process steps and, therefore, are more effective at countering an attacker who has legitimate access to the facility. We have tentatively concluded that we will continue to encourage the implementation of broad mitigation strategies on a voluntary basis, but we will require the implementation of focused mitigation strategies at actionable process steps. We request comment on this tentative conclusion, and on whether we should include, in a final rule, a requirement for the implementation of any broad mitigation strategies. iii. Examples of focused mitigation strategies for FDA-identified key activity types. For the FDA-identified key activity types, a variety of focused mitigation strategies may be applicable, VerDate Mar<15>2010 17:30 Dec 23, 2013 Jkt 232001 dependent both on the food manufactured, processed, packed, or held at the facility and on the practices and processes employed at that facility. We list in this section some examples of focused mitigation strategies that may be appropriate to implement at actionable process steps for each of these four key activity types. While the decision of which and how many focused mitigation strategies would be appropriate to employ at an actionable process step is dependent upon the physical layout and operation at a specific facility, the examples presented in the section immediately below illustrate the decision-making process to identify and determine appropriate focused mitigation strategies at an actionable process step. Bulk liquid receiving and loading— Examples of focused mitigation strategies that may be appropriate include the following: 1. Controlling access to the receiving or loading area, conveyances, and equipment, including hoses and pumping machinery, to prevent an unauthorized person from gaining access to the food during receiving or loading. Access controls may include: strategies to easily identify authorized persons, such as color-coded uniforms or badges; restricting conveyance drivers to areas away from the receiving or loading area (e.g., restricting them to a lounge or break room); securing hoses with locking caps or in cabinets; and ensuring that conveyance access hatches, vents, and inspection ports are secured; 2. Ensuring adequate lighting in the receiving or loading area, which reduces the ability of an attacker to disguise his or her actions. Adequate lighting in and around vulnerable areas of a food operation increases the likelihood that other staff will witness the actions of an attacker and enable them to take steps to prevent or react to contamination; 3. Increasing observation of the receiving or loading area, which reduces the ability of an attacker to disguise his or her actions. For example, maximizing the line of sight by removing boxes, crates, or other obstructions from the area; positioning quality control personnel in the receiving or loading area to supervise operations; or utilizing closed-circuit TV systems or other monitoring devices; 4. Verifying that seals on a shipping conveyance are intact prior to receiving or after loading a bulk liquid to reduce the likelihood that the shipping conveyance was or is accessed during transport to introduce a contaminant into the product; PO 00000 Frm 00032 Fmt 4701 Sfmt 4702 5. Establishing and implementing a policy for driver check-in and identification to help confirm driver identity and verify the individual is authorized, through verification of shipping documentation or other means, to deliver or pick-up the shipment and reduce the likelihood that an attacker could fraudulently pose as a driver as a means of gaining access to the facility; and 6. Inspecting the shipping conveyance prior to loading bulk liquids to help ensure that no contaminant has been introduced to the conveyance chamber that could then contaminate the product once the product is loaded. Liquid storage and handling— Examples of focused mitigation strategies that may be appropriate include the following: 1. Controlling access to liquid storage, holding, surge, or metering tanks, similar to the strategies that may be applied for controlling access to bulk liquid receiving and holding; 2. Ensuring that the area around liquid storage, holding, surge, or metering tanks is free of unrelated materials, such as personal items (backpacks, purses, or packages), and other items that are not directly related to the food operation, to reduce the likelihood of a contaminant being brought into the area for introduction into the tank; 3. Ensuring adequate lighting in and around liquid storage, holding, surge or metering tanks, similar to the strategies that may be applied for ensuring adequate lighting at bulk liquid receiving and loading; 4. Installing one-way sample ports in liquid storage, holding, surge, or metering tanks , so that food product can be drawn out of the equipment but a contaminant cannot be inserted into the tank; 5. Inspecting tanks prior to filling to help ensure that no contaminant has been introduced into the empty tank that could then contaminate the product once loaded; 6. Inspecting pumping or metering equipment prior to use to help ensure that no contaminant has been introduced into the equipment that could contaminate the product; 7. Using enclosed tanks and transfer systems to move materials to reduce the potential for an attacker to access the product and introduce a contaminant; and 8. Positioning holding, surge, or metering tanks to increase visibility, such that frequent observation is facilitated and visibility of activity around the tank is improved. This E:\FR\FM\24DEP2.SGM 24DEP2 sroberts on DSK5SPTVN1PROD with PROPOSALS Federal Register / Vol. 78, No. 247 / Tuesday, December 24, 2013 / Proposed Rules focused mitigation strategy may be less practical for longer term storage tanks. Secondary ingredient handling— Examples of focused mitigation strategies that may be appropriate include the following: 1. Controlling access to ingredient handling areas, including where secondary ingredients or rework are staged, prepared, or added to the product stream, to prevent an unauthorized person from gaining access to the ingredients or rework during these processes. As with other key activity types, access controls may include strategies to easily identify authorized persons, such as with color coded uniforms or badges, or conducting ingredient handling activities in areas behind locking gates, doors, or other barriers; 2. Ensuring the secondary ingredient handling area is free of unrelated materials, such as personal items or other items not directly related to the activity, to help ensure that a contaminant is not brought into the area for introduction into the ingredient during staging, preparation, or addition; 3. Ensuring adequate lighting and increasing visibility in and around ingredient staging and handling areas, similar to the strategies that may be employed to ensure adequate lighting at bulk liquid receiving and holding; 4. Reducing staging time to reduce the opportunity for intentional adulteration. Any time sealed or tamper-evident containers are breached provides a potential opportunity for an attacker to introduce a contaminant into the ingredient or rework. Reducing the time ingredients and rework are staged in unsecured containers reduces the opportunity for an attacker to adulterate the ingredient or rework; 5. Restricting secondary ingredient handling to senior staff to reduce the accessibility and opportunity for intentional adulteration; 6. Using peer monitoring in the ingredient handling area, because requiring at least two staff members to be in the area at any given time during operations can reduce the opportunity for a contaminant to be discreetly introduced into the food; 7. Using automated and enclosed ingredient handling equipment, such as automated computer weighing, measuring, and addition equipment, to reduce human contact with secondary ingredients or rework and thereby reduce the opportunity for introduction of a contaminant; and 8. Inspecting secondary ingredients held in staging and investigating any irregularities in the amount, condition, or organization of items in secondary VerDate Mar<15>2010 17:30 Dec 23, 2013 Jkt 232001 ingredient handling areas to identify circumstances that suggest product contamination before a contaminated ingredient is added to the product stream. Mixing and similar activities— Examples of focused mitigation strategies that may be appropriate include the following: 1. Controlling access to processing areas where mixing and similar activities are conducted to prevent an unauthorized person from gaining access to the product and equipment. Access controls may include: strategies to easily identify authorized persons, such as with color coded uniforms or badges; conducting these activities in areas behind locking gates, doors, or other barriers; securing access to overhead gangways and sampling platforms; and securing hatches, ports, and lids with locks or access alarm devices; 2. Ensuring that the area is free of unrelated materials, such as personal items and other items that are not directly related to the activity, to reduce the likelihood of a contaminant being brought into the area for introduction into the ingredient during mixing and similar activities; 3. Ensuring adequate lighting and increasing visibility in and around mixing and similar activities areas, similar to the strategies that may be employed to ensure adequate lighting at bulk receiving and loading; 4. Positioning mixing and similar equipment in a manner that maximizes visibility, similar to the strategies that may be employed to maximize visibility for liquid storage and handling; 5. Using one-way sample ports that prohibit introduction of a contaminant into the mixing or similar equipment, similar to the strategies that may be employed for liquid storage and handling; 6. Conducting inspections of mixing and similar equipment prior to use to help ensure no contaminant has been introduced that could contaminate the product once loaded; 7. Restricting mixing and similar activities to senior staff, similar to the strategies that may be employed for secondary ingredient handling; 8. Using peer monitoring in this area to ensure that at least two staff members are in this area at any given time during operations, reducing the opportunity for a contaminant to be discreetly introduced into the food; and 9. Using automated, self-contained, enclosed equipment to reduce human contact with the product and reduce the opportunity for introduction of a contaminant. PO 00000 Frm 00033 Fmt 4701 Sfmt 4702 78045 These examples of focused mitigation strategies are consistent with measures included in the MSD. The examples are not intended to be an exhaustive list of appropriate focused mitigation strategies. For additional guidance on identifying appropriate focused mitigation strategies, see our guidance documents, the MSD, and other resources (see section II.D of this document). iv. Specific examples of determining appropriate focused mitigation strategies. In this section, we discuss specific examples of the decisionmaking process to identify and determine appropriate focused mitigation strategies at an actionable process step for each of the FDAidentified key activity types. Bulk liquid receiving and loading— Unloading at Facility A’s bulk tanker truck unloading bay is an actionable process step for this key activity type. Facility A has a significant vulnerability related to access to the food during the unloading of the bulk liquid. At Facility A, the tanker truck drives into the unloading bay without passing through any security check-in procedures. A single facility employee is assigned to this area and takes a facility-owned hose from an open shelving unit in the unloading bay and attaches it to the tanker truck’s unloading port. The driver of the tanker truck assists in unloading by opening the venting hatch at the top of the tanker truck while the facility employee is attaching the hose. The driver then waits in the unloading bay area while the truck is being unloaded. Upon completion of unloading activities, the driver gets back in the truck and exits the facility. Facility A is not implementing focused mitigation strategies at this actionable process step such that access to the food during unloading of the bulk liquid is significantly minimized or eliminated. The food is significantly vulnerable to an attacker (in this case, potentially the driver, the facility employee, or a third party) who could intentionally add a contaminant to the product to adulterate the food. One approach for Facility A to significantly minimize or eliminate the significant vulnerability at this actionable process step is to implement the following focused mitigation strategies: • Establish a receiving check-in and verification procedure to ensure that the shipment is being delivered by the proper firm and that the driver is properly identified. The procedure would be documented and maintained in a shipping log that records the key identifying information about the driver, tanker truck, and shipping E:\FR\FM\24DEP2.SGM 24DEP2 sroberts on DSK5SPTVN1PROD with PROPOSALS 78046 Federal Register / Vol. 78, No. 247 / Tuesday, December 24, 2013 / Proposed Rules documentation for the delivered product. The facility would also institute a policy requiring that the shipping documentation include the ID numbers of the seals on the unloading ports so that the facility employee can verify that seal numbers match the shipping documentation and that the seals were not broken, tampered with or replaced during transport. • Implement a procedure to store hoses securely to reduce the likelihood an attacker could add a contaminant to the hoses when not in use. This would include storing hoses in locking cabinets and placing end caps on the hoses. The facility also would issue keys only to staff working in the tanker truck receiving bay and use a key numbering and tracking system to verify that all keys are accounted for. • Increase active observation of the unloading process to reduce the likelihood of an attacker successfully introducing a contaminant by requiring two or more production staff members to be present during unloading activities (i.e., peer monitoring), or requiring the bulk liquid unloading operations be overseen by a supervisor or a member of the quality control staff. Alternatively, the facility could employ video surveillance of the area. If the truck driver is permitted to remain in the area of the receiving bay, the introduction of active observation practices ensures that no contaminant could be intentionally introduced to the product during unloading activities. Alternatively, the facility could limit the driver’s access to the product by restricting the location of the driver to designated areas outside the loading area while the truck is being unloaded. In this example, the focused mitigation strategies were selected to achieve the following goals: Establishing the identity of personnel with access to the food; ensuring that equipment that may be used to introduce a contaminant is secured when not in use; and providing active observation of activities at actionable process steps. By implementing these focused mitigation strategies, the facility could significantly minimize the significant vulnerability identified at the actionable process step. Liquid storage and handling—The storage of liquid in Facility B’s bulk liquid storage tank is an actionable process step for this key activity type. Facility B’s bulk storage tank holding a primary ingredient is located within its building, and a significant vulnerability relates to access to the food during such storage. In Facility B, a network of gangways, ladders, and platforms surround the bulk liquid storage tank so that personnel can gain access to a hatch VerDate Mar<15>2010 17:30 Dec 23, 2013 Jkt 232001 at the top of the tank. Facility B has a procedure for securing this hatch with a lock, and the facility stores the key to the hatch in the operations manager’s office. To access a key, a worker must request the key from the operations manager and justify the need to open the lock. When an employee checks out the key, the manager’s assistant records the employee’s name, time the key is checked out, and the reason. Facility B’s bulk liquid storage tank also has a second hatch along the side which is used for cleaning the tank when empty and is not locked. This secondary hatch is not accessible while product is in the tank because it opens inward, and pressure from product in the tank prevents the hatch from being opened when product is present. In considering the requirement for focused mitigation strategies at this actionable process step, Facility B would determine that it has sufficient safeguards in place to significantly minimize the likelihood of intentional adulteration from an attacker accessing the hatch on the top of the bulk storage tank. However, the facility would identify the secondary hatch as presenting a significant vulnerability for which insufficient focused mitigation strategies are being implemented. While food is in the tank, the secondary hatch is secure. However, when the tank is empty after cleaning, there is an opportunity for an attacker to introduce a contaminant into the tank via the secondary hatch which would then contaminate the food when it is added to the tank. To significantly minimize or eliminate the significant vulnerability presented by the secondary hatch, the facility would implement focused mitigation strategies to restrict and document access to the secondary hatch as is done for the hatch on the top of the tank. To do this, the facility would install a lock on the secondary hatch and incorporate the key for the secondary hatch into its existing key management system. Alternatively, the facility could implement a procedure of monitoring the condition of the tank interior immediately prior to reintroducing product to the tank. This monitoring check would be recorded in a monitoring log. Facility B already has in place some practices that we would consider appropriate focused mitigation strategies. The procedures in place to control access to the top access hatch on the bulk liquid storage tank are sufficient to minimize the significant vulnerability presented by this hatch. However, Facility B still has a significant vulnerability associated with the secondary access hatch, which PO 00000 Frm 00034 Fmt 4701 Sfmt 4702 required additional focused mitigation strategies to significantly reduce or eliminate the risk of intentional contamination. Another example of an actionable process step for the key activity type ‘‘Liquid Storage and Handling’’ is liquid storage in a liquid surge tank located above an in-line bottling operation at Facility C. The surge tank is used to control the flow rate of liquid product into the bottling equipment and is enclosed by an unlocked lid. A ladder and walkway enable workers to access the surge tank as needed to monitor product flow and take quality control samples. Facility C has an operations control room, which is equipped with windows to view the production floor. However, the view of the bottling operation from the operations control room is commonly blocked by pallets of empty bottles awaiting introduction into the bottling equipment. It is not practical for Facility C to lock the surge tank lid because workers need to frequently check the status of product flow and take quality control samples. Also, it is not practical to physically limit access to the ladder or walkway used to access the surge tank, for the same reasons. One approach for Facility C to significantly minimize or eliminate the significant vulnerability at this actionable process step is to implement the following focused mitigation strategies: • Implement a policy to prohibit all personnel not associated with the bottling operation from entering the area and issue uniforms of a particular color to the bottling personnel only. The staff working in the bottling area would enforce this policy by instructing any staff not associated with the bottling operation to leave the area. • Prohibit staff working in the bottling area from bringing any items not associated with the bottling operation into the work area. • Train the staff working in the bottling area in a peer monitoring program to be attentive to the activity of other staff in the area. • Stage pallets of empty bottles awaiting introduction into the bottling equipment in another location to improve line of sight from the operations control room. By implementing these focused mitigation strategies, the facility could significantly minimize or eliminate the significant vulnerability associated with the actionable process step at the liquid surge tank. Secondary ingredient handling— Ingredient staging at Facility D is an actionable process step for this key activity type. Facility D opens a E:\FR\FM\24DEP2.SGM 24DEP2 sroberts on DSK5SPTVN1PROD with PROPOSALS Federal Register / Vol. 78, No. 247 / Tuesday, December 24, 2013 / Proposed Rules containerized secondary ingredient’s tamper evident package, measures out the required amount into a secondary container, and pre-positions the ingredient in the production area so that it is readily added to the product line. Access to the food during each of these activities at this actionable process step presents a significant vulnerability. Facility D stages a dry, powdered ingredient near the mixer the night before it is intended to be used so that it is ready when the production run begins the next morning. Additionally, the staging area in Facility D is accessible to all staff and is an open area on the production floor. One approach for Facility D to significantly minimize or eliminate the significant vulnerability at this actionable process step is to implement the following focused mitigation strategies: • Reduce staging time, by revising its procedures so that ingredients are staged immediately before they are added into the product stream. This strategy would reduce the time ingredients are accessible. • Change its staffing procedures to ensure that only senior or long-term employees are assigned to measuring and staging secondary ingredients. Assigning the most trusted employees to work in sensitive areas reduces the risk of intentional contamination. • Increase its observation of this area by installing closed-circuit TV cameras to monitor the actions of staff in the secondary ingredient staging area. By its nature, the action of ingredient staging is an open and accessible process step. Focused mitigation strategies must address personnel access so that the likelihood of an intentional contamination at this step is significantly reduced or eliminated. By implementing these focused mitigation strategies, the facility could significantly minimize the significant vulnerability identified at the actionable process step. Mixing and similar activities— Blending in Facility E’s dough mixer is an actionable process step for this key activity type. Facility E operates a dough mixer to combine several dry and liquid ingredients. This mixer is not enclosed and is located in an open area of the facility where it is under regular—though not dedicated—human observation. While a batch of product is being mixed, the staff member assigned to the mixer may leave the area to retrieve and prepare ingredients for the next production batch. The line of sight in this area is clear, and management in the operations control room located above the production floor has a clear VerDate Mar<15>2010 17:30 Dec 23, 2013 Jkt 232001 view of the mixer through an observation window. The mixer is vulnerable to an attacker who could intentionally introduce a contaminant into the food because of the open nature of the mixer, the lack of constant and dedicated observation, and the lack of physical access control to the area where it is located. One approach for Facility E to significantly minimize or eliminate the significant vulnerability at this actionable process step is to implement the following focused mitigation strategies: • Install a lid on the mixer that must be opened to add anything to the mixer. If Facility E determines that it would be disruptive to the production schedule to install a lock on the lid, the facility could install an access alarm that would indicate that the lid has been opened. This alarm would sound in the operation control room where a manager supervises production operations. • Assign another member of staff the responsibility of preparing and securely staging ingredients for later production batches. This would alleviate the need for the mixer operator to leave the area, leaving the mixer unattended. With the introduction of these two focused mitigation strategies, the facility would have taken steps to enclose the mixer, making it more difficult for an attacker to introduce a contaminant without alerting management (by the sounding of the alarm), and increased the dedicated observation of this otherwise vulnerable process step by ensuring that the mixer operator is not required to leave the area unattended. Mixing at Facility F’s rotating air dryer is another example of an actionable process step for the key activity type ‘‘Mixing and similar activities.’’ In Facility F, product, such as crackers or breakfast cereals, are fed through drum-like equipment, where warm air is blown across it while the drum rotates. Although the goal of this process is to dry the product, it also could distribute any contaminant introduced into the dryer evenly across the product. Facility F’s rotating air dryer is located alongside a commonly used walkway, but is behind a guard rail to prevent employees from coming in contact with the hot exterior of the dryer. Product is fed into the top of the dryer via a pneumatic conveyor. There is sufficient space between the dryer opening and the pneumatic conveyor discharge to enable an attacker to introduce a contaminant to the dryer at this point. That opening is about six feet above the ground, accessible from the floor of the facility. Product leaves the dryer through a gravity fed line. The PO 00000 Frm 00035 Fmt 4701 Sfmt 4702 78047 connection between the dryer and the discharge line is sealed. To goal of focused mitigation strategies at this actionable process step would be to reduce access to this equipment to significantly reduce the likelihood an attacker could introduce a contaminant into the rotating air dryer. One way Facility F could do this would be to install a clear plastic shield that would be affixed to and extend from the discharge of the pneumatic conveyor to the opening of the dryer where it would also be tightly affixed to the housing of the dryer. A clear plastic shield would enable workers to supervise the product flow into the dryer while posing as an effective barrier to an attacker wishing to introduce a contaminant into the product at the dryer. This engineering improvement would significantly minimize or eliminate access to the food in the dryer and thereby significantly reduce or eliminate the likelihood of a successful act of intentional adulteration at this process step. The installation of physical barriers to access of equipment at actionable process steps can be one of the most effective focused mitigation strategies because it does not require restricting personnel or maintaining active observation of an area. The implementation of this engineering improvement would be detailed in the facility’s food defense plan. c. Proposed § 121.135(a)— Requirement to identify and implement focused mitigation strategies for actionable process steps. Proposed § 121.135(a) would require that the owner, operator, or agent in charge of a facility identify and implement focused mitigation strategies at each actionable process step to provide assurances that the significant vulnerability at each step will be significantly minimized or prevented and the food manufactured, processed, packed or held by such facility will not be adulterated under section 402 of the FD&C Act. Under § 121.135, we are proposing that, for each of the identified actionable process steps, the owner, operator, or agent in charge of a facility covered by this rule identify and implement focused mitigation strategies. Focused mitigation strategies would be required only for actionable process steps. Because a focused mitigation strategy that would be necessary at an actionable process step must be tailored to address the significant vulnerability applicable to the specific actionable process step, we are not proposing to specify the particular focused mitigation strategies that would be appropriate. Rather, we expect the owner, operator, or agent in charge of the facility covered by this E:\FR\FM\24DEP2.SGM 24DEP2 sroberts on DSK5SPTVN1PROD with PROPOSALS 78048 Federal Register / Vol. 78, No. 247 / Tuesday, December 24, 2013 / Proposed Rules rule to identify the specific focused mitigation strategy(s) that would be appropriate, considering the facility and food it produces, and to ensure the proper implementation of those strategies to provide assurances that the significant vulnerability at each identified actionable process step is significantly minimized or prevented and the food is not adulterated. In section V.C.3.b of this document, we list examples of focused mitigation strategies and describe scenarios for determining appropriate focused mitigation strategies at actionable process steps for each of the FDAidentified key activity types. A facility would have the flexibility to identify and implement focused mitigation strategies from among all procedures, practices, and processes available to the facility that would provide the assurances that would be required by proposed § 121.135. The flexibility provided under this proposed provision acknowledges the existing expertise within the food industry in this regard, and recognizes the complex and varied nature of operations in food facilities. Additionally, to the extent facilities may already be engaging in practices that constitute focused mitigation strategies, facilities should consider whether those measures satisfy the requirements of proposed § 121.135, such that the implementation of additional focused mitigation strategies may not be necessary. (Note that associated requirements, such as monitoring and verification, would apply). FDA’s existing guidance documents and other resources (discussed in section II.D of this document) include guidance for industry on a range of focused mitigation strategies. In particular, the MSD includes a list of mitigation strategies that can be applied to different steps in a food operation to reduce the risk of intentional adulteration. The database is searchable by key words and processing steps common to food operations (e.g., packing, manufacturing, processing and holding). Proposed § 121.135(a) implements the provisions in sections 418(c)(2) and 420(b)(2) of the FD&C Act. FDA requests comments on our analysis and proposed provisions related to mitigation strategies necessary to protect against intentional adulteration of food caused by acts of terrorism. We also seek input on whether and, to what extent, facilities currently employ broad mitigation strategies and focused mitigation strategies. d. Proposed § 121.135(b)— Requirement for written focused VerDate Mar<15>2010 17:30 Dec 23, 2013 Jkt 232001 mitigation strategies. Proposed § 121.135(b) would require that focused mitigation strategies for actionable process steps be written. The focused mitigation strategy(ies) selected for each actionable process step identified in accordance with proposed § 121.130, and a justification for how the strategy significantly reduces or eliminates the risk of intentional adulteration at that actionable process step(s) must be documented. Similar to preventive controls in a food safety plan, written focused mitigation strategies in a food defense plan are essential for the facility to implement the focused mitigation strategies consistently, and essential for the facility and inspectors. Written focused mitigation strategies also would be essential for training purposes and during reanalysis and updates of the focused mitigation strategies. Proposed § 121.135(b) implements the provisions in sections 418(h) and 420(b)(2) of the FD&C Act. e. Proposed § 121.135(c)— Applicability of monitoring, corrective actions, and verification. Proposed § 121.135(c) would specify that the focused mitigation strategies required under this section would be subject to monitoring as would be required by proposed § 121.140; corrective actions as would be required by proposed § 121.145; and verification as would be required by proposed § 121.150. Proposed § 121.135(c)(1) through (c)(3) would restate the requirements of proposed §§ 121.140, 121.145, and 121.150 to clearly communicate the applicability of proposed §§ 121.140, 121.145, and 121.150 to the focused mitigation strategies that would be required under proposed § 121.135 and would establish no new requirements. 4. Monitoring a. General description of monitoring. Proposed § 121.3 would define ‘‘monitor’’ to mean ‘‘to conduct a planned sequence of observations or measurements to assess whether focused mitigation strategies are consistently applied and to produce an accurate record for use in verification.’’ In developing the proposed monitoring requirements related to food defense, we considered our proposed monitoring requirements related to food safety, which are described in section XII.E of the PC proposed rule. For the same reasons outlined in the PC proposed rule, we have tentatively concluded that monitoring is necessary to establish the performance of the implementation of the focused mitigation strategies. The proposed provisions in § 121.140 implement section 418(h) of the FD&C Act. PO 00000 Frm 00036 Fmt 4701 Sfmt 4702 b. Proposed § 121.140(a)— Requirement for written procedures for monitoring. Proposed § 121.140(a) would require that the owner, operator, or agent in charge of a facility establish and implement written procedures, including the frequency with which they are to be performed, for monitoring the focused mitigation strategies. Monitoring the performance of focused mitigation strategies at specified frequencies would facilitate tracking the implementation of the focused mitigation strategies to provide assurance that they are consistently applied in a facility covered by this rule. If monitoring shows that a focused mitigation strategy is frequently not implemented, a facility can consider whether another focused mitigation strategy would be more appropriate. For example, if an ingredient storeroom door is to be kept locked when not in use, but the door is frequently left unlocked because access to the room is needed for other purposes, the facility may replace the previous focused mitigation strategy with video monitoring. Further, if monitoring is conducted with sufficient frequency, it will detect if a focused mitigation strategy is not properly implemented (e.g., if access to a particular area of a facility is not being appropriately restricted or a bulk liquid tank is not being visually inspected prior to filling), indicating a problem and signaling the need for an appropriate corrective action. In addition, the proposed monitoring requirement would result in written documentation for use in verification. c. Proposed § 121.140(b)—Frequency of monitoring. Proposed § 121.140(b) would require that the owner, operator, or agent in charge of a facility monitor the focused mitigation strategies with sufficient frequency to provide assurances that they are consistently applied. Proposed § 121.140(b) does not specify a single monitoring frequency applicable to all facilities and processes. Rather, it requires monitoring with ‘‘sufficient frequency’’ to ensure that the focused mitigation strategies are consistently applied in a facility covered by this rule. We note that for food defense that many focused mitigation strategies may be monitored over longer timeframes (non-continuous monitoring) than preventive controls for food safety, which are often monitored continuously. In large part preventive controls for food safety are monitored continuously because they relate to physical or chemical parameters of the process, such as the temperature of a pasteurizer, which both lend themselves E:\FR\FM\24DEP2.SGM 24DEP2 sroberts on DSK5SPTVN1PROD with PROPOSALS Federal Register / Vol. 78, No. 247 / Tuesday, December 24, 2013 / Proposed Rules to continuous monitoring and necessitate that level of monitoring to ensure that the process is under control. As discussed in greater detail in section V.C.3 of this document, most focused mitigation strategies for food defense are not related to physical or chemical parameters of the process. They tend to have more in common with sanitation preventive controls for food safety in that they relate to conditions around the food process, such as access to the equipment. A focused mitigation strategy such as ‘‘adequate lighting at an actionable process step’’ or ‘‘secure air vents on a cooling tank with one-way valves’’ would not require continuous monitoring. Management may choose to monitor lighting on a weekly basis to ensure that everything is working properly and monitoring of the security of air vents with one-way valves on a cooling tank might be done monthly. Frequency is not prescribed in this proposed rule. More frequent (e.g., daily) monitoring would be appropriate for mitigation strategies that relate to conditions or practices that are more likely to change more rapidly, such as keeping the access door to an actionable process step closed when not in use or ensuring that employees with color coded uniforms are staying in the areas designated by the color code. d. Proposed § 121.140(c)— Requirement for records. To implement section 418(g) of the FD&C Act, proposed § 121.140(c) would require that all monitoring of focused mitigation strategies in accordance with this section must be documented in records that are subject to verification in accordance with § 121.150(a) and records review in accordance with proposed § 121.150(c). The monitoring records would be used to verify that the focused mitigation strategies are being monitored, as would be required by proposed § 121.150(a), and to verify that the focused mitigations strategies are consistently implemented and are effective at significantly minimizing or preventing the significant vulnerabilities, as would be required by proposed § 121.150(c). Further, they are necessary to facilitate regulatory review of the system of controls. Together, proposed §§ 121.140(a), (b), and (c) and 121.150(a), (c), and (e) would establish a system that would provide assurances that the significant vulnerabilities identified for a food operation are being significantly minimized or prevented. 5. Corrective Actions a. General description of corrective actions. When a HACCP-type system is applied to ensure food safety, the term VerDate Mar<15>2010 17:30 Dec 23, 2013 Jkt 232001 ‘‘corrective actions’’ is used to describe procedures that are in place to correct the cause of a deviation to ensure that a critical control point is under control and to ensure that the product produced under that deviation is safe, since total adherence to a planned process may not always occur. This concept is discussed in detail in section XII.F of the PC proposed rule. This same concept can be applied to the control of intentional adulteration related to acts of terrorism. Monitoring may detect a deviation from implementation of a focused mitigation strategy; corrective actions are implemented to re-establish control. In developing the proposed corrective actions requirements related to food defense, we considered our proposed relevant requirements related to food safety. The proposed provisions in § 121.145 implement sections 418(e), 418(h), and 420(b)(2) of the FD&C Act. b. Proposed § 127.145(a)—Corrective action procedures. Proposed § 121.145(a)(1) would require that the owner, operator, or agent in charge of a facility establish and implement written corrective action procedures that must be taken if focused mitigation strategies are not properly implemented. Having written procedures in place would enable facilities covered by this rule to act quickly and appropriately when focused mitigation strategies are not properly implemented—e.g., a situation where a work station at an actionable process step requires two staff at all times in a ‘‘buddy system’’ but is only staffed by one person for a period of time. The benefits of identifying corrective action procedures before corrective action is needed largely derive from having written procedures. Written corrective action procedures would be essential to the facility’s management, to auditors, and to inspectors. The facility’s management will be responsible for ensuring that appropriate corrective actions are taken if focused mitigation strategies are not properly implemented. Having access to appropriate, written corrective action procedures determined in advance of the need for such action can ensure that correct and complete actions are taken in a timely fashion. Having written corrective action procedures available for auditors and for inspectors is essential for them to assess the adequacy of the food defense plan; the procedures a facility will use to address implementation failures are essential to proper, consistent implementation, and without them a complete assessment cannot be made. Written corrective action procedures also will be useful for PO 00000 Frm 00037 Fmt 4701 Sfmt 4702 78049 training purposes, so that employees who would need to implement the corrective action procedures will be prepared for what they would need to do. Proposed § 121.145(a)(2) would require that corrective action procedures describe the steps to be taken to ensure that appropriate action is taken to identify and correct a problem with implementation of a focused mitigation strategy to reduce the likelihood that the problem will recur. In the previous example in which two staff are required to be at a work station at all times, the corrective action could be speaking with the employees to ensure they understand the importance of remaining at the work station together, sending staff to a refresher course on food defense awareness, and ensuring that the supervisor knows that there must be adequate staff present on a shift so two people can be at the work station at all times. If the problem recurs, management may need to consider other measures for preventing access at that process step. c. Proposed § 121.145(b)— Documentation. Proposed § 121.145(b) would require that all corrective actions taken in accordance with this section be documented in records that are subject to verification in accordance with proposed § 121.150(b) and records review in accordance with proposed § 121.150(c). The records that document corrective actions would be used to verify that appropriate decisions about corrective actions are being made and appropriate corrective actions are being taken in facilities covered by this rule. d. Corrective actions proposed to be required by part 117 but not part 121. Unlike in proposed part 117, in proposed part 121, we have not proposed a requirement to ensure that all affected food is evaluated for food safety if focused mitigation strategies are not properly implemented or are found to be ineffective. An act of intentional adulteration or attempted intentional adulteration has historically been a rare event and, as a result, in the vast majority of cases, the failure to properly implement a focused mitigation strategy would not be expected to result in contaminated food. This is because intentional adulteration requires not just the opportunity for contamination (i.e., failure of a mitigation strategy to limit access to an actionable process step), but also someone with intent to cause harm at that same moment. In contrast, the failure to properly implement a preventive control for a food safety hazard, such as proper cook temperatures, is more likely to result in adulterated food (e.g., because the E:\FR\FM\24DEP2.SGM 24DEP2 78050 Federal Register / Vol. 78, No. 247 / Tuesday, December 24, 2013 / Proposed Rules pathogen reasonably likely to be present in the raw food would not be eliminated from the food by the inadequate cooking process). However, our decision not to propose these requirements does not absolve an owner, operator, or agent in charge of a facility from their responsibility to ensure that food is not adulterated. In addition, food firms would continue to be subject to the reporting requirements under section 417 of the FD&C Act. Moreover, the introduction or delivery for introduction into interstate commerce of any food that is adulterated is a prohibited act under section 301(a) of the FD&C Act. The PC proposed rule also contains requirements for corrective actions that must be taken in the event of an unanticipated problem. Unlike in proposed part 117, in proposed part 121, we are not proposing a requirement related to unanticipated problems because we are not aware of circumstances where this would be relevant. Because of the nature of the focused mitigation strategies, we expect that the outcomes of monitoring will be binary, either the focused mitigation strategy will be in place or it will not be in place. For this reason, we expect that corrective action plans will be straightforward, with no provision needed for unanticipated corrective actions. This contrasts with the circumstances of food safety preventive measures, where controls are often more complex, presenting opportunities for a more nuanced corrective action, which may not be possible to fully anticipate in advance. We ask for comment on our rationale and tentative conclusion not to propose these requirements. sroberts on DSK5SPTVN1PROD with PROPOSALS 6. Verification a. General description of verification. In the preventive controls framework, ‘‘verification’’ involves activities that help determine whether the focused mitigation strategies are valid and are implemented according to the food defense plan. Verification includes confirming that monitoring and corrective actions are being implemented as planned, through review of records and periodic reanalysis of the food defense plan. This concept as applied to food safety is discussed in detail in section XII.G of the PC proposed rule. We have tentatively concluded that this same concept applies to the control of intentional adulteration related to acts of terrorism. Efforts must be made to ensure that the system of mitigation strategies is in place and functioning as designed. The proposed provisions in VerDate Mar<15>2010 17:30 Dec 23, 2013 Jkt 232001 § 121.150 implement sections 418(f) and 420(b)(2) of the FD&C Act. b. Proposed § 121.150(a)—Verification of monitoring. Proposed § 121.150(a) would require that the owner, operator, or agent in charge of a facility verify that monitoring is being conducted. Verification of monitoring can be conducted in a number of ways. One example of verification of monitoring is a periodic observation of the monitoring activity, e.g., by a supervisor. Another example is an independent test made by a person other than the person doing the monitoring. For example, if a shift supervisor is assigned to check at the end of each shift that chemicals are properly stored and secured, another supervisor may be responsible for checking periodically (e.g., once a week) that this is occurring. In another example, if an alarm is supposed to sound if a mixing tank is accessed without authorization and the monitoring procedures provide for weekly testing of the alarm, a supervisor may be responsible for performing the same test monthly to ensure that the alarm and the monitoring procedure are both working properly. Proposed § 121.150(a) would not specify the verification activities that must be conducted for monitoring. We request comment on whether proposed § 121.150(a) should do so, and if so, what verification activities should be required. c. Proposed § 121.150(b)—Verification of corrective actions. Proposed § 121.150(b) would require that the owner, operator, or agent in charge of a facility verify that appropriate decisions about corrective actions are being made. An example of verification that appropriate decisions about corrective actions are being made is observation of the corrective actions being taken, e.g., by a supervisor. Proposed § 121.150(b) would not specify the verification activities that must be conducted for corrective actions. We request comment on whether proposed § 121.150(b) should do so, and if so, what verification activities should be required. d. Proposed § 121.150(c)— Implementation and effectiveness. Proposed § 121.150(c) would require that the owner, operator, or agent in charge of a facility verify that the focused mitigation strategies are consistently implemented and are effectively and significantly minimizing or preventing the significant vulnerabilities. As appropriate to the facility and the food, this must include review of the monitoring and corrective action records within appropriate timeframes to ensure that the records PO 00000 Frm 00038 Fmt 4701 Sfmt 4702 are complete, the activities reflected in the records occurred in accordance with the food defense plan, the focused mitigation strategies are effective, and appropriate decisions were made about corrective actions. Proposed § 121.150(c) would establish that the purpose of the review of records is to ensure that the records are complete, the activities reflected in the records occurred in accordance with the food defense plan, the focused mitigation strategies are effective, and appropriate decisions are made about corrective actions. We tentatively conclude that review of the records required by proposed § 121.150(c) would accomplish these purposes. Reviewing monitoring records can reveal whether they contain information on all of the activities or measures that were to be monitored to determine whether a focused mitigation strategy is being consistently implemented in accordance with the food defense plan. For example, a review of monitoring records can show if the shift supervisor is consistently storing and securing chemicals at the end of each shift as may be required by a food defense plan. Review of monitoring records also can reveal whether any information is missing—e.g., a date or time—so that the missing information can be quickly identified and added to the record if necessary. Review of records also can reveal whether appropriate decisions were made about corrective actions. The review would determine whether all the corrective action procedures required by proposed § 121.145 have been followed to prevent recurrence of the problem. For example, in the previous example on corrective actions, a review of records could reveal that the supervisor spoke to the staff about always having two staff present at the work station as required in the food defense plan and, as appropriate, enrolled the staff in a refresher course on food defense awareness. Proposed § 121.150(c) would require review of the monitoring and corrective action records within an appropriate time after the records are made. We are not proposing to require review of records within a specified timeframe. While the PC proposed rule contains a requirement that monitoring and corrective action records be reviewed within a week after the records are made, in the case of food defense, we do not believe specifying a timeframe for records review is necessary. As discussed previously, some focused mitigation strategies may be monitored less frequently than are preventive controls for food safety. In a HACCP- E:\FR\FM\24DEP2.SGM 24DEP2 sroberts on DSK5SPTVN1PROD with PROPOSALS Federal Register / Vol. 78, No. 247 / Tuesday, December 24, 2013 / Proposed Rules type system for food safety, monitoring and corrective action records are often reviewed a short time after their creation to enable action to be taken relative to food that may be adulterated (e.g., recall). It is unlikely that an improperly implemented focused mitigation strategy would result in adulterated food (i.e., because adulteration of food would require not only opportunity but also a simultaneous intent to cause adulteration). A focused mitigation strategy such as ‘‘adequate lighting at the bulk truck unloading bay’’ or ‘‘secure air vents on a cooling tank with one-way valves’’ may be monitored on a weekly or monthly basis. Because the focused mitigation strategies may be monitored less frequently and because these frequencies may vary significantly from one focused mitigation strategy to another, we believe it is appropriate for owners, operators, or agents in charge of a facility to determine when review of the monitoring and corrective action records is best performed. e. Proposed § 121.150(d)—Reanalysis. To implement section 418(i) of the FD&C Act, proposed § 121.150(d)(1) would require that the owner, operator, or agent in charge of a facility conduct a reanalysis of the food defense plan as follows: 1. At least once every 3 years (proposed § 121.150(d)(1)(i)). 2. Whenever a significant change is made in the activities conducted at a facility operated by such owner, operator, or agent in charge if the change creates a reasonable potential for a new vulnerability or a significant increase in a previously identified vulnerability (proposed § 121.150(d)(1)(ii)). For example, if a facility adds a new product line, then the food defense plan must be reanalyzed to consider whether it includes one of the key activity types, and, if so to implement appropriate focused mitigation strategies. 3. Whenever such owner, operator or agent in charge becomes aware of new information about potential vulnerabilities associated with the food operation or facility (proposed § 121.150(d)(1)(iii)). For example, an owner, operator, or agent in charge of a facility may become aware that access to a particular piece of equipment is greater than was thought to be the case when they initially considered whether a key activity type is applicable to their food process. 4. Whenever a focused mitigation strategy is found to be ineffective (proposed § 121.150(d)(1)(iv)). Proposed § 121.150(d)(1)(iv) would require that the owner, operator, or agent in charge VerDate Mar<15>2010 17:30 Dec 23, 2013 Jkt 232001 of a facility reanalyze the food defense plan to determine whether modification of the plan is required if a focused mitigation strategy is found to be ineffective. For example, if the owner, operator, or agent in charge of a facility finds that color coding of employee hard hats according to their assigned work stations or areas is not effective in preventing employees from crossing into areas where they are not assigned because employees have found that adhering to the system adversely affects product, the owner, operator, or agent in charge may need to consider other focused mitigation strategies to ensure that staff access at actionable process steps is controlled. 5. Whenever FDA requires reanalysis to respond to new vulnerabilities and developments in scientific understanding including, as appropriate, results from a DHS biological, chemical, radiological, or other terrorism risk assessment (proposed § 121.150(d)(1)(v)). Risk assessments or vulnerability assessments conducted by DHS or others may reveal a significant vulnerability in process steps in addition to the significant vulnerabilities associated with the key activity types that FDA has identified. FDA would require reanalysis of food defense plans, as necessary, to respond to any new knowledge about threats or vulnerabilities to food operations based on information available to the agency. This requirement for reanalysis could involve a requirement to consider whether a new key activity type is relevant to a facility’s food processes. It could also involve a requirement to reconsider existing key activity types in light of a credible threat of terrorist attack on a specific food type, product, brand, or company. Proposed § 121.150(d)(2) would require that the owner, operator, or agent in charge of a facility complete the required reanalysis and implement any additional focused mitigation strategies needed to address the significant vulnerabilities identified, if any, before the change in activities at the facility is operative or, when necessary, during the first six weeks of production. The purpose of the reanalysis is to identify the need for, and implement, focused mitigation strategies in light of a reasonable potential for a new significant vulnerability, or a significant increase in a previously identified significant vulnerability. Proposed § 121.150(d)(3) would require that the owner, operator, or agent in charge of a facility revise the written plan if a significant change is made or document the basis for the PO 00000 Frm 00039 Fmt 4701 Sfmt 4702 78051 conclusion that no additional or revised focused mitigation strategies are needed. It is important to document that a reanalysis has been conducted and the plan has been revised accordingly or that no change has been made. Such documentation demonstrates that a facility has considered all relevant information on the defense of the operation, including new information that has become available since the last analysis. The documentation further demonstrates that appropriate changes have been made or that current procedures for implementing focused mitigation strategies are adequate to significantly minimize or prevent significant vulnerabilities. f. Proposed § 121.150(e)— Requirement for records for verification. To implement sections 418(g) and 420(b)(2) of the FD&C Act, proposed § 121.150(e) would require that all verification activities taken in accordance with this section be documented in records. g. Verification proposed to be required by part 117 but not part 121. In the PC proposed rule, we proposed to require, as part of verification, the validation of the adequacy of the preventive controls implemented to control the hazards identified in the hazard analysis as reasonably likely to occur. In this proposed rule, we are not including a similar proposed requirement. Unlike preventive controls, which often involve processing parameters that can be scientifically validated, focused mitigations strategies for food defense (which correspond to preventive controls for food safety) often are not of a nature that they can be scientifically validated. For example, it would not be practical for a facility to attempt to validate the effectiveness of a lock on a tank or the use of a ‘buddy system’ at a particular process step to prevent or significantly minimize intentional adulteration of food caused by a terrorist attack. Most of the recommended mitigation strategies in the MSD (Ref. 30) are similar in nature to the two mentioned in the example above in that validation would be impractical. Therefore, we have tentatively concluded not to propose a requirement for validation of focused mitigation strategies. However, if a facility chooses to use a processing parameter (e.g., thermal kill step) as a focused mitigation strategy, the facility should employ such a processing parameter if it has been demonstrated to be effective in significantly minimizing or preventing the associated significant vulnerability. In many circumstances it is not appropriate to use such strategies E:\FR\FM\24DEP2.SGM 24DEP2 78052 Federal Register / Vol. 78, No. 247 / Tuesday, December 24, 2013 / Proposed Rules sroberts on DSK5SPTVN1PROD with PROPOSALS because they are usually effective against one or several, but not all, potential contaminants. See section XII.G of the PC proposed rule for additional discussion of validation. The PC proposed rule also includes proposed requirements for calibration of process monitoring instruments and verification instruments and also records associated with these activities. As discussed previously, it is our expectation that most of the focused mitigation strategies will not be continuously monitored and will not require process monitoring instruments or instruments to verification purposes. Therefore, we do not believe it would be necessary to include those requirements in this part. We ask for comment on our tentative decision not to include validation of the focused mitigation strategies and calibration of monitoring and verification instruments in codified requirements in proposed § 121.150. 7. Training of Personnel Proposed § 121.160 would establish requirements related to training of certain personnel working in a food operation. Proposed § 121.160(a) would require that personnel and supervisors assigned to actionable process steps receive appropriate training in food defense awareness and their respective responsibilities in implementing focused mitigation strategies. Because the effectiveness of a mitigation strategy, which is applied at an actionable process step, is dependent on the proper implementation by personnel and supervisors of the strategy, we are proposing to require that personnel and supervisors assigned to actionable process steps be appropriately trained in food defense. The purpose of training a supervisor, in addition to personnel at actionable process steps, is so that the supervisor can help train employees, recognize conditions that could lead to intentional contamination, and take necessary actions to correct those conditions. We are proposing that training required under this provision must cover food defense awareness and the respective responsibilities of personnel and supervisors assigned to actionable steps in implementing focused mitigation strategies. At a minimum, such training must include the general principles of food defense, including simple procedures for employees to follow to adhere to those principles in their jobs. We have tentatively concluded that completion of FDA’s training course on Food Defense Awareness for the Front-line Employee (described in this section of the VerDate Mar<15>2010 17:30 Dec 23, 2013 Jkt 232001 document), which takes about 20 minutes to complete, would be sufficient to satisfy this element of the proposed training requirement. Additionally, training must contain specifics about the actionable process steps where employees are working and their roles in the proper implementation of the focused mitigation strategy(ies) applied at those actionable process steps. Training on the application of focused mitigation strategies, which is likely to be specific to each facility or actionable process step, may be added to existing on-the-job training programs or provided separately. FDA has developed training tools that are available for use by the industry. FDA revamped its online food defense courses in 2013, and the revamped courses, entitled ‘‘Food Defense 101’’ (Ref. 27), address the types of intentional contamination that have occurred in the United States in recent years and reflect FDA’s current thinking on how to minimize the likelihood and impact of such incidents. The courses included in Food Defense 101 are: (1) Food Defense Awareness for the Food Professional; (2) Food Defense Awareness for the Front-line Employee; (3) Food Defense Regulations; and (4) ALERT, for owners and operators of food facilities. The course on Food Defense Awareness for the Food Professional provides an understanding of food defense and information for professionals in the food industry. The course modules progress through food defense planning including broad mitigation strategies, vulnerability assessments, focused mitigation strategies, and food defense plans. The course on Food Defense Awareness for Front-line Employees provides information specific to front-line workers and simple procedures for these employees to follow in food defense. The course on Food Defense Regulations presents an overview of the Public Health Security and Bioterrorism Preparedness and Response Act of 2002 (the Bioterrorism Act), FSMA, and FDA’s Reportable Food Registry. Finally, the course on ALERT, which was developed by FDA to help stakeholders better understand food defense and how food defense applies to the food industry, provides specific examples of ways to protect a firm from the threat of intentional contamination. FDA’s Food Defense 101 online courses are available free-of-charge on our Web site at http://www.fda.gov/Food/ FoodDefense/default.htm. We expect these existing courses will assist industry to comply with this training requirement, if finalized as proposed. We are also aware of training PO 00000 Frm 00040 Fmt 4701 Sfmt 4702 seminars and programs offered by private sector entities (Ref. 59, Ref. 60, Ref. 61, Ref. 62) that may also assist industry to comply with this training requirement. We seek comment on the adequacy of FDA’s Food Defense 101 training materials, and whether there is a need for revisions to these existing FDA courses or the development of additional FDA training materials. FDA also previously issued guidance documents for industry on food defense (Ref. 22, Ref. 23, Ref. 24, Ref. 25, Ref. 26), which include recommendations related to personnel training. In these guidance documents, we recommended that all employees have training in food defense awareness, including information on how to prevent, detect, and respond to an intentional contamination incident at their facility. As noted in these guidance documents, we recommended incorporating periodic reminders of the importance of food defense procedures into routine facility communications, such as brochures, staff meetings or payroll stuffers. We further recommended that facilities encourage all employees to report unusual or suspicious individuals or activities to management. We reiterate these recommendations described in our guidance documents. However, in this proposed rule, we are not proposing to include additional specific training requirements to reflect all of those recommendations. For example, although we are not requiring that all employees at a facility receive training in food defense, we recognize the importance of training as a measure to protect against intentional adulteration of food and, therefore, reiterate our recommendation that all personnel working in a food operation receive training in food defense awareness. We request comment on this issue, including on whether we should require, in a final rule, that basic food defense awareness training be completed by all employees at a facility. We also request comment on whether we should require training to be repeated periodically, including when significant changes are made to food defense plans. Proposed § 121.160(b) would require that all training received in accordance with section § 121.160 be documented in records. Under proposed § 121.305, records would include such information as the date of the training, the topics covered, and the person(s) trained. An example of records that would comply with proposed § 121.160(b) is an attendance sheet with the date, list of those in attendance, and the particular topics covered (such as an overview of food defense principles or food defense E:\FR\FM\24DEP2.SGM 24DEP2 Federal Register / Vol. 78, No. 247 / Tuesday, December 24, 2013 / Proposed Rules planning). The records required by proposed § 121.160(b) would enable a facility to track the training that personnel received, thereby enabling identification of personnel that have the prerequisite awareness training for an assignment at an actionable process step. Such records could be used to document that a person has, as would be required under proposed § 121.160(a), successfully completed training appropriate to the person’s duties at an actionable process step. We recognize that industry has already begun to implement food defense measures to meet certain industry standards, which include guidelines for food defense training (Ref. 63, Ref. 33, Ref. 35). Our proposed minimum requirements for training are consistent with these standards, as well as with WHO recommendations for personnel training in its guidance on food defense (Ref. 6). We seek comment on the feasibility of our proposed training requirements, in light of the current state of food defense awareness in the industry and available training resources. sroberts on DSK5SPTVN1PROD with PROPOSALS D. Requirements Applying to Records That Must Be Established and Maintained When a HACCP-type system is implemented for food safety, records are a critical part of the system because they aid facilities in compliance with the requirements, including all the elements of a food safety plan as proposed in Part 117, and allow facilities to show, and FDA to determine, compliance with the requirements. This concept is discussed in detail in section XV of the PC proposed rule. We have tentatively concluded that records are critical to protect food from intentional adulteration caused by acts of terrorism. In subpart D of proposed part 121, FDA is proposing to establish requirements applying to records that must be established and maintained according to the requirements of this proposed rule. This subpart implements numerous provisions in section 418 of the FD&C Act, including sections 418(a), (b)(3), (g), (h), and (n)(1)(A), as well as section 420(b) of the FD&C Act. 1. Proposed § 121.301—Records Subject to the Requirements of this Subpart D Proposed § 121.301(a) would establish that, except as provided by proposed § 121.301(b), all records required by proposed subpart C of part 121 would be subject to all requirements of proposed subpart D. We have tentatively concluded that the requirements in subpart D describing how records must be established and maintained, VerDate Mar<15>2010 17:30 Dec 23, 2013 Jkt 232001 including the general requirements, record retention requirements, and requirements for official review and public disclosure, are applicable to all records that would be required under subpart C. Such records would aid facilities in compliance with the requirements of proposed part 121, and allow facilities to show, and FDA to determine, compliance with the requirements of part 121. The proposed requirements of subpart D are discussed in this document. Proposed § 121.301(b) would establish that the requirements of proposed § 121.310 apply only to the written food defense plan and is discussed in more detail in section V.D.3 of this document. 2. Proposed § 121.305—General Requirements Applying to Records Proposed § 121.305 contains general requirements that would apply to records that would be required under proposed part 121, including the format for required records, the recording of actual values and observations obtained during monitoring, when records must be created, and information that must be included in each record. a. Proposed § 121.305(a). Proposed § 121.305(a) would require that the records be kept as original records, true copies (such as photocopies, pictures, scanned copies, microfilm, microfiche, or other accurate reproductions of the original records), or electronic records. True copies of records should be of sufficient quality to detect whether the original record was changed or corrected in a manner that obscured the original entry (e.g., through the use of white-out). Proposed § 121.305(a) would provide flexibility for mechanisms for keeping records while maintaining the integrity of the recordkeeping system. The proposed requirement allowing true copies provides options that may be compatible with the way records are currently being kept in facilities. Proposed § 121.305(a) also would require that electronic records be kept in accordance with part 11 (21 CFR part 11). Part 11 provides criteria for acceptance by FDA, under certain circumstances, of electronic records, electronic signatures, and handwritten signatures executed to electronic records as equivalent to paper records and handwritten signatures executed on paper. The proposed requirement clarifies and acknowledges that records required by proposed part 121 may be retained electronically, provided that they comply with part 11. In the PC proposed rule, FDA tentatively concluded that it would be appropriate to apply the requirements of part 11 to the records that would be PO 00000 Frm 00041 Fmt 4701 Sfmt 4702 78053 required to be kept under proposed part 117. However, we requested comment on whether there are any circumstances that would warrant not applying part 11 to records that would be kept under proposed part 117. In section XV.C of that document, we provided examples of circumstances in which we exempted records from the requirements of part 11 (21 CFR 1.329(b)) to avoid the necessity of establishing new recordkeeping systems as long as current practices would satisfy the requirements of the Act. In the PC proposed rule, we also asked for comment on whether we should allow additional time for electronic records to be kept in accordance with part 11. We seek similar comment with regard to circumstances that would warrant not applying part 11 to records that would be kept under proposed part 121 and whether we should allow additional time for electronic records to be kept in accordance with part 11. Comments should provide the basis for any view that the requirements of part 11 are not warranted. b. Proposed § 121.305(b). Proposed § 121.305(b) would require that records contain the actual values and observations obtained during monitoring. For example, monitoring of the locking of an access door to an actionable process step could be recorded as ‘‘locked’’ or ‘‘unlocked’’ (or ‘‘yes’’ or ‘‘no’’) and the monitoring of the presence of staff with only appropriate color uniforms in a designated area could be recorded as ‘‘100% staff (or 10 of 10 staff) with blue uniforms’’ or conversely ‘‘80% staff (or 8 of 10 staff) with blue uniforms’’ in the case of an improperly implemented focused mitigation strategy. In the case of an improperly implemented focused mitigation strategy, it is important to document the extent to which the strategy was incorrectly applied, as monitoring data can show a trend toward loss of control at an actionable process step. So, in the example in which 8 of 10 staff have blue uniforms, a facility may also consider documenting what color the remaining two staff were wearing if such information would be valuable in establishing a trend. If the recording of numerical values is possible in the monitoring of a focused mitigation strategy (e.g., if a facility is using a processing parameter such as heat treatment), then the actual times and temperatures or other appropriate processing data should be recorded. c. Proposed § 121.305(c), (d) and (e). Proposed § 121.305(c), (d) and (e) would require that records be accurate, indelible, and legible (proposed E:\FR\FM\24DEP2.SGM 24DEP2 sroberts on DSK5SPTVN1PROD with PROPOSALS 78054 Federal Register / Vol. 78, No. 247 / Tuesday, December 24, 2013 / Proposed Rules § 121.305(c)); be created concurrently with performance of the activity documented (proposed § 121.305(d)); and be as detailed as necessary to provide a history of work performed (proposed § 121.305(e)). Proposed § 121.305(c) and (d) would ensure that the records are useful to the owner, operator, or agent in charge of a facility in complying with the requirements of proposed part 121, for example, in documenting compliance with monitoring requirements and verifying compliance with the food defense plan. These proposed requirements would also ensure that the records would be useful to FDA in determining compliance with the requirements of proposed part 121. Proposed § 121.305(e) would provide flexibility to facilities to tailor the amount of detail to the nature of the record. d. Proposed § 121.305(f). Proposed § 121.305(f) would require that the records include the following: (1) The name and location of the facility; (2) the date and time of the activity documented; (3) the signature or initials of the person performing the activity; and (4) where appropriate, the identity of the product and the production code, if any. The name and location of the facility and the date and time would allow the owner, operator, or agent in charge of a facility (and, during inspection, an FDA investigator) to assess whether the record is current, to identify when and where any deviation occurred, and to track corrective actions. The signature of the individual who made the observation would ensure responsibility and accountability. In addition, if there is a question about the record, a signature would ensure that the source of the record will be known. Linking a record to a specific product (and, when applicable, the production code) would enable the owner, operator, or agent in charge of a facility covered by this rule to isolate product if there is a question that food has been adulterated. We seek comment on the scope and potential burden associated with these proposed requirements. The proposed requirement (proposed § 121.305(f)(4)) for the identity of the product and production code, if any, is important in the context of food safety, where the production of potentially adulterated product may result from loss of control during processing, such as an improper cook temperature, and a recall may be necessary. It is also especially applicable for food safety in cases of continuous monitoring, when the loss of control can be associated with a particular product or production code. Consistent with the PC proposed rule, we have qualified the proposed VerDate Mar<15>2010 17:30 Dec 23, 2013 Jkt 232001 requirement to indicate that the identity of the product and the production code should be included as part of the record ‘‘where appropriate.’’ We note that, in many cases, it will likely be more difficult to include this information for a focused mitigation strategy. As noted in the discussion on monitoring in section V.C.5 of this proposed rule, some focused mitigation strategies may be monitored weekly or monthly. In that case, it may not be appropriate to include all of the products and production codes that may have been affected by an improperly implemented focused mitigation strategy. Further, in many cases the identity of the product and the production code will not be relevant because the monitoring will be performed in the area surrounding one or more production lines, used for one or more products, rather than of processing parameters on a production line for a specific lot of product. On the other hand, if control of processing parameters, such as pasteurization time and temperature, are used as a focused mitigation strategy, it would be appropriate to document the product and production code, if any, that was being processed at the time of monitoring. The nature of the focused mitigation strategy should drive the decision by an owner, operator, or agent in charge of a facility regarding whether or not to include the identity of the product and the production code, if any, in records. 3. Proposed § 121.310—Additional Requirements Applying to the Food Defense Plan Proposed § 121.310 would require that the owner, operator, or agent in charge of a facility sign and date the food defense plan upon initial completion (proposed § 121.310(a)) and upon any modification (proposed § 121.310(b)). Such a signature would provide direct evidence of the owner, operator, or agent’s acceptance of the plan and commitment to implementation of the plan. Additionally, the signature, along with the date of signing, would serve to minimize potential confusion over the authenticity of any differing versions or editions of the document that might exist. 4. Proposed § 121.315—Requirements for Record Retention Proposed § 121.315 contains requirements on the length of time records that would be required under proposed part 121 must be retained and allowances for offsite storage of records under certain circumstances. PO 00000 Frm 00042 Fmt 4701 Sfmt 4702 a. Proposed § 121.315(a) and (b). Proposed § 121.315(a) would require that all records that would be required by proposed part 121 be retained at the facility for at least 2 years after the date they were prepared. Proposed § 121.315(b) would require that the food defense plan be retained at the facility for at least 2 years after its use is discontinued (e.g., because the facility has updated the written food defense plan. The 2-year timeframe for all records required by proposed part 121 is consistent with the length of time that nonperishable food products, on average, can be expected to be in commercial distribution plus a reasonable time thereafter to ensure that the records are available for verification activities. This proposed requirement is similar to the proposed records retention requirement in the PC proposed rule, which contains a discussion of similar requirements found in other FDA regulations and in particular the proposed and final rules implementing the recordkeeping requirements of the Bioterrorism Act. This 2-year retention period would run from either the date the record is prepared, for day-to-day operational records, or the date at which use of the record is discontinued, for the food defense plan. We seek comment on this proposal. b. Proposed § 121.315(c). Proposed § 121.315(c) would provide that, except for the food defense plan, use of offsite storage for records is permitted after 6 months following the date that the record was made if such records can be retrieved and provided onsite within 24 hours of request for official review. The food defense plan would be required to remain onsite. FDA realizes that the proposed requirements for recordkeeping could require some facilities to store a significant quantity of records, and that there may not be adequate storage space in the facility for all of these records. Providing for offsite storage of most records after 6 months would enable a facility to comply with the proposed requirements for record retention while reducing the amount of space needed for onsite storage of the records without interfering with the purpose of record retention, because the records will be readily available. Proposed § 121.315(c) also would provide that electronic records are considered to be onsite if they are accessible from an onsite location. Computerized systems within corporations can be networked, allowing for the sending and receiving of information in a secure fashion to all of the different food processing facilities of that corporation worldwide. This E:\FR\FM\24DEP2.SGM 24DEP2 Federal Register / Vol. 78, No. 247 / Tuesday, December 24, 2013 / Proposed Rules type of system can be used to provide access at multiple locations to records from multiple facilities. c. Proposed § 121.315(d). Proposed § 121.315(d) would provide that if the facility is closed for a prolonged period, the records may be transferred to some other reasonably accessible location but must be returned to the facility within 24 hours for official review upon request. Allowing for transfer of records will give practical storage relief to seasonal operations or those closed for other reasons for prolonged periods. prohibited. Under section 301(ww) of the FD&C Act, the following act, and the causing thereof, are prohibited: ‘‘[t]he failure to comply with section 420 [of the FD&C Act].’’ To clearly communicate that failure to comply with the regulations established under section 420 of the FD&C Act is a prohibited act, proposed § 121.401(b) would establish that the failure to comply with section 420 of the FD&C Act or subparts C or D of part 121 is a prohibited act under section 301(ww) of the FD&C Act. 5. Proposed § 121.320—Requirements for Official Review Proposed § 121.320 would require that all records required by proposed part 121 be made promptly available to a duly authorized representative of the Secretary of Health and Human Services upon oral or written request. VI. Preliminary Regulatory Impact Analysis sroberts on DSK5SPTVN1PROD with PROPOSALS 6. Proposed § 121.325—Public Disclosure Proposed § 121.325 would establish that all records required by proposed part 121 will be protected from public disclosure to the extent allowable under part 20 of this chapter. Our general policies, procedures, and practices relating to the protection of confidential or otherwise protected information received from third parties would apply to information received under this rule. E. Compliance Section 103(e) of FSMA amends section 301 of the FD&C Act (21 U.S.C. 331) by adding a new section—(uu)—to the list of acts and the causing thereof that are prohibited. Under section 301(uu) of the FD&C Act, the following act, and the causing thereof, are prohibited: ‘‘[t]he operation of a facility that manufactures, processes, packs, or holds food for sale in the United States if the owner, operator, or agent in charge of such facility is not in compliance with section 418 [of the FD&C Act].’’ To clearly communicate that failure to comply with the regulations established under section 418 of the FD&C Act is a prohibited act, proposed § 121.401(a) in subpart E would establish that the operation of a facility that manufactures, processes, packs, or holds food for sale in the United States if the owner, operator, or agent in charge of such facility is required to comply with, and is not in compliance with, section 418 or subparts C or D of part 121 is a prohibited act under section 301(uu) of the FD&C Act. Section 106(d) of FSMA amends section 301 of the FD&C Act by adding a new section—(ww)—to the list of acts and the causing thereof that are VerDate Mar<15>2010 17:30 Dec 23, 2013 Jkt 232001 A. Overview FDA has examined the impacts of the proposed rule under Executive Order 12866, Executive Order 13563, the Regulatory Flexibility Act (5 U.S.C. 601–612), and the Unfunded Mandates Reform Act of 1995 (Pub. L. 104–4). Executive Orders 12866 and 13563 direct Agencies to assess all costs and benefits of available regulatory alternatives and, when regulation is necessary, to select regulatory approaches that maximize net benefits (including potential economic, environmental, public health and safety, and other advantages; distributive impacts; and equity). We believe that this proposed rule is a significant regulatory action under Executive Order 12866. B. Regulatory Flexibility Act The Regulatory Flexibility Act requires Agencies to analyze regulatory options that would minimize any significant impact of a rule on small entities. The annualized costs per entity due to this proposed rule are about $13,000 for a one-facility firm with 100 employees, and there are about 4,100 small businesses that would be affected by the proposed rule, so we tentatively conclude that the proposed rule could have a significant economic impact on a substantial number of small entities. C. Small Business Regulatory Enforcement Fairness Act of 1996 The Small Business Regulatory Enforcement Fairness Act of 1996 (Pub. L. 104–121) defines a major rule for the purpose of congressional review as having caused or being likely to cause one or more of the following: An annual effect on the economy of $100 million or more; a major increase in costs or prices; significant adverse effects on competition, employment, productivity, or innovation; or significant adverse effects on the ability of U.S.-based enterprises to compete with foreign- PO 00000 Frm 00043 Fmt 4701 Sfmt 4702 78055 based enterprises in domestic or export markets. In accordance with the Small Business Regulatory Enforcement Fairness Act, the Office of Management and Budget (OMB) has determined that this proposed rule is a major rule for the purpose of congressional review. D. Unfunded Mandates Reform Act of 1995 Section 202(a) of the Unfunded Mandates Reform Act of 1995 requires that Agencies prepare a written statement, which includes an assessment of anticipated costs and benefits, before proposing ‘‘any rule that includes any Federal mandate that may result in the expenditure by State, local, and tribal governments, in the aggregate, or by the private sector, of $100,000,000 or more (adjusted annually for inflation) in any one year.’’ The current threshold after adjustment for inflation is $141 million, using the most current (2012) Implicit Price Deflator for the Gross Domestic Product. We expect this proposed rule may result in a 1-year expenditure that would meet or exceed this amount. E. Paperwork Reduction Act of 1995 This proposed rule contains information collection requirements that are subject to review by the Office of Management and Budget (OMB) under the Paperwork Reduction Act of 1995 (PRA) (44 U.S.C. 3501–3520). A description of these provisions is given in the Description section of this document with an estimate of the annual reporting, recordkeeping, and third-party disclosure burden. Included in the estimate is the time for reviewing instructions, searching existing data sources, gathering and maintaining the data needed, and completing and reviewing each collection of information. FDA invites comments on: (1) Whether the proposed collection of information is necessary for the proper performance of FDA’s functions, including whether the information will have practical utility; (2) the accuracy of FDA’s estimate of the burden of the proposed collection of information, including the validity of the methodology and assumptions used; (3) ways to enhance the quality, utility, and clarity of the information to be collected; and (4) ways to minimize the burden of the collection of information on respondents, including through the use of automated collection techniques, when appropriate, and other forms of information technology. To ensure that comments on information collection are received, OMB recommends that written E:\FR\FM\24DEP2.SGM 24DEP2 78056 Federal Register / Vol. 78, No. 247 / Tuesday, December 24, 2013 / Proposed Rules comments be faxed to the Office of Information and Regulatory Affairs, OMB, Attn: FDA Desk Officer, FAX: 202–395–7285, or emailed to oira_ submission@omb.eop.gov. All comments should be identified with the title ‘‘Focused Mitigation Strategies to Protect Food Against Intentional Adulteration.’’ In compliance with the Paperwork Reduction Act of 1995 (44. U.S.C. 3407(d)), the agency has submitted the information collection provisions of this proposed rule to OMB for review. Interested persons are requested to send comments regarding information collection by January 23, 2014 to the Office of Information and Regulatory Affairs, OMB. To ensure that comments on information collection are received, OMB recommends that written comments be faxed to the Office of Information and Regulatory Affairs, OMB, Attn: FDA Desk Officer, FAX: 202–395–6974, or emailed to oira_ submission@omb.eop.gov. All comments should be identified with the title, ‘‘Focused Mitigation Strategies to Protect Food Against Intentional Adulteration.’’ F. Public Access to the Analyses The analyses that we have performed to examine the impacts of this proposed rule under Executive Order 12866, Executive Order 13563, the Regulatory Flexibility Act (5 U.S.C. 601–612), the Unfunded Mandates Reform Act of 1995 (Pub. L. 104–4), and the Paperwork Reduction Act of 1995 (44 U.S.C. 3501– 3520) are available to the public in the docket for this final rule (Ref. 64). sroberts on DSK5SPTVN1PROD with PROPOSALS VII. Analysis of Environmental Impact The Agency has determined under 21 CFR 25.30(h) that this action is of a type that does not individually or cumulatively have a significant effect on the human environment (Ref. 65). Therefore, neither an environmental assessment nor an environmental impact statement is required. VIII. Federalism FDA has analyzed this proposed rule in accordance with the principles set forth in Executive Order 13132. FDA has determined that the proposed rule, if finalized, would not contain policies that would have substantial direct effects on the States, on the relationship between the National Government and the States, or on the distribution of power and responsibilities among the various levels of government. Accordingly, the Agency tentatively concludes that the proposed rule does not contain policies that have federalism implications as defined in VerDate Mar<15>2010 17:30 Dec 23, 2013 Jkt 232001 the Executive order and, consequently, a federalism summary impact statement is not required. IX. Comments We invite public comment on the matters specified in this document as well as any other matters concerning this proposed rule that are of interest. Interested persons may submit either electronic comments regarding this document to http://www.regulations.gov or written comments to the Division of Dockets Management (see ADDRESSES). It is only necessary to send one set of comments. Identify comments with the docket number found in brackets in the heading of this document. Received comments may be seen in the Division of Dockets Management between 9 a.m. and 4 p.m., Monday through Friday, and will be posted to the docket at http:// www.regulations.gov. X. References The following references have been placed on display in the Division of Dockets Management (see ADDRESSES) and may be seen by interested persons between 9 a.m. and 4 p.m., Monday through Friday. (FDA has verified the Web site addresses, but FDA is not responsible for any subsequent changes to the Web sites after this document publishes in the Federal Register.) 1. Kennedy, S.K. and F.F. Busta, ‘‘Chapter 5 Biosecurity: Food Protection and Defense,’’ Food Microbiology: Fundamentals and Frontiers, Edited by M.P. Doyle and L.R. Beuchat, American Society for Microbiology Press: Washington, DC, pp. 87–102, 2007. Accessed October 30, 2013. 2. Khan A.S., D.L. Swerdlow, and D.D. Juranek, ‘‘Precautions Against Biological and Chemical Terrorism Directed at Food and Water Supplies,’’ Public Health Reports, 116(1):3–14, 2001. 3. Sobel, J., A.S. Khan, and D.L. Swerdlow, ‘‘Threat of a Biological Terrorist Attack on the US Food Supply: The CDC Perspective,’’ The Lancet, 359(9309):874–880, March 9, 2002. ¨ ¨ 4. Torok, T.J., R.V. Tauxe, R.P. Wise, et al., ‘‘A Large Community Outbreak of Salmonellosis Caused by Intentional Contamination of Restaurant Salad Bars,’’ Journal of American Medical Association, 278(5):389–395, August 1997. 5. British Standards Institute and Centre for the Protection of National Infrastructure. ‘‘Publicly Available Specification 96:2010 Defending Food and Drink,’’ March 2010. http://www.cpni.gov.uk/documents/ publications/non-cpni_pubs/pas96_ vis14.pdf. Accessed September 25, 2013. 6. World Health Organization. ‘‘Terrorist Threats to Food: Guidance for Establishing and Strengthening Prevention and Response Systems,’’ Food Safety Issues, Revision May 2008. http://www.who.int/foodsafety/ publications/general/en/terrorist.pdf. Accessed September 23, 2013. PO 00000 Frm 00044 Fmt 4701 Sfmt 4702 7. Everstine, K., S. Kennedy, and J. Spink, ‘‘Economically Motivated Adulteration (EMA) of Food: Common Characteristics of EMA Incidents,’’ Journal of Food Protection, 76(4):723–735, 2013. 8. U.S. Food and Drug Administration. ‘‘Economically Motivated Adulteration; Public Meeting; Request for Comment,’’ Federal Register, 74(64):15497–15499, 2009. http://www.gpo.gov/fdsys/pkg/FR-2009-0406/pdf/E9-7843.pdf. Accessed September 23, 2013. 9. Spink, J. and DC Moyer, ‘‘Defining the Public Health Threat of Food Fraud,’’ Journal of Food Science, 75(9):R157–R163, 2011. 10. Ingelfinger, J.R., ‘‘Melamine and the Global Implications of Food Contamination,’’ New England Journal of Medicine, 359(26):2745–2748, 2008. 11. Xiu, C. and K.K. Klein, ‘‘Melamine in Milk Products in China: Examining the Factors That Led to Deliberate Use of the Contaminant,’’ Food Policy, 35(5):463–470, 2010. 12. World Health Organization. Food Security Page. http://www.who.int/trade/ glossary/story028/en. Accessed September 23, 2013 13. Kolavic, S., A. Kimura, S. Simons, L. Slutsker, S. Barth, and C. Haley, ‘‘An Outbreak of Shigella dysenteriae Type 2 Among Laboratory Workers Due to Intentional Food Contamination,’’ Journal of American Medical Association, 278(5):396– 398, August 1997. 14. Anderson, S., J. DeMent, C.B. Ocfemia, and D.C. Hunt, Outbreaks of Methomyl Poisoning Caused by the Intentional Contamination of Salsa at the Mi Ranchito Restaurant in Lenexa, KS—August 2009, Kansas Department of Health and Environment, April 12, 2011. http:// www.kdheks.gov/epi/download/Final_Mi_ Ranchito_Report.pdf. Accessed October 22, 2013. 15. U.S. Government Printing Office. Senate Hearing 108–491, ‘‘Agroterrorism: The Threat to America’s Breadbasket,’’ p. 1, November 19, 2003. http://www.gpo.gov/ fdsys/pkg/CHRG-108shrg91045/html/CHRG108shrg91045.htm. Accessed September 23, 2013. 16. The White House, Office of the Press Secretary. Homeland Security Presidential Directive/HSPD–8, December, 17, 2003. https://www.fas.org/irp/offdocs/nspd/hspd8.html. Accessed October 17, 2013. 17. The White House, Office of the Press Secretary. Homeland Security Presidential Directive 7: Critical Infrastructure Identification, Prioritization, and Protection, December, 17, 2003. https://www.dhs.gov/ homeland-security-presidential-directive-7. Accessed October 17, 2013. 18. The White House, Office of the Press Secretary. Homeland Security Presidential Directive/HSPD–9, January, 30, 2004. https://www.fas.org/irp/offdocs/nspd/hspd9.html. Accessed October 17, 2013. 19. The White House, Office of the Press Secretary. Presidential Policy Directive/PPD– 8: National Preparedness, March 30, 2011. http://www.dhs.gov/presidential-policydirective-8-national-preparedness. Accessed October 17, 2013. 20. The White House, Office of the Press Secretary. Presidential Policy Directive 21: E:\FR\FM\24DEP2.SGM 24DEP2 sroberts on DSK5SPTVN1PROD with PROPOSALS Federal Register / Vol. 78, No. 247 / Tuesday, December 24, 2013 / Proposed Rules Critical Infrastructure Security and Resilience, February 12, 2013. http:// www.whitehouse.gov/the-press-office/2013/ 02/12/presidential-policy-directive-criticalinfrastructure-security-and-resil. Accessed October 7, 2013. 21. U.S. Food and Drug Administration. Strategic Partnership Program Agroterrorism (SPPA) Initiative: Final Summary Report September 2005—September 2008, December 2008. http://www.fda.gov/Food/ FoodDefense/FoodDefensePrograms/ ucm170509.htm. Accessed September 23, 2013. 22. U.S. Food and Drug Administration, Center for Food Safety and Applied Nutrition. ‘‘Guidance for Industry: Food Producers, Processors, and Transporters: Food Security Preventive Measures Guidance,’’ March 2003, Revision October 2007. http://www.fda.gov/Food/ GuidanceRegulation/ GuidanceDocumentsRegulatoryInformation/ FoodDefense/ucm083075.htm. Accessed September 23, 2013. 23. U.S. Food and Drug Administration, Center for Food Safety and Applied Nutrition. ‘‘Guidance for Industry: Importers and Filers: Food Security Preventive Measures Guidance,’’ March 2003, Revision October 2007. http://www.fda.gov/Food/ GuidanceRegulation/ GuidanceDocumentsRegulatoryInformation/ FoodDefense/ucm078978.htm. Accessed September 23, 2013. 24. U.S. Food and Drug Administration, Center for Food Safety and Applied Nutrition. ‘‘Guidance for Industry: Dairy Farms, Bulk Milk Transporters, Bulk Milk Transfer Stations and Fluid Milk Processors: Food Security Preventive Measures Guidance,’’ July 2003, Revision October 2007. http://www.fda.gov/Food/ GuidanceRegulation/ GuidanceDocumentsRegulatoryInformation/ FoodDefense/ucm078978.htm. Accessed September 23, 2013. 25. U.S. Food and Drug Administration, Center for Food Safety and Applied Nutrition. ‘‘Guidance for Industry: Retail Food Stores and Food Service Establishments: Food Security Preventive Measures Guidance,’’ December 2003, Revision October 2007. http://www.fda.gov/ Food/GuidanceRegulation/ GuidanceDocumentsRegulatoryInformation/ FoodDefense/ucm082751.htm. Accessed September 23, 2013. 26. U.S. Food and Drug Administration, Center for Food Safety and Applied Nutrition. ‘‘Guidance for Industry: Cosmetics Processors and Transporters of Cosmetics Security Preventive Measures Guidance,’’ November 2003, Revision October 2007. http://www.fda.gov/Food/ GuidanceRegulation/ GuidanceDocumentsRegulatoryInformation/ FoodDefense/ucm082716.htm. Accessed September 23, 2013. 27. U.S. Food and Drug Administration. Food Defense 101 Page. http://www.fda.gov/ Food/FoodDefense/ ToolsEducationalMaterials/ucm353774.htm. Accessed October 17, 2013. 28. U.S. Food and Drug Administration. Employees FIRST Page. http://www.fda.gov/ VerDate Mar<15>2010 17:30 Dec 23, 2013 Jkt 232001 Food/FoodDefense/ ToolsEducationalMaterials/ucm295997.htm. Accessed and printed on October 17, 2013. 29. U.S. Food and Drug Administration. Vulnerability Assessment Software Page, Version 2.4, November 2011. http:// www.fda.gov/Food/FoodDefense/ ToolsEducationalMaterials/ucm295900.htm. Accessed September 25, 2013. 30. U.S. Food and Drug Administration. Mitigation Strategies Database Page. http:// www.fda.gov/Food/FoodDefense/ ToolsEducationalMaterials/ucm295898.htm. Accessed September 25, 2013. 31. U.S. Food and Drug Administration. Food Defense Plan Builder Software Page. http://www.fda.gov/Food/FoodDefense/ ToolsEducationalMaterials/ucm349888.htm. Accessed September 25, 2013. 32. U.S. Food and Drug Administration. Food Related Emergency Exercise Bundle (FREE–B) Page. http://www.fda.gov/Food/ FoodDefense/ToolsEducationalMaterials/ ucm295902.htm. Accessed October 17, 2013. 33. Global Food Safety Initiative. GFSI Guidance Document, Version 6.1, 6(2), August 2011. http://www.mygfsi.com/ gfsifiles/Guidance_Document_Sixth_Edition_ Version_6.1.pdf. Accessed September 23, 2013. 34. Safe Quality Food Institute. SQF Code: A HACCP-Based Supplier Assurance Code for the Food Industry, Edition 7.1, April 2013. http://www.sqfi.com/wp-content/ uploads/SQF-Code-Ed-7.1-4-3-13.pdf. Accessed October 17, 2013. 35. International Featured Standards. Events and Academy Page. http://www.ifscertification.us/events. Accessed November 5, 2013. 36. China Inspection and Quarantine Service, Administrative Provisions on Filing of Export Food Production Enterprises Page. http://en.ciqcid.com/Zjl/Comprehensives/ 51829.htm. Accessed September 25, 2013. 37. German Federal Office of Consumer Protection and Food Safety. ‘‘General Recommendations for Protection of Animal Feed and Food Supply Chain From the Intentional Release of Agents,’’ February 2011. Accessed October 22, 2013. 38. French Republic. Guide Containing Recommendations for the Protection of the Food Chain From Threats of Malevolent, Criminal, or Terrorist Acts, May 2007. http://www.frenchfoodintheus.org/IMG/pdf/ I07008308-imtnea-Guide_des_ recommandations-ENG_3_.pdf. Accessed and printed on September 23, 2013. 39. Trusted Information Sharing Network for Critical Infrastructure Protection. A National Strategy for Enhancing the Safety and Security of our Food Supply, March 2006. http://www.daff.gov.au/__data/assets/ pdf_file/0004/183325/enhancing_safety_ security_strategy.pdf. Accessed September 23, 2013. 40. U.S. Food and Drug Administration. Memorandum to the File: Evaluation of the potential for intentional adulteration of produce during activities that occur on produce farms, September 2013. 41. Buttars, N.K., A.J. Young, D. Bailey, ‘‘Adoption of Security Systems by Dairy Farms To Address Bioterrorist Threats in the Intermountain United States,’’ Journal of PO 00000 Frm 00045 Fmt 4701 Sfmt 4702 78057 Dairy Science, 89:1822–1829, 2006. Accessed October 22, 2013. 42. International Dairy Foods Association. Global Markets Page. http://www.idfa.org/ key-issues/category/global-markets/map/#us. Accessed October 23, 2013. 43. Newkirk, R., C. Hedberg, and J. Bender, ‘‘Establishing a Milkborne Disease Outbreak Profile: Potential Food Defense Implications,’’ Foodborne Pathogens and Disease, 8(3):433–437, 2011. 44. Popkin, B., ‘‘Patterns of Beverage Use Across the Lifecycle,’’ Physiology and Behavior, 100(1):4–9, 2010. 45. Sebastian, R.S., J.D. Goldman, C.W. Enns, and R.P. LaComb, ‘‘Fluid Milk Consumption in the United States: What We Eat In America, NHANES 2005–2006,’’ Food Surveys Research Group Dietary Data Brief No. 3, September 2010. http://ars.usda.gov/ SP2UserFiles/Place/12355000/pdf/DBrief/3_ milk_consumption_0506.pdf. Accessed October 23, 2013. 46. U.S. Department of Agriculture and Economic Research Service. Dairy Products: Per capita consumption, United States (Annual), 2013. http://www.ers.usda.gov/ data-products/dairy-data.aspx. Accessed October 23, 2013. 47. Wein, L.M. and Y. Lui, ‘‘Analyzing a Bioterror Attack on the Food Supply: The Case of Botulinum Toxin in Milk,’’ Proceedings of the National Academy of Sciences of the United States of America, 102(28):9984–9989, 2005. 48. Blayney, D.P., ‘‘The Changing Landscape of U.S. Milk Production,’’ Statistical Bulletin No. 978, U.S. Department of Agriculture, June 2002. http:// usda.mannlib.cornell.edu/usda/nass/sb/ sb978.pdf. Accessed October 23, 2013. 49. Codex Alimentarius Commission. General Principles of Food Hygiene, CAC/ RCP 1–1969, 2003. 50. Sobel J. and J. Watson, ‘‘Chapter 10: Intentional Terrorism Contamination of Food and Water,’’ Beyond Anthrax, Springer Link, 2009. 51. Stinson, T.F., J. Kinsey, D. Degeneffe, and K. Ghosh, How Should America’s AntiTerrorism Budget Be Allocated? Findings From a National Survey of Attitudes of U.S. Residents About Terrorism, The Food Industry Center, March 2006. http:// ageconsearch.umn.edu/bitstream/14351/1/ tr06–01.pdf. Accessed October 21, 2013. 52. Merriam-Webster. Vulnerability Page. http://www.merriam-webster.com/dictionary/ vulnerability. Accessed October 21, 2013. 53. U.S. Food and Drug Administration, Study and Report on the Food Processing Sector, 2011. 54. U.S. Food and Drug Administration. Analysis of Results for FDA Food Defense Vulnerability Assessments and Identification of Activity Types, April 2013. http:// www.fda.gov/food/guidanceregulation/fsma/ ucm347023.htm. Accessed September 25, 2013. 55. U.S. Food and Drug Administration. Memorandum to the File: Evaluation of the potential for intentional adulteration of animal feed from acts of terrorism, December 2013. 56. U.S. Department of Health and Human Services, Public Health Service, and National E:\FR\FM\24DEP2.SGM 24DEP2 78058 Federal Register / Vol. 78, No. 247 / Tuesday, December 24, 2013 / Proposed Rules sroberts on DSK5SPTVN1PROD with PROPOSALS Toxicology Program. Report on Carcinogens, 12th Edition, 2011. 57. U.S. Department of Health and Human Services, Centers for Disease Control and Prevention, and U.S. Department of Agriculture. HHS and USDA Select Agents and Toxins 7 CFR Part 331, 9 CFR Part 121, and 42 CFR Part 73, September 10, 2013. http://www.selectagents.gov/resources/ List_of_Select_Agents_and_Toxins_2013-0910.pdf. Accessed October 21, 2013. 58. U.S. Food and Drug Administration. Vulnerability Assessments of Food Systems: Final Summary Report, June 2009-February 2012. http://www.fda.gov/downloads/Food/ FoodDefense/UCM317547.pdf. Accessed September 23, 2013. 59. AIB International. Food Safety and Food Defense Education Page. https:// www.aibonline.org/foodsafetyeducation/ index.html. Accessed October 17, 2013. 60. Center for Agriculture and Food Security and Preparedness and University of Tennessee Knoxville. Instructor-Led Courses Page: Agriculture and Food Vulnerability Assessment Training. http:// www.vet.utk.edu/cafsp/courses.php. Accessed October 17, 2013. 61. International Featured Standards. IFS Food: Standard for Auditing Quality and Food Safety of Food Products, Version 6, January 2012. http://www.ifscertification.com/images/ifs_standards/ifs6/ IFS_Food_V6_en.pdf. Accessed September 23, 2013. 62. National Center for Food Protection and Defense. Food Defense Online Modules Page. http://www.ncfpd.umn.edu/index.cfm/ education/food-defense-online-modules/. Accessed October 17, 2013. 63. AIB International. The AIB International Consolidated Standards for Inspection: Prerequisite and Food Safety Programs, January 2013. https:// www.aibonline.org/Standards/ 2013FoodSafety_web_ENG.pdf. Accessed October 17, 2013. 64. U.S. Food and Drug Administration. FDA’s Preliminary Regulatory Impact Analysis, Preliminary Regulatory Flexibility Analysis, Preliminary Unfunded Mandates Reform Act Analysis, Preliminary Paperwork Reduction Act Analysis, December 2013. 65. U.S. Food and Drug Administration. Memorandum to the File: Environmental analysis related to the proposed rule on focused mitigation strategies to protect food against intentional adulteration, November 2013. List of Subjects in 21 CFR Part 121 Food packaging, Foods. Therefore, under the Federal Food, Drug, and Cosmetic Act and under authority delegated to the Commissioner of Food and Drugs, it is proposed that 21 CFR chapter I be amended by adding part 121 to read as follows: PART 121—FOCUSED MITIGATION STRATEGIES TO PROTECT FOOD AGAINST INTENTIONAL ADULTERATION Subpart A—General Provisions Sec. VerDate Mar<15>2010 17:30 Dec 23, 2013 Jkt 232001 121.3 121.5 Definitions. Exemptions. Subpart B—[Reserved] Subpart C—Food Defense Measures 121.126 Requirement for a food defense plan. 121.130 Identification of actionable process steps. 121.135 Focused mitigation strategies for actionable process steps. 121.140 Monitoring. 121.145 Corrective actions. 121.150 Verification. 121.160 Training. Subpart D—Requirements Applying to Records That Must Be Established and Maintained 121.301 Records subject to the requirements of this subpart. 121.305 General requirements applying to records. 121.310 Additional requirements applying to the food defense plan. 121.315 Requirements for record retention. 121.320 Requirements for official review. 121.325 Public disclosure. Subpart E—Compliance 121.401 Compliance. Authority: 21 U.S.C. 331, 342, 350g, 350(i), 371, 374. Subpart A—General Provisions § 121.3 Definitions. The definitions and interpretations of terms in section 201 of the Federal Food, Drug, and Cosmetic Act are applicable to such terms when used in this part. The following definitions also apply: Actionable process step means a point, step, or procedure in a food process at which food defense measures can be applied and are essential to prevent or eliminate a significant vulnerability or reduce such vulnerability to an acceptable level. Contaminant means any biological, chemical, physical or radiological agent that may be intentionally added to food and that may cause illness, injury or death. Facility means a domestic facility or a foreign facility that is required to register under section 415 of the Federal Food, Drug, and Cosmetic Act (21 U.S.C. 350d), in accordance with the requirements of 21 CFR part 1, subpart H. Farm means farm as defined in § 1.227 of this chapter. FDA means the Food and Drug Administration. Focused mitigation strategies mean those risk-based, reasonably appropriate measures that a person knowledgeable about food defense would employ to significantly minimize or prevent significant vulnerabilities identified at PO 00000 Frm 00046 Fmt 4701 Sfmt 4702 actionable process steps, and that are consistent with the current scientific understanding of food defense at the time of the analysis. Food means food as defined in section 201(f) of the Federal Food, Drug, and Cosmetic Act (21 U.S.C. 321(f)) and includes raw materials and ingredients. Food defense means the effort to protect food from intentional acts of adulteration where there is an intent to cause public health harm and economic disruption. Holding means storage of food. Holding facilities include warehouses, cold storage facilities, storage silos, grain elevators, and liquid storage tanks. For farms and farm mixed-type facilities, holding also includes activities traditionally performed by farms for the safe or effective storage of raw agricultural commodities grown or raised on the same farm or another farm under the same ownership, but does not include activities that transform a raw agricultural commodity, as defined in section 201(r) of the Federal Food, Drug, and Cosmetic Act, into a processed food as defined in section 201(gg). Manufacturing/processing means making food from one or more ingredients, or synthesizing, preparing, treating, modifying or manipulating food, including food crops or ingredients. Examples of manufacturing/processing activities are cutting, peeling, trimming, washing, waxing, eviscerating, rendering, cooking, baking, freezing, cooling, pasteurizing, homogenizing, mixing, formulating, bottling, milling, grinding, extracting juice, distilling, labeling, or packaging. For farms and farm mixedtype facilities, manufacturing/ processing does not include activities that are part of harvesting, packing, or holding. Mixed-type facility means an establishment that engages in both activities that are exempt from registration under section 415 of the Federal Food, Drug, and Cosmetic Act and activities that require the establishment to be registered. An example of such a facility is a ‘‘farm mixed-type facility,’’ which is an establishment that grows and harvests crops or raises animals and may conduct other activities within the farm definition, but also conducts activities that require the establishment to be registered. Monitor means to conduct a planned sequence of observations or measurements to assess whether focused mitigation strategies are consistently applied and to produce an accurate record for use in verification. E:\FR\FM\24DEP2.SGM 24DEP2 sroberts on DSK5SPTVN1PROD with PROPOSALS Federal Register / Vol. 78, No. 247 / Tuesday, December 24, 2013 / Proposed Rules Packing means placing food into a container other than packaging the food. For farms and farm mixed-type facilities, packing also includes activities traditionally performed by farms to prepare raw agricultural commodities grown or raised on the same farm or another farm under the same ownership for storage and transport, but does not include activities that transform a raw agricultural commodity, as defined in section 201(r) of the Federal Food, Drug, and Cosmetic Act, into a processed food as defined in section 201(gg). Qualified end-user, with respect to a food, means the consumer of the food (where the term consumer does not include a business); or a restaurant or retail food establishment (as those terms are defined in § 1.227 of this chapter) that: (1) Is located: (i) In the same State as the qualified facility that sold the food to such restaurant or establishment; or (ii) Not more than 275 miles from such facility; and (2) Is purchasing the food for sale directly to consumers at such restaurant or retail food establishment. Qualified facility means (when including the sales by any subsidiary; affiliate; or subsidiaries or affiliates, collectively, of any entity of which the facility is a subsidiary or affiliate) a facility that is: (1) A very small business as defined in this part; or (2) A facility to which both of the following apply: (i) During the 3-year period preceding the applicable calendar year, the average annual monetary value of the food manufactured, processed, packed or held at such facility that is sold directly to qualified end-users (as defined in this part) during such period exceeded the average annual monetary value of the food sold by such facility to all other purchasers; and (ii) The average annual monetary value of all food sold during the 3-year period preceding the applicable calendar year was less than $500,000, adjusted for inflation. Significant vulnerability means a vulnerability for which a prudent person knowledgeable about food defense would employ food defense measures because of the potential for serious adverse health consequences or death and the degree of accessibility to that point in the food process. Significantly minimize means to reduce to an acceptable level, including to eliminate. Small business means a business employing fewer than 500 persons. VerDate Mar<15>2010 17:30 Dec 23, 2013 Jkt 232001 78059 Verification means those activities, other than monitoring, that establish that the system is operating according to the food defense plan. Very small business means a business that has less than $10,000,000 in total annual sales of food, adjusted for inflation. Vulnerability means the susceptibility of a point, step, or procedure in a facility’s food process to intentional adulteration. (ii) Constitutes not more than 5 percent of the overall sales of the facility, as determined by the Secretary of the Treasury. (f) This part does not apply to the manufacturing, processing, packing, or holding of food for animals other than man. § 121.5 § 121.126 plan. Exemptions. (a) This part does not apply to a qualified facility, except that qualified facilities must, upon request, provide for official review documentation that was relied upon to demonstrate that the facility meets this exemption. Such documentation must be retained for 2 years. (b) This part does not apply to the holding of food, except the holding of food in liquid storage tanks. (c) This part does not apply to the packing, re-packing, labeling, or relabeling of food where the container that directly contacts the food remains intact. (d) This part does not apply to activities of a facility that are subject to section 419 of the Federal Food, Drug, and Cosmetic Act (21 U.S.C. 350h) (Standards for Produce Safety). (e)(1) This part does not apply with respect to alcoholic beverages at a facility that meets the following two conditions: (i) Under the Federal Alcohol Administration Act (27 U.S.C. 201 et seq.) or chapter 51 of subtitle E of the Internal Revenue Code of 1986 (26 U.S.C. 5001 et seq.) the facility is required to obtain a permit from, register with, or obtain approval of a notice or application from the Secretary of the Treasury as a condition of doing business in the United States, or is a foreign facility of a type that would require such a permit, registration, or approval if it were a domestic facility; and (ii) Under section 415 of the Federal Food, Drug, and Cosmetic Act (21 U.S.C. 350d) the facility is required to register as a facility because it is engaged in manufacturing, processing, packing, or holding one or more alcoholic beverages. (2) This part does not apply with respect to food other than alcoholic beverages at a facility described in paragraph (e)(1) of this section, provided such food: (i) Is in prepackaged form that prevents any direct human contact with such food; and PO 00000 Frm 00047 Fmt 4701 Sfmt 4702 Subpart B—[Reserved] Subpart C—Food Defense Measures Requirement for a food defense (a) Food defense plan. The owner, operator, or agent in charge of a facility must prepare, or have prepared, and implement a written food defense plan. (b) Contents of a food defense plan. The food defense plan must include: (1) The written identification of actionable process steps as required by § 121.130; (2) The written focused mitigation strategies as required by § 121.135(b); (3) The written procedures for monitoring as required by § 121.140(a); (4) The written corrective action procedures as required by § 121.145(a)(1); and (5) The written verification procedures as required by § 121.150(e). § 121.130 Identification of actionable process steps. The owner, operator, or agent in charge of a facility must identify any actionable process steps, using the procedures described in either paragraph (a) or paragraph (b) of this section. The identification of actionable process steps and the assessment leading to that identification must be written. (a) Key activity types. The owner, operator, or agent in charge of a facility must assess, for each type of food manufactured, processed, packed or held at the facility, whether the facility has one or more of the following key activity types and identify the actionable process steps associated with any key activity types present: (1) Bulk liquid receiving and loading—a step in which a bulk liquid is received and unloaded from an inbound conveyance or loaded into an outbound conveyance where a contaminant can be intentionally introduced and, if it is, it is likely that the contaminant will be distributed throughout the liquid due to sloshing, movement, or turbulence caused by the receiving and unloading or loading activity. (2) Liquid storage and handling—a step in which a liquid is contained in bulk storage tanks or in holding, surge, E:\FR\FM\24DEP2.SGM 24DEP2 78060 Federal Register / Vol. 78, No. 247 / Tuesday, December 24, 2013 / Proposed Rules or metering tanks where a contaminant can be intentionally introduced and, if it is, it is likely that the contaminant will be distributed into the food. (3) Secondary ingredient handling—a staging, preparation, addition, or rework step where a contaminant can be intentionally introduced into a relatively small amount of ingredient or rework and, if it is, it is likely that the contaminant will be distributed into a larger volume of food. (4) Mixing and similar activities—a step, such as mixing, blending, homogenizing, or grinding where a contaminant can be intentionally introduced and, if it is, it is likely that the contaminant will be distributed into the food. (b) Vulnerability assessment. The owner, operator, or agent in charge of a facility must conduct or have conducted, for each type of food manufactured, processed, packed or held at the facility, an evaluation to identify and prioritize the points, steps, and procedures in a food operation based on their vulnerability to intentional adulteration and to identify actionable process steps. Such vulnerability assessments must be performed by an individual(s) qualified by experience and/or training using appropriate methods. sroberts on DSK5SPTVN1PROD with PROPOSALS (a) The owner, operator, or agent in charge of a facility must identify and implement focused mitigation strategies at each actionable process step to provide assurances that the significant vulnerability at each step will be significantly minimized or prevented and the food manufactured, processed, packed, or held by such facility will not be adulterated under section 402 of the Federal Food, Drug, and Cosmetic Act (21 U.S.C. 342). (b) Focused mitigation strategies must be written. (c) Focused mitigation strategies required under this section are subject to: (1) Monitoring as required by § 121.140; (2) Corrective actions as required by § 121.145; and (3) Verification as required by § 121.150. Monitoring. (a) The owner, operator, or agent in charge of a facility must establish and implement written procedures, including the frequency with which they are to be performed, for monitoring the focused mitigation strategies. (b) The owner, operator, or agent in charge of a facility must monitor the VerDate Mar<15>2010 17:30 Dec 23, 2013 Jkt 232001 § 121.145 Corrective actions. (a) Corrective action procedures. (1) The owner, operator, or agent in charge of a facility must establish and implement written corrective action procedures that must be taken if focused mitigation strategies are not properly implemented. (2) The corrective action procedures must describe the steps to be taken to ensure that appropriate action is taken to identify and correct a problem with implementation of a focused mitigation strategy to reduce the likelihood that the problem will recur. (b) Documentation. All corrective actions taken in accordance with this section must be documented in records that are subject to verification in accordance with § 121.150(b) and records review in accordance with § 121.150(c). § 121.150 § 121.135 Focused mitigation strategies for actionable process steps. § 121.140 focused mitigation strategies with sufficient frequency to provide assurances that they are consistently applied. (c) All monitoring of focused mitigation strategies in accordance with this section must be documented in records that are subject to verification in accordance with § 121.150(a) and records review in accordance with § 121.150(c). Verification. (a) Monitoring. The owner, operator, or agent in charge of a facility must verify that monitoring is being conducted, as required by § 121.140. (b) Corrective actions. The owner, operator, or agent in charge of a facility must verify that appropriate decisions about corrective actions are being made, as required by § 121.145. (c) Implementation and effectiveness. The owner, operator, or agent in charge of a facility must verify that the focused mitigation strategies are consistently implemented and are effectively and significantly minimizing or preventing the significant vulnerabilities. As appropriate to the facility and the food, this must include review of the monitoring and corrective actions records within appropriate timeframes to ensure that the records are complete, the activities reflected in the records occurred in accordance with the food defense plan, the focused mitigation strategies are effective, and appropriate decisions were made about corrective actions. (d) Reanalysis. The owner, operator, or agent in charge of a facility must: (1) Conduct a reanalysis of the food defense plan: (i) At least once every 3 years; (ii) Whenever a significant change is made in the activities conducted at a PO 00000 Frm 00048 Fmt 4701 Sfmt 4702 facility operated by such owner, operator, or agent in charge if the change creates a reasonable potential for a new vulnerability or a significant increase in a previously identified vulnerability; (iii) Whenever such owner, operator or agent in charge becomes aware of new information about potential vulnerabilities associated with the food operation or facility; (iv) Whenever a focused mitigation strategy is found to be ineffective; and (v) Whenever FDA requires reanalysis to respond to new vulnerabilities and developments in scientific understanding including, as appropriate, results from the Department of Homeland Security biological, chemical, radiological, or other terrorism risk assessment. (2) Complete such reanalysis and implement any additional focused mitigation strategies needed to address the significant vulnerabilities identified, if any, before the change in activities at the facility is operative or, when necessary, during the first 6 weeks of production; and (3) Revise the written plan if a significant change is made or document the basis for the conclusion that no additional or revised focused mitigation strategies are needed. (e) Documentation. All verification activities taken in accordance with this section must be documented in records. § 121.160 Training. (a) Personnel and supervisors assigned to actionable process steps must receive appropriate training in food defense awareness and their respective responsibilities in implementing focused mitigation strategies. (b) All training received in accordance with this section must be documented in records. Subpart D—Requirements Applying to Records That Must Be Established and Maintained § 121.301 Records subject to the requirements of this subpart D. (a) Except as provided by paragraph (b) of this section, all records required by subpart C of this part are subject to all requirements of this subpart D. (b) The requirements of § 121.310 apply only to the written food defense plan. § 121.305 General requirements applying to records. Records must: (a) Be kept as original records, true copies (such as photocopies, pictures, scanned copies, microfilm, microfiche, E:\FR\FM\24DEP2.SGM 24DEP2 Federal Register / Vol. 78, No. 247 / Tuesday, December 24, 2013 / Proposed Rules or other accurate reproductions of the original records), or electronic records, which must be kept in accordance with part 11 of this chapter; (b) Contain the actual values and observations obtained during monitoring; (c) Be accurate, indelible, and legible; (d) Be created concurrently with performance of the activity documented; (e) Be as detailed as necessary to provide history of work performed; and (f) Include: (1) The name and location of the facility; (2) The date and time of the activity documented; (3) The signature or initials of the person performing the activity; and (4) Where appropriate, the identity of the product and the production code, if any. least 2 years after the date they were prepared. (b) The food defense plan must be retained for at least 2 years after its use is discontinued; (c) Except for the food defense plan, offsite storage of records is permitted after 6 months following the date that the record was made if such records can be retrieved and provided onsite within 24 hours of request for official review. The food defense plan must remain onsite. Electronic records are considered to be onsite if they are accessible from an onsite location. (d) If the facility is closed for a prolonged period, the records may be transferred to some other reasonably accessible location but must be returned to the facility within 24 hours for official review upon request. § 121.310 Additional requirements applying to the food defense plan. § 121.320 The food defense plan must be signed and dated by the owner, operator, or agent in charge of the facility: (a) Upon initial completion; and (b) Upon any modification. § 121.315 Requirements for record retention. sroberts on DSK5SPTVN1PROD with PROPOSALS (a) All records required by this part must be retained at the facility for at VerDate Mar<15>2010 17:30 Dec 23, 2013 Jkt 232001 Requirements for official review. All records required by this part must be made promptly available to a duly authorized representative of the Secretary of Health and Human Services upon oral or written request. § 121.325 Public disclosure. Subpart E—Compliance § 121.401 Compliance. (a) The operation of a facility that manufactures, processes, packs, or holds food for sale in the United States if the owner, operator, or agent in charge of such facility is required to comply with, and is not in compliance with, section 418 of the Federal Food, Drug, and Cosmetic Act (21 U.S.C. 350g) or subparts C or D of this part is a prohibited act under section 301(uu) of the Federal Food, Drug, and Cosmetic Act (21 U.S.C. 331(uu)). (b) The failure to comply with section 420 of the Federal Food, Drug, and Cosmetic Act (21 U.S.C. 350i) or subparts C or D of this part is a prohibited act under section 301(ww) of the Federal Food, Drug, and Cosmetic Act. Dated: December 13, 2013. Leslie Kux, Assistant Commissioner for Policy. [FR Doc. 2013–30373 Filed 12–20–13; 8:45 am] BILLING CODE 4160–01–P Records required by this part will be protected from public disclosure to the extent allowable under part 20 of this chapter. PO 00000 Frm 00049 Fmt 4701 Sfmt 9990 78061 E:\FR\FM\24DEP2.SGM 24DEP2

Agencies

[Federal Register Volume 78, Number 247 (Tuesday, December 24, 2013)]
[Proposed Rules]
[Pages 78013-78061]
From the Federal Register Online via the Government Printing Office [www.gpo.gov]
[FR Doc No: 2013-30373]



[[Page 78013]]

Vol. 78

Tuesday,

No. 247

December 24, 2013

Part III





Department of Health and Human Services





-----------------------------------------------------------------------





Food and Drug Administration





-----------------------------------------------------------------------





21 CFR Parts 16 and 121





Focused Mitigation Strategies To Protect Food Against Intentional 
Adulteration; Proposed Rule

Federal Register / Vol. 78 , No. 247 / Tuesday, December 24, 2013 / 
Proposed Rules

[[Page 78014]]


-----------------------------------------------------------------------

DEPARTMENT OF HEALTH AND HUMAN SERVICES

Food and Drug Administration

21 CFR Parts 16 and 121

[Docket No. FDA-2013-N-1425]
RIN 0910-AG63


Focused Mitigation Strategies To Protect Food Against Intentional 
Adulteration

AGENCY: Food and Drug Administration, HHS.

ACTION: Proposed rule.

-----------------------------------------------------------------------

SUMMARY: The Food and Drug Administration (FDA or we) is proposing to 
require domestic and foreign food facilities that are required to 
register under the Federal Food, Drug, and Cosmetic Act (the FD&C Act) 
to address hazards that may be intentionally introduced by acts of 
terrorism. These food facilities would be required to identify and 
implement focused mitigation strategies to significantly minimize or 
prevent significant vulnerabilities identified at actionable process 
steps in a food operation. FDA is proposing these requirements as part 
of our implementation of the FDA Food Safety Modernization Act (FSMA). 
Further, as part of the proposal, FDA discusses an approach to 
addressing economically motivated intentional adulteration. We expect 
the proposed rule, if finalized as proposed, would help to protect food 
from intentional adulteration caused by acts of terrorism.

DATES: Submit either electronic or written comments on the proposed 
rule by March 31, 2014. Submit comments on information collection 
issues under the Paperwork Reduction Act of 1995 by January 23, 2014, 
(see the ``Paperwork Reduction Act of 1995'' section of this document).

ADDRESSES: You may submit comments, identified by Docket No. FDA-2013-
N-1425 and/or Regulatory Information Number (RIN) 0910-AG63, by any of 
the following methods, except that comments on information collection 
issues under the Paperwork Reduction Act of 1995 must be submitted to 
the Office of Information and Regulatory Affairs, Office of Management 
and Budget (OMB) (see the ``Paperwork Reduction Act of 1995'' section 
of this document).

Electronic Submissions

    Submit electronic comments in the following way:
     Federal eRulemaking Portal: http://www.regulations.gov. 
Follow the instructions for submitting comments.
    Written Submissions
    Submit written submissions in the following ways:
     Mail/Hand delivery/Courier (for paper or CD-ROM 
submissions): Division of Dockets Management (HFA-305), Food and Drug 
Administration, 5630 Fishers Lane, rm. 1061, Rockville, MD 20852.
    Instructions: All submissions received must include the Agency name 
and Docket No. FDA-2013-N-1425 and Regulatory Information Number (RIN) 
0910-AG63 for this rulemaking. All comments received may be posted 
without change to http://www.regulations.gov, including any personal 
information provided. For additional information on submitting 
comments, see the ``Comments'' heading of the SUPPLEMENTARY INFORMATION 
section of this document.
    Docket: For access to the docket to read background documents or 
comments received, go to http://www.regulations.gov and insert the 
docket number, found in brackets in the heading of this document, into 
the ``Search'' box and follow the prompts and/or go to the Division of 
Dockets Management, 5630 Fishers Lane, rm. 1061, Rockville, MD 20852.

FOR FURTHER INFORMATION CONTACT: Regarding the provisions with respect 
to human food: Ryan Newkirk, Center for Food Safety and Applied 
Nutrition (HFS-005), Food and Drug Administration, 5100 Paint Branch 
Pkwy., College Park, MD 20740, 240-402-2428. Regarding the provisions 
with respect to food for animals: Alfred Montgomery, Center for 
Veterinary Medicine (HFV-200), Food and Drug Administration, 7519 
Standish Pl., Rockville, MD 20855, 240-453-6836.

SUPPLEMENTARY INFORMATION: 

Table of Contents

Executive Summary

    Scope of Coverage of the Proposed Rule
    Summary of the Major Provisions of the Proposed Rule
    Costs and Benefits
I. Introduction
II. Background
    A. Incidents of Intentional Adulteration of Food
    B. Interagency Approach to Food Defense
    C. Resources for the Food Sector
    D. Outreach
    E. Industry Standards
    F. International Food Defense Guidelines
III. Legal Authority
    A. Section 103 of FSMA
    B. Section 106 of FSMA
    C. Intrastate Activities
IV. Regulatory Approach
    A. Framework of the Rule
    B. Activities That Occur on Produce Farms
    C. Transportation Carriers
    D. Food for Animals
    E. Acts of Disgruntled Employees, Consumers, or Competitors
    F. Economically Motivated Adulteration
    G. Low-Risk Activities at Farm Mixed-Type Facilities
    H. Activities That Occur on Dairy Farms
    I. Other Ways To Focus on Foods With a High Risk of Intentional 
Adulteration Caused by Terrorism
V. The Proposal
    A. Definitions
    B. Exemptions
    C. Food Defense Measures
    D. Requirements Applying to Records That Must Be Established and 
Maintained
    E. Compliance
VI. Preliminary Regulatory Impact Analysis
VII. Analysis of Environmental Impact
VIII. Federalism
IX. Comments
X. References

Executive Summary

    This proposed regulation implements three provisions of the Federal 
Food, Drug, and Cosmetic (FD&C) Act, as amended by the FDA Food Safety 
Modernization Act (FSMA), that relate to the intentional adulteration 
of food. Section 418 of the FD&C Act (21 U.S.C. 350g) addresses 
intentional adulteration in the context of facilities that manufacture, 
process, pack, or hold food and are required to register under section 
415 of the FD&C Act (21 U.S.C. 350d). Section 419 of the FD&C Act (21 
U.S.C. 350h) addresses intentional adulteration in the context of 
fruits and vegetables that are raw agricultural commodities. Section 
420 of the FD&C Act (21 U.S.C. 350i) addresses intentional adulteration 
in the context of high risk foods and exempts farms except for farms 
that produce milk. FDA is implementing the intentional adulteration 
provisions in sections 418, 419, and 420 of the FD&C Act in this 
rulemaking.

Scope of Coverage of the Proposed Rule

    The subject of this proposed rule is protection of food against 
intentional adulteration caused by acts of terrorism. This proposed 
rule would apply to both domestic and foreign facilities that are 
required to register under section 415 of the FD&C Act. However, as 
explained in the remainder of this document and shown in Diagram 1 and 
Table 1, the proposed rule contains several exemptions. (The diagrams 
and table below are intended to illustrate the proposed scope and 
requirements of this rule, and do not include all aspects of the 
proposed regulation.) These exemptions are:
     The proposed rule would not apply to a qualified facility, 
except that the

[[Page 78015]]

facility would be required to provide for official review, upon 
request, documentation that was relied upon to demonstrate that the 
facility qualifies for this exemption. As proposed, a qualified 
facility would be: (1) A very small business (i.e., a business that has 
less than $10,000,000 in total annual sales of food, adjusted for 
inflation), or (2) a facility that meets two requirements, i.e., (a) 
During the 3-year period preceding the applicable calendar year, the 
average annual monetary value of the food manufactured, processed, 
packed or held at such facility that is sold directly to qualified end-
users (as defined in this part) during such period exceeded the average 
annual monetary value of the food sold by such facility to all other 
purchasers; and (b) the average annual monetary value of all food sold 
during the 3-year period preceding the applicable calendar year was 
less than $500,000, adjusted for inflation.
     This proposed rule would not apply to the holding of food, 
except the holding of food in liquid storage tanks.
     This proposed rule would not apply to the packing, re-
packing, labeling, or re-labeling of food where the container that 
directly contacts the food remains intact.
     This proposed rule would not apply to activities of a 
facility that are subject to section 419 of the Federal Food, Drug, and 
Cosmetic Act (Standards for Produce Safety).
     This proposed rule would not apply with respect to 
alcoholic beverages at a facility that meets certain conditions.
     This proposed rule would not apply to the manufacturing, 
processing, packing, or holding of food for animals other than man.
    We seek comment on these exclusions and whether additional 
exclusions are warranted.
BILLING CODE 4160-01-P

[[Page 78016]]

[GRAPHIC] [TIFF OMITTED] TP24DE13.026

BILLING CODE 4160-01-C

[[Page 78017]]



 Table 1--Scope of Intentional Adulteration and Proposed Exclusions and
                               Exemptions
------------------------------------------------------------------------
                                                    Brief rationale, and
                                 Coverage within          relevant
     Type of intentional      scope of proposed 21      corresponding
        adulteration                 CFR 121         section of the rule
                                                              *
------------------------------------------------------------------------
    I. Types of Intentional Adulteration Considered in this Proposed
                               Rulemaking
------------------------------------------------------------------------
1. Acts of disgruntled        Not within the scope  [ssquf] Not
 employees, consumers, or      of intentional        considered ``high
 competitors intended to       adulteration          risk'' because not
 attack the reputation of a    covered under         intended to cause
 company, and not to cause     proposed 21 CFR 121.  widespread,
 public health harm,                                 significant public
 although public health harm                         health harm.
 may occur.                                         [ssquf] See section
                                                     IV.E of this
                                                     document.
2. Economically motivated     Not within the scope  [ssquf] Considering
 adulteration (EMA) intended   of intentional        addressing as part
 to obtain economic gain,      adulteration          of hazard analysis
 and not to cause public       covered under         in a preventive
 health harm, although         proposed 21 CFR 121.  controls framework
 public health harm may                              where EMA is
 occur.                                              ``reasonably likely
                                                     to occur.''
                                                    [ssquf] See section
                                                     IV.F of this
                                                     document.
3. Acts intended to cause     Covered within        [ssquf] Considered
 massive public health harm,   scope, and is the     ``high risk''
 including acts of terrorism.  focus of proposed     because intent of
                               21 CFR 121.           the act is to cause
                                                     widespread,
                                                     significant public
                                                     health harm.
                                                    [ssquf] See section
                                                     IV.A of this
                                                     document.
------------------------------------------------------------------------
 II. Facilities or Operations Excluded or Exempted from Proposed 21 CFR
                                   121
------------------------------------------------------------------------
    Facility or Operation         Exclusion or      Brief rationale, and
                                Exemption (and any         relevant
                               associated modified      corresponding
                                  requirements)      section of the rule
                                                              *
------------------------------------------------------------------------
Activities that fall within   Excluded............  [ssquf] Activities
 the definition of ``farm''                          that occur on
 (as defined in 21 CFR Sec.                          produce farms are
  1.227).                                            not considered
                                                     ``high risk.''
                                                    [ssquf] Activities
                                                     that occur on dairy
                                                     farms are addressed
                                                     below.
                                                    [ssquf] Activities
                                                     that occur on other
                                                     farms are outside
                                                     the scope of 103,
                                                     105, and 106 of
                                                     FSMA.
                                                    [ssquf] See section
                                                     IV.B of this
                                                     document.
Transportation carriers.....  Excluded............  [ssquf]
                                                     Transportation of
                                                     bulk liquids is
                                                     addressed by
                                                     coverage of
                                                     shippers and
                                                     receivers.
                                                    [ssquf] Other
                                                     transportation
                                                     activities are not
                                                     considered ``high
                                                     risk.''
                                                    [ssquf] See section
                                                     IV.C of this
                                                     document.
------------------------------------------------------------------------
Activities that occur on      [ssquf] Fluid milk storage and loading
 dairy farms.                  appear to pose a significant
                               vulnerability.
                              [ssquf] We seek comment on practical and
                               effective approach to address this
                               vulnerability.
                              [ssquf] See section IV.H of this document.
------------------------------------------------------------------------
Qualified facility, as        Exempt, except must   [ssquf] Very small
 defined in proposed Sec.      provide for FDA       businesses are not
 121.3.                        review, upon          considered ``high
                               request,              risk.''
                               documentation        [ssquf] See section
                               relied on to          V.B.1 of this
                               demonstrate that      document.
                               the facility
                               qualifies for this
                               exemption.
Holding of food, except the   Exempt..............  [ssquf] Not
 holding of food in liquid                           considered ``high
 storage tanks.                                      risk'' because
                                                     these activities do
                                                     not fit within any
                                                     of the FDA-
                                                     identified key
                                                     activity types.
                                                    [ssquf] See section
                                                     V.B.2 of this
                                                     document.
------------------------------------------------------------------------
Packing, re-packing,          Exempt..............  [ssquf] Not
 labeling, or re-labeling of                         considered ``high
 food where the container                            risk'' because
 that directly contacts the                          these activities do
 food remains intact.                                not fit within any
                                                     of the FDA-
                                                     identified key
                                                     activity types.
                                                    [ssquf] See section
                                                     V.B.3 of this
                                                     document.
Activities of a facility      Exempt..............  [ssquf] Activities
 that are subject to                                 that occur on
 Standards for Produce                               produce farms are
 Safety (proposed 21 CFR                             not considered
 112).                                               ``high risk.''
                                                    [ssquf] See section
                                                     V.B.4 of this
                                                     document.
Alcoholic beverages at        Exempt..............  [ssquf] Alcoholic
 certain alcohol-related                             beverages at these
 facilities, and certain                             facilities are
 prepackaged food sold in                            outside the scope
 limited quantities along                            of 103, 105, and
 with alcoholic beverages at                         106 of FSMA.
 the same facilities (see                           [ssquf] See section
 proposed Sec.   121.5(e)).                          V.B.5 of this
                                                     document.
Manufacturing, processing,    Exempt..............  [ssquf] Not
 packing, or holding of food                         considered ``high
 for animals.                                        risk'' because
                                                     unlikely to impact
                                                     human health.
                                                    [ssquf] See section
                                                     V.B.6 of this
                                                     document.
------------------------------------------------------------------------
* Please see the corresponding sections of the rule identified in the
  column for a complete discussion of our analysis, rationale, and
  tentative conclusions related to the proposed exclusions or exemption.


[[Page 78018]]

Summary of the Major Provisions of the Proposed Rule

    This proposed rule would establish various food defense measures 
that an owner, operator, or agent in charge of a facility would be 
required to implement to protect against the intentional adulteration 
of food, as summarized in Diagram 2. Specifically:
     Prepare and implement a written food defense plan that 
includes actionable process steps, focused mitigation strategies, and 
procedures for monitoring, corrective actions, and verification 
(proposed Sec.  121.126).
     Identify any actionable process steps, using one of two 
procedures. FDA has analyzed vulnerability assessments conducted using 
the CARVER+Shock methodology and identified four key activity types: 
Bulk liquid receiving and loading; Liquid storage and handling; 
Secondary ingredient handling; and Mixing and similar activities. FDA 
has determined that the presence of one or more of these key activity 
types at a process step (e.g., manufacturing, processing, packing, or 
holding of food) indicates a significant vulnerability under section 
418 of the FD&C Act and that the food is at high risk of intentional 
adulteration caused by acts of terrorism under section 420 of the FD&C 
Act. Facilities may identify actionable process steps using the FDA-
identified key activity types as described in proposed Sec.  121.130(a) 
or conduct their own facility-specific vulnerability assessments as 
provided in proposed Sec.  121.130(b).
     Identify and implement focused mitigation strategies at 
each actionable process step to provide assurances that the significant 
vulnerability at each step will be significantly minimized or prevented 
and the food manufactured, processed, packed, or held by the facility 
will not be adulterated (proposed Sec.  121.135).
     Establish and implement procedures, including the 
frequency with which they are to be performed, for monitoring the 
focused mitigation strategies (proposed Sec.  121.140).
     Establish and implement corrective action procedures that 
must be taken if focused mitigation strategies are not properly 
implemented (proposed Sec.  121.145).
     Verify that monitoring is being conducted and appropriate 
decisions about corrective actions are being made; verify that the 
focused mitigation strategies are consistently implemented and are 
effectively and significantly minimizing or preventing the significant 
vulnerabilities; and conduct a reanalysis of the food defense plan 
(proposed Sec.  121.150).
     Ensure that personnel and supervisors assigned to 
actionable process steps receive appropriate training in food defense 
awareness and their respective responsibilities in implementing focused 
mitigation strategies (proposed Sec.  121.160).
     Establish and maintain certain records, including the 
written food defense plan; written identification of actionable process 
steps and the assessment leading to that identification; written 
focused mitigation strategies; written procedures for monitoring, 
corrective actions, and verification; and documentation related to 
training of personnel (proposed Sec. Sec.  121.301 to 121.325).
    As proposed, the effective date is 60 days after a final rule is 
published. However, we are providing for a longer timeline for 
facilities to come into compliance. Facilities, other than small and 
very small businesses, would have one year after the effective date to 
comply with proposed part 121. Small businesses (i.e., those employing 
fewer than 500 persons) would have 2 years after the effective date to 
comply with proposed part 121. Very small businesses (i.e., businesses 
that have less than $10,000,000 in total annual sales of food, adjusted 
for inflation) would be considered a qualified facility and would have 
3 years after the effective date to comply with proposed Sec.  
121.5(a).
BILLING CODE 4160-01-P

[[Page 78019]]

[GRAPHIC] [TIFF OMITTED] TP24DE13.027

BILLING CODE 4160-01-C

[[Page 78020]]

    In addition, we describe our current thinking and seek comment on 
other issues, including activities that occur on dairy farms and 
economically motivated adulteration. Finally, elsewhere in this issue 
of the Federal Register, FDA is publishing for comment its evaluation 
that identifies low-risk activities that occur at farm mixed-type 
facilities, with a specific focus on the risk presented by hazards that 
may be intentionally introduced by acts of terrorism.

Costs and Benefits

    As described in the Preliminary Regulatory Impact Analysis (PRIA), 
we estimate the annualized costs of the actions required by this 
proposed rule to be about $370 million. The benefits of these actions 
are a reduction in the possibility of illness, death, and economic 
disruption resulting from intentional adulteration of food. We are 
unable to quantify these benefits. However, we monetize the damage that 
various intentional adulteration scenarios might cause, and present a 
breakeven analysis showing the number of prevented attacks at which the 
benefits are larger than the costs.

                  Annualized Cost and Benefit Overview
------------------------------------------------------------------------
    All numbers are USD millions,
      annualized over 10 years           3% discount       7% discount
------------------------------------------------------------------------
Costs:
    Learning about Rule.............                $3                $3
    Mitigation Costs................                59                63
    Monitoring and Corrective Action               100               100
    Employee Training...............                 4                 5
    Documentation...................                 6                 6
                                     -----------------------------------
        Subtotal (Domestic cost)....               172               177
    Cost to Foreign Firms...........               185               190
                                     -----------------------------------
        Total.......................               357               367
                                     -----------------------------------
Benefits: Lower Chance of
 Intentional Adulteration...........             Unquantified.
------------------------------------------------------------------------

I. Introduction

    The FDA Food Safety Modernization Act (FSMA) (Pub. L. 111-353), 
signed into law on January 4, 2011, enables FDA to better protect 
public health by helping to ensure the safety and security of the food 
supply. FSMA enables us to focus more on preventing food safety 
problems rather than primarily reacting to problems after they occur. 
The law also provides us with new enforcement authorities to help us 
achieve higher rates of compliance with prevention- and risk-based 
safety standards and to better respond to and contain problems when 
they do occur. In addition, the law gives us important new tools to 
better ensure the safety of imported foods and directs us to build an 
integrated national food safety system in partnership with State, 
local, tribal, and territorial authorities.
    Section 103 of FSMA directs FDA to issue regulations establishing 
requirements for facilities that manufacture, process, pack or hold 
food and requires facilities to consider hazards that may be 
intentionally introduced, including by acts of terrorism. Section 106 
of FSMA requires FDA to issue regulations to protect food for which 
there is a high risk of intentional contamination and for which such 
intentional contamination could cause serious adverse health 
consequences or death to humans or animals. In addition, section 105 of 
FSMA directs FDA to issue regulations setting forth science-based 
minimum standards for the safe production and harvesting of produce, 
and requires that the rulemaking consider hazards that may be 
intentionally introduced, including by acts of terrorism.
    Efforts to protect against intentional adulteration require a shift 
in perspective from that applied to traditional food safety. In 
proposed rules entitled ``Current Good Manufacturing Practice and 
Hazard Analysis and Risk-Based Preventive Controls for Human Food'' (78 
FR 3646, January 16, 2013) (Docket No. FDA-2011-N-0920; hereafter 
referred to as ``the PC proposed rule''), ``Current Good Manufacturing 
Practice and Hazard Analysis and Risk-Based Preventive Controls for 
Food for Animals'' (78 FR 64736, October 29, 2013) (Docket No. FDA-
2011-N-0922; hereafter referred to as ``the Animal Food PC proposed 
rule''), and ``Standards for the Growing, Harvesting, Packing and 
Holding of Produce for Human Consumption'' (78 FR 3504, January 16, 
2013) (Docket No. FDA-2011-N-0921; hereafter referred to as ``the 
Produce Safety proposed rule''), FDA tentatively decided not to include 
requirements to address ``hazards that may be intentionally introduced, 
including by acts of terrorism'' (sections 418(b)(2) and 419(a)(3)(C) 
of the FD&C Act (21 U.S.C. 350g(b)(2) and 350h(a)(3)(C))) and to 
implement sections 103 and 105 of FSMA regarding such hazards in a 
separate rulemaking (this proposed rule). As noted in those proposed 
rules, FDA tentatively concluded that intentional adulteration, which 
is not addressed by traditional Hazard Analysis and Critical Controls 
Point (HACCP) or other food safety systems, likely will require 
different kinds of controls. FDA is taking the action described in this 
proposed rule to implement the intentional adulteration provisions in 
sections 103, 105, and 106 of FSMA.

II. Background

    Intentional adulteration of the food supply can result in 
catastrophic public health consequences, widespread public fear, loss 
of public confidence in the safety of food and the ability of 
government to ensure food safety, and significant adverse economic 
impacts, including disruption of trade (Ref. 1, Ref. 2, Ref. 3, Ref. 
4). Acts of intentional adulteration may take several forms, including 
acts of terrorism; acts of disgruntled employees, consumers, or 
competitors; and economically motivated adulteration. Acts of terrorism 
are associated with an intent to cause massive public health harm and, 
to a lesser extent, economic disruption (Ref. 5, Ref. 2, Ref. 3, Ref. 
6). Acts of disgruntled employees, consumers, or competitors are 
generally understood to be directed at attacking the reputation of the 
company and not at public health harm. The primary purpose of 
economically motivated adulteration is to obtain economic gain, and not 
to impact public health (Ref. 7, Ref. 8, Ref. 9), although public 
health harm may occur (Ref. 10, Ref. 11).

[[Page 78021]]

    ``Food defense'' and ``food security'' are terms that are sometimes 
used interchangeably. We use the term ``food defense'' to refer to the 
effort to protect food from acts of intentional adulteration where 
there is an intent to cause public health harm and economic disruption. 
``Food security'' is defined by the World Health Organization (WHO) to 
mean ``when all people at all times have access to sufficient, safe, 
nutritious food to maintain a healthy and active life'' (Ref. 12). To 
avoid confusion, we use the term ``food defense'' and not the term 
``food security'' in the context of intentional adulteration.

A. Incidents of Intentional Adulteration of Food

    Several cases of intentional adulteration with the intent to cause 
public health harm and economic disruption in the United States have 
been documented. For example, in 1984, in an attempt to prevent the 
general public from voting in the local elections, members of a local 
religious commune in The Dalles, OR, intentionally contaminated food in 
restaurants with Salmonella. A total of 751 people became ill and 45 
were hospitalized (Ref. 4). In another incident, in 1996, 12 laboratory 
workers at a large medical facility in Texas became ill from consuming 
anonymously donated pastries that were intentionally contaminated with 
Shigella dysenteriae type 2, which was later discovered to have 
originated from the facility's stock culture (Ref. 13). In 2009, two 
related incidents resulted in 49 individuals reporting rapid and acute 
onset of gastrointestinal and neurological symptoms after eating meals 
at a restaurant in Lenexa, KS. Investigations concluded that the 
illnesses were caused by methomyl (an insecticide) poisoning associated 
with the consumption of salsa at the restaurant. Two former employees 
of the restaurant were found guilty of intentionally contaminating the 
salsa (Ref. 14).
    A widespread incident of economically motivated adulteration 
occurred in China in 2008. Some Chinese milk firms added melamine, a 
nitrogen-rich industrial by-product, to diluted dairy products to 
increase the apparent protein content. This adulteration resulted in 
significant public health consequences, with more than 290,000 ill 
infants and 6 deaths in China. In addition, this incident caused 
significant economic disruption within the Chinese dairy industry, with 
estimates approaching $3 billion in loss to industry (Ref. 10, Ref. 
11).

B. Interagency Approach to Food Defense

1. Homeland Security Presidential Directives and Presidential Policy 
Directives for the Food and Agriculture Sector
    Intelligence gathered since the attacks on the United States on 
September 11, 2001, indicates that terrorist organizations have 
discussed contamination of the food supply as a means to harm U.S. 
citizens and disrupt the global economy (Ref. 15). In response, FDA, 
along with the Centers for Disease Control and Prevention (CDC), the 
United States Department of Agriculture (USDA), the Department of 
Homeland Security (DHS), the Federal Bureau of Investigation (FBI), the 
Environmental Protection Agency (EPA), the Department of Defense, the 
Department of Energy, the Department of Commerce, and the Department of 
the Interior, as well as with State, local, tribal, territorial, and 
private sector partners have coordinated efforts to prevent, prepare 
for, and respond to threats against the food supply. Many of these 
efforts were accomplished in accordance with applicable Homeland 
Security Presidential Directives (HSPD), specifically HSPD-7, HSPD-8, 
and HSPD-9, and Presidential Policy Directives (PPD), specifically PPD-
8 and PPD-21 (Ref. 16, Ref. 17, Ref. 18, Ref. 19, Ref. 20). In 
accordance with these directives, FDA, USDA, DHS, State and local 
governments and the food industry collaborated to conduct vulnerability 
assessments of a variety of products and processes within the food and 
agriculture sector.
2. The Evolution of Vulnerability Assessments
    Initially, FDA used Operational Risk Management (ORM), which is a 
vulnerability assessment methodology that uses a six-step sequence of 
identifying hazards and reducing the potential for negative public 
health consequences. The ORM process resulted in three main outcomes: 
(1) A calculation of risk by combining assessments of severity and 
probability of an attack on a specific food; (2) calculations for 
specific contaminants and specific food processes or related 
activities; and (3) a categorization of specific food/contaminant/food 
process or related activity into a high, medium, or low risk scheme.
    At first, ORM-based assessments were focused on reducing large 
public health consequences of attacks on the food supply. FDA realized 
that other significant considerations (i.e., large economic 
disruptions, public alarm, loss of confidence in the food supply, and 
interruption of the food stream) warranted incorporation into the 
vulnerability assessment calculus. To incorporate these considerations, 
FDA and USDA's Food Safety and Inspection Service (FSIS) adapted a 
military targeting tool known as CARVER to assess vulnerabilities of 
the food and agriculture sector. CARVER is an acronym for the following 
six attributes used to evaluate the attractiveness of a target for 
attack:
     Criticality--measure of public health and economic impacts 
of an attack;
     Accessibility--ability to physically access and egress 
from target;
     Recuperability--ability of a system to recover from an 
attack;
     Vulnerability--ease of accomplishing an attack;
     Effect--amount of direct loss from an attack as measured 
by loss in production; and
     Recognizability--ease of identifying a target.
    A seventh attribute, ``Shock'', was added to the original six 
attributes to assess the combined health, economic, and psychological 
impacts of an attack on the food industry. ORM and CARVER+Shock 
assessment conclusions were consistent; however, the CARVER+Shock 
methodology improved vulnerability assessment efforts because its 
process allowed for the identification and estimation of economic and 
psychological impacts throughout the food system.
    In 2005, the Strategic Partnership Program Agroterrorism (SPPA), a 
public-private cooperative effort was established by FDA, USDA, FBI, 
and DHS, in partnership with State and industry partners. The intent of 
the SPPA Initiative was to collect the necessary data to identify food 
and agriculture sector-specific vulnerabilities using the CARVER+Shock 
method, develop mitigation strategies, identify research gaps, and 
increase coordination between government and industry partners. The 
SPPA initiative ran from 2005 to 2008, resulting in vulnerability 
assessments of 36 food products and processes (Ref. 21). The SPPA 
Initiative was a significant step towards identifying vulnerabilities, 
mitigation strategies, and research needs within the food and 
agriculture industries. This initiative also provided Federal, State, 
and local government agencies with an in-depth look at the 
vulnerabilities that may be associated with the food and agriculture 
industry, and helped enhance communication among industry, government, 
and law enforcement

[[Page 78022]]

stakeholders concerned with the protection of the U.S. food supply. 
Since the conclusion of the SPPA Initiative, we have conducted 
additional vulnerability assessments, which continue to help inform our 
research and policy.

C. Resources for the Food Sector

    FDA has issued guidance documents and developed other resources to 
assist industry in their efforts to protect the food supply against 
intentional adulteration. In 2003, FDA issued five guidance documents 
covering food defense preventive measures for various segments of the 
food and cosmetic industry: (1) Guidance for Industry: Food Producers, 
Processors, and Transporters: Food Security Preventive Measures 
Guidance (Ref. 22); (2) Guidance for Industry: Importers and Filers: 
Food Security Preventive Measures Guidance (Ref. 23); (3) Guidance for 
Industry: Dairy Farms, Bulk Milk Transporters, Bulk Milk Transfer 
Stations and Fluid Milk Processors: Food Security Preventive Measures 
Guidance (Ref. 24); (4) Retail Food Stores and Food Service 
Establishments: Food Security Preventive Measures Guidance (Ref. 25); 
and(5) Cosmetics Processors and Transporters of Cosmetics Security 
Preventive Measures Guidance (Ref. 26). These guidance documents 
provide FDA's recommendations for best practices in food defense, and 
describe preventive measures that establishments can take to minimize 
the risk of intentional adulteration of food. We updated the guidance 
documents in 2007 to include a self-assessment tool that guides the 
user through an assessment of recommended preventive measures to 
identify those most applicable to the facility.
    FDA also has made available other resources to help industry 
identify and mitigate potential vulnerabilities for intentional 
adulteration. These include:
     The ``ALERT'' program,
     The ``Employees FIRST'' training tool,
     The ``CARVER+Shock Vulnerability Assessment'' software 
tool,
     The ``Mitigations Strategies Database,''
     The ``Food Defense Plan Builder'' software tool,
     The Food Related Emergency Exercise Bundle, and
     The ``Food Defense 101'' training courses.
    We describe each briefly in this section of the document.
    The ALERT program, originally released in 2006, is an educational 
program intended to raise the awareness of State and local governments 
and industry regarding food defense (Ref. 27). ALERT identifies five 
key elements that industry can use in food defense planning:
     A--How do you ASSURE that the supplies and ingredients you 
use are from safe and secure sources?
     L--How do you LOOK after the security of the products and 
ingredients in your facility?
     E--What do you know about your EMPLOYEES and people coming 
in and out of your facility?
     R--Could you provide REPORTS about the security of your 
products while under your control?
     T--What do you do and who do you notify if you have a 
THREAT or issue at your facility, including suspicious behavior?
    Similarly, the Employees FIRST educational tool, originally 
released in 2008, is a food defense awareness training program for 
front-line food industry workers about the risk of intentional 
adulteration and the actions they can take to identify and reduce these 
risks (Ref. 28). This tool identifies the following five key elements:
     F--Follow company food defense plan and procedures;
     I--Inspect your work area and surrounding areas;
     R--Recognize anything out of the ordinary;
     S--Secure all ingredients, supplies, and finished product; 
and
     T--Tell management if you notice anything unusual or 
suspicious.
    The CARVER+Shock Vulnerability Assessment software tool, originally 
released in 2007, helps users conduct vulnerability assessments for 
their establishments to identify and prioritize the ``critical nodes,'' 
(also known as critical process steps) the potential targets vulnerable 
to intentional adulteration attacks (Ref. 29). It guides users through 
a series of questions to determine the vulnerability of each of the 
nodes within their facility. After the vulnerabilities are identified, 
the software helps users to identify mitigation strategies for reducing 
the risk of intentional adulteration. Using the software tool, the user 
can focus resources on protecting the most susceptible points in their 
system.
    The Mitigation Strategies Database (MSD), originally released in 
2011, is a database of mitigation strategies that can be applied to 
different steps in a food operation to reduce the risk of intentional 
adulteration (Ref. 30). The database is searchable by key words and 
processing steps common to agriculture and food operations (e.g., 
growing, harvesting, packing, manufacturing, processing, and holding). 
See also the discussion in section V.C.3 of this document.
    The Food Defense Plan Builder (FDPB) software tool, released in 
2013, is a user-friendly computer software program designed to assist 
owners and operators of food facilities in developing food defense 
plans for their facilities (Ref. 31). In addition to providing new 
functionality for food defense planning and implementation, the FDPB 
software tool harnesses our food defense guidance documents, 
CARVER+Shock Vulnerability Assessment software tool, and the MSD into a 
single application.
    The Food Related Emergency Exercise Bundle (FREE-B), which FDA 
released in 2011 and developed in collaboration with CDC and FSIS and 
USDA's Animal and Plant Health Inspection Service (APHIS), is a 
compilation of scenarios based on both intentional and unintentional 
food contamination events. The FREE-B is designed to assist the food 
industry, government regulatory agencies, and public health 
organizations in assessing existing food emergency response plans, 
protocols, and procedures (Ref. 32). The FREE-B tool is designed to 
allow an individual agency or industry entity to test its own plans, 
protocols, and procedures independently. Additionally, the tool allows 
multiple jurisdictions and organizations (e.g., medical community, 
private sector, law enforcement, and first responder communities) to 
jointly conduct exercises. The tool is a set of five scenarios, each of 
which contains a Facilitator's Guide, a Lead Planner's guide, and a 
Situation Manual.
    Finally, our food defense training courses, entitled ``Food Defense 
101'' and released in 2013, reflect FDA's current thinking on how to 
minimize the likelihood and impact of incidents of intentional 
adulteration (Ref. 27). Four courses integrated into one module 
include: (1) Food Defense Awareness for Professionals, (2) Food Defense 
Awareness for Frontline Employees, (3) FDA Regulations, and (4) ALERT 
for owners and operators of food facilities. The ALERT program is 
described previously. The other programs are described in section V.C.7 
of this document.

D. Outreach

    We have conducted food defense awareness outreach to international 
and domestic stakeholders. Beginning in 2008, under the auspices of the 
Asia-Pacific Economic Cooperation (APEC), we collaborated with the U.S. 
Department of State, USDA's Foreign Agricultural Service, and FSIS to 
launch the Food Defense Pilot Program for the

[[Page 78023]]

APEC member countries. The Pilot Program was developed with the intent 
to implement the food defense principles endorsed by the APEC Counter 
Terrorism Task Force. The goal of the program was to build and foster 
global capacity to prevent and protect against deliberate tampering and 
intentional contamination of the food supply through information 
sharing, outreach, and technical assistance on food defense, thereby 
safeguarding food trade and public health across the APEC member 
countries. In addition, to support the international capacity building 
goals of FSMA, we conducted several workshops in various countries to 
discuss topics such as increasing food defense awareness, developing 
food defense plans, conducting vulnerability assessments, and 
implementing mitigation strategies.
    In 2013, we increased our domestic outreach activities with a 
series of workshops in the United States. Using a similar format and 
agenda as the international workshops, we conducted 1-day food defense 
awareness workshops to provide industry, State and local governments, 
and academic partners with information on food defense, and share tools 
and resources. During these workshops, we shared information on how to 
use the new FDPB software tool to develop a comprehensive food defense 
plan. These workshops also served as a forum to discuss food defense 
concerns, understand industry's current practices, and share ideas for 
collaboration to better protect the food supply against intentional 
adulteration. We plan to continue to hold additional workshops in 2014.

E. Industry Standards

    Guidelines accompanying industry standards in the United States 
have addressed intentional adulteration of food. For example, the 
Global Food Safety Initiative's (GFSI) Guidance Document Sixth Edition 
(Ref. 33) addresses food defense. Some organizations that own and 
manage industry standards have worked or are working to incorporate 
food defense requirements into their standards to meet this GFSI 
guideline. For example, the Safe Quality Foods (SQF) Code, edition 7.1, 
issued in 2013, is a process and product certification standard that 
specifies various food defense elements, including that the methods, 
responsibility, and criteria for preventing food adulteration caused by 
a deliberate act of sabotage or terrorist-like incident shall be 
documented, implemented and maintained (Ref. 34). Another example of 
industry standards that incorporate food defense elements is the 
International Featured Standards (IFS) Food Version 6 Standard, which 
specifies that areas critical to security be identified, food defense 
hazard analysis and assessment of associated risks be conducted 
annually or upon changes that affect food integrity, and an appropriate 
alert system be defined and periodically tested for effectiveness (Ref. 
35).

F. International Food Defense Guidelines

    In 2008, WHO issued its ``Terrorist Threats to Food--Guidelines for 
Establishing and Strengthening Prevention and Response Systems'' to 
provide policy guidance to its Member States for integrating 
consideration of deliberate acts of sabotage of food into existing 
prevention and response programs (Ref. 6). WHO uses the term ``food 
terrorism'' and defines it as ``an act or threat of deliberate 
contamination of food for human consumption with biological, chemical 
and physical agents or radionuclear materials for the purpose of 
causing injury or death to civilian populations and/or disrupting 
social, economic or political stability.'' Focusing on the two key 
strategies of prevention and response, WHO recommends that all segments 
of the food industry consider the development of security and response 
plans for their establishments, proportional to the threat and their 
resources. The guidelines state that the key to preventing food 
terrorism is enhancing existing food safety programs and implementing 
reasonable security measures on the basis of vulnerability assessments. 
The guidelines further state that the most vulnerable foods, food 
ingredients, and food processes should be identified, including: the 
most readily accessible food processes; foods that are most vulnerable 
to undetected tampering; foods that are the most widely disseminated or 
spread; and the least supervised food production areas and processes.
    Other national governments, including Australia, China, France, 
Germany, and the United Kingdom, also have issued guidelines to assist 
their food industry stakeholders in protecting food against intentional 
adulteration (Ref. 5, Ref. 36, Ref. 37, Ref. 38, Ref. 39).

III. Legal Authority

    FDA is proposing this regulation under the FD&C Act as amended by 
FSMA. Under sections 103 and 106 of FSMA, FDA is proposing the 
requirements applicable to the owner, operator, or agent in charge of a 
facility required to register under section 415 of the FD&C Act. Under 
section 106 of FSMA, FDA is proposing the requirements applicable to 
activities at some facilities not covered by section 103 of FSMA (i.e., 
activities subject to and in compliance with the juice and seafood 
HACCP regulations in parts 120 and 123 (21 CFR parts 120 and 123) and 
the manufacturing, processing, packing, or holding of a dietary 
supplement in compliance with certain requirements). Under section 
701(a) of the FD&C Act (21 U.S.C. 371(a)), FDA is authorized to issue 
regulations for the efficient enforcement of the FD&C Act.

A. Section 103 of FSMA

    Section 103 of FSMA, Hazard Analysis and Risk-Based Preventive 
Controls, amends the FD&C Act to create a new section 418 that mandates 
rulemaking. Section 418(n)(1)(A) of the FD&C Act requires that the 
Secretary of Health and Human Services issue regulations ``to establish 
science-based minimum standards for conducting a hazard analysis, 
documenting hazards, implementing preventive controls, and documenting 
the implementation of the preventive controls . . ..'' Section 
418(n)(1)(B) of the FD&C Act requires that the regulations define the 
terms ``small business'' and ``very small business,'' taking into 
consideration the study of the food processing sector required by 
section 418(l)(5) of the FD&C Act. Further, section 103(e) of FSMA 
creates a new section 301(uu) in the FD&C Act (21 U.S.C. 331(uu)) to 
prohibit ``[t]he operation of a facility that manufactures, processes, 
packs, or holds food for sale in the United States if the owner, 
operator, or agent in charge of such facility is not in compliance with 
section 418 [of the FD&C Act].''
    In addition to rulemaking requirements, section 418 of the FD&C Act 
contains requirements applicable to the owner, operator, or agent in 
charge of a facility required to register under section 415 of the FD&C 
Act. Section 418(a) of the FD&C Act is a general provision that 
requires the owner, operator, or agent in charge of a facility to 
evaluate the hazards that could affect food manufactured, processed, 
packed, or held by the facility, identify and implement preventive 
controls, monitor the performance of those controls, and maintain 
records of the monitoring. In addition to the general requirements in 
section 418(a) of the FD&C Act, sections 418(b) to (i) of the FD&C Act 
contain more specific requirements applicable to facilities, including 
several provisions explicitly directed at intentional adulteration. For 
example, section 418(b)(2) of the FD&C Act specifies that the owner, 
operator, or

[[Page 78024]]

agent in charge of a facility shall identify and evaluate hazards that 
may be intentionally introduced, including by acts of terrorism. 
Section 418(c)(2) of the FD&C Act specifies that the owner, operator, 
or agent in charge of a facility shall identify and implement 
preventive controls to provide assurances that any hazards that relate 
to intentional adulteration will be significantly minimized or 
prevented and addressed, consistent with section 420 of the FD&C Act. 
In sections IV and V of this document, we discuss proposed requirements 
(proposed subparts C and D of part 121) that would implement these 
provisions of section 418 of the FD&C Act.
    Sections 418(j) to (m) of the FD&C Act and sections 103(c)(1)(D) 
and (g) of FSMA provide authority for certain exemptions and 
modifications to the requirements of section 418 of the FD&C Act. These 
include provisions related to seafood and juice HACCP, and low-acid 
canned food (section 418(j) of the FD&C Act); activities of facilities 
subject to section 419 of the FD&C Act (Standards for Produce Safety) 
(section 418(k)); qualified facilities (section 418(l)); facilities 
that are solely engaged in the production of food for animals other 
than man, the storage of raw agricultural commodities (other than 
fruits and vegetables) intended for further distribution or processing, 
or the storage of packaged foods that are not exposed to the 
environment (section 418(m)); facilities engaged only in certain low-
risk on-farm activities on certain foods conducted by small or very 
small businesses (section 103(c)(1)(D) of FSMA), and dietary 
supplements (section 103(g) of FSMA). In sections IV and V of this 
document, we discuss the related proposed provisions that would 
implement these provisions of section 418 of the FD&C Act and section 
103 of FSMA.

B. Section 106 of FSMA

    Section 106 of FSMA, Protection Against Intentional Adulteration, 
amends the FD&C Act to create a new section 420, which mandates 
rulemaking. Section 420 of the FD&C Act requires FDA to issue 
regulations to protect against the intentional adulteration of food. 
Section 420(b)(1) of the FD&C Act requires that such regulations are to 
specify how a person is to assess whether the person is required to 
implement mitigation strategies or measures intended to protect against 
the intentional adulteration of food. Section 420(b)(2) of the FD&C Act 
requires that the regulations specify appropriate science--based 
mitigation strategies or measures to prepare and protect the food 
supply chain at specific vulnerable points, as appropriate. Section 
420(c) of the FD&C Act provides that such regulations are to apply only 
to food for which there is a high risk of intentional adulteration and 
for which such intentional adulteration could cause serious adverse 
health consequences or death to humans or animals. Section 420(c)(1) 
provides that such foods are to include those for which FDA has 
identified clear vulnerabilities. Section 420(d) of the FD&C Act limits 
applicability on farms to farms that produce milk. Further, section 
106(d) of FSMA creates a new section 301(ww) in the FD&C Act to 
prohibit ``[t]he failure to comply with section 420 [of the FD&C 
Act].'' We are proposing all of the provisions under section 420 of the 
FD&C Act.

C. Intrastate Activities

    FDA tentatively concludes that the provisions in the proposed rule 
should be applicable to activities that are intrastate in character. 
Facilities are required to register under section 415 of the FD&C Act 
regardless of whether the food from the facility enters interstate 
commerce (Sec.  1.225(b)). The plain language of section 418 of the 
FD&C Act applies to facilities that are required to register under 
section 415 of the FD&C Act (section 418(o)(2)) and does not exclude a 
facility because food from such a facility is not in interstate 
commerce. Similarly, the plain language of section 420 of the FD&C Act 
requires FDA to issue regulations to protect against the intentional 
adulteration of food and does not include a limitation to interstate 
commerce. Further, the prohibited act provisions in sections 301(uu) 
and (ww) of the FD&C Act (21 U.S.C. 331(uu) and (ww)) do not require an 
interstate commerce nexus. Notably, other subsections in section 301 of 
the FD&C Act, and section 304 of the FD&C Act (21 U.S.C. 334) 
demonstrate that Congress has included a specific interstate commerce 
nexus in the provisions of the FD&C Act when that is its intent. 
Accordingly, it is reasonable to interpret sections 418, 420, 301(uu) 
and (ww) of the FD&C Act as not limiting the application of the 
proposed rule only to those facilities with a direct connection to 
interstate commerce. However, we seek comment on this interpretation 
and potential alternatives.

IV. Regulatory Approach

A. Framework of the Rule

    This proposed regulation implements three provisions of FSMA that 
relate to the intentional adulteration of food. Section 103 of FSMA 
addresses intentional adulteration in the context of facilities that 
manufacture, process, pack, or hold food and are required to register 
under section 415 of the FD&C Act. Section 105 of FSMA addresses 
intentional adulteration in the context of fruits and vegetables that 
are raw agricultural commodities. Section 106 of FSMA addresses 
intentional adulteration in the context of high risk foods and exempts 
farms except for farms that produce milk.
1. Scope of Intentional Adulteration Covered by this Rule
    As noted in section I of this document, acts of intentional 
adulteration may take several forms, including: (1) Acts of terrorism; 
(2) acts of disgruntled employees, consumers, or competitors; and (3) 
economically motivated adulteration. With regard to intentional 
adulteration from acts of terrorism, we are proposing to require 
certain facilities covered by this rule to address significant 
vulnerabilities by implementing focused mitigation strategies at 
actionable process steps. While we refer to the protection of the food 
supply from ``acts of terrorism'' throughout this rule, we expect our 
proposed approach and the proposed implementation of focused mitigation 
strategies would generally address acts intended to cause massive 
public health harm and, to a lesser extent, economic disruption, 
whether committed by terrorists, terrorist organizations, individuals, 
or groups of individuals. For the reasons described in section IV.E of 
this document, we have tentatively concluded not to propose additional 
requirements for the protection of food against intentional 
adulteration caused by acts of disgruntled employees, consumers, or 
competitors. We describe our approach to address economically motivated 
adulteration in section IV.F of this document, and seek comment on our 
current thinking on this issue.
2. Identification of Key Activity Types
    Terrorist attacks on the U.S. food supply have been exceedingly 
rare. However, vulnerability assessments performed by FDA, USDA, DHS, 
and FBI, under the SPPA Initiative (Ref. 21), show that an attack could 
have devastating public health and economic consequences. Because such 
an attack is a low probability but potentially exceedingly high 
consequence event, we have tentatively determined that requirements 
should focus on those facilities and process steps within those 
facilities that pose the greatest risk. To

[[Page 78025]]

assess this risk, FDA and USDA, in collaboration with DHS, FBI, and 
State and local government and industry partners, performed 
vulnerability assessments using the CARVER+Shock methodology. This 
methodology is specifically tailored to assess the risk of a terrorist 
attack and is different from an assessment of risk posed by food safety 
hazards (i.e., unintentional adulteration).
    As discussed in section V.C.2 of this document, based on an 
analysis of the vulnerability assessments that FDA has conducted using 
the CARVER+Shock methodology, we have identified four key activity 
types: Bulk liquid receiving and loading; Liquid storage and handling; 
Secondary ingredient handling; and Mixing and similar activities. FDA 
has tentatively determined that the presence of one or more of these 
key activity types at a process step (e.g., manufacturing, processing, 
packing, or holding of food) indicates a significant vulnerability 
under section 418 of the FD&C Act and that the food is at high risk of 
intentional adulteration caused by acts of terrorism under section 420 
of the FD&C Act. We seek comment on the inclusion of these key activity 
types.
    Designation of these key activity types would serve two purposes. 
First, it would provide a facility with a means to assess whether it is 
required to implement focused mitigation strategies or measures 
intended to protect against intentional adulteration under section 
420(b)(1) of the FD&C Act. Second, it would assist a facility subject 
to section 418 of the FD&C Act with the performance of a hazard 
analysis to identify and evaluate hazards that may be intentionally 
introduced by acts of terrorism, in accordance with section 418(b)(2).
    Facilities would be able to determine whether their operations 
involve one or more of the key activity types or choose to perform a 
vulnerability assessment. Our experience is that the most challenging 
part of developing a system of controls for intentional adulteration 
related to terrorism is identifying the points in the food operation 
that are most vulnerable to attack by performing a vulnerability 
assessment. By using the FDA-identified key activity types, facilities 
would be able to concentrate their efforts on the identification of 
appropriate focused mitigation strategies and the development and 
implementation of the HACCP-type system for ensuring that those 
strategies are consistently and effectively implemented.
3. Requirement for a HACCP-Type System of Controls
    We have tentatively concluded that a preventive controls approach 
like the one we proposed for the systematic control of food safety 
hazards in the PC proposed rule is the most effective means of ensuring 
that the focused mitigation strategies are consistently applied once 
the significant vulnerabilities are identified and appropriate focused 
mitigation strategies are developed. The evolution and advantages of 
this system, derived from the HACCP methodology, is discussed in detail 
in section II.C of the PC proposed rule. The application of HACCP-type 
controls for ensuring the implementation of food defense mitigation 
strategies is consistent with the approach taken in Publicly Available 
Specification (PAS) 96, developed by the Centre for the Protection of 
National Infrastructure in collaboration with the British Standards 
Institution, entitled ``The Threat Assessment Critical Control Point 
(TACCP) Approach'' (Ref. 5). It is also consistent with WHO 
recommendations on protection against intentional adulteration (Ref. 
6). We request comment on the appropriateness of a HACCP-type system to 
ensure that mitigation strategies designed to significantly minimize or 
prevent intentional adulteration related to terrorism and whether there 
are approaches that would be more suitable.
    Section 418 of the FD&C Act exempts several kinds of activities 
(e.g., those related to seafood, juice, dietary supplements, low-acid 
canned food [for certain microbiological hazards]). These activities 
are subject to preventive control-type regulations that address food 
safety, but not food defense, concerns. Section 420 of the FD&C Act 
instructs FDA to issue regulations to require that science-based 
mitigation strategies or measures be applied to foods that are at high 
risk of intentional adulteration. The exemptions set out in section 418 
of the FD&C Act are not applicable to the provisions of section 420 of 
the FD&C Act. We also have tentatively determined that some activities 
that are not subject to section 418 of the FD&C Act that involve 
manufacturing, processing, packing, or holding of food are likely to 
involve one of the key activity types (e.g., juice manufacturing, 
breaded seafood manufacturing, and mixing activity in a low-acid canned 
food process). Based on our tentative conclusion that the HACCP-type 
system in section 418 of the FD&C Act is generally appropriate for 
application to intentional adulteration related to terrorism, this same 
system would be required for these activities. Applying the same 
regulatory framework under sections 418 and 420 of the FD&C Act would 
facilitate a concise and consistent approach to protection against 
intentional adulteration of food and the efficient enforcement of the 
requirements. Further, this approach would be consistent with the 
approach for unintentional adulteration that many of these facilities 
(those subject to section 418 of the FD&C Act relative to the control 
of food safety hazards) would already be required to take for 
unintentional hazards under the PC proposed rule.
    We acknowledge that regulation of entities in the food production 
system (in this case, facilities) to reduce the risk of intentional 
adulteration of food caused by acts of terrorism is, essentially, 
without precedent. Such an endeavor is further complicated by the low 
probability and potentially high impact nature of such an attack which 
makes estimating potential public health benefits and establishing an 
appropriate threshold for requiring action difficult. We are further 
challenged by the paucity of data on the extent to which facilities 
have already implemented programs to mitigate this risk, and the 
effectiveness of various strategies to prevent intentional adulteration 
of food caused by acts of terrorism.
    In developing this proposed rule we have relied on our experience 
in both implementing preventive control schemes targeting unintentional 
food safety hazards as well as working with the U.S. intelligence 
community on the threat of a terrorist attack on the food and 
agriculture sector, including performing vulnerability assessments and 
developing guidance for industry. While these activities have provided 
us with a useful foundation on which to develop this proposed rule, the 
challenges described previously remain. We request comment on our 
proposed approach, including on the following issues:
     From which entities would implementation of measures to 
protect against intentional adulteration derive the greatest benefit to 
public health protection? How could this proposed regulation be 
modified to better target such entities?
     Would it be feasible to require measures to protect 
against intentional adulteration only in the event of a credible 
threat? If so, would such an approach be consistent with the 
intentional adulteration provisions of FSMA? How would such 
requirements

[[Page 78026]]

be communicated to industry in a timely and actionable manner?
     What is an appropriate level of public health protection 
with respect to intentional adulteration, considering the intentional 
adulteration provisions of FSMA?
     Are there other ways to further focus the scope of the 
rule (see also section IV.I of this document)?
4. Compliance Dates
    Section 103(i)(1) of FSMA, General Rule, provides that ``[t]he 
amendments made by this section shall take effect 18 months after the 
date of enactment'' (i.e., by July 4, 2012). Section 103(i)(2) of FSMA, 
Flexibility for Small Businesses, provides that ``[n]otwithstanding 
paragraph (1),'' the amendments made by this section ``shall apply'' to 
a small business and very small business beginning on the date that are 
6 months and 18 months, respectively, ``after the effective date'' of 
FDA's final regulation. Section 106 of FSMA does not contain similar 
language. FDA is implementing the amendments made by sections 103 and 
106 of FSMA to the FD&C Act, as they relate to intentional 
adulteration, through this rulemaking.
    We have tentatively concluded that it is appropriate to provide a 
sufficient time period following publication of the final regulation 
for facilities to come into compliance with proposed part 121. FDA 
recognizes that it can take time to develop and implement a food 
defense plan that would require, among other things, identification of 
actionable process steps, implementation of focused mitigation 
strategies, and monitoring of focused mitigation strategies.
    FDA is proposing that the final rule would be effective 60 days 
after publication in the Federal Register, with staggered compliance 
dates, consistent with the proposed effective dates in the PC proposed 
rule and Produce Safety proposed rule. Similarly, we recognize that 
businesses of all sizes may need more time to comply with the new 
requirements established under FSMA. As noted in section VII of the PC 
proposed rule, FDA believes that it is reasonable to allow for 1 year 
after the date of publication of the final rule for businesses other 
than small and very small businesses to come into compliance with the 
new requirements established under FSMA. FDA also believes that it is 
reasonable to allow for 2 years after the date of publication of the 
final rule for small businesses to come into compliance with the new 
requirements established under FSMA, and 3 years after the date of 
publication of the final rule for very small businesses to come into 
compliance with the new requirements established under FSMA.
    Therefore, as proposed, facilities, other than small and very small 
businesses, that are subject to part 121 would have 1 year after the 
effective date to comply with proposed part 121. Small businesses would 
have 2 years after the effective date to comply with proposed part 121 
(see section V.A of this document for a discussion of the proposed 
definition of a ``small business''). With respect to very small 
businesses, we are proposing to exempt qualified facilities, which 
include very small businesses, from the requirements of proposed part 
121, except that such facilities must, upon request, provide for 
official review documentation that was relied upon to demonstrate that 
the facility meets this exemption. Very small businesses then would 
have 3 years after the effective date to comply with proposed Sec.  
121.5(a). FDA intends to work closely with the food industry, extension 
and education organizations, and State partners to develop any 
necessary additional tools and training programs needed to facilitate 
implementation of this rule.

B. Activities That Occur on Produce Farms

    Section 419 of the FD&C Act requires FDA to issue regulations to 
establish science-based minimum standards for the safe production and 
harvesting of fruits and vegetables. In developing these regulations, 
the Act requires us to consider, among others, those hazards that may 
be intentionally introduced, including by acts of terrorism (section 
419(a)(3)(C) and (c)(1)(A) of the FD&C Act). Note that neither section 
418 of the FD&C Act nor section 420 of the FD&C Act apply to these 
activities. Section 420 of the FD&C Act specifically exempts farms, 
except those that produce milk, and section 418 of the FD&C Act exempts 
activities of facilities subject to section 419 of the FD&C Act.
    In implementing section 419 of the FD&C Act, we considered the 
risks posed by a terrorist attack on the kinds of activities that occur 
on produce farms. We considered those activities that fall within the 
definition of ``farm'' (as defined in 21 CFR 1.227) (e.g., planting, 
tilling, irrigating, treating with pesticides, harvesting, drying for 
purposes of storing or transporting, hydro-cooling, packing, 
refrigerating, waxing, shelling, sifting, removing leaves, stems and 
husks, culling, shelling, and washing). We utilized data gathered from 
vulnerability assessments that we conducted employing the CARVER+Shock 
methodology, and evaluated whether activities that occur on produce 
farms pose significant vulnerabilities (Ref. 40).
    Our evaluation found that activities that are typically performed 
on produce farms are at relatively low risk for intentional 
adulteration of food from acts of terrorism (Ref. 40). Based on this 
evaluation, we have tentatively concluded that requirements for produce 
farms are not necessary to minimize the risk of serious adverse health 
consequences or death from this type of adulteration. Further, we have 
tentatively concluded that requirements relating to this form of 
adulteration are not reasonably necessary to prevent the introduction 
of known or reasonably foreseeable hazards and to provide reasonable 
assurances that the produce is not adulterated under section 402 of the 
FD&C Act. For these reasons, we are not proposing requirements for 
produce farms to specifically address intentional adulteration related 
to terrorism. We seek comment on this tentative conclusion and our 
analysis that informed this tentative decision.
    We acknowledge that there may be activities that occur on produce 
farms for which we are not proposing requirements that are similar to 
off-farm activities for which we are proposing to require the 
implementation of focused mitigation strategies. However, there are 
aspects of the specific on-farm activities that minimize the risk for 
intentional adulteration caused by acts of terrorism. For example, 
waxing is an on-farm activity that is similar to coating and that fits 
within one of the key activity types. However, there are key 
differences that make an on-farm waxing operation less vulnerable 
compared to a coating operation. With waxing, there is difficulty of 
mixing a contaminant into a clear, heated wax in a tank in close 
proximity to the busy packing line in an on-farm packing house. 
Conversely, a coating operation involves an opaque, ambient or 
refrigerated, aqueous coating mix in a tank and occurs in a relatively 
isolated part of the manufacturing plant. In addition, the uncertainty 
about whether the produce leaving the farm is destined for direct 
consumption or for further processing, such as removal of the wax, 
which could inactivate or remove any contaminant intentionally added, 
makes it a relatively less likely target for intentional adulteration.

C. Transportation Carriers

    One of the key activity types that we have tentatively determined 
indicates a significant vulnerability to intentional adulteration 
caused by acts of terrorism

[[Page 78027]]

is Bulk liquid receiving and loading. As proposed, receiving and 
loading of other types of foods (e.g., non-bulk liquids, solid foods, 
gaseous foods) are not identified as key activity types because we 
determined that they do not present this same level of risk. By 
requiring that shippers and receivers of bulk liquids implement focused 
mitigation strategies at actionable process steps involving this key 
activity, as proposed in Sec.  121.135(a), we expect that shippers and 
receivers will institute focused mitigation strategies that will 
significantly minimize or prevent the potential for intention 
adulteration of these foods during transportation. Such mitigation 
strategies may include sealing or locking outbound conveyances of bulk 
liquid, or requiring that inbound conveyances be sealed or locked as a 
condition of receipt of the bulk liquid. Where such measures are 
implemented by the shippers and receivers of bulk liquids, we have 
tentatively concluded that the food would be sufficiently protected 
from intentional adulteration caused by acts of terrorism, and that no 
further actions by a carrier would be needed to ensure the safety of 
the food. For this reason, we are not proposing to cover transportation 
carriers in this proposed rule. We request comment on our analysis of 
this issue, and our tentative conclusion.
    Note that FDA will issue a proposed rule in the near future related 
to transportation carriers and sanitary transportation practices.

D. Food for Animals

    As discussed in section V.B.6 of this document, we are proposing to 
exempt the manufacturing, processing, packing, and holding of animal 
food from this proposed regulation with respect to intentional 
adulteration caused by acts of terrorism.

E. Acts of Disgruntled Employees, Consumers, or Competitors

    While the goals and outcomes of acts of disgruntled employees, 
consumers or competitors can overlap with acts of terrorism, generally, 
the distinction has to do with differences in scale. Disgruntled 
employees are generally understood to be interested primarily in 
attacking the reputation of the company, and otherwise have little 
interest in public health harm. On the other hand, terrorist 
organizations are generally understood to be interested in maximizing 
public health harm and, to a lesser extent, economic disruption (Ref. 
5, Ref. 6).
    Section 420(c) of the FD&C Act requires that the regulation 
prepared under that section apply to ``food for which there is a high 
risk of intentional contamination.'' In the spectrum of risk associated 
with intentional adulteration of food, attacks perpetrated by terrorist 
organizations intent on causing massive casualties and, to a lesser 
extent, economic disruption would be ranked as relatively high risk. On 
the other hand, attacks by disgruntled employees, consumers, or 
competitors would be consistently ranked as relatively low risk; 
although these events occur annually, their public health and economic 
impact would be generally quite small. In general, the target food and 
the point in its production are those of convenience (i.e., a point to 
which the employee, consumer, or competitor has ready access). Should a 
disgruntled employee, consumer, or competitor choose to attack at an 
actionable process step, where the adverse public health and economic 
consequences could be greater, the provisions of this proposed rule 
would be effective in minimizing the opportunity for success. Actions 
taken to mitigate the potential for a terrorist attack against the food 
supply are likely to have collateral benefits in reducing the potential 
for an attack by a disgruntled employee, consumer, or competitor (as 
well as on other security related issues, such as theft and vandalism). 
As a practical matter, hardening the food supply (i.e., reducing the 
opportunity for attack) to attacks by disgruntled employees, consumers, 
or competitors could require taking steps at many more points in the 
food system than would be required to harden the food supply to 
minimize the potential for terrorist attack. We have tentatively 
concluded that the latter can be accomplished by focusing on those 
points in the food system where an attack would be expected to cause 
massive adverse public health impact, and, to a lesser extent, economic 
disruption.

F. Economically Motivated Adulteration

    Efforts to protect against intentional adulteration require a shift 
in perspective from that applied to traditional food safety. In the PC, 
Animal Food PC, and Produce Safety proposed rules, we tentatively 
concluded that hazards associated with intentional adulteration, which 
are not addressed in traditional HACCP or other food safety systems, 
likely will require different kinds of controls, and would be best 
addressed in a separate rulemaking (this proposed rule). However, we 
also explained how in some circumstances economically motivated 
adulteration could be viewed as reasonably likely to occur. Further, we 
requested comment on where to address those hazards that may be 
intentionally introduced for economic gain. After additional 
consideration, we present our current thinking in this section of the 
document.
    For facilities subject to section 418 of the FD&C Act, we have 
tentatively concluded that economically motivated adulteration would be 
best addressed under the regulatory regime described in the PC and 
Animal Food PC proposed rules and thus best addressed in those 
rulemakings. Before we decide to finalize provisions on economically 
motivated adulteration in the PC and Animal Food PC final rules, FDA 
plans to provide new language and an analysis of costs associated with 
these provisions, and seek comment. Under this approach, the owner, 
operator, or agent in charge of a covered facility would be required to 
perform a hazard analysis to identify those hazards related to 
economically motivated adulteration that are reasonably likely to 
occur. Economically motivated adulteration could be reasonably likely 
to occur, for example, when obtaining certain ingredients from a 
country in which economically motivated adulteration has occurred in 
those ingredients in the past. Because of past incidents regarding the 
addition of melamine to certain food products apparently to enhance 
perceived quality and/or protein content, even if there is no known 
history regarding the specific supplier or the specific food product, a 
prudent person would implement preventive controls to address the 
potential presence of this hazard in a food. The goal of the 
perpetrator of economically motivated adulteration is for the 
adulterant to be undetected in the product, so that the perpetrator can 
continue to obtain the desired economic benefits (Ref. 7, Ref. 9). 
Accordingly, unlike with acts of terrorism, such occurrences of 
economic adulteration are expected to be long term, and would not be 
appropriately viewed as a rare occurrence, but rather as reasonably 
likely to occur.
    We have tentatively concluded that this hazard-analysis type 
approach is better suited to address economically motivated 
adulteration than the vulnerability assessment-type approach we are 
proposing to address intentional adulteration related to terrorism. In 
the latter approach, which we are not proposing, significant 
vulnerabilities would be identified based either on the presence of key 
activity types (which reflect FDA-conducted vulnerability assessments) 
or facility-specific vulnerability assessments. Under a vulnerability 
assessment-type approach,

[[Page 78028]]

the assessment would need to consider the degree to which a food is a 
likely target for economically motivated adulteration based on the 
attributes of the food (such as the nature of the food, its production 
system, and its supply chain) and the capabilities of a perpetrator 
(such as availability and access to adulterants that can be readily 
disguised and undetected by currently accepted testing methods). 
Factors to consider could include previous occurrences of economically 
motivated adulteration; a highly complex supply chain; sudden changes 
in commodity prices; known inadequacies in identification and assay 
testing methods for potential adulterants; a highly complex and 
variable food ingredient; the widespread availability of a potential 
adulterant; the lack of organoleptic properties of a potential 
adulterant; the high cost or scarcity of an ingredient; and variation 
in the value of a food based on variations in levels of a high value 
attribute of that food. The nature of economically motivated 
adulteration makes it difficult to identify all relevant factors to be 
considered in a vulnerability assessment to predict when novel events 
of economic adulteration are expected to occur. Moreover, predictive 
tools such as CARVER+Shock are not currently configured to assess the 
risk of economically motivated adulteration, nor have extensive 
vulnerability assessments for economically motivated adulteration in 
food products been conducted by FDA or others. Therefore, we believe 
the most appropriate framework to assess the risk of economically 
motivated adulteration is to consider whether it is reasonably likely 
to occur (such as whether it has occurred under similar circumstances 
with some regularity in the past) as part of a hazard analysis.
    Under this approach, facilities subject to section 418 of the FD&C 
Act would be expected to implement controls against economically 
motivated adulteration under circumstances where there has been a 
pattern of such adulteration in the past, even though the past 
occurrences may not be associated with the specific supplier or the 
specific food product but the pattern suggests a potential for 
intentional adulteration. Further, a system of monitoring, corrective 
action, verification, and recordkeeping that is similar to those in the 
PC and Animal Food PC proposed rules would be appropriate for 
economically motivated adulteration. In addition, the elements of a 
preventive control system, including hazard analysis, preventive 
controls, monitoring, corrective actions, verification, and 
recordkeeping would be documented in a food safety plan that would 
include control of economically motivated adulteration. We believe that 
addressing both of these potential sources for contamination within the 
same framework is likely to streamline requirements and reduce costs to 
industry.
    We seek comment on our tentative conclusions presented above. 
Specifically, we are interested in information on the specific factors 
that are most relevant for determining whether economically motivated 
adulteration is reasonably likely to occur, particularly in instances 
where the specific product or supplier has not been previously 
associated with such adulteration. In addition, we seek comment on 
whether and how these relevant factors may be used to develop 
appropriate predictive tools or establish a standard for when 
preventive controls are necessary.
    Section 418 of the FD&C Act contains certain exemptions related to 
compliance with FDA's seafood and juice HACCP regulations and with 
regard to manufacturing, processing, packing or holding dietary 
supplements that are in compliance with the requirements of sections 
402(g)(2) and 761 of the FD&C Act. Section 420 of the FD&C Act does not 
contain these exemptions and requires FDA to issue regulations to 
protect against the intentional adulteration of food. Seafood and juice 
are currently subject to HACCP-type regulations in Sec. Sec.  123 and 
120, respectively, and our current thinking is that under section 420 
economically motivated adulteration could be addressed through the 
existing frameworks for these foods. Under this option, FDA would amend 
the seafood and juice HACCP regulations to specify that economically 
motivated adulteration is a hazard that must be considered in a hazard 
analysis of these foods, and addressed in a HACCP plan. For example, 
for seafood, we could propose to add ``economically motivated 
adulteration that could result in serious adverse health consequences 
or death'' to the list of hazards to be considered in a hazard analysis 
in accordance with Sec.  123.6(c)(1). Similarly, for juice we could 
propose to add ``economically motivated adulteration that could result 
in serious adverse health consequences or death'' to the list of 
hazards to be considered in a hazard analysis in accordance with Sec.  
120.7(c). Also under this option, FDA would consider proposing to amend 
part 111 (21 CFR part 111), the Dietary Supplements current good 
manufacturing practice (CGMP) rule, to include economically motivated 
adulteration that could result in serious adverse health consequences 
or death. Current Sec.  111.70(b) and (c) require establishing 
component specifications and in-process specifications to ensure the 
identity, purity, strength, and composition of the dietary supplement, 
and we could amend these provisions to cover economically motivated 
adulteration that could result in serious adverse health consequences 
or death.
    We have also tentatively concluded not to require produce farms 
subject to section 419 of the FD&C Act and farms that produce milk 
(also referred to in this document as ``dairy farms'') subject to 
section 420 of the FD&C Act to take measures to address economically 
motivated adulteration. With regard to produce farms subject to section 
419 of the FD&C Act, we have tentatively concluded that there are not 
procedures, processes, or practices that are reasonably necessary to be 
implemented by these entities to prevent the introduction of known or 
reasonably foreseeable biological, chemical, or physical hazards that 
can cause serious adverse health consequences or death as a result of 
economically motivated adulteration. With regard to farms that produce 
milk subject to section 420 of the FD&C Act, we have tentatively 
concluded that there are not appropriate science-based strategies or 
measures intended to protect against economically motivated 
adulteration that can be applied at the farm. These tentative 
conclusions are based on our assessment that preventive controls for 
economically motivated adulteration are suitable to address such 
adulteration when it is perpetrated by the entity's supplier, but not 
when it is perpetrated by the entity itself, as would be the case for 
economically motivated adulteration at a produce farm or a farm that 
produces milk. Actions such as auditing of suppliers or reliance upon 
supplier-supplied test results or production control records are 
generally considered unsuitable to address economically motivated 
adulteration where the supplier, if intentionally adulterating the 
food, would already be violating the law and would be able to subvert 
these controls. For both types of farms, we are not aware of inputs 
into the growing, harvesting, packing, or holding of produce or milk 
(i.e., within our farm definition) that could be subject to 
economically motivated adulteration that could cause serious adverse 
health consequences or death under sections 419 and 420 of the FD&C 
Act. We seek comment on this tentative conclusion.

[[Page 78029]]

G. Low-Risk Activities at Farm Mixed-Type Facilities

    Section 103(c)(1)(C) of FSMA directs the Secretary of Health and 
Human Services to conduct a science-based risk analysis as part of the 
section 103(c) rulemaking. The science-based risk analysis is to cover 
``(i) specific types of on-farm packing or holding of food that is not 
grown, raised, or consumed on such farm or another farm under the same 
ownership, as such packing and holding relates to specific foods; and 
(ii) specific on-farm manufacturing and processing activities as such 
activities relate to specific foods that are not consumed on that farm 
or on another farm under common ownership.'' In section VIII.G of the 
PC proposed rule, we describe a draft Qualitative Risk Assessment (the 
draft RA) we performed to satisfy this requirement. Section 
103(c)(1)(D)(i) of FSMA requires FDA to use the results of this 
analysis to establish exemptions and inspection frequencies, or modify 
requirements, for facilities engaged only in specific types of on-farm 
activities that FDA determines to be low risk.
    Elsewhere in this issue of the Federal Register, FDA is publishing 
a notice announcing the availability for public comment Appendix 4 to 
the draft RA (the draft RA Appendix). The purpose of the draft RA 
Appendix is to provide a science-based risk analysis of those foods 
whose production processes would be considered low risk with respect to 
the risk of intentional adulteration caused by acts of terrorism. FDA 
conducted this evaluation to satisfy the requirement in Section 
103(c)(1)(C) of FSMA to conduct a science-based risk analysis with 
respect to the risk of intentional adulteration caused by acts of 
terrorism. We evaluated the production processes for the types of 
finished foods we expect are produced at farm mixed-type facilities to 
determine whether or not they are low-risk with respect to hazards that 
may be intentionally introduced by acts of terrorism. For the purposes 
of this analysis, we evaluated whether a production process involved 
any of the four FDA-identified key activity types, and identified a 
production process that did not involve any of the four key activity 
types as a ``low risk production process.'' Based on this evaluation, 
we concluded that the production processes for the following finished 
foods are ``low-risk'':
     Eggs (In-Shell)
     Fruits & Vegetables Other Than Pods, Seeds for Direct 
Consumption, and Hesperidia (Fresh, Intact)
     Game Meats (Whole or Cut, Not Ground or Shredded, Without 
Secondary Ingredients)
     Peanuts & Tree Nuts (Raw, In-Shell)
     Sugarcane & Sugar Beets (Fresh, Intact)
    We are considering the results of this analysis in determining any 
specific exemptions or modified requirements. We request comment on 
whether we should exempt on-farm manufacturing, processing, packing, or 
holding of the foods identified as having low-risk production practices 
when conducted by a small or very small business if such activities are 
the only activities conducted by the business that are subject to 
section 418 of the FD&C Act. If we were to take this approach, only 
facilities meeting all of the specified criteria would be exempt as a 
result of being engaged in low-risk activities. Thus, a facility 
located on-farm, that is a small or very small business, and only 
produces fresh, intact apples as a finished product (e.g., by packing 
apples grown on a different farm that is under different ownership) 
would be exempt from this proposed rule. On the other hand, an apple-
packing facility that is off-farm would not be exempt, an apple packing 
facility that is on-farm but that is not a small or very small business 
would not be exempt, and an apple packing facility that also packs 
green beans would not be exempt. We request comment on whether we 
should broaden this potential exemption in any way, such as by removing 
certain of the restrictions mentioned immediately above. We also seek 
comment on whether we should instead establish modified requirements 
for facilities that produce foods identified as having low-risk 
production processes, and if so, what those modified requirements 
should be and the scope of application of the modified requirements. In 
addition, we seek comment on whether and how we should consider the 
results of this analysis in determining whether to exempt or modify the 
inspections frequency requirements under Section 421 of the FD&C Act, 
Targeting of Inspection Resources for Domestic Facilities.

H. Activities That Occur on Dairy Farms

1. Assessment of Vulnerabilities
    Under section 420 of the FD&C Act, we considered whether activities 
that occur on farms that produce milk pose a high risk for intentional 
adulteration of food caused by acts of terrorism that could cause 
significant adverse health consequences or death. A preliminary 
evaluation indicates that fluid milk storage appears to fit within the 
key activity type, Liquid storage and handling, and fluid milk loading 
appears to fit within the key activity type, Bulk liquid receiving and 
holding. The fluid milk storage tank is one of the actionable process 
steps that would be applicable to both of these activities on a dairy 
farm.
    As discussed in section V.C.2 of this document, FDA is proposing to 
require that the owner, operator, or agent in charge of a facility that 
has one or more of the FDA-identified key activity types identify 
actionable process steps for those key activity types and implement 
focused mitigation strategies at any actionable process steps. Because 
dairy farms generally are not facilities as defined in this rule, they 
would not be subject to this requirement. However, section 420 is 
applicable to dairy farms (see Sec.  420(d)) and fluid milk storage and 
loading in a dairy farm operation appear to pose a significant 
vulnerability.
    The risk posed by intentional adulteration of milk on-farm results 
from a number of factors: (1) The system of milk collection from farms 
and subsequent holding and processing serves to distribute contaminants 
added to the milk on the farm into much larger quantities of fluid 
milk, increasing the potential magnitude of an intentional adulteration 
event; (2) in its fluid form milk has a short shelf life, increasing 
the potential for significant adverse public health impacts before 
detection and, once detected, before a public health intervention can 
be implemented; (3) fluid milk is widely consumed across different sub-
populations, including infants and children, increasing the potential 
for significant adverse public health impacts and, because of public 
reaction to child and infant morbidity and mortality, decreasing public 
confidence in the food supply; (4) fluid milk is consumed in a variety 
of food forms, including as a beverage (finished food) and as an 
ingredient in other finished foods, complicating public health 
intervention; and (5) milk storage tanks are commonly left unlocked 
(Ref. 41, Ref. 42, Ref. 43, Ref. 44, Ref. 45, Ref. 46, Ref. 47).
2. Mitigation Strategies
    Farms are not subject to the HACCP-type system of preventive 
controls prescribed in section 418 of the FD&C Act, and our current 
thinking is that, should we include requirements relative to dairy 
farms in the final rule, we would not require HACCP-type controls for 
dairy farms under section 420 of the FD&C Act. Similarly, under section 
419 of the FD&C Act we did not propose to apply such an approach to 
unintentional adulteration on produce

[[Page 78030]]

farms in the Produce Safety proposed rule (see section IV.D of the 
Produce Safety proposed rule). Rather, as with produce farms, a more 
appropriate approach might be a CGMP-type provision that relates 
directly to the significant vulnerability. Generally, CGMPs set out 
mandatory, broad, generally applicable practices and conditions that 
are required to be met, and the criteria and definitions that are 
applicable in determining whether the food is adulterated. For example, 
a CGMP approach would identify the broad, generally applicable 
mitigation strategies that dairy farm operators must implement (e.g., 
limiting access to fluid milk storage tanks), without specifying how 
that strategy must be accomplished and without a further requirement 
for monitoring, recordkeeping or the development of a plan. We seek 
comment on this approach.
    FDA previously provided guidance for the dairy industry, including 
dairy farms, on the potential for intentional contamination and 
identified the types of food defense measures that dairy farms may take 
to minimize the risk that fluid milk under their control will be 
subject to tampering or other malicious, criminal, or terrorist actions 
(Ref. 24). Among other recommendations, FDA's guidance recommends 
``limiting access'' to raw and pasteurized milk storage as a food 
defense preventive measure. We acknowledge the difficulties involved in 
limiting access to many dairy farms, including multiple entries to the 
milk house, multiple visitors with customary access to the milk house 
(e.g., State food safety inspectors, vendors delivering veterinary 
medications, and drivers collecting bulk milk for transport to 
processing and storage facilities); continuous milk piping from the 
milking parlor to the bulk milk tank, providing for access points to 
the bulk milk tank from outside the milk house; open access to the 
milking parlor for workers and cows; and automated milking operations 
where employees are not necessarily present to escort cows into the 
milking parlor.
    In light of these circumstances, we request comment on whether and 
how access to the bulk milk storage tank and associated systems can be 
limited, and the costs and other implications of doing so. In addition, 
we are interested in comment on whether and what types of focused 
mitigation strategies or other measures are currently employed by dairy 
farms. Specifically for fluid milk storage tanks, we seek comment on 
whether and what focused mitigation strategies would be appropriate and 
feasible given current dairy farming practices.
    We also seek comment on whether it would be more appropriate for 
FDA to require that dairy farm operators receive food defense awareness 
training rather than requiring that they implement focused mitigation 
strategies to limit access to certain steps of their operation. If you 
support an approach based on training rather than mandated focused 
mitigation strategies, we are further interested in how such an 
approach would work at those farms where an agent of the farm may not 
be present at all times, given that a system based on awareness 
training is premised on the assumption that such training would provide 
the operator with the tools to report and respond to suspicious 
activity that they observe.
3. Scope of Dairy Farms Subject to any Requirement
    Finally, we seek comment on the scope of farms that produce milk 
that should be subject to any requirements that we may establish in a 
final rule. For example, the scope of dairy farms covered could be 
determined based on the potential for adverse public health outcome 
resulting from consumption of milk produced at a farm, if a contaminant 
were intentionally introduced into the milk from that farm. Farms with 
less than 50 milk-producing cows contribute a relatively small 
proportion to the total volume of milk produced in the United States 
(i.e., approximately 4.2 percent of total milk produced in the United 
States), and the current trend in the dairy farm industry toward 
consolidation (Ref. 48) likely further reduces the percentage of 
production that such farms will contribute in the future. However, milk 
from even very small dairy farms may be pooled with milk from other 
farms in raw milk storage tanks at milk processing and storage 
facilities, potentially resulting in a public health impact from 
intentional adulteration that is disproportionate to the size of the 
farm or its contribution to the milk supply. We request comment on the 
appropriateness of determining the scope of dairy farms covered based 
on the number of cows on a farm. Alternatively, should we consider 
excluding farms based on how the milk from a farm is distributed (e.g., 
direct sale to consumers or other end users; pooling with milk from 
other farms; supplied to the Grade A Milk system for the production of 
fluid milk; or used in the production of cheese and other products that 
have a different risk associated with intentional adulteration caused 
by acts of terrorism)?

I. Other Ways to Focus on Foods With a High Risk of Intentional 
Adulteration Caused by Terrorism

    We are requesting comment on whether, under section 420 of the FD&C 
Act, there are other ways in which the coverage of this proposed 
regulation can be further focused on foods that present a high risk of 
intentional adulteration caused by acts of terrorism. For example, are 
there ways in which a food's shelf life, turnover in the marketplace, 
batch size, serving size and servings per batch, distribution and 
consumption patterns, and intended consumer could be considered in 
providing for an exemption or in setting modified requirements for that 
food. Ordinarily, these considerations are part of a vulnerability 
assessment, and in such assessments the risk reduction aspects of one 
attribute may be offset or exacerbated by those of another attribute, 
and may be very facility-specific. Such attributes specific to the 
food(s) manufactured, processed, packed, or held at the facility can be 
taken into account, should a facility choose to perform its own 
vulnerability assessment and assign actionable process steps, as 
provided for in proposed Sec.  121.130(b). However, as discussed in 
section V.C.2 of this document, facilities would not be required to 
perform a facility-specific vulnerability assessment and, instead, 
would have the option of identifying actionable process steps using the 
procedure in proposed Sec.  121.130(a). We are particularly interested 
in how food-specific attributes can be taken into account in the 
absence of a general requirement for a facility-specific vulnerability 
assessment.

V. The Proposal

A. Definitions

    In subpart A of proposed part 121, under Sec.  121.3, FDA is 
proposing the following definitions and interpretations of terms 
relevant to proposed part 121. The definitions and interpretations of 
terms in section 201 of the FD&C Act (21 U.S.C. 321) are applicable to 
such terms when used in this part. As proposed, several terms in part 
121 have the same definitions as in proposed part 117 and, therefore, 
we have not included an extensive discussion of those terms in this 
proposed rule. See section X.B of the PC proposed rule for a discussion 
of the following terms: facility, farm, holding, manufacturing/
processing, mixed-type facility, packing, qualified end-user, qualified 
facility, and small business.
    FDA is proposing to define the term ``actionable process step'' to 
mean a

[[Page 78031]]

point, step, or procedure in a food process at which food defense 
measures can be applied and are essential to prevent or eliminate a 
significant vulnerability or reduce such vulnerability to an acceptable 
level. The term ``actionable process step'' used in the food defense 
context is analogous to the term ``critical control point'' (CCP), 
which is defined as ``a point, step, or procedure in a food process at 
which control can be applied and is essential to prevent or eliminate a 
food safety hazard or reduce such hazard to an acceptable level.'' 
Similar to a CCP, in proposed part 121, an ``actionable process step'' 
is identified during a vulnerability assessment (analogous to a hazard 
analysis) in relation to a significant vulnerability (analogous to a 
hazard that is reasonably likely to occur), and is facility-specific.
    As discussed in section V.C.2 of this document, based on 
vulnerability assessments, FDA has identified four key activity types 
that we have tentatively concluded pose significant vulnerabilities in 
a food operation. FDA identified and described these key activity types 
(which are not facility-specific) with the expectation that an owner, 
operator, or agent in charge would objectively determine whether the 
processing steps in a facility fit within one or more of these key 
activity types. The processing steps identified by facilities in their 
food operation that fit within the FDA-identified key activity types 
are ``actionable process steps,'' and are steps at which a focused 
mitigation strategy would be employed to prevent or eliminate a 
significant vulnerability or reduce it to an acceptable level. 
Actionable process steps might also be identified in a vulnerability 
assessment (proposed Sec.  121.130(b)). Though we use the term 
``actionable process step'' in FDA's FDPB software tool (Ref. 31), we 
recognize it is a relatively new term and, therefore, we solicit 
comment on its appropriateness and any other more appropriate 
alternative terms.
    FDA is proposing to define the term ``contaminant'' as any 
biological, chemical, physical or radiological agent that may be 
intentionally added to food and that may cause illness, injury or 
death. We based the proposed definition, in part, on the definition of 
``contaminant'' used in Codex Alimentarius guidelines (Ref. 49) that 
refers to any biological or chemical agent, foreign matter or other 
substances not intentionally added to feed or food that may compromise 
feed and food safety or suitability. In this proposal, the term 
``contaminant'' is used in the context of key activity types, which are 
related to intentional acts of adulteration caused by acts of terrorism 
with intent to cause public health harm and, to a lesser extent, 
economic disruption. Therefore, for the purposes of proposed part 121, 
we focused the definition of ``contaminant'' on agents that may be 
intentionally added to food and that may cause illness, injury, or 
death, which is consistent with our determination that the primary goal 
of such an attack would be public health harm (i.e., illness, injury, 
or death). Our proposed definition of ``contaminant'' in proposed 121.3 
would be applicable to proposed part 121 only. We acknowledge that this 
term has a broader meaning in other settings, as evidenced by its use 
in the Codex Alimentarius guidelines.
    FDA is proposing to define the term ``facility'' to mean a domestic 
facility or a foreign facility that is required to register under 
section 415 of the FD&C Act in accordance with the requirements of part 
1, subpart H (21 CFR part 1, subpart H). The proposed definition would 
incorporate the definition in section 418(o)(2) of the FD&C Act.
    FDA is proposing to define the term ``farm'' by reference to the 
definition of that term in proposed Sec.  1.227. We are proposing to 
cross-reference the definition of ``farm'' rather than to define it in 
proposed part 121 because the definition of ``farm,'' under both 
current Sec.  1.227(b)(3) and proposed Sec.  1.227, includes the word 
``facility'' with a meaning that is broader than the meaning of 
``facility'' in section 418(o)(2) of the FD&C Act. Under part 1, 
subpart H, the term ``facility'' is not limited to entities that are 
required to register under section 415 of the FD&C Act. We are 
proposing to cross-reference the definition to reduce the potential 
confusion that could result if we used the term ``facility'' to have 
two different meanings within proposed part 121. See sections X.B and 
VIII of the PC proposed rule for additional information.
    FDA is proposing to define the term ``focused mitigation 
strategies'' to mean those risk-based, reasonably appropriate measures 
that a person knowledgeable about food defense would employ to 
significantly minimize or prevent significant vulnerabilities 
identified at actionable process steps, and that are consistent with 
the current scientific understanding of food defense at the time of the 
analysis. The term ``focused mitigation strategies'' used in the food 
defense context is analogous to the term ``preventive controls'' in a 
HACCP-type framework for food safety.
    As discussed in section V.C.3 of this document, a mitigation 
strategy is a measure taken by a facility to reduce the potential for 
intentional adulteration of food. A ``focused mitigation strategy'' is 
such a strategy applied in response to the identification of a 
significant vulnerability and at an actionable process step. Focused 
mitigation strategies are customized to the processing step at which 
they are applied, tailored to existing facility practices and 
procedures, and depend on an evaluation of the vulnerabilities 
identified in a facility. Because they are applied in response to a 
significant vulnerability, we have determined that focused mitigation 
strategies are essential to ensure that appropriate action is taken to 
protect the food from intentional adulteration caused by acts of 
terrorism.
    While an option to perform a vulnerability assessment is provided 
under proposed Sec.  121.130(b), facilities may choose instead to rely 
on the analysis performed by FDA that resulted in the identification of 
the key activity types listed in proposed Sec.  121.130(a) when 
identifying actionable process steps and, subsequently, focused 
mitigation strategies, eliminating the need for a full vulnerability 
assessment. See section V.C.3 of this document for examples of focused 
mitigation strategies.
    FDA is proposing to define the term ``food defense'' as the effort 
to protect food from intentional acts of adulteration where there is an 
intent to cause public health harm and economic disruption. As 
discussed in section IV.A of this document, acts of intentional 
adulteration may take several forms, including acts of terrorism; acts 
of disgruntled employees, consumers, or competitors; and economically 
motivated adulteration. We are proposing to define the term ``food 
defense'' to refer to the sum of actions and activities (including 
identification of actionable process steps; implementation of focused 
mitigation strategies; monitoring, corrective actions, verification, 
and training activities) taken to protect food from intentional acts of 
adulteration related to terrorism.
    FDA is proposing to define the term ``holding'' to mean the storage 
of food. The proposed definition would also state that holding 
facilities include warehouses, cold storage facilities, storage silos, 
grain elevators, and liquid storage tanks; and that, for farms and farm 
mixed-type facilities, holding also includes activities traditionally 
performed by farms for the safe or effective storage of raw 
agricultural commodities grown or raised on the same farm or another 
farm under the

[[Page 78032]]

same ownership, but does not include activities that transform a raw 
agricultural commodity, as defined in section 201(r) of the FD&C Act, 
into a processed food as defined in section 201(gg) of the FD&C Act. 
For consistency of terminology, we are proposing the same definition of 
``holding'' as in the PC proposed rule (see proposed Sec. Sec.  1.227 
and 117.3). For a detailed discussion of ``holding,'' see sections 
VIII.E and X.B of the PC proposed rule.
    FDA is proposing to define the term ``manufacturing/processing'' to 
mean making food from one or more ingredients, or synthesizing, 
preparing, treating, modifying or manipulating food, including food 
crops or ingredients. The proposed definition would also state that 
examples of manufacturing/processing activities are cutting, peeling, 
trimming, washing, waxing, eviscerating, rendering, cooking, baking, 
freezing, cooling, pasteurizing, homogenizing, mixing, formulating, 
bottling, milling, grinding, extracting juice, distilling, labeling, or 
packaging. The proposed definition would also specify that, for farms 
and farm mixed-type facilities, manufacturing/processing does not 
include activities that are part of harvesting, packing, or holding. 
For consistency of terminology, we are proposing the same definition of 
``manufacturing/processing'' as in the PC proposed rule (see proposed 
Sec. Sec.  1.227 and 117.3). For a detailed discussion of 
``manufacturing/processing,'' see sections VIII.E and X.B of the PC 
proposed rule.
    FDA is proposing to define the term ``mixed-type facility'' to mean 
an establishment that engages in both activities that are exempt from 
registration under section 415 of the FD&C Act and activities that 
require the establishment to be registered. The proposed definition 
would also state that an example of such a facility is a ``farm mixed-
type facility,'' which is an establishment that grows and harvests 
crops or raises animals and may conduct other activities within the 
farm definition, but also conducts activities that require the 
establishment to be registered. For consistency of terminology, we are 
proposing the same definition of ``mixed-type facility'' as in the PC 
proposed rule (see proposed Sec. Sec.  1.227 and 117.3). For a detailed 
discussion of ``mixed-type facilities,'' see sections VIII.E and X.B of 
the PC proposed rule.
    FDA is proposing to define the term ``monitor'' to mean to conduct 
a planned sequence of observations or measurements to assess whether 
focused mitigation strategies are consistently applied and to produce 
an accurate record for use in verification. In the intentional 
adulteration framework, monitoring would be performed to ensure that 
focused mitigation strategies are consistently applied and to provide a 
record for use in verifying consistent application.
    FDA is proposing to define the term ``packing'' to mean placing 
food into a container other than packaging the food. The proposed 
definition would also specify that, for farms and farm mixed-type 
facilities, packing also includes activities traditionally performed by 
farms to prepare raw agricultural commodities grown or raised on the 
same farm or another farm under the same ownership for storage and 
transport, but does not include activities that transform a raw 
agricultural commodity, as defined in section 201(r) of the FD&C Act, 
into a processed food as defined in section 201(gg). We are proposing 
to use the same definition of ``packing'' as in the PC proposed rule 
(see proposed Sec. Sec.  1.227 and 117.3). For a detailed discussion of 
``packing,'' see sections VIII.E and X.B of the PC proposed rule.
    FDA is proposing to define the term ``qualified end-user'' to mean, 
with respect to a food, the consumer of the food (where the term 
consumer does not include a business); or a restaurant or retail food 
establishment (as those terms are defined in Sec.  1.227) that: (1) Is 
located: (i) in the same State as the qualified facility that sold the 
food to such restaurant or establishment; or (ii) not more than 275 
miles from such facility; and (2) is purchasing the food for sale 
directly to consumers at such restaurant or retail food establishment. 
The proposed definition would incorporate the definition in section 
418(l)(4)(B) of the FD&C Act.
    FDA is proposing to define the term ``qualified facility'' to mean 
(when including the sales by any subsidiary; affiliate; or subsidiaries 
or affiliates, collectively, of any entity of which the facility is a 
subsidiary or affiliate) a facility that is: (1) A very small business 
as defined in this part; or (2) a facility to which both of the 
following apply: (i) During the 3-year period preceding the applicable 
calendar year, the average annual monetary value of the food 
manufactured, processed, packed or held at such facility that is sold 
directly to qualified end-users (as defined in this part) during such 
period exceeded the average annual monetary value of the food sold by 
such facility to all other purchasers; and (ii) the average annual 
monetary value of all food sold during the 3-year period preceding the 
applicable calendar year was less than $500,000, adjusted for 
inflation.
    We acknowledge that facilities would not need to consider the 
applicability of previous paragraph (2) because facilities that meet 
this second prong of the definition would be included in our proposed 
definition of a very small business, which is broader.
    The proposed definition would incorporate the description of 
``qualified facility'' in section 418(l)(1) of the FD&C Act with 
editorial changes to improve clarity.
    FDA is proposing to define the term ``significant vulnerability'' 
to mean a vulnerability for which a prudent person knowledgeable about 
food defense would employ food defense measures because of the 
potential for serious adverse health consequences or death and the 
degree of accessibility to that point in the food process. The term 
``significant vulnerability'' is analogous to the term ``hazard that is 
reasonably likely to occur'' in a HACCP-type framework for food safety. 
As proposed, a ``significant vulnerability'' is a type of vulnerability 
for which there is both: (1) The potential for serious adverse health 
consequences or death from the intentional introduction of a 
contaminant at the particular point in the process at which the 
significant vulnerability exists; and (2) a significant degree of 
accessibility at the particular point in the process. Unlike a ``hazard 
that is reasonably likely to occur'' in a HACCP system, a ``significant 
vulnerability'' exists at a particular point in a process (e.g., during 
storage in a bulk tank or during mixing). As discussed in section V.C.2 
of this document, we have determined that significant vulnerabilities 
exist in a food operation at those actionable process steps that fit in 
the FDA-identified key activity types or that are identified as part of 
a vulnerability assessment.
    We have retained in this proposed definition the concept of a 
``prudent person'' used in the definition of a ``hazard that is 
reasonably likely to occur'' in the PC proposed rule. However, because 
intentional adulteration is a potentially high consequence but low 
probability occurrence, the portion of the proposed definition in the 
PC proposed rule that reads, ``experience, illness data, scientific 
reports, or other information provides a basis to conclude that there 
is a reasonable possibility that the hazard will occur in the type of 
food being manufactured, processed, packed, or held in the absence of 
those controls,'' does not appear to be appropriate. Successful 
intentional adulteration caused by an act of

[[Page 78033]]

terrorism requires not only the absence of focused mitigation 
strategies designed to address a significant vulnerability, but also 
simultaneous intent by an attacker to adulterate the food. As such, the 
absence of focused mitigation strategies to address a significant 
vulnerability alone may not present a reasonable possibility of 
intentional adulteration. Instead, as described above, we have 
tentatively concluded that the prudent person would consider the 
potential for public health consequences should intentional 
adulteration occur, and the degree of access by the attacker to commit 
the intentional adulteration, in determining which vulnerabilities are 
significant.
    FDA is proposing to define the term ``significantly minimize'' to 
mean to reduce to an acceptable level, including to eliminate. As noted 
in section X.B of the PC proposed rule, the term ``significantly 
minimize'' is used in FSMA and is consistent with the outcome of a 
``control measure'' as described in the HACCP regulations for seafood 
(part 123), juice (part 120), and meat and poultry (9 CFR part 417). 
Generally, a ``control measure'' is implemented so that hazards are 
prevented, reduced to an acceptable level, or eliminated.
    FDA is proposing to define the term ``small business'' to mean, for 
the purposes of proposed part 121, a business employing fewer than 500 
persons. The proposed limit of 500 employees would include all 
employees of the business rather than be limited to the employees of a 
particular facility. We are proposing to establish the same definition 
for small business as that which has been established by the U.S. Small 
Business Administration under 13 CFR part 121 for most food 
manufacturers.
    FDA is proposing to define the term ``verification'' to mean those 
activities, other than monitoring, that establish that the system is 
operating according to the food defense plan. As discussed in section 
V.C.6 of this document, we are not proposing to require validation of 
the focused mitigation strategies and, therefore, we are not proposing 
to include a determination of the validity of the food defense plan 
within the definition of verification in proposed Sec.  121.3.
    FDA is proposing to define the term ``very small business'' to 
mean, for the purposes of proposed part 121, a business that has less 
than $10,000,000 in total annual sales of food, adjusted for inflation. 
In the discussion on the regulatory framework in section IV.A of this 
document, we discuss our assessment that the goal of terrorist 
organizations is to maximize public health harm and, to a lesser 
extent, economic disruption. It is our assessment that such goals are 
likely to drive terrorist organizations to target the product of 
relatively large facilities, especially those for which the brand is 
nationally or internationally recognizable. An attack on such a target 
would potentially provide the wide-scale consequences desired by a 
terrorist organization and the significant public attention that would 
accompany an attack on a recognizable brand. Such facilities are likely 
to have larger batch sizes, potentially resulting in greater human 
morbidity and mortality. Further, an attack on a well-recognized, 
trusted brand is likely to result in greater loss of consumer 
confidence in the food supply and in the government's ability to ensure 
its safety and, consequently, cause greater economic disruption than a 
relatively unknown brand that is distributed regionally (Ref. 2, Ref. 
50, Ref. 3, Ref. 51, Ref. 6). Therefore, we have set a threshold of 
$10,000,000 in total food sales, adjusted for inflation, as the level 
defining a very small business. Data from the Dun & Bradstreet Global 
Business Database show that businesses with less than $10,000,000 in 
total food sales represent about 3 percent of the market share of food 
commodities, but include the majority of food facilities. Of a total of 
65,900 domestic food facilities that are estimated to have actionable 
process steps, about 51,700 are owned by businesses with less than 
$10,000,000 in total annual sales. We request comment on our proposed 
definition, and whether a dollar amount of sales more than or less than 
$10,000,000 would be more appropriate. We also seek comment on whether 
this threshold should be based on total food sold, as we proposed, or 
on some appropriate proportion of food sales. For example, in the case 
of foreign facilities, would it be more appropriate to consider the 
proportion of food sold for marketing in the United States?
    FDA is proposing to define the term ``vulnerability'' to mean the 
susceptibility of a point, step, or procedure in a facility's food 
process to intentional adulteration. ``Vulnerability'' is used in the 
term ``vulnerability assessment'' in section 420 of the FD&C Act and 
may best be described in the food defense context as analogous to the 
term ``hazard'' in a HACCP-type framework for food safety. While 
hazards in the unintentional adulteration context may also be thought 
of as analogous to agents or contaminants in the intentional 
adulteration context, we have tentatively concluded that focusing on 
individual agents or contaminants is generally not effective or 
efficient in minimizing the risk of intentional adulteration caused by 
acts of terrorism. There are a significant number of potential agents 
or contaminants that could be used in a terrorist attack on food, with 
one or more being suitable for essentially any point in the production 
of any specific food. It would be extremely difficult, if not 
impossible, to consider the multiple combinations of potential 
contaminants, points in a food operation, and food categories, and to 
determine a strategy that would effectively address all possible 
agents. For this reason, determining whether there is an agent that 
could be intentionally introduced to a specific food that would then 
cause serious adverse health consequences or death would not be a 
useful exercise. Further, many agents or contaminants that could be 
used in such an attack are different from those that are associated 
with foodborne illnesses caused by unintentional adulteration and, as 
such, are not expected to be well understood by operators of food 
facilities. Therefore, we have tentatively concluded that in the 
intentional adulteration framework related to acts of terrorism, it is 
appropriate to refer to ``vulnerabilities'' rather than ``hazards''. 
According to the Merriam-Webster dictionary (Ref. 52), vulnerability is 
a ``susceptibility,'' and we believe this concept best captures the 
idea of a point, step, or procedure where someone intent on intentional 
adulteration would focus an attack in a facility's food process. See 
section V.C.2 of this document for a discussion of assessing 
vulnerabilities to identify actionable process steps.
    We solicit comment on the proposed definitions.

B. Exemptions

    In subpart A of proposed part 121, proposed Sec.  121.5 would 
establish exemptions from some or all of the provisions of this 
proposed regulation.
1. Proposed Sec.  121.5(a)--Exemption for Qualified Facilities
    Proposed Sec.  121.5(a) would provide that proposed part 121 does 
not apply to a qualified facility, except that qualified facilities 
must, upon request, provide for official review documentation that was 
relied upon to demonstrate that the facility meets this exemption. Such 
documentation must be retained for 2 years.
    a. Exemption of qualified facilities. As discussed in section V.A 
of this document, proposed Sec.  121.3 would

[[Page 78034]]

define a qualified facility to mean (when including the sales by any 
subsidiary; affiliate; or subsidiaries or affiliates, collectively, of 
any entity of which the facility is a subsidiary or affiliate) a 
facility that is: (1) A very small business as defined in this part, or 
(2) a facility to which both of the following apply: (i) During the 3-
year period preceding the applicable calendar year, the average annual 
monetary value of the food manufactured, processed, packed or held at 
such facility that is sold directly to qualified end-users (as defined 
in this part) during such period exceeded the average annual monetary 
value of the food sold by such facility to all other purchasers; and 
(ii) the average annual monetary value of all food sold during the 3-
year period preceding the applicable calendar year was less than 
$500,000, adjusted for inflation. In addition, we are proposing to 
define very small business to mean a business that has less than 
$10,000,000 in total annual sales of food, adjusted for inflation.
    Section 418(l)(2)(A) of the FD&C Act provides that a qualified 
facility ``shall not be subject to the requirements under [sections 
418(a) through (i) and (n) of the FD&C Act].'' We have tentatively 
concluded that we should include the exemption provided in section 
418(l)(2)(A) of the FD&C Act in proposed Sec.  121.5(a) to establish by 
regulation the reach of the provision.
    Section 418(l)(5) of the FD&C Act requires the Secretary of Health 
and Human Services, in consultation with the Secretary of Agriculture, 
to conduct a study of the food processing sector regulated by the 
Secretary of Health and Human Services and to make determinations in 
five areas. These areas include, in part: (1) Distribution of food 
production by type and size of operation; (2) the proportion of food 
produced by each type and size of operation; (3) the number and types 
of food facilities co-located on farms; (4) the incidence of foodborne 
illness originating from each size and type of operation; and (5) the 
effect on foodborne illness risk associated with certain activities 
regarding food.
    Section 418(n)(1)(B) of the FD&C Act requires that the regulations 
define the terms ``small business'' and ``very small business,'' taking 
into consideration the study of the food processing sector required by 
section 418(l)(5) of the FD&C Act. Consistent with section 418(l)(5) of 
the FD&C Act, we have consulted with USDA during our study of the food 
processing sector. The study is available in the docket established for 
this proposed rule (Ref. 53). We request comment on that study. We will 
consider comments regarding the study, as well as comments regarding 
our proposed definition for very small business, in any final rule 
based on this proposed rule.
    We note that section 420 of the FD&C Act does not contain an 
explicit size-based exemption, such as the qualified facility provision 
in section 418 of the FD&C Act. In section IV.A of this document, we 
discuss our assessment that the goal of terrorist organizations is to 
maximize public health harm and, to a lesser extent, economic 
disruption. We have tentatively concluded that such goals are likely to 
drive terrorist organizations to target the product of relatively large 
facilities, especially those for which the brand is nationally or 
internationally recognizable. The regulations issued under section 420 
of the FD&C Act are to apply to food for which there is a high risk of 
intentional contamination. We have tentatively concluded that 
designating businesses with less than $10,000,000 in total annual sales 
of food as very small businesses, resulting in their exemption from 
proposed part 121, is consistent with the requirement in section 420 of 
the FD&C Act that the regulation be limited to foods at high risk of 
intentional adulteration.
    We acknowledge that the amount of food sales in the proposed 
definition of very small business (total annual sales of food of less 
than $10,000,000) is significantly higher than the threshold in the PC 
proposed rule, in which we co-proposed three amounts ($250,000, 
$500,000, and $1,000,000 in total annual sales of food). The higher 
amount proposed here reflects the difference in the nature of risk 
related to intentional adulteration covered by this rule and is 
consistent with the requirement in section 418(n)(3)(C) of the FD&C Act 
that this regulation ``acknowledge differences in risk and minimize, as 
appropriate, the number of separate standards that apply to separate 
foods.''
    There are some facilities that are not subject to section 418 of 
the FD&C Act but are subject to section 420 of the FD&C Act, and would 
be subject to this rulemaking because their activities would likely 
involve one of the key activity types (e.g., juice manufacturing and 
breaded seafood manufacturing). However, under proposed Sec.  121.5(a), 
such facilities would be exempt from proposed part 121 if they are part 
of businesses with less than $10,000,000 in total annual sales of food, 
adjusted for inflation.
    b. Documentation requirement for qualified facilities. Sections 
418(l)(2)(A) and (l)(2)(B) of the FD&C Act provide that a qualified 
facility is exempt from the requirements of sections 418(a) through (i) 
and (n) (i.e., the requirements for hazard analysis and risk-based 
preventive controls), but must instead submit two types of 
documentation to the Secretary of Health and Human Services. The first 
type of required documentation relates to food safety practices at the 
facility, and section 418(l)(2)(B)(i) of the FD&C Act provides two 
options for satisfying this documentation requirement. Under section 
418(l)(2)(B)(i)(I) of the FD&C Act, the qualified facility may choose 
to submit documentation that demonstrates that the owner, operator, or 
agent in charge of the facility has identified potential hazards 
associated with the food being produced, is implementing preventive 
controls to address the hazards, and is monitoring the preventive 
controls to ensure that such controls are effective. Alternatively, 
under section 418(l)(2)(B)(i)(II) of the FD&C Act, the qualified 
facility may choose to submit documentation (which may include 
licenses, inspection reports, certificates, permits, credentials, 
certification by an appropriate agency (such as a State department of 
agriculture), or other evidence of oversight), as specified by the 
Secretary of Health and Human Services, that the facility is in 
compliance with State, local, county, or other applicable non-Federal 
food safety law.
    The second type of required documentation relates to whether the 
facility satisfies the definition of a qualified facility. Under 
section 418(l)(2)(B)(ii) of the FD&C Act, the facility must submit 
documentation, as specified by the Secretary of Health and Human 
Services in a guidance document, that the facility is a qualified 
facility under section 418(l)(1)(B) or section 418(l)(1)(C).
    Section 418(l)(7)(A) of the FD&C Act requires that a qualified 
facility that is exempt from the requirements under sections 418(a) 
through (i) and subsection (n), and that does not prepare documentation 
under section 418(l)(2)(B)(i)(I), provide notification to consumers by 
one of two procedures, depending on whether a food packaging label is 
required on the food. With respect to a food for which a food packaging 
label is required by the Secretary of Health and Human Services under 
any other provision of the FD&C Act, section 418(l)(7)(A)(i) of the 
FD&C Act requires that a qualified facility include prominently and 
conspicuously on such label the name and business address of the 
facility where the food was manufactured or processed. With

[[Page 78035]]

respect to a food for which a food packaging label is not required by 
the Secretary of Health and Human Services under any other provisions 
of the FD&C Act, section 418(l)(7)(A)(ii) of the FD&C Act requires that 
a qualified facility prominently and conspicuously display, at the 
point of purchase, the name and business address of the facility where 
the food was manufactured or processed, on a label, poster, sign, 
placard, or documents delivered contemporaneously with the food in the 
normal course of business, or, in the case of Internet sales, in an 
electronic notice.
    Section XIII.A of the PC proposed rule describes our proposed 
requirements pursuant to the above described modified requirements for 
qualified facilities in that proposed rule. In summary, in the PC 
proposed rule, we proposed codified language to require submission of 
the following to FDA: (1) Documentation that the facility is a 
qualified facility; and (2) documentation that demonstrates that the 
owner, operator, or agent in charge of the facility has identified the 
potential hazards associated with the food being produced, is 
implementing preventive controls to address the hazards, and is 
monitoring the performance of the preventive controls to ensure that 
such controls are effective; or documentation (which may include 
licenses, inspection reports, certificates, permits, credentials, 
certification by an appropriate agency (such as a State department of 
agriculture), or other evidence of oversight) that the facility is in 
compliance with State, local, county, or other applicable non-Federal 
food safety law, including relevant laws and regulations of foreign 
countries. In Section XIII.A of the PC proposed rule, we clarified that 
the following submission of information would be satisfactory: (1) A 
statement from the owner, operator, or agent in charge of a qualified 
facility certifying that the facility is a very small business, 
otherwise meets the definition of a qualified facility under proposed 
Sec.  117.3, or both; and (2) a statement from the owner, operator, or 
agent in charge of a qualified facility certifying that the facility 
(a) has identified the potential hazards associated with the food being 
produced, is implementing preventive controls to address the hazards, 
and is monitoring the implementation of the preventive controls to 
ensure that such controls are effective; or (b) is in compliance with 
State, local, county, or other applicable non-Federal food safety law, 
including relevant laws and regulations of foreign countries. We 
tentatively concluded that we would not, for example, require that a 
facility submit documentation to FDA demonstrating the content of their 
hazard identification, preventive controls, or monitoring of the 
implementation of preventive controls; or copies of their non-Federal 
licenses, inspection reports, certificates, permits, credentials, or 
certifications. We proposed to require that the information be 
resubmitted to FDA at least every 2 years, or whenever there is a 
material change to the information. Finally, we proposed to require 
that a qualified facility maintain records relied upon to support their 
assertion of meeting the requirements of the qualified exemption. We 
tentatively concluded that it is appropriate to require that the 
records relied upon to support a self-certified statement be retained 
and made available to FDA upon request.
    Proposed Sec.  121.5(a) would require that qualified facilities, 
upon request, provide for official review documentation that was relied 
upon to demonstrate that the facility meets this exemption. In 
addition, proposed Sec.  121.5(a) would provide that such documentation 
must be retained for 2 years. We are not proposing to apply all of the 
modified requirements described in proposed Sec.  117.201 in the PC 
proposed rule to qualified facilities that would be covered under this 
rule. We have tentatively concluded that such an approach is 
reasonable, considering the context and wording of the statutory 
provision as it relates to intentional adulteration caused by acts of 
terrorism.
    c. Withdrawal of exemption for qualified facilities. Section 
418(l)(3) of the FD&C Act provides that the Secretary of Health and 
Human Services may withdraw the exemption provided in section 
418(l)(2)(A) under certain circumstances. We discuss the withdrawal 
provisions of section 418(l)(3) of the FD&C Act, and the process we 
propose to use to withdraw an exemption for a qualified facility 
subject to that rule in section XIV.E of the PC proposed rule. We ask 
for comment on the appropriateness of those proposed procedures to 
withdraw an exemption for a qualified facility subject to this proposed 
rule. We also seek input on whether we should include the process for 
such withdrawal within proposed part 121 or whether those provisions 
might be best placed in a separate part and cross-referenced in 
proposed part 121 in order to reduce duplication, given these 
provisions also appear in the PC and the Produce Safety proposed rules.
2. Proposed Sec.  121.5(b)--Exemption for Holding of Food
    a. Requirement of section 418 of the FD&C Act. Section 418(m) of 
the FD&C Act provides in relevant part that FDA may by regulation 
``exempt or modify the requirements for compliance under [section 418 
of the FD&C Act] with respect to facilities that are solely engaged in 
. . . the storage of raw agricultural commodities (other than fruits 
and vegetables) intended for further distribution or processing or the 
storage of packaged foods that are not exposed to the environment.'' In 
the PC proposed rule, we proposed exemptions and modified requirements 
based on this provision (see proposed Sec. Sec.  117.5(j), 117.7, and 
117.206).
    b. Petition relevant to section 418(m) of the FD&C Act. In a letter 
dated July 22, 2011, an industry coalition of the American Bakers 
Association, the American Frozen Food Institute, the Grocery 
Manufacturers Association, the International Bottled Water Association, 
the International Dairy Foods Association, the International Warehouse 
Logistics Association, the Peanut and Tree Nut Processors Association, 
and the Snack Food Association (the section 418(m) petitioners) 
submitted a citizen petition (Docket No. FDA-2011-P-0561). The petition 
requests that FDA issue regulations under section 418(m) of the FD&C 
Act ``to exempt from compliance or modify the requirements for 
compliance under section 418 [of the FD&C Act] for facilities that are 
solely engaged in the storage of packaged foods that are not exposed to 
the environment, by allowing such facilities to satisfy the 
requirements of that section through compliance with the [CGMPs] 
mandated for such facilities by [current] Sec.  110.93.'' The section 
418(m) petitioners assert that the food safety issues presented by 
facilities used only to store packaged foods that are not exposed to 
the environment are essentially the same, regardless of the type of 
food. As such, trade associations representing a variety of product 
sectors are signatories to the petition and are supportive of the 
request to exempt such facilities from the provisions of section 418 of 
the FD&C Act.
    The section 418(m) petitioners stated, ``As an initial matter, the 
risk of intentional adulteration at facilities solely engaged in the 
storage of packaged foods not exposed to the environment is quite 
remote. The food in these facilities is stored in unit packaging, 
meaning any effort to adulterate the food would be laborious and likely 
ineffective.'' They further

[[Page 78036]]

asserted that, ``Members of the food industry have implemented a number 
of precautions against intentional adulteration. Most importantly, 
these facilities are locked and secured against unauthorized entry. 
Access is restricted to the employees of the manufacturer dropping off 
food, any staff employed at the facility, and the persons who deliver 
food to retailers and other customers. Food is often held in such 
facilities for a short period of time, which would not be conducive to 
attempts at intentional adulteration. Further, we note that the 
continual activity in these facilities during pickup and drop-off hours 
serves as a deterrent for anyone attempting to gain unauthorized 
access.''
    c. Proposed exemption for the holding of food. Proposed Sec.  
121.5(b) would exempt from the requirements in proposed part 121 the 
holding of food, except the holding of food in liquid storage tanks. 
This provision is broader in scope than exemptions in proposed 
Sec. Sec.  117.5(j) and 117.7 in the PC proposed rule, and would 
exempt, for example, storage of whole grains, shell eggs, fruits and 
vegetables, and packaged foods (including packaged milk and orange 
juice). It would not exempt, for example, storage in bulk storage tanks 
of milk or liquid orange juice.
    As discussed in section V.C.2 of this document, based on an 
analysis of the vulnerability assessments that FDA has conducted using 
the CARVER+Shock methodology, we identified four key activity types 
(Bulk liquid receiving and loading; Liquid storage and handling; 
Secondary ingredient handling; and Mixing and similar activities) as 
production processes that require focused mitigation strategies. With 
the exception of the holding of food in liquid storage tanks, which is 
not included in the proposed exemption, we are not aware of activities 
performed during the holding of food that fit within any of these four 
key activity types.
    We acknowledge that our proposed exemption in Sec.  121.5(b) is not 
identical to the exemption in section 418(m) of the FD&C Act. However, 
as explained above, the holding of food that would be exempt does not 
include any of the four key activity types associated with actionable 
process steps under proposed Sec.  121.130(a). Consequently, even 
without an exemption, this holding of food would not require the 
implementation of focused mitigation strategies under proposed Sec.  
121.130(a) to protect food against intentional adulteration. The only 
requirement related to holding activities would be for a written 
assessment that would conclude that no focused mitigation strategies 
are necessary with regard to the holding activities. Under these 
circumstances, we have tentatively concluded that an exemption is 
appropriate. Accordingly, we propose to exempt the holding of food, 
except the holding of food in liquid storage tanks, from the 
requirements of this proposed regulation. Although we are not 
responding to the merits of the arguments of the section 418(m) 
petitioners with regard to precautions against intentional 
adulteration, we believe that this proposed exemption meets the request 
of the section 418(m) petitioners.
3. Proposed Sec.  121.5(c)--Exemption for Packing, Re-Packing, 
Labeling, and Re-labeling of Food
    Proposed Sec.  121.5(c) would exempt from the requirements in 
proposed part 121 the packing, re-packing, labeling, or re-labeling of 
food where the container that directly contacts the food remains 
intact. As discussed in section V.C.2 of this document, based on an 
analysis of the vulnerability assessments that FDA has conducted using 
the CARVER+Shock methodology, we identified four key activity types 
(Bulk liquid receiving and loading; Liquid storage and handling; 
Secondary ingredient handling; and Mixing and similar activities) as 
production processes that require focused mitigation strategies. We are 
not aware of activities performed during the packing, re-packing, 
labeling, or re-labeling of food where the immediate package or 
container of the food remains intact that fit within any of these four 
key activity types.
    As discussed in section V.A of this document, the proposed rule 
would not require a facility that chooses to identify its actionable 
process steps under proposed Sec.  121.30(a) to implement focused 
mitigation strategies for a food process that does not include any of 
the four key activity types. Even without the exemption, a facility 
that conducts packing, re-packing, labeling, or re-labeling activities 
would be able to conclude that it has no key activity types and, 
therefore, would not be required to implement focused mitigation 
strategies. However, without an exemption, under proposed Sec.  
121.130, such a facility would be required to perform a written 
assessment to make this determination. We have tentatively concluded 
that requiring such an assessment is unnecessary. Consequently, we 
propose to exempt the packing, re-packing, labeling, or re-labeling of 
food where the container that directly contacts the food remains intact 
from the requirements of this proposed regulation.
4. Proposed Sec.  121.5(d)--Exemption for Produce Farms
    Proposed Sec.  121.5(d) would exempt from the requirements in 
proposed part 121 the activities of a facility that are subject to 
section 419 of the FD&C Act (Standards for Produce Safety). We discuss 
our tentative decision not to cover produce farms under section 419 of 
the FD&C Act in sections IV.B and IV.F, respectively, of this document.
    Section 418(k) of the FD&C Act provides that section 418 ``shall 
not apply to activities of a facility that are subject to section 
419''. Section 419 of the FD&C Act, ``Standards for Produce Safety,'' 
requires FDA to establish by regulation ``science-based minimum 
standards for the safe production and harvesting of those types of 
fruits and vegetables, including specific mixes or categories of fruits 
and vegetables, that are raw agricultural commodities for which [FDA] 
has determined that such standards minimize the risk of serious adverse 
health consequences or death.'' Section 419(h) of the FD&C Act provides 
that section 419 ``shall not apply to activities of a facility that are 
subject to section 418.''
    Establishments that are exempt from registration under section 415 
of the FD&C Act as ``farms'' would not be subject to section 418 of the 
FD&C Act when conducting activities within the farm definition. Farm 
mixed-type facilities would be subject to section 418 of the FD&C Act 
when conducting those activities that trigger the section 415 
registration requirement. We have tentatively concluded that 
Congressional intent regarding the reach of section 418(k) of the FD&C 
Act is unambiguous in that section 418(k) directly limits the exemption 
to activities of the facility that are subject to section 419 of the 
FD&C Act. We have also tentatively concluded that we should include a 
provision implementing section 418(k) of the FD&C Act in the proposed 
regulation to establish by regulation the reach of the exemption. 
Therefore, in proposed Sec.  121.5(d), we are proposing that proposed 
part 121 would not apply to activities of a facility that are subject 
to section 419 of the FD&C Act (Standards for Produce Safety).
    At the time FDA developed the farm definition and its 
interpretations of that definition, the practical impact of an 
activity's classification as inside or outside that definition was 
limited to the potential to trigger the section 415 registration 
regulations and the section 414 recordkeeping regulations. With the

[[Page 78037]]

advent of FSMA, the scope of the farm definition has taken on more 
importance because, for example, activities within the farm definition 
are not subject to section 418 of the FD&C Act, but activities outside 
the farm definition are subject to section 418. Therefore, FDA proposed 
to clarify and adjust the scope of the farm definition, including the 
classification of manufacturing, processing, packing, and holding 
activities relevant to that definition, in the proposed preventive 
controls regulations for human food. In section VIII.D of the PC 
proposed rule, we described a set of organizing principles that would 
form the basis for our proposal for classifying activities to more 
accurately reflect the scope of activities traditionally conducted by 
farms and to allow for more certainty among industry with regard to how 
their activities will be regulated.
5. Proposed Sec.  121.5(e)--Exemption for Alcoholic Beverages
    Proposed Sec.  121.5(e)(1) would provide that proposed part 121 
does not apply with respect to alcoholic beverages at a facility that 
meets the following two conditions: (i) Under the Federal Alcohol 
Administration Act (27 U.S.C. 201 et seq.) or chapter 51 of subtitle E 
of the Internal Revenue Code of 1986 (26 U.S.C. 5001 et seq.) the 
facility is required to obtain a permit from, register with, or obtain 
approval of a notice or application from the Secretary of the Treasury 
as a condition of doing business in the United States, or is a foreign 
facility of a type that would require such a permit, registration, or 
approval if it were a domestic facility; and (ii) Under section 415 of 
the Federal Food, Drug, and Cosmetic Act (21 U.S.C. 350d) the facility 
is required to register as a facility because it is engaged in 
manufacturing, processing, packing, or holding one or more alcoholic 
beverages.
    Proposed Sec.  121.5(e)(2) would provide that proposed part 121 
does not apply with respect to food other than alcoholic beverages at a 
facility described in paragraph (e)(1) of this section, provided such 
food: (i) Is in prepackaged form that prevents any direct human contact 
with such food; and (ii) Constitutes not more than 5 percent of the 
overall sales of the facility, as determined by the Secretary of the 
Treasury.
    In section X.C.7 of the PC proposed rule, we explain in detail our 
interpretation of section 116 of FSMA and our consideration of hazards 
and preventive controls for the manufacturing, processing, packing, and 
holding of alcoholic beverages. Based on that analysis, we proposed, in 
proposed Sec.  117.5(i), to exempt certain facilities engaged in the 
manufacturing, processing, packing, or holding of alcoholic beverages 
and other food. Consistent with that analysis, we are proposing similar 
exemptions related to alcoholic beverages in this proposed rule on 
focused mitigation strategies for the protection of food against 
intentional adulteration caused by acts of terrorism.
    We have tentatively concluded that we should include a provision 
implementing section 116 of FSMA in the proposed rule to establish by 
regulation the reach of the provision. We request comment on our 
interpretation of section 116 of FSMA, described in section X.C.7 of 
the PC proposed rule, and its application to the proposed exemption in 
Sec.  121.5(e).
6. Proposed Sec.  121.5(f)--Exemption for Food for Animals
    Proposed Sec.  121.5(f) would exempt from the requirements of 
proposed part 121 the manufacturing, processing, packing, and holding 
of food for animals other than man. In the Animal Food PC proposed 
rule, we proposed to require that facilities that manufacture, process, 
pack, or hold animal food and that are not otherwise covered by certain 
exemptions, design and implement a system of preventive controls to 
address food safety issues. In that proposed rulemaking, we tentatively 
concluded that hazards associated with intentional adulteration would 
likely require different kinds of controls and would be best addressed 
in a separate rulemaking.
    We also requested comment in that rulemaking on whether to include 
in those regulations potential hazards that may be intentionally 
introduced for economic reasons, which we refer to as economically 
motivated adulteration, a type of intentional adulteration. Our current 
thinking regarding economically motivated adulteration is discussed in 
section IV.F of this document.
    Section 418(m) of the FD&C Act authorizes FDA to exempt or modify 
the requirements for compliance with section 418 with regard to 
facilities that engage solely in the production of animal food. 
Further, section 420(c) of the FD&C Act requires that regulations that 
FDA issues under that section apply only to food for which there is a 
high risk of intentional contamination. In section IV.A of this 
document, we discuss how FDA is proposing to implement the provisions 
of sections 418 and 420 of the FD&C Act with regard to circumstances 
under which a facility subject to either of these sections would be 
required to have and implement focused mitigation strategies under a 
HACCP-like system to address intentional adulteration related to 
terrorism. In summary, this proposed rule would require a facility to 
implement focused mitigation strategies if one or more of four key 
activity types are applicable to its food operation or if a facility 
conducts its own vulnerability assessment and identifies actionable 
process steps for significant vulnerabilities in its food operation.
    The identification of a production step for a food as necessitating 
focused mitigation strategies is premised upon an analysis, based on 
CARVER+Shock methodology, that an attack at these points in the 
production of a food would likely result in an outcome that is 
consistent with our understanding of the goal of terrorist 
organizations (i.e., maximizing adverse public health impacts and, to a 
lesser extent, economic disruption) (Ref. 54). For human foods, our 
analyses show the potential for significant human morbidity and 
mortality should intentional adulteration occur at any one or more of 
these points in a food operation. (Significant economic harm is also 
likely, related to the human morbidity and mortality as well as 
disruption in the food supply as a result of loss of consumer 
confidence in its safety.) In contrast, for animal food, our analysis 
shows only minimal potential for human morbidity or mortality as a 
result of attacks at key activity types or other points in an animal 
food operation. Significantly, our CARVER+Shock vulnerability 
assessments of animal food have had to focus entirely on economic 
consequences because of the lack of potential for human morbidity and 
mortality.
    In considering whether to provide an exemption related to animal 
food, we evaluated three types of possible attack scenarios: (1) 
Incorporation of a contaminant into feed to be used for muscle meat-
producing animals; (2) incorporation of a contaminant into feed to be 
used for egg-producing or milk-producing animals; and (3) incorporation 
of a contaminant into pet food. With regard to the two former 
scenarios, we are not aware of contaminants that could be incorporated 
into feed at levels that would not produce noticeable clinical signs 
and/or mortality in animals but would result in significant human 
morbidity or mortality among consumers that subsequently eat the meat, 
eggs or milk (Ref. 55). While contaminants can increase the risk of 
chronic disease, such as cancer, among consumers (Ref. 56), such an 
outcome is not consistent

[[Page 78038]]

with our understanding of the goals of terrorist organizations, which 
include a more immediate impact. We recognize that such an attack could 
result in significant economic disruption because of the loss of 
consumer confidence in the safety of the food supply. While important, 
attacks of that nature fall significantly below those involving human 
morbidity and mortality when placed on a scale of risk with regard to 
targeting by terrorist organizations.
    Regarding the third attack scenario (incorporation of a contaminant 
into pet food), we are aware of contaminants that could be incorporated 
into feed or pet food that could result in significant animal 
(including pet) morbidity and mortality, including some which could 
result in secondary infectious spread of disease (because some 
infectious agents can be transmitted orally as well as through 
aerosol). Again, such attacks could be significant from an economic and 
societal standpoint. However, the risk that they pose with regard to 
targeting by terrorist organizations appears to be significantly lower 
than those involving human morbidity and mortality. We request comment 
on this assessment of risk.
    Therefore, notwithstanding the likely presence of one or more of 
the four key activity types in the production of many animal foods, we 
have tentatively concluded that animal food (regardless of whether it 
is produced at a facility solely engaged in the production of animal 
food or at a facility engaged in the production of both animal and 
human food) does not involve significant vulnerabilities that require 
focused mitigation strategies under section 418 of the FD&C Act and is 
not at high risk for intentional adulteration related to terrorism 
under section 420 of the FD&C Act. Consequently, we are proposing to 
exempt the manufacturing, processing, packing, and holding of food for 
animals other than man. We request comment on these tentative 
conclusions.

C. Food Defense Measures

    In subpart C of proposed part 121, FDA is proposing various food 
defense measures, including requirements for a food defense plan, 
identification of actionable process steps, implementation of focused 
mitigation strategies and related monitoring, corrective actions, and 
verification, and training of certain personnel. We discuss the 
provisions of proposed subpart C in this section.
1. Food Defense Plan
    a. Proposed Sec.  121.126(a)--Requirement for a Food Defense Plan. 
Proposed Sec.  121.126(a) would require that the owner, operator, or 
agent in charge of a facility prepare, or have prepared, and implement 
a written food defense plan. To make clear that the written plan is 
related to food defense rather than to other plans a facility may have 
(such as quality control plans or food safety plans), for purposes of 
this rulemaking, we have designated the ``written plan'' to be a ``food 
defense plan.'' A written food defense plan is essential for a facility 
covered by this rule to implement the plan consistently, train its 
employees, and periodically reanalyze and update the plan. It is also 
essential to auditors, and to inspectors, in the same way written plans 
are essential to ensuring food safety. A written food defense plan 
addressing vulnerabilities associated with intentional adulteration is 
analogous to a written HACCP or food safety plan for hazards associated 
with unintentional contamination.
    Proposed Sec.  121.126(a) would provide flexibility for the owner, 
operator, or agent in charge of the facility to either prepare the 
written food defense plan or have that plan prepared, in whole or in 
part, on its behalf. In addition, proposed Sec.  121.126 would provide 
flexibility for facilities in the development of their food defense 
plans by allowing facilities to group food types or production method 
types if the vulnerabilities, focused mitigation strategies, and other 
required procedures, such as monitoring, are essentially identical.
    Proposed Sec.  121.126(a) would require that the owner, operator, 
or agent in charge of a facility implement the written food defense 
plan. Our proposed requirement to develop and implement a food defense 
plan, which includes the identification of actionable process steps and 
implementation of focused mitigation strategies, reflects our tentative 
conclusion that such actions are measures necessary to prepare and 
protect the food supply from intentional adulteration caused by acts of 
terrorism. Proposed Sec.  121.126(a) implements sections 418(b), (c), 
(d), (e), (f), and (h), and 420(b) of the FD&C Act. We seek comment on 
these tentative conclusions.
    b. Proposed Sec.  121.126(b)--Contents of a food defense plan. 
Proposed Sec.  121.126(b)(1) through (b)(5) would require that the 
contents of a food defense plan include:
     The written identification of actionable process steps as 
required by proposed Sec.  121.130;
     The written focused mitigation strategies as required by 
proposed Sec.  121.135(b);
     The written procedures for monitoring as required by 
proposed Sec.  121.140(a);
     The written corrective action procedures as required by 
proposed Sec.  121.145(a)(1); and
     The written verification procedures as required by 
proposed Sec.  121.150(e).
    Although we are proposing to require that the contents of food 
defense plan include only the specific elements described above, the 
food defense plan can be used as a resource for facilities to capture 
additional food defense-related information. For example, facilities 
may also wish to include information, such as process flow diagrams, an 
evaluation of broad mitigation strategies, emergency contact 
information, crisis management plans, action plans for implementation 
of broad mitigation strategies, results of supplier audits, and other 
documents, analysis, reviews, or information the facility finds 
relevant to its food defense program. FDA has developed and publicly 
released the user-friendly FDPB software tool that can be used to 
assist a facility to develop a robust food defense plan. This free tool 
is available on the FDA Web site at http://www.fda.gov/Food/FoodDefense/ToolsEducationalMaterials/ucm349888.htm.
    Proposed Sec.  121.126, if finalized, would establish a requirement 
for every facility covered by this rule to have its own written food 
defense plan. Like the food safety plan, this facility-based nature of 
the written food defense plan is consistent with the overall framework 
of section 418 of the FD&C Act, which is directed to a facility rather 
than, for example, a corporate entity that may have multiple 
facilities.
    Proposed Sec.  117.126(c) of the PC proposed rule would require 
that the food safety plan be prepared by (or its preparation overseen 
by) a qualified individual (See the discussion in section XII.A.4 of 
the PC proposed rule). We are proposing to require that the 
vulnerability assessment be performed by an individual qualified by 
experience and/or training only when facilities choose to identify 
actionable process steps in their food defense plans using the 
provisions of proposed Sec.  121.130(b), whereby they would perform 
their own vulnerability assessment. Our proposal is based on two 
considerations. First, we anticipate that most facilities will develop 
their food defense plan using the procedure in proposed Sec.  
121.130(a) for identification of actionable process steps. Here, FDA 
has performed much of the scientific analysis required and identified 
the key activity types (see section V.C.2 of this document for

[[Page 78039]]

further discussion). Second, we believe that the identification of 
focused mitigation strategies, and the monitoring, corrective action 
and verification activities to implement them requires less technical 
expertise than required for preventive controls and implementation 
procedures for those controls. The former usually involve focused 
mitigation strategies to limit access to specific steps in the 
production process with simple visual checks to monitor them, while the 
latter often involve scientific studies to establish critical limits 
with process control instruments to monitor them.
    Proposed Sec.  121.126(b) implements sections 418(h) and 420(b)(2) 
of the FD&C Act.
    We seek comment on our proposed provisions related to the written 
food defense plan and its contents.
2. Identification of Actionable Process Steps
    a. FDA's vulnerability assessments and FDA-identified key activity 
types. As noted in section II.B of this document, under the SPPA 
Initiative, FDA, along with USDA, FBI, and DHS, conducted vulnerability 
assessments on products and processes in the food and agriculture 
sector. After conclusion of the initiative, FDA continued conducting 
assessments for products and processes not previously assessed. To 
implement section 420(a)(1)(A), FDA combined and analyzed data from a 
subset of these assessments (i.e., those relevant to the food 
manufacturing and distribution segments of the food system) and 
identified activities which consistently ranked high for vulnerability 
to intentional adulteration. FDA published the results of this analysis 
in April, 2013 (April 2013 Report) (Ref. 54).
    CARVER+Shock methodology is a tool for assessing the 
vulnerabilities within a food system and determining the most 
vulnerable points, and focusing resources on protecting the most 
susceptible points. Using the CARVER+Shock methodology, FDA, in 
collaboration with other U.S. government partners conducted over 50 
vulnerability assessments on a wide range of food products and 
processes. Based on these assessments, we identified the processing 
steps with the greatest vulnerability to intentional adulteration 
caused by acts of terrorism. Through this review, we determined that 
the processing steps we identified fit into one of four groups of 
activities occurring at those processing steps. We refer to these as 
``key activity types.'' The key activity types that we have identified 
are: (1) Bulk liquid receiving and loading, (2) Liquid storage and 
handling, (3) Secondary ingredient handling, and (4) Mixing and similar 
activities. In this proposed rule we have modified the activity type 
names and descriptions from those in the April 2013 Report for clarity.
    Providing these key activity types to facilities for their use in 
identifying actionable process steps and developing focused mitigation 
strategies provides some advantages over other approaches that we might 
have taken, such as identifying points in the production of specific 
foods at increased risk for intentional adulteration caused by an acts 
of terrorism, or requiring each facility to perform its own 
vulnerability assessment. First, publicly providing a list of key 
activity types does not disclose sensitive information, as might be the 
case if we provided CARVER+Shock scores derived from our vulnerability 
assessments for process steps for specific foods.
    Second, providing a list of key activity types rather than 
requiring facilities to perform their own facility-specific 
vulnerability assessments relieves the burden upon the facility to 
assemble a team of individuals with the diverse expertise needed to 
properly self-score the steps in their process (using the CARVER+Shock 
Vulnerability Assessment software tool or another suitable tool). When 
we performed vulnerability assessments during the SPPA initiative our 
teams included individuals with expertise in the production of the food 
under study, law enforcement, food science, food regulatory systems, 
and public health. We expect that such an effort is likely beyond the 
capacity of many facilities. Further, by providing a list of key 
activity types, we eliminate the need to identify a CARVER+Shock score, 
for example, as the threshold for the implementation of focused 
mitigation strategies. This is important because CARVER+Shock scores 
are somewhat subjective and difficult to correlate across food types, 
making identification of a universal threshold score challenging.
    b. Proposed Sec.  121.130--Requirement for written identification 
of actionable process steps. Proposed Sec.  121.130 would require that 
the owner, operator, or agent in charge of a facility identify any 
actionable process steps, using the procedures in either proposed Sec.  
121.130(a) or proposed Sec.  121.130(b). A facility would be required 
to follow either one of the two specified procedures, but not both.
    Proposed Sec.  121.130 would also require that the identification 
of actionable process steps and the assessment leading to that 
identification be written. A written assessment of whether the facility 
has one or more of the key activity types (under proposed Sec.  
121.130(a)) or a written vulnerability assessment (under proposed Sec.  
121.130(b)) would help the facility organize its assessment, and fully 
understand the nature of the vulnerabilities. In addition, it is 
essential for auditors and inspectors to assess the adequacy of the 
facility's assessment. This written identification of actionable 
process steps would also be essential during reanalysis of the food 
defense plan, as would be required by proposed Sec.  121.150(d). Such a 
written document would also be useful for training purposes as a tool 
to make employees aware of the elements of the facility's food defense 
plan.
    The written identification of actionable process steps must include 
the justification for whatever conclusion the owner, operator, or agent 
in charge of a facility reaches. Proposed Sec.  121.130 would not limit 
the requirement for a written identification of actionable process 
steps to only those circumstances where the owner, operator, or agent 
in charge of a facility identifies one or more actionable process 
steps. Rather, under proposed Sec.  121.130, a written analysis would 
be required even if the conclusion of the analysis is that there are no 
actionable process step.
    If a facility chooses to identify actionable process steps using 
the procedure in proposed Sec.  121.130(a), the written documentation 
would not need to include the procedures for assessing the 
vulnerabilities associated with identified actionable process steps. If 
a facility chooses to identify actionable process steps using the 
procedure in proposed Sec.  121.130(b), the written identification of 
actionable process steps must include information about the appropriate 
methods used to conduct the vulnerability assessment and identify 
actionable process steps, and the experience and training of the 
person(s) who conducted that assessment (see also discussion in section 
V.C.2.d of this document).
    Proposed Sec.  121.130 implements sections 418(b)(2), 418(b)(3), 
420(a)(1), and 420(b)(1) of the FD&C Act.
    c. Proposed Sec.  121.130(a)--Identification of actionable process 
steps using FDA-identified key activity types. Proposed Sec.  
121.130(a) would specify the first of two procedures by which the 
proposed requirement for identification of actionable process steps in 
proposed Sec.  121.130 can be met, i.e., using the FDA-identified key 
activity types.

[[Page 78040]]

    Proposed Sec.  121.130(a) would state that the owner, operator, or 
agent in charge of a facility must assess, for each type of food 
manufactured, processed, packed or held at the facility, whether the 
facility has one or more of the following key activity types and 
identify the actionable process steps associated with any key activity 
types present:
    1. Bulk liquid receiving and loading--a step in which a bulk liquid 
is received and unloaded from an inbound conveyance or loaded into an 
outbound conveyance where a contaminant can be intentionally introduced 
and, if it is, it is likely that the contaminant will be distributed 
throughout the liquid due to sloshing, movement, or turbulence caused 
by the receiving and unloading or loading activity;
    2. Liquid storage and handling--a step in which a liquid is 
contained in bulk storage tanks or in holding, surge, or metering tanks 
where a contaminant can be intentionally introduced and, if it is, it 
is likely that the contaminant will be distributed into the food;
    3. Secondary ingredient handling--a staging, preparation, addition, 
or rework step where a contaminant can be intentionally introduced into 
a relatively small amount of ingredient or rework and, if it is, it is 
likely that the contaminant will be distributed into a larger volume of 
food; and
    4. Mixing and similar activities--a step, such as mixing, blending, 
homogenizing, or grinding where a contaminant can be intentionally 
introduced and, if it is, it is likely that the contaminant will be 
distributed into the food.
    The owner, operator, or agent in charge would be required to assess 
whether the facility has a food process that involves any one or more 
of the specified four key activity types. If the food process is found 
to involve any key activity types, the owner, operator, or agent would 
be required to identify actionable process step(s) that are associated 
with each key activity type that is present.
    For example, based on proposed Sec.  121.130(a), a facility may 
identify a mixing tank as involving the key activity type, Mixing and 
similar activities, in its operation because the mixing tank has an 
unsecured lid and several sample ports which provide direct access to 
the food product and because a contaminant can be introduced into the 
tank through the lid or one of the sampling ports and, if it is, the 
contaminant would be distributed into the food. The owner would 
conclude that the mixing tank is an actionable process step. We would 
expect that this conclusion would be reached for virtually all steps 
that involve mixing, blending, homogenizing, or grinding because these 
kinds of process steps generally: (1) Present an opportunity for access 
to the product at or just prior to the equipment (e.g., in-feed 
conveyor); and (2) would cause a contaminant, if intentionally added, 
to be distributed into the food. We expect this conclusion to be 
reached regardless of whether the facility may already have mitigation 
strategies in place to impede access to the mixing tank (e.g., a 
``buddy system'' that ensures that at least two employees were present 
at the mixing tank at all times or a lock on the mixing tank access 
ports). The presence of mitigation strategies should not be considered 
when assessing whether a facility has a process step that involves one 
of the key activity types. Any existing mitigation strategies and their 
adequacy to significantly minimize or prevent the significant 
vulnerability should be considered at a later step when identifying 
appropriate focused mitigation strategies, in accordance with proposed 
Sec.  121.135.
    We acknowledge the possibility, although not likely, that 
circumstances may exist where access at or just prior to the equipment 
is not possible (i.e., because the equipment is fully enclosed, with no 
access ports), and that in such a situation this process step would not 
be identified as fitting within the key activity type. For example, the 
owner of the same facility may assess a second mixing tank that is part 
of an entirely closed system, with no direct access points into the 
system, such that an individual attempting to access this mixing tank 
would likely cause a major disruption to the line, foiling any 
attempted intentional adulteration. Based on this assessment, the owner 
may conclude that the enclosed nature of this second mixing tank 
renders the product inaccessible at this step and, therefore, it does 
not fit within the key activity type. In this circumstance, there would 
be no requirement to identify an actionable process step associated 
with this mixing tank (in which case, there also would be no 
requirement to implement a focused mitigation strategy at this step). 
Under proposed Sec.  121.130, the owner would be required to document 
the basis for the determination that the second mixing tank does not 
fit within the key activity type. The second mixing tank would continue 
to be subject to the requirement for reanalysis of a food defense plan, 
as proposed in Sec.  121.150(d) and the facility would consider the 
applicability of the four key activity types during reanalysis. We 
request comment on whether there are specific process steps for 
specific products that otherwise fit within one of the four key 
activity types but for which access to the equipment is not possible 
(i.e., because the equipment is fully enclosed, with no access ports).
    If the owner, operator, or agent in charge determines that the food 
operation does not involve any of the key activity types, there would 
be no need to identify actionable process steps. Such a facility, 
however, would still be required to document its finding that none of 
the key activity types apply to its food processes, under proposed 
Sec.  121.130. The documentation would be a part of the written food 
defense plan required under proposed Sec.  121.126. Such a facility 
would continue to be subject to the requirement for reanalysis of a 
food defense plan, as proposed in Sec.  121.150(d).
    Proposed Sec.  121.130(a) would require that the process of 
identification of actionable process steps be done ``for each type of 
food manufactured, processed, packed, or held at the facility.'' The 
vulnerability of a food to intentional contamination may differ based 
on the type of food and associated process, practices, and conditions 
at the facility. Therefore, we are proposing that the facility assess 
whether it has any of the key activity types for each type of food that 
is manufactured, processed, packed, or held at that facility. A 
facility may find that its operation related to one type of food 
manufactured at that facility involves one or more of the key activity 
types, but all other types of food manufactured at that facility do not 
involve any of the key activity types. In such an instance, actionable 
process steps would need to be identified and focused mitigation 
strategies implemented only for the food type that involved the key 
activity types.
    Description of key activity types--As discussed in section V.C.2.a 
of this document, our vulnerability assessments revealed four key 
activity types that most commonly rank high: Bulk liquid receiving and 
loading; Liquid storage and handling; Secondary ingredient handling; 
and Mixing and similar activities. We have tentatively concluded that 
the presence of any of these four key activity types in a food 
operation indicates a significant vulnerability for intentional 
contamination caused by acts of terrorism. Based on our assessments, we 
believe that these four key activity types capture the significant 
vulnerabilities in a food operation. However, although generally 
unlikely, a vulnerability

[[Page 78041]]

assessment of a specific food at a specific facility conducted under 
proposed Sec.  121.130(b) may identify significant vulnerabilities at 
actionable process steps that are not associated with one of these four 
key activity types. We seek comment on our tentative conclusion.
    Proposed Sec.  121.130(a)(1) would identify ``Bulk liquid receiving 
and loading'' as a key activity type, based on our finding that this 
activity type commonly ranked high in our vulnerability assessments. 
Proposed Sec.  121.130(a) would describe this key activity type as a 
step in which a bulk liquid is received and unloaded from an inbound 
conveyance or loaded into an outbound conveyance where a contaminant 
can be intentionally introduced and, if it is, it is likely that the 
contaminant will be distributed throughout the liquid due to sloshing, 
movement, or turbulence caused by the receiving and unloading or 
loading activity. Bulk liquid receiving refers to the inbound movement 
of liquid product into a facility for its use in the food production 
process, whereas bulk liquid loading refers to the outbound movement of 
liquid product from a facility for further processing or use by an end 
customer/consumer. Examples of products that may be received or loaded 
in bulk include juices, high fructose corn syrup and other sweeteners, 
milk, animal fats, syrups, and vegetable oils.
    Bulk liquid receiving and loading refers to any processing step 
where a liquid ingredient is being received and unloaded at a facility 
or a liquid intermediate or finished product is being loaded into an 
outbound shipping transport vehicle and for which there is an 
opportunity for a contaminant to be intentionally introduced into the 
food. This key activity type incorporates the actions of opening the 
transport vehicle, attaching any pumping equipment or hoses, and 
opening any venting hatches. The characteristics associated with these 
activities are such that there is a high probability of a contaminant, 
if intentionally added, mixing within the liquid, due to significant 
sloshing, movement, and turbulence associated with the receiving or 
loading activity. In addition, the need for worker activity associated 
with these processing steps provides access to hoses, the transport 
vessel, and potentially the product as it is being received or loaded.
    Proposed Sec.  121.130(a)(2) would identify ``Liquid storage and 
handling'' as a key activity type, based on our finding that this 
activity type ranked high in our vulnerability assessments. Proposed 
Sec.  121.130(a) would describe this key activity type as a step in 
which a liquid is contained in bulk storage tanks or in holding, surge, 
or metering tanks where a contaminant can be intentionally introduced 
and, if it is, it is likely that the contaminant will be distributed 
into the food. This key activity type refers to any processing step 
where a liquid ingredient or intermediate or finished liquid product is 
stored in either bulk storage tanks or smaller secondary, non-bulk 
holding tanks or surge tanks and for which there is an opportunity for 
a contaminant to be intentionally introduced into the food. Bulk liquid 
storage refers to any storage silo or tank where liquid product may be 
stored prior to introduction into the product stream or prior to 
loading for outbound shipping. Non-bulk tanks can be used to store non-
bulk liquid ingredients (e.g., fats, oils, vitamin mixes, and 
sweeteners), hold liquid product for sample testing and other quality 
control activity, or to control flow rates of liquid ingredients or 
product through the production system. Non-bulk storage tanks also 
include tanks or totes where the tamper evident seals are opened and 
the container itself is used for holding. Both categories of liquid 
storage can be considered key processing steps because if a contaminant 
were successfully introduced, there is a high probability of a 
contaminant mixing within the liquid due to the agitation commonly used 
to prevent separation within the liquid medium. Access necessary for 
the introduction of a contaminant is generally available through 
hatches, sample ports, and the container lid (in the case of a tanker 
or tote for which the tamper evident seal has been broken).
    Proposed Sec.  121.130(a)(3) would identify ``Secondary ingredient 
handling'' as a key activity type, based on our finding that this 
activity type commonly ranked high in our vulnerability assessments. 
Proposed Sec.  121.130(a) would describe this key activity type as the 
staging, preparation, addition, or rework step where a contaminant can 
be intentionally introduced into a relatively small amount of 
ingredient or rework and, if it is, it is likely that the contaminant 
will be distributed into a larger volume of food. This key activity 
type refers to any processing step where ingredients (either dry or 
liquid) are manipulated prior to or during addition to the product 
stream by human contact and for which there is an opportunity for a 
contaminant to be intentionally introduced into the food. ``Staging'' 
refers to the process of opening the tamper evident packaging of a 
secondary ingredient and moving the ingredient to the production area 
in advance of being added into the primary product stream. 
``Preparation'' refers to any act of measuring, weighing, premixing, or 
otherwise manipulating the ingredient prior to addition to the product 
stream. ``Addition'' refers to any act of physically adding ingredient 
directly into the product stream or into surge or meter hoppers in 
order to deliver the ingredient into the product stream. ``Rework'' 
refers to clean, unadulterated food that has been removed from 
processing for reasons other than insanitary conditions or that has 
been successfully reconditioned by reprocessing and that is suitable 
for use as food. Staging, preparation, addition, and rework involving 
secondary ingredients are key activities because a contaminant added to 
a relatively small volume of product would be distributed into the 
large product flow as the ingredient or rework is combined with the 
other components of the food. Secondary ingredient staging, 
preparation, addition, and rework are generally open and accessible and 
that accessibility is an inherent component of the activity. Thus, 
these key activities provide a potential point of access where a 
contaminant could be introduced into the product stream.
    Proposed Sec.  121.130(a)(4) would identify ``Mixing and similar 
activities'' as a key activity type, based on our finding that the 
activities commonly ranked high in our vulnerability assessments. 
Proposed Sec.  121.130(a) would describe this key activity type as a 
step, such as mixing, blending, homogenizing, coating, glazing, or 
grinding where a contaminant can be intentionally introduced and, if it 
is, it is likely that the contaminant will be distributed into the 
food. This key activity type refers to any processing step where there 
is an opportunity for a contaminant to be intentionally introduced into 
the food, and the primary purpose or result of the processing step is: 
(1) Coating, i.e., to layer a powder or liquid onto the surface of a 
product, such as a batter, breading, glazing or flavoring; (2) mixing, 
i.e., to blend a powder, dough, or liquid ingredient together; (3) 
grinding, i.e., to reduce the particle size of a solid ingredient or 
mass to a smaller granularity; or (4) homogenizing, i.e., to reduce the 
particle size of an ingredient and disperse it throughout a liquid.
    These are key activities because a potential contaminant 
successfully added at one of these steps would generally be readily 
dispersed throughout the product. Further, access is generally 
available through access ports, lids, and in-feed conveyors or

[[Page 78042]]

flumes. Examples of equipment associated with these activities include: 
Mixers, blenders, homogenizers, cascade breaders, mills, grinders, and 
pulverizers.
    We seek comment on these key activity types, and whether they are 
each appropriate to include and whether there are additional activities 
that present significant vulnerability to intentional adulteration 
caused by acts of terrorism.
    Proposed Sec.  121.130(a) implements sections 418(a) through (c) 
and 420(a)(1)(A) of the FD&C Act.
    d. Proposed Sec.  121.130(b)--Identification of actionable process 
steps by conducting a vulnerability assessment. Proposed Sec.  
121.130(b) would provide the second of two options for identification 
of actionable process steps. Proposed Sec.  121.130(b) would specify 
that the owner, operator, or agent in charge of a facility must conduct 
or have conducted, for each food type manufactured, processed, packed 
or held at the facility, an evaluation to identify and prioritize the 
points, steps, and procedures in a food operation based on their 
vulnerability to intentional adulteration and to identify actionable 
process steps.
    Proposed Sec.  121.130(b) would provide flexibility to the owner, 
operator, or agent in charge of a facility covered by this rule to 
conduct, or have conducted, their own vulnerability assessment of the 
food operations at a facility, rather than assessing their food 
operation against the FDA-identified key activity types. We are 
proposing that a vulnerability assessment conducted under proposed 
Sec.  121.130(b) must be performed by an individual(s) qualified by 
experience and/or training using appropriate methods. Training or job 
experience is essential to the effective evaluation of vulnerabilities 
and identification of actionable process steps. Only a trained 
individual or individual qualified by job experience using appropriate 
methods would be capable of effectively conducting a vulnerability 
assessment, including assessing the various points, steps, or 
procedures in a food process; identifying and prioritizing those 
points, steps, or procedures in a food process that are susceptible to 
intentional contamination; and identifying actionable process steps 
where food defense measures are essential to address significant 
vulnerabilities. Our proposed definition of significant vulnerability 
(in proposed Sec.  121.3), too, reflects the need for a qualified 
individual to make such assessments where focused mitigation strategies 
would be necessary to protect the food from intentional adulteration 
caused by acts of terrorism. As noted above, when we performed 
vulnerability assessments during the SPPA initiative our teams included 
individuals with expertise in the production of the food under study, 
law enforcement, food science, food regulatory systems, and public 
health. While we are not proposing to specify the particular training 
or experience requirements of the individual(s) qualified to conduct 
such vulnerability assessments, or the particular methods that must be 
used to conduct these assessments, facilities choosing this procedure 
in proposed Sec.  121.130(b) would be required to employ appropriate 
methods and use a qualified individual(s) to conduct a robust and 
scientifically sound vulnerability assessment of the facility's food 
operation. FDA's resources available online, such as the CARVER+Shock 
Vulnerability Assessment software tool and the FDPB software tool may 
be helpful.
    Finally, as in the case of proposed Sec.  121.130(a), proposed 
Sec.  121.130(b) would require that the process of identification of 
actionable process steps be done ``for each type of food manufactured, 
processed, packed, or held at the facility.'' See discussion in section 
V.C.2 of this document.
    Elements of a Facility-Specific Vulnerability Assessment--The 
elements of an approach to conducting a facility-specific vulnerability 
assessment are:
     Planning to conduct a vulnerability assessment--collect 
and evaluate appropriate background information on biological, 
chemical, physical, and radiological agents of concern, such as those 
found in the CDC's Select Agents and Toxins List (Ref. 57);
     Assembling the vulnerability assessment team--identify 
appropriate individuals within the organization to assist in the 
vulnerability assessment process. This may include personnel working in 
the areas of security, food safety/quality assurance or control, human 
resources, operations, maintenance, and other individuals deemed 
necessary to facilitate the formation of a vulnerability assessment;
     Developing a process flow diagram--list out each of the 
steps in the food process to be evaluated;
     Identifying significant vulnerabilities--evaluate each 
process step to prioritize vulnerabilities and identify significant 
vulnerabilities. For each process step, the evaluation should consider, 
at a minimum: (1) The potential public health impact if a contaminant 
were added; (2) whether downstream processing steps would eliminate or 
remove agents of concern; (3) the degree of physical access to product; 
(4) the ability of an aggressor to successfully contaminate the 
product; and (5) the volume of product impacted. This evaluation should 
also include the rationale or justification for which process steps 
were and were not identified as significant vulnerabilities; and
     Identifying actionable process steps--for identified 
significant vulnerabilities, indicate where actionable process steps 
exist in the food process and where associated focused mitigation 
strategies would be required to be implemented, under proposed Sec.  
121.135.
    Facilities that choose this alternative may need assistance from 
outside experts who are knowledgeable in food defense and vulnerability 
assessments. Some facilities may not have the resources or the 
necessary expertise on site and expert advice may be obtained when 
necessary from other sources, such as trade and industry associations, 
independent experts, and regulatory authorities.
    We seek comment on the need for, and appropriateness of, proposed 
Sec.  121.130(b), including whether, in a final rule, we should specify 
the particular qualifications of individual(s) performing the 
vulnerability assessment or the methods that must be used under this 
alternative procedure, and whether the vulnerability assessment 
elements, we described previously, provide sufficient direction 
regarding appropriate methodology.
    Proposed Sec.  121.130(b) implements sections 418(a) to (c) and 
420(a)(1)(A) of the FD&C Act.
3. Focused Mitigation Strategies
    a. Requirements of sections 418 and 420 of the FD&C Act. Section 
418(c)(2) of the FD&C Act, in relevant part, specifies that the owner, 
operator, or agent in charge of a facility shall identify and implement 
preventive controls to provide assurances that hazards identified in 
the hazard analysis conducted under section 418(b)(2) of the FD&C Act 
will be significantly minimized or prevented and addressed, consistent 
with section 420 of the FD&C Act, as applicable. Section 418(c)(1)(3) 
of the FD&C Act, in relevant part, specifies that the preventive 
controls must also provide assurances that the food manufactured, 
processed, packed, or held by such facility will not be adulterated 
under section 402 of the FD&C Act. Section 418(h) of the FD&C Act 
requires that the owner, operator, or agent in charge of a facility 
prepare a written food safety plan that, among

[[Page 78043]]

other things, identifies the preventive controls within the plan. 
Section 420(b) of the FD&C Act requires FDA to issue regulations to 
protect against the intentional adulteration of food. Such regulations 
are to specify appropriate science-based mitigation strategies or 
measures to prepare and protect the food supply chain at specific 
vulnerable points, as appropriate (section 420(b)(2) of the FD&C Act).
    Section 418(o)(3) of the FD&C Act defines preventive controls as 
``those risk-based, reasonably appropriate procedures, practices, and 
processes that a person knowledgeable about the safe manufacturing, 
processing, packing, or holding of food would employ to significantly 
minimize or prevent the hazards identified under the hazard analysis 
conducted under [section 418(b) of the FD&C Act] and that are 
consistent with the current scientific understanding of safe food 
manufacturing, processing, packing or holding at the time of the 
analysis.'' The definition provides that ``those procedures, practices, 
and processes may include the following: (A) Sanitation procedures for 
food-contact surfaces and utensils and food-contact surfaces of 
equipment; (B) Supervisor, manager, and employee hygiene training; (C) 
An environmental monitoring program to verify the effectiveness of 
pathogen controls in processes where a food is exposed to a potential 
contaminant in the environment; (D) A food allergen control program; 
(E) A recall plan; (F) Current Good Manufacturing Practices (cGMPs) 
under part 110 of title 21, Code of Federal Regulations (or any 
successor regulations); (G) Supplier verification activities that 
relate to the safety of food.'' (emphasis added)
    In section V.A.2 of this document, we discuss our proposed 
definition of focused mitigation strategy and its relationship to the 
definition of preventive controls in section 418(o)(3) of the FD&C Act. 
We are not proposing requirements for sanitation procedures, hygiene 
training, environmental monitoring, food allergen control, and CGMPs 
because these examples are relevant to food safety, but not to food 
defense. We considered proposing to require a recall plan (as we did in 
the PC proposed rule in proposed Sec.  117.135(d)(4); see sections 
XII.C.8 and XII.D of that document). However, we tentatively conclude 
that the usefulness of a recall plan is greatly reduced in the context 
of preventive controls for intentional adulteration. The relationship 
between an implementation failure and the status of the food is 
different in intentional adulteration and food safety contexts. An act 
of intentional adulteration caused by terrorism, historically, has been 
a rare event. In the vast majority of cases, the failure to properly 
implement a focused mitigation strategy would not be expected to result 
in intentional adulteration. With intentional adulteration, 
adulteration of food requires not just the opportunity for a 
contamination event (i.e., failure of a mitigation strategy to limit 
access to an actionable process step), but also someone with intent to 
cause harm at that same moment. As such, it is unlikely that a 
deviation from the provisions of this proposed rule would necessitate a 
recall. In contrast, the failure to properly implement a preventive 
control for a food safety hazard (for example, where proper cook 
temperatures are not reached in a process) would be expected to more 
likely result in a situation where the food becomes adulterated (e.g., 
because the pathogen reasonably likely to be present in the raw food 
would not be eliminated from the food by the inadequate cooking 
process), potentially necessitating a recall.
    b. General description of mitigation strategies. Mitigation 
strategies are measures taken by a facility to reduce the potential for 
intentional adulteration of food. Based on these vulnerability 
assessments, FDA previously developed recommendations for mitigation 
strategies that can be implemented, as appropriate, to minimize or 
prevent intentional contamination of food. These mitigation strategies 
are presented in our guidance documents (Ref. 22, Ref. 23, Ref. 24, 
Ref. 25, Ref. 26), the CARVER+Shock Vulnerability Assessment software 
tool (Ref. 29), the MSD (Ref. 30), and the FDPB software tool (Ref. 
31). FDA divides mitigation strategies into two types: Broad Mitigation 
Strategies and Focused Mitigation Strategies. We explain each of these 
types in this section of the document.
    i. Broad mitigation strategies. Broad mitigation strategies are 
general facility-level measures that are intended to minimize a 
facility's vulnerability, as a whole, to potential acts of intentional 
contamination. Examples of broad mitigation strategies are: (1) 
Physical security, such as perimeter security fencing, locking exterior 
doors, penetration alarms; (2) personnel security, such as pre-hire 
background, reference checks, identification badges, and controlled 
visitor access; (3) securing hazardous materials, such as cleaning 
products, laboratory materials, and pesticides; (4) management 
practices, such as ingredient storage inventory procedures; key 
security procedures, PINs or passwords; procedures to restrict personal 
items from all food production areas; procedures requiring IDs and 
uniforms to be returned when a person's employment ends; and supplier 
verification or certification procedures; and (5) crisis management 
planning, such as maintenance of updated emergency contact information, 
procedures for responding to reported threats, and establishment of a 
designated food defense leadership team.
    Broad mitigation strategies, by nature, are generally applicable to 
a facility, regardless of the type of food being processed, and, as 
such, are not targeted to a specific processing step in a food 
operation. Broad mitigation strategies address facility-wide 
vulnerabilities that may present an opportunity for an attacker to 
access the facility and intentionally adulterate food. Broad mitigation 
strategies serve as foundational actions or procedures that improve a 
facility's overall defense against intentional contamination caused by 
acts of terrorism.
    We are proposing to require the implementation of focused 
mitigation strategies only. However, as set out in our guidance 
documents (Ref. 22, Ref. 23, Ref. 24, Ref. 25, Ref. 26), we think it is 
prudent for facilities to review our guidance and implement those broad 
mitigation strategies that are appropriate to minimize the risk for 
intentional adulteration of food.
    ii. Focused mitigation strategies. As discussed in section V.A of 
this document, we are proposing to define focused mitigation strategies 
as those risk-based, reasonably appropriate measures that a person 
knowledgeable about food defense would employ to significantly minimize 
or prevent significant vulnerabilities identified at actionable process 
steps, and that are consistent with the current scientific 
understanding of food defense at the time of the analysis.
    Focused mitigation strategies are specific to an actionable process 
step in a food operation where a significant vulnerability is 
identified. They represent reasonably appropriate measures that are 
necessary to reduce the likelihood of intentional contamination caused 
by an act of terrorism at that process step. Focused mitigation 
strategies are customized to the processing step at which they are 
applied, tailored to existing facility practices and procedures, and 
depend on an evaluation of the vulnerabilities identified in a 
vulnerability assessment. When properly implemented, focused

[[Page 78044]]

mitigation strategies by themselves are sufficient to significantly 
minimize or eliminate the chances that an attacker would be successful 
if an act of intentional adulteration were attempted at the specific 
process step. Focused mitigation strategies focus on minimizing either 
the accessibility of an attacker to the product at a particular process 
step or the opportunity for the attacker to successfully contaminate 
the product at that process step, or both.
    Based on our vulnerability assessments, we tentatively conclude 
that the implementation of focused mitigation strategies at actionable 
process steps in a food operation is necessary to minimize or prevent 
the significant vulnerabilities that are identified in a vulnerability 
assessment (Ref. 21, Ref. 54, Ref. 58), regardless of the existence of 
broad mitigation strategies. Although broad mitigation strategies are 
important to further reduce the vulnerability for intentional 
contamination, they are not sufficient to significantly minimize the 
risk of intentional contamination caused by an act of terrorism because 
broad mitigation strategies are not specific enough, for example, to 
counter the actions of an attacker who has legitimate access to the 
facility (i.e., insider attack) or an attacker who circumvents 
perimeter protections (e.g., scaling a fence), with the goal of 
intentionally contaminating the food. Focused mitigation strategies, on 
the other hand, are targeted to actionable process steps identified in 
a food operation to reduce the likelihood of intentional contamination 
at those process steps and, therefore, are essential to ensure that 
appropriate food defense measures are taken to protect the food from 
intentional contamination caused by acts of terrorism. In contrast to 
broad mitigation strategies, focused mitigation strategies are targeted 
to actionable process steps and, therefore, are more effective at 
countering an attacker who has legitimate access to the facility. We 
have tentatively concluded that we will continue to encourage the 
implementation of broad mitigation strategies on a voluntary basis, but 
we will require the implementation of focused mitigation strategies at 
actionable process steps. We request comment on this tentative 
conclusion, and on whether we should include, in a final rule, a 
requirement for the implementation of any broad mitigation strategies.
    iii. Examples of focused mitigation strategies for FDA-identified 
key activity types. For the FDA-identified key activity types, a 
variety of focused mitigation strategies may be applicable, dependent 
both on the food manufactured, processed, packed, or held at the 
facility and on the practices and processes employed at that facility. 
We list in this section some examples of focused mitigation strategies 
that may be appropriate to implement at actionable process steps for 
each of these four key activity types. While the decision of which and 
how many focused mitigation strategies would be appropriate to employ 
at an actionable process step is dependent upon the physical layout and 
operation at a specific facility, the examples presented in the section 
immediately below illustrate the decision-making process to identify 
and determine appropriate focused mitigation strategies at an 
actionable process step.
    Bulk liquid receiving and loading--Examples of focused mitigation 
strategies that may be appropriate include the following:
    1. Controlling access to the receiving or loading area, 
conveyances, and equipment, including hoses and pumping machinery, to 
prevent an unauthorized person from gaining access to the food during 
receiving or loading. Access controls may include: strategies to easily 
identify authorized persons, such as color-coded uniforms or badges; 
restricting conveyance drivers to areas away from the receiving or 
loading area (e.g., restricting them to a lounge or break room); 
securing hoses with locking caps or in cabinets; and ensuring that 
conveyance access hatches, vents, and inspection ports are secured;
    2. Ensuring adequate lighting in the receiving or loading area, 
which reduces the ability of an attacker to disguise his or her 
actions. Adequate lighting in and around vulnerable areas of a food 
operation increases the likelihood that other staff will witness the 
actions of an attacker and enable them to take steps to prevent or 
react to contamination;
    3. Increasing observation of the receiving or loading area, which 
reduces the ability of an attacker to disguise his or her actions. For 
example, maximizing the line of sight by removing boxes, crates, or 
other obstructions from the area; positioning quality control personnel 
in the receiving or loading area to supervise operations; or utilizing 
closed-circuit TV systems or other monitoring devices;
    4. Verifying that seals on a shipping conveyance are intact prior 
to receiving or after loading a bulk liquid to reduce the likelihood 
that the shipping conveyance was or is accessed during transport to 
introduce a contaminant into the product;
    5. Establishing and implementing a policy for driver check-in and 
identification to help confirm driver identity and verify the 
individual is authorized, through verification of shipping 
documentation or other means, to deliver or pick-up the shipment and 
reduce the likelihood that an attacker could fraudulently pose as a 
driver as a means of gaining access to the facility; and
    6. Inspecting the shipping conveyance prior to loading bulk liquids 
to help ensure that no contaminant has been introduced to the 
conveyance chamber that could then contaminate the product once the 
product is loaded.
    Liquid storage and handling--Examples of focused mitigation 
strategies that may be appropriate include the following:
    1. Controlling access to liquid storage, holding, surge, or 
metering tanks, similar to the strategies that may be applied for 
controlling access to bulk liquid receiving and holding;
    2. Ensuring that the area around liquid storage, holding, surge, or 
metering tanks is free of unrelated materials, such as personal items 
(backpacks, purses, or packages), and other items that are not directly 
related to the food operation, to reduce the likelihood of a 
contaminant being brought into the area for introduction into the tank;
    3. Ensuring adequate lighting in and around liquid storage, 
holding, surge or metering tanks, similar to the strategies that may be 
applied for ensuring adequate lighting at bulk liquid receiving and 
loading;
    4. Installing one-way sample ports in liquid storage, holding, 
surge, or metering tanks , so that food product can be drawn out of the 
equipment but a contaminant cannot be inserted into the tank;
    5. Inspecting tanks prior to filling to help ensure that no 
contaminant has been introduced into the empty tank that could then 
contaminate the product once loaded;
    6. Inspecting pumping or metering equipment prior to use to help 
ensure that no contaminant has been introduced into the equipment that 
could contaminate the product;
    7. Using enclosed tanks and transfer systems to move materials to 
reduce the potential for an attacker to access the product and 
introduce a contaminant; and
    8. Positioning holding, surge, or metering tanks to increase 
visibility, such that frequent observation is facilitated and 
visibility of activity around the tank is improved. This

[[Page 78045]]

focused mitigation strategy may be less practical for longer term 
storage tanks.
    Secondary ingredient handling--Examples of focused mitigation 
strategies that may be appropriate include the following:
    1. Controlling access to ingredient handling areas, including where 
secondary ingredients or rework are staged, prepared, or added to the 
product stream, to prevent an unauthorized person from gaining access 
to the ingredients or rework during these processes. As with other key 
activity types, access controls may include strategies to easily 
identify authorized persons, such as with color coded uniforms or 
badges, or conducting ingredient handling activities in areas behind 
locking gates, doors, or other barriers;
    2. Ensuring the secondary ingredient handling area is free of 
unrelated materials, such as personal items or other items not directly 
related to the activity, to help ensure that a contaminant is not 
brought into the area for introduction into the ingredient during 
staging, preparation, or addition;
    3. Ensuring adequate lighting and increasing visibility in and 
around ingredient staging and handling areas, similar to the strategies 
that may be employed to ensure adequate lighting at bulk liquid 
receiving and holding;
    4. Reducing staging time to reduce the opportunity for intentional 
adulteration. Any time sealed or tamper-evident containers are breached 
provides a potential opportunity for an attacker to introduce a 
contaminant into the ingredient or rework. Reducing the time 
ingredients and rework are staged in unsecured containers reduces the 
opportunity for an attacker to adulterate the ingredient or rework;
    5. Restricting secondary ingredient handling to senior staff to 
reduce the accessibility and opportunity for intentional adulteration;
    6. Using peer monitoring in the ingredient handling area, because 
requiring at least two staff members to be in the area at any given 
time during operations can reduce the opportunity for a contaminant to 
be discreetly introduced into the food;
    7. Using automated and enclosed ingredient handling equipment, such 
as automated computer weighing, measuring, and addition equipment, to 
reduce human contact with secondary ingredients or rework and thereby 
reduce the opportunity for introduction of a contaminant; and
    8. Inspecting secondary ingredients held in staging and 
investigating any irregularities in the amount, condition, or 
organization of items in secondary ingredient handling areas to 
identify circumstances that suggest product contamination before a 
contaminated ingredient is added to the product stream.
    Mixing and similar activities--Examples of focused mitigation 
strategies that may be appropriate include the following:
    1. Controlling access to processing areas where mixing and similar 
activities are conducted to prevent an unauthorized person from gaining 
access to the product and equipment. Access controls may include: 
strategies to easily identify authorized persons, such as with color 
coded uniforms or badges; conducting these activities in areas behind 
locking gates, doors, or other barriers; securing access to overhead 
gangways and sampling platforms; and securing hatches, ports, and lids 
with locks or access alarm devices;
    2. Ensuring that the area is free of unrelated materials, such as 
personal items and other items that are not directly related to the 
activity, to reduce the likelihood of a contaminant being brought into 
the area for introduction into the ingredient during mixing and similar 
activities;
    3. Ensuring adequate lighting and increasing visibility in and 
around mixing and similar activities areas, similar to the strategies 
that may be employed to ensure adequate lighting at bulk receiving and 
loading;
    4. Positioning mixing and similar equipment in a manner that 
maximizes visibility, similar to the strategies that may be employed to 
maximize visibility for liquid storage and handling;
    5. Using one-way sample ports that prohibit introduction of a 
contaminant into the mixing or similar equipment, similar to the 
strategies that may be employed for liquid storage and handling;
    6. Conducting inspections of mixing and similar equipment prior to 
use to help ensure no contaminant has been introduced that could 
contaminate the product once loaded;
    7. Restricting mixing and similar activities to senior staff, 
similar to the strategies that may be employed for secondary ingredient 
handling;
    8. Using peer monitoring in this area to ensure that at least two 
staff members are in this area at any given time during operations, 
reducing the opportunity for a contaminant to be discreetly introduced 
into the food; and
    9. Using automated, self-contained, enclosed equipment to reduce 
human contact with the product and reduce the opportunity for 
introduction of a contaminant.
    These examples of focused mitigation strategies are consistent with 
measures included in the MSD. The examples are not intended to be an 
exhaustive list of appropriate focused mitigation strategies. For 
additional guidance on identifying appropriate focused mitigation 
strategies, see our guidance documents, the MSD, and other resources 
(see section II.D of this document).
    iv. Specific examples of determining appropriate focused mitigation 
strategies. In this section, we discuss specific examples of the 
decision-making process to identify and determine appropriate focused 
mitigation strategies at an actionable process step for each of the 
FDA-identified key activity types.
    Bulk liquid receiving and loading--Unloading at Facility A's bulk 
tanker truck unloading bay is an actionable process step for this key 
activity type. Facility A has a significant vulnerability related to 
access to the food during the unloading of the bulk liquid. At Facility 
A, the tanker truck drives into the unloading bay without passing 
through any security check-in procedures. A single facility employee is 
assigned to this area and takes a facility-owned hose from an open 
shelving unit in the unloading bay and attaches it to the tanker 
truck's unloading port. The driver of the tanker truck assists in 
unloading by opening the venting hatch at the top of the tanker truck 
while the facility employee is attaching the hose. The driver then 
waits in the unloading bay area while the truck is being unloaded. Upon 
completion of unloading activities, the driver gets back in the truck 
and exits the facility.
    Facility A is not implementing focused mitigation strategies at 
this actionable process step such that access to the food during 
unloading of the bulk liquid is significantly minimized or eliminated. 
The food is significantly vulnerable to an attacker (in this case, 
potentially the driver, the facility employee, or a third party) who 
could intentionally add a contaminant to the product to adulterate the 
food. One approach for Facility A to significantly minimize or 
eliminate the significant vulnerability at this actionable process step 
is to implement the following focused mitigation strategies:
     Establish a receiving check-in and verification procedure 
to ensure that the shipment is being delivered by the proper firm and 
that the driver is properly identified. The procedure would be 
documented and maintained in a shipping log that records the key 
identifying information about the driver, tanker truck, and shipping

[[Page 78046]]

documentation for the delivered product. The facility would also 
institute a policy requiring that the shipping documentation include 
the ID numbers of the seals on the unloading ports so that the facility 
employee can verify that seal numbers match the shipping documentation 
and that the seals were not broken, tampered with or replaced during 
transport.
     Implement a procedure to store hoses securely to reduce 
the likelihood an attacker could add a contaminant to the hoses when 
not in use. This would include storing hoses in locking cabinets and 
placing end caps on the hoses. The facility also would issue keys only 
to staff working in the tanker truck receiving bay and use a key 
numbering and tracking system to verify that all keys are accounted 
for.
     Increase active observation of the unloading process to 
reduce the likelihood of an attacker successfully introducing a 
contaminant by requiring two or more production staff members to be 
present during unloading activities (i.e., peer monitoring), or 
requiring the bulk liquid unloading operations be overseen by a 
supervisor or a member of the quality control staff. Alternatively, the 
facility could employ video surveillance of the area. If the truck 
driver is permitted to remain in the area of the receiving bay, the 
introduction of active observation practices ensures that no 
contaminant could be intentionally introduced to the product during 
unloading activities. Alternatively, the facility could limit the 
driver's access to the product by restricting the location of the 
driver to designated areas outside the loading area while the truck is 
being unloaded.
    In this example, the focused mitigation strategies were selected to 
achieve the following goals: Establishing the identity of personnel 
with access to the food; ensuring that equipment that may be used to 
introduce a contaminant is secured when not in use; and providing 
active observation of activities at actionable process steps. By 
implementing these focused mitigation strategies, the facility could 
significantly minimize the significant vulnerability identified at the 
actionable process step.
    Liquid storage and handling--The storage of liquid in Facility B's 
bulk liquid storage tank is an actionable process step for this key 
activity type. Facility B's bulk storage tank holding a primary 
ingredient is located within its building, and a significant 
vulnerability relates to access to the food during such storage. In 
Facility B, a network of gangways, ladders, and platforms surround the 
bulk liquid storage tank so that personnel can gain access to a hatch 
at the top of the tank. Facility B has a procedure for securing this 
hatch with a lock, and the facility stores the key to the hatch in the 
operations manager's office. To access a key, a worker must request the 
key from the operations manager and justify the need to open the lock. 
When an employee checks out the key, the manager's assistant records 
the employee's name, time the key is checked out, and the reason. 
Facility B's bulk liquid storage tank also has a second hatch along the 
side which is used for cleaning the tank when empty and is not locked. 
This secondary hatch is not accessible while product is in the tank 
because it opens inward, and pressure from product in the tank prevents 
the hatch from being opened when product is present.
    In considering the requirement for focused mitigation strategies at 
this actionable process step, Facility B would determine that it has 
sufficient safeguards in place to significantly minimize the likelihood 
of intentional adulteration from an attacker accessing the hatch on the 
top of the bulk storage tank. However, the facility would identify the 
secondary hatch as presenting a significant vulnerability for which 
insufficient focused mitigation strategies are being implemented. While 
food is in the tank, the secondary hatch is secure. However, when the 
tank is empty after cleaning, there is an opportunity for an attacker 
to introduce a contaminant into the tank via the secondary hatch which 
would then contaminate the food when it is added to the tank. To 
significantly minimize or eliminate the significant vulnerability 
presented by the secondary hatch, the facility would implement focused 
mitigation strategies to restrict and document access to the secondary 
hatch as is done for the hatch on the top of the tank. To do this, the 
facility would install a lock on the secondary hatch and incorporate 
the key for the secondary hatch into its existing key management 
system. Alternatively, the facility could implement a procedure of 
monitoring the condition of the tank interior immediately prior to 
reintroducing product to the tank. This monitoring check would be 
recorded in a monitoring log.
    Facility B already has in place some practices that we would 
consider appropriate focused mitigation strategies. The procedures in 
place to control access to the top access hatch on the bulk liquid 
storage tank are sufficient to minimize the significant vulnerability 
presented by this hatch. However, Facility B still has a significant 
vulnerability associated with the secondary access hatch, which 
required additional focused mitigation strategies to significantly 
reduce or eliminate the risk of intentional contamination.
    Another example of an actionable process step for the key activity 
type ``Liquid Storage and Handling'' is liquid storage in a liquid 
surge tank located above an in-line bottling operation at Facility C. 
The surge tank is used to control the flow rate of liquid product into 
the bottling equipment and is enclosed by an unlocked lid. A ladder and 
walkway enable workers to access the surge tank as needed to monitor 
product flow and take quality control samples. Facility C has an 
operations control room, which is equipped with windows to view the 
production floor. However, the view of the bottling operation from the 
operations control room is commonly blocked by pallets of empty bottles 
awaiting introduction into the bottling equipment.
    It is not practical for Facility C to lock the surge tank lid 
because workers need to frequently check the status of product flow and 
take quality control samples. Also, it is not practical to physically 
limit access to the ladder or walkway used to access the surge tank, 
for the same reasons. One approach for Facility C to significantly 
minimize or eliminate the significant vulnerability at this actionable 
process step is to implement the following focused mitigation 
strategies:
     Implement a policy to prohibit all personnel not 
associated with the bottling operation from entering the area and issue 
uniforms of a particular color to the bottling personnel only. The 
staff working in the bottling area would enforce this policy by 
instructing any staff not associated with the bottling operation to 
leave the area.
     Prohibit staff working in the bottling area from bringing 
any items not associated with the bottling operation into the work 
area.
     Train the staff working in the bottling area in a peer 
monitoring program to be attentive to the activity of other staff in 
the area.
     Stage pallets of empty bottles awaiting introduction into 
the bottling equipment in another location to improve line of sight 
from the operations control room.
    By implementing these focused mitigation strategies, the facility 
could significantly minimize or eliminate the significant vulnerability 
associated with the actionable process step at the liquid surge tank.
    Secondary ingredient handling--Ingredient staging at Facility D is 
an actionable process step for this key activity type. Facility D opens 
a

[[Page 78047]]

containerized secondary ingredient's tamper evident package, measures 
out the required amount into a secondary container, and pre-positions 
the ingredient in the production area so that it is readily added to 
the product line. Access to the food during each of these activities at 
this actionable process step presents a significant vulnerability. 
Facility D stages a dry, powdered ingredient near the mixer the night 
before it is intended to be used so that it is ready when the 
production run begins the next morning. Additionally, the staging area 
in Facility D is accessible to all staff and is an open area on the 
production floor.
    One approach for Facility D to significantly minimize or eliminate 
the significant vulnerability at this actionable process step is to 
implement the following focused mitigation strategies:
     Reduce staging time, by revising its procedures so that 
ingredients are staged immediately before they are added into the 
product stream. This strategy would reduce the time ingredients are 
accessible.
     Change its staffing procedures to ensure that only senior 
or long-term employees are assigned to measuring and staging secondary 
ingredients. Assigning the most trusted employees to work in sensitive 
areas reduces the risk of intentional contamination.
     Increase its observation of this area by installing 
closed-circuit TV cameras to monitor the actions of staff in the 
secondary ingredient staging area.
    By its nature, the action of ingredient staging is an open and 
accessible process step. Focused mitigation strategies must address 
personnel access so that the likelihood of an intentional contamination 
at this step is significantly reduced or eliminated. By implementing 
these focused mitigation strategies, the facility could significantly 
minimize the significant vulnerability identified at the actionable 
process step.
    Mixing and similar activities--Blending in Facility E's dough mixer 
is an actionable process step for this key activity type. Facility E 
operates a dough mixer to combine several dry and liquid ingredients. 
This mixer is not enclosed and is located in an open area of the 
facility where it is under regular--though not dedicated--human 
observation. While a batch of product is being mixed, the staff member 
assigned to the mixer may leave the area to retrieve and prepare 
ingredients for the next production batch. The line of sight in this 
area is clear, and management in the operations control room located 
above the production floor has a clear view of the mixer through an 
observation window.
    The mixer is vulnerable to an attacker who could intentionally 
introduce a contaminant into the food because of the open nature of the 
mixer, the lack of constant and dedicated observation, and the lack of 
physical access control to the area where it is located. One approach 
for Facility E to significantly minimize or eliminate the significant 
vulnerability at this actionable process step is to implement the 
following focused mitigation strategies:
     Install a lid on the mixer that must be opened to add 
anything to the mixer. If Facility E determines that it would be 
disruptive to the production schedule to install a lock on the lid, the 
facility could install an access alarm that would indicate that the lid 
has been opened. This alarm would sound in the operation control room 
where a manager supervises production operations.
     Assign another member of staff the responsibility of 
preparing and securely staging ingredients for later production 
batches. This would alleviate the need for the mixer operator to leave 
the area, leaving the mixer unattended.
    With the introduction of these two focused mitigation strategies, 
the facility would have taken steps to enclose the mixer, making it 
more difficult for an attacker to introduce a contaminant without 
alerting management (by the sounding of the alarm), and increased the 
dedicated observation of this otherwise vulnerable process step by 
ensuring that the mixer operator is not required to leave the area 
unattended.
    Mixing at Facility F's rotating air dryer is another example of an 
actionable process step for the key activity type ``Mixing and similar 
activities.'' In Facility F, product, such as crackers or breakfast 
cereals, are fed through drum-like equipment, where warm air is blown 
across it while the drum rotates. Although the goal of this process is 
to dry the product, it also could distribute any contaminant introduced 
into the dryer evenly across the product. Facility F's rotating air 
dryer is located alongside a commonly used walkway, but is behind a 
guard rail to prevent employees from coming in contact with the hot 
exterior of the dryer. Product is fed into the top of the dryer via a 
pneumatic conveyor. There is sufficient space between the dryer opening 
and the pneumatic conveyor discharge to enable an attacker to introduce 
a contaminant to the dryer at this point. That opening is about six 
feet above the ground, accessible from the floor of the facility. 
Product leaves the dryer through a gravity fed line. The connection 
between the dryer and the discharge line is sealed.
    To goal of focused mitigation strategies at this actionable process 
step would be to reduce access to this equipment to significantly 
reduce the likelihood an attacker could introduce a contaminant into 
the rotating air dryer. One way Facility F could do this would be to 
install a clear plastic shield that would be affixed to and extend from 
the discharge of the pneumatic conveyor to the opening of the dryer 
where it would also be tightly affixed to the housing of the dryer. A 
clear plastic shield would enable workers to supervise the product flow 
into the dryer while posing as an effective barrier to an attacker 
wishing to introduce a contaminant into the product at the dryer. This 
engineering improvement would significantly minimize or eliminate 
access to the food in the dryer and thereby significantly reduce or 
eliminate the likelihood of a successful act of intentional 
adulteration at this process step. The installation of physical 
barriers to access of equipment at actionable process steps can be one 
of the most effective focused mitigation strategies because it does not 
require restricting personnel or maintaining active observation of an 
area. The implementation of this engineering improvement would be 
detailed in the facility's food defense plan.
    c. Proposed Sec.  121.135(a)--Requirement to identify and implement 
focused mitigation strategies for actionable process steps. Proposed 
Sec.  121.135(a) would require that the owner, operator, or agent in 
charge of a facility identify and implement focused mitigation 
strategies at each actionable process step to provide assurances that 
the significant vulnerability at each step will be significantly 
minimized or prevented and the food manufactured, processed, packed or 
held by such facility will not be adulterated under section 402 of the 
FD&C Act. Under Sec.  121.135, we are proposing that, for each of the 
identified actionable process steps, the owner, operator, or agent in 
charge of a facility covered by this rule identify and implement 
focused mitigation strategies. Focused mitigation strategies would be 
required only for actionable process steps.
    Because a focused mitigation strategy that would be necessary at an 
actionable process step must be tailored to address the significant 
vulnerability applicable to the specific actionable process step, we 
are not proposing to specify the particular focused mitigation 
strategies that would be appropriate. Rather, we expect the owner, 
operator, or agent in charge of the facility covered by this

[[Page 78048]]

rule to identify the specific focused mitigation strategy(s) that would 
be appropriate, considering the facility and food it produces, and to 
ensure the proper implementation of those strategies to provide 
assurances that the significant vulnerability at each identified 
actionable process step is significantly minimized or prevented and the 
food is not adulterated. In section V.C.3.b of this document, we list 
examples of focused mitigation strategies and describe scenarios for 
determining appropriate focused mitigation strategies at actionable 
process steps for each of the FDA-identified key activity types.
    A facility would have the flexibility to identify and implement 
focused mitigation strategies from among all procedures, practices, and 
processes available to the facility that would provide the assurances 
that would be required by proposed Sec.  121.135. The flexibility 
provided under this proposed provision acknowledges the existing 
expertise within the food industry in this regard, and recognizes the 
complex and varied nature of operations in food facilities. 
Additionally, to the extent facilities may already be engaging in 
practices that constitute focused mitigation strategies, facilities 
should consider whether those measures satisfy the requirements of 
proposed Sec.  121.135, such that the implementation of additional 
focused mitigation strategies may not be necessary. (Note that 
associated requirements, such as monitoring and verification, would 
apply).
    FDA's existing guidance documents and other resources (discussed in 
section II.D of this document) include guidance for industry on a range 
of focused mitigation strategies. In particular, the MSD includes a 
list of mitigation strategies that can be applied to different steps in 
a food operation to reduce the risk of intentional adulteration. The 
database is searchable by key words and processing steps common to food 
operations (e.g., packing, manufacturing, processing and holding).
    Proposed Sec.  121.135(a) implements the provisions in sections 
418(c)(2) and 420(b)(2) of the FD&C Act. FDA requests comments on our 
analysis and proposed provisions related to mitigation strategies 
necessary to protect against intentional adulteration of food caused by 
acts of terrorism. We also seek input on whether and, to what extent, 
facilities currently employ broad mitigation strategies and focused 
mitigation strategies.
    d. Proposed Sec.  121.135(b)--Requirement for written focused 
mitigation strategies. Proposed Sec.  121.135(b) would require that 
focused mitigation strategies for actionable process steps be written. 
The focused mitigation strategy(ies) selected for each actionable 
process step identified in accordance with proposed Sec.  121.130, and 
a justification for how the strategy significantly reduces or 
eliminates the risk of intentional adulteration at that actionable 
process step(s) must be documented. Similar to preventive controls in a 
food safety plan, written focused mitigation strategies in a food 
defense plan are essential for the facility to implement the focused 
mitigation strategies consistently, and essential for the facility and 
inspectors. Written focused mitigation strategies also would be 
essential for training purposes and during reanalysis and updates of 
the focused mitigation strategies.
    Proposed Sec.  121.135(b) implements the provisions in sections 
418(h) and 420(b)(2) of the FD&C Act.
    e. Proposed Sec.  121.135(c)--Applicability of monitoring, 
corrective actions, and verification. Proposed Sec.  121.135(c) would 
specify that the focused mitigation strategies required under this 
section would be subject to monitoring as would be required by proposed 
Sec.  121.140; corrective actions as would be required by proposed 
Sec.  121.145; and verification as would be required by proposed Sec.  
121.150. Proposed Sec.  121.135(c)(1) through (c)(3) would restate the 
requirements of proposed Sec. Sec.  121.140, 121.145, and 121.150 to 
clearly communicate the applicability of proposed Sec. Sec.  121.140, 
121.145, and 121.150 to the focused mitigation strategies that would be 
required under proposed Sec.  121.135 and would establish no new 
requirements.
4. Monitoring
    a. General description of monitoring. Proposed Sec.  121.3 would 
define ``monitor'' to mean ``to conduct a planned sequence of 
observations or measurements to assess whether focused mitigation 
strategies are consistently applied and to produce an accurate record 
for use in verification.'' In developing the proposed monitoring 
requirements related to food defense, we considered our proposed 
monitoring requirements related to food safety, which are described in 
section XII.E of the PC proposed rule. For the same reasons outlined in 
the PC proposed rule, we have tentatively concluded that monitoring is 
necessary to establish the performance of the implementation of the 
focused mitigation strategies. The proposed provisions in Sec.  121.140 
implement section 418(h) of the FD&C Act.
    b. Proposed Sec.  121.140(a)--Requirement for written procedures 
for monitoring. Proposed Sec.  121.140(a) would require that the owner, 
operator, or agent in charge of a facility establish and implement 
written procedures, including the frequency with which they are to be 
performed, for monitoring the focused mitigation strategies. Monitoring 
the performance of focused mitigation strategies at specified 
frequencies would facilitate tracking the implementation of the focused 
mitigation strategies to provide assurance that they are consistently 
applied in a facility covered by this rule. If monitoring shows that a 
focused mitigation strategy is frequently not implemented, a facility 
can consider whether another focused mitigation strategy would be more 
appropriate. For example, if an ingredient storeroom door is to be kept 
locked when not in use, but the door is frequently left unlocked 
because access to the room is needed for other purposes, the facility 
may replace the previous focused mitigation strategy with video 
monitoring. Further, if monitoring is conducted with sufficient 
frequency, it will detect if a focused mitigation strategy is not 
properly implemented (e.g., if access to a particular area of a 
facility is not being appropriately restricted or a bulk liquid tank is 
not being visually inspected prior to filling), indicating a problem 
and signaling the need for an appropriate corrective action. In 
addition, the proposed monitoring requirement would result in written 
documentation for use in verification.
    c. Proposed Sec.  121.140(b)--Frequency of monitoring. Proposed 
Sec.  121.140(b) would require that the owner, operator, or agent in 
charge of a facility monitor the focused mitigation strategies with 
sufficient frequency to provide assurances that they are consistently 
applied. Proposed Sec.  121.140(b) does not specify a single monitoring 
frequency applicable to all facilities and processes. Rather, it 
requires monitoring with ``sufficient frequency'' to ensure that the 
focused mitigation strategies are consistently applied in a facility 
covered by this rule. We note that for food defense that many focused 
mitigation strategies may be monitored over longer timeframes (non-
continuous monitoring) than preventive controls for food safety, which 
are often monitored continuously. In large part preventive controls for 
food safety are monitored continuously because they relate to physical 
or chemical parameters of the process, such as the temperature of a 
pasteurizer, which both lend themselves

[[Page 78049]]

to continuous monitoring and necessitate that level of monitoring to 
ensure that the process is under control. As discussed in greater 
detail in section V.C.3 of this document, most focused mitigation 
strategies for food defense are not related to physical or chemical 
parameters of the process. They tend to have more in common with 
sanitation preventive controls for food safety in that they relate to 
conditions around the food process, such as access to the equipment. A 
focused mitigation strategy such as ``adequate lighting at an 
actionable process step'' or ``secure air vents on a cooling tank with 
one-way valves'' would not require continuous monitoring. Management 
may choose to monitor lighting on a weekly basis to ensure that 
everything is working properly and monitoring of the security of air 
vents with one-way valves on a cooling tank might be done monthly. 
Frequency is not prescribed in this proposed rule. More frequent (e.g., 
daily) monitoring would be appropriate for mitigation strategies that 
relate to conditions or practices that are more likely to change more 
rapidly, such as keeping the access door to an actionable process step 
closed when not in use or ensuring that employees with color coded 
uniforms are staying in the areas designated by the color code.
    d. Proposed Sec.  121.140(c)--Requirement for records. To implement 
section 418(g) of the FD&C Act, proposed Sec.  121.140(c) would require 
that all monitoring of focused mitigation strategies in accordance with 
this section must be documented in records that are subject to 
verification in accordance with Sec.  121.150(a) and records review in 
accordance with proposed Sec.  121.150(c).
    The monitoring records would be used to verify that the focused 
mitigation strategies are being monitored, as would be required by 
proposed Sec.  121.150(a), and to verify that the focused mitigations 
strategies are consistently implemented and are effective at 
significantly minimizing or preventing the significant vulnerabilities, 
as would be required by proposed Sec.  121.150(c). Further, they are 
necessary to facilitate regulatory review of the system of controls. 
Together, proposed Sec. Sec.  121.140(a), (b), and (c) and 121.150(a), 
(c), and (e) would establish a system that would provide assurances 
that the significant vulnerabilities identified for a food operation 
are being significantly minimized or prevented.
5. Corrective Actions
    a. General description of corrective actions. When a HACCP-type 
system is applied to ensure food safety, the term ``corrective 
actions'' is used to describe procedures that are in place to correct 
the cause of a deviation to ensure that a critical control point is 
under control and to ensure that the product produced under that 
deviation is safe, since total adherence to a planned process may not 
always occur. This concept is discussed in detail in section XII.F of 
the PC proposed rule.
    This same concept can be applied to the control of intentional 
adulteration related to acts of terrorism. Monitoring may detect a 
deviation from implementation of a focused mitigation strategy; 
corrective actions are implemented to re-establish control. In 
developing the proposed corrective actions requirements related to food 
defense, we considered our proposed relevant requirements related to 
food safety. The proposed provisions in Sec.  121.145 implement 
sections 418(e), 418(h), and 420(b)(2) of the FD&C Act.
    b. Proposed Sec.  127.145(a)--Corrective action procedures. 
Proposed Sec.  121.145(a)(1) would require that the owner, operator, or 
agent in charge of a facility establish and implement written 
corrective action procedures that must be taken if focused mitigation 
strategies are not properly implemented. Having written procedures in 
place would enable facilities covered by this rule to act quickly and 
appropriately when focused mitigation strategies are not properly 
implemented--e.g., a situation where a work station at an actionable 
process step requires two staff at all times in a ``buddy system'' but 
is only staffed by one person for a period of time.
    The benefits of identifying corrective action procedures before 
corrective action is needed largely derive from having written 
procedures. Written corrective action procedures would be essential to 
the facility's management, to auditors, and to inspectors. The 
facility's management will be responsible for ensuring that appropriate 
corrective actions are taken if focused mitigation strategies are not 
properly implemented. Having access to appropriate, written corrective 
action procedures determined in advance of the need for such action can 
ensure that correct and complete actions are taken in a timely fashion. 
Having written corrective action procedures available for auditors and 
for inspectors is essential for them to assess the adequacy of the food 
defense plan; the procedures a facility will use to address 
implementation failures are essential to proper, consistent 
implementation, and without them a complete assessment cannot be made. 
Written corrective action procedures also will be useful for training 
purposes, so that employees who would need to implement the corrective 
action procedures will be prepared for what they would need to do.
    Proposed Sec.  121.145(a)(2) would require that corrective action 
procedures describe the steps to be taken to ensure that appropriate 
action is taken to identify and correct a problem with implementation 
of a focused mitigation strategy to reduce the likelihood that the 
problem will recur. In the previous example in which two staff are 
required to be at a work station at all times, the corrective action 
could be speaking with the employees to ensure they understand the 
importance of remaining at the work station together, sending staff to 
a refresher course on food defense awareness, and ensuring that the 
supervisor knows that there must be adequate staff present on a shift 
so two people can be at the work station at all times. If the problem 
recurs, management may need to consider other measures for preventing 
access at that process step.
    c. Proposed Sec.  121.145(b)--Documentation. Proposed Sec.  
121.145(b) would require that all corrective actions taken in 
accordance with this section be documented in records that are subject 
to verification in accordance with proposed Sec.  121.150(b) and 
records review in accordance with proposed Sec.  121.150(c). The 
records that document corrective actions would be used to verify that 
appropriate decisions about corrective actions are being made and 
appropriate corrective actions are being taken in facilities covered by 
this rule.
    d. Corrective actions proposed to be required by part 117 but not 
part 121. Unlike in proposed part 117, in proposed part 121, we have 
not proposed a requirement to ensure that all affected food is 
evaluated for food safety if focused mitigation strategies are not 
properly implemented or are found to be ineffective. An act of 
intentional adulteration or attempted intentional adulteration has 
historically been a rare event and, as a result, in the vast majority 
of cases, the failure to properly implement a focused mitigation 
strategy would not be expected to result in contaminated food. This is 
because intentional adulteration requires not just the opportunity for 
contamination (i.e., failure of a mitigation strategy to limit access 
to an actionable process step), but also someone with intent to cause 
harm at that same moment. In contrast, the failure to properly 
implement a preventive control for a food safety hazard, such as proper 
cook temperatures, is more likely to result in adulterated food (e.g., 
because the

[[Page 78050]]

pathogen reasonably likely to be present in the raw food would not be 
eliminated from the food by the inadequate cooking process). However, 
our decision not to propose these requirements does not absolve an 
owner, operator, or agent in charge of a facility from their 
responsibility to ensure that food is not adulterated. In addition, 
food firms would continue to be subject to the reporting requirements 
under section 417 of the FD&C Act. Moreover, the introduction or 
delivery for introduction into interstate commerce of any food that is 
adulterated is a prohibited act under section 301(a) of the FD&C Act.
    The PC proposed rule also contains requirements for corrective 
actions that must be taken in the event of an unanticipated problem. 
Unlike in proposed part 117, in proposed part 121, we are not proposing 
a requirement related to unanticipated problems because we are not 
aware of circumstances where this would be relevant. Because of the 
nature of the focused mitigation strategies, we expect that the 
outcomes of monitoring will be binary, either the focused mitigation 
strategy will be in place or it will not be in place. For this reason, 
we expect that corrective action plans will be straightforward, with no 
provision needed for unanticipated corrective actions. This contrasts 
with the circumstances of food safety preventive measures, where 
controls are often more complex, presenting opportunities for a more 
nuanced corrective action, which may not be possible to fully 
anticipate in advance.
    We ask for comment on our rationale and tentative conclusion not to 
propose these requirements.
6. Verification
    a. General description of verification. In the preventive controls 
framework, ``verification'' involves activities that help determine 
whether the focused mitigation strategies are valid and are implemented 
according to the food defense plan. Verification includes confirming 
that monitoring and corrective actions are being implemented as 
planned, through review of records and periodic reanalysis of the food 
defense plan. This concept as applied to food safety is discussed in 
detail in section XII.G of the PC proposed rule.
    We have tentatively concluded that this same concept applies to the 
control of intentional adulteration related to acts of terrorism. 
Efforts must be made to ensure that the system of mitigation strategies 
is in place and functioning as designed. The proposed provisions in 
Sec.  121.150 implement sections 418(f) and 420(b)(2) of the FD&C Act.
    b. Proposed Sec.  121.150(a)--Verification of monitoring. Proposed 
Sec.  121.150(a) would require that the owner, operator, or agent in 
charge of a facility verify that monitoring is being conducted. 
Verification of monitoring can be conducted in a number of ways. One 
example of verification of monitoring is a periodic observation of the 
monitoring activity, e.g., by a supervisor. Another example is an 
independent test made by a person other than the person doing the 
monitoring. For example, if a shift supervisor is assigned to check at 
the end of each shift that chemicals are properly stored and secured, 
another supervisor may be responsible for checking periodically (e.g., 
once a week) that this is occurring. In another example, if an alarm is 
supposed to sound if a mixing tank is accessed without authorization 
and the monitoring procedures provide for weekly testing of the alarm, 
a supervisor may be responsible for performing the same test monthly to 
ensure that the alarm and the monitoring procedure are both working 
properly. Proposed Sec.  121.150(a) would not specify the verification 
activities that must be conducted for monitoring. We request comment on 
whether proposed Sec.  121.150(a) should do so, and if so, what 
verification activities should be required.
    c. Proposed Sec.  121.150(b)--Verification of corrective actions. 
Proposed Sec.  121.150(b) would require that the owner, operator, or 
agent in charge of a facility verify that appropriate decisions about 
corrective actions are being made. An example of verification that 
appropriate decisions about corrective actions are being made is 
observation of the corrective actions being taken, e.g., by a 
supervisor. Proposed Sec.  121.150(b) would not specify the 
verification activities that must be conducted for corrective actions. 
We request comment on whether proposed Sec.  121.150(b) should do so, 
and if so, what verification activities should be required.
    d. Proposed Sec.  121.150(c)--Implementation and effectiveness. 
Proposed Sec.  121.150(c) would require that the owner, operator, or 
agent in charge of a facility verify that the focused mitigation 
strategies are consistently implemented and are effectively and 
significantly minimizing or preventing the significant vulnerabilities. 
As appropriate to the facility and the food, this must include review 
of the monitoring and corrective action records within appropriate 
timeframes to ensure that the records are complete, the activities 
reflected in the records occurred in accordance with the food defense 
plan, the focused mitigation strategies are effective, and appropriate 
decisions were made about corrective actions.
    Proposed Sec.  121.150(c) would establish that the purpose of the 
review of records is to ensure that the records are complete, the 
activities reflected in the records occurred in accordance with the 
food defense plan, the focused mitigation strategies are effective, and 
appropriate decisions are made about corrective actions. We tentatively 
conclude that review of the records required by proposed Sec.  
121.150(c) would accomplish these purposes. Reviewing monitoring 
records can reveal whether they contain information on all of the 
activities or measures that were to be monitored to determine whether a 
focused mitigation strategy is being consistently implemented in 
accordance with the food defense plan. For example, a review of 
monitoring records can show if the shift supervisor is consistently 
storing and securing chemicals at the end of each shift as may be 
required by a food defense plan. Review of monitoring records also can 
reveal whether any information is missing--e.g., a date or time--so 
that the missing information can be quickly identified and added to the 
record if necessary.
    Review of records also can reveal whether appropriate decisions 
were made about corrective actions. The review would determine whether 
all the corrective action procedures required by proposed Sec.  121.145 
have been followed to prevent recurrence of the problem. For example, 
in the previous example on corrective actions, a review of records 
could reveal that the supervisor spoke to the staff about always having 
two staff present at the work station as required in the food defense 
plan and, as appropriate, enrolled the staff in a refresher course on 
food defense awareness.
    Proposed Sec.  121.150(c) would require review of the monitoring 
and corrective action records within an appropriate time after the 
records are made. We are not proposing to require review of records 
within a specified timeframe. While the PC proposed rule contains a 
requirement that monitoring and corrective action records be reviewed 
within a week after the records are made, in the case of food defense, 
we do not believe specifying a timeframe for records review is 
necessary. As discussed previously, some focused mitigation strategies 
may be monitored less frequently than are preventive controls for food 
safety. In a HACCP-

[[Page 78051]]

type system for food safety, monitoring and corrective action records 
are often reviewed a short time after their creation to enable action 
to be taken relative to food that may be adulterated (e.g., recall). It 
is unlikely that an improperly implemented focused mitigation strategy 
would result in adulterated food (i.e., because adulteration of food 
would require not only opportunity but also a simultaneous intent to 
cause adulteration). A focused mitigation strategy such as ``adequate 
lighting at the bulk truck unloading bay'' or ``secure air vents on a 
cooling tank with one-way valves'' may be monitored on a weekly or 
monthly basis. Because the focused mitigation strategies may be 
monitored less frequently and because these frequencies may vary 
significantly from one focused mitigation strategy to another, we 
believe it is appropriate for owners, operators, or agents in charge of 
a facility to determine when review of the monitoring and corrective 
action records is best performed.
    e. Proposed Sec.  121.150(d)--Reanalysis. To implement section 
418(i) of the FD&C Act, proposed Sec.  121.150(d)(1) would require that 
the owner, operator, or agent in charge of a facility conduct a 
reanalysis of the food defense plan as follows:
    1. At least once every 3 years (proposed Sec.  121.150(d)(1)(i)).
    2. Whenever a significant change is made in the activities 
conducted at a facility operated by such owner, operator, or agent in 
charge if the change creates a reasonable potential for a new 
vulnerability or a significant increase in a previously identified 
vulnerability (proposed Sec.  121.150(d)(1)(ii)). For example, if a 
facility adds a new product line, then the food defense plan must be 
reanalyzed to consider whether it includes one of the key activity 
types, and, if so to implement appropriate focused mitigation 
strategies.
    3. Whenever such owner, operator or agent in charge becomes aware 
of new information about potential vulnerabilities associated with the 
food operation or facility (proposed Sec.  121.150(d)(1)(iii)). For 
example, an owner, operator, or agent in charge of a facility may 
become aware that access to a particular piece of equipment is greater 
than was thought to be the case when they initially considered whether 
a key activity type is applicable to their food process.
    4. Whenever a focused mitigation strategy is found to be 
ineffective (proposed Sec.  121.150(d)(1)(iv)). Proposed Sec.  
121.150(d)(1)(iv) would require that the owner, operator, or agent in 
charge of a facility reanalyze the food defense plan to determine 
whether modification of the plan is required if a focused mitigation 
strategy is found to be ineffective. For example, if the owner, 
operator, or agent in charge of a facility finds that color coding of 
employee hard hats according to their assigned work stations or areas 
is not effective in preventing employees from crossing into areas where 
they are not assigned because employees have found that adhering to the 
system adversely affects product, the owner, operator, or agent in 
charge may need to consider other focused mitigation strategies to 
ensure that staff access at actionable process steps is controlled.
    5. Whenever FDA requires reanalysis to respond to new 
vulnerabilities and developments in scientific understanding including, 
as appropriate, results from a DHS biological, chemical, radiological, 
or other terrorism risk assessment (proposed Sec.  121.150(d)(1)(v)). 
Risk assessments or vulnerability assessments conducted by DHS or 
others may reveal a significant vulnerability in process steps in 
addition to the significant vulnerabilities associated with the key 
activity types that FDA has identified. FDA would require reanalysis of 
food defense plans, as necessary, to respond to any new knowledge about 
threats or vulnerabilities to food operations based on information 
available to the agency. This requirement for reanalysis could involve 
a requirement to consider whether a new key activity type is relevant 
to a facility's food processes. It could also involve a requirement to 
reconsider existing key activity types in light of a credible threat of 
terrorist attack on a specific food type, product, brand, or company.
    Proposed Sec.  121.150(d)(2) would require that the owner, 
operator, or agent in charge of a facility complete the required 
reanalysis and implement any additional focused mitigation strategies 
needed to address the significant vulnerabilities identified, if any, 
before the change in activities at the facility is operative or, when 
necessary, during the first six weeks of production. The purpose of the 
reanalysis is to identify the need for, and implement, focused 
mitigation strategies in light of a reasonable potential for a new 
significant vulnerability, or a significant increase in a previously 
identified significant vulnerability.
    Proposed Sec.  121.150(d)(3) would require that the owner, 
operator, or agent in charge of a facility revise the written plan if a 
significant change is made or document the basis for the conclusion 
that no additional or revised focused mitigation strategies are needed. 
It is important to document that a reanalysis has been conducted and 
the plan has been revised accordingly or that no change has been made. 
Such documentation demonstrates that a facility has considered all 
relevant information on the defense of the operation, including new 
information that has become available since the last analysis. The 
documentation further demonstrates that appropriate changes have been 
made or that current procedures for implementing focused mitigation 
strategies are adequate to significantly minimize or prevent 
significant vulnerabilities.
    f. Proposed Sec.  121.150(e)--Requirement for records for 
verification. To implement sections 418(g) and 420(b)(2) of the FD&C 
Act, proposed Sec.  121.150(e) would require that all verification 
activities taken in accordance with this section be documented in 
records.
    g. Verification proposed to be required by part 117 but not part 
121. In the PC proposed rule, we proposed to require, as part of 
verification, the validation of the adequacy of the preventive controls 
implemented to control the hazards identified in the hazard analysis as 
reasonably likely to occur. In this proposed rule, we are not including 
a similar proposed requirement. Unlike preventive controls, which often 
involve processing parameters that can be scientifically validated, 
focused mitigations strategies for food defense (which correspond to 
preventive controls for food safety) often are not of a nature that 
they can be scientifically validated. For example, it would not be 
practical for a facility to attempt to validate the effectiveness of a 
lock on a tank or the use of a `buddy system' at a particular process 
step to prevent or significantly minimize intentional adulteration of 
food caused by a terrorist attack. Most of the recommended mitigation 
strategies in the MSD (Ref. 30) are similar in nature to the two 
mentioned in the example above in that validation would be impractical. 
Therefore, we have tentatively concluded not to propose a requirement 
for validation of focused mitigation strategies.
    However, if a facility chooses to use a processing parameter (e.g., 
thermal kill step) as a focused mitigation strategy, the facility 
should employ such a processing parameter if it has been demonstrated 
to be effective in significantly minimizing or preventing the 
associated significant vulnerability. In many circumstances it is not 
appropriate to use such strategies

[[Page 78052]]

because they are usually effective against one or several, but not all, 
potential contaminants. See section XII.G of the PC proposed rule for 
additional discussion of validation.
    The PC proposed rule also includes proposed requirements for 
calibration of process monitoring instruments and verification 
instruments and also records associated with these activities. As 
discussed previously, it is our expectation that most of the focused 
mitigation strategies will not be continuously monitored and will not 
require process monitoring instruments or instruments to verification 
purposes. Therefore, we do not believe it would be necessary to include 
those requirements in this part.
    We ask for comment on our tentative decision not to include 
validation of the focused mitigation strategies and calibration of 
monitoring and verification instruments in codified requirements in 
proposed Sec.  121.150.
7. Training of Personnel
    Proposed Sec.  121.160 would establish requirements related to 
training of certain personnel working in a food operation. Proposed 
Sec.  121.160(a) would require that personnel and supervisors assigned 
to actionable process steps receive appropriate training in food 
defense awareness and their respective responsibilities in implementing 
focused mitigation strategies. Because the effectiveness of a 
mitigation strategy, which is applied at an actionable process step, is 
dependent on the proper implementation by personnel and supervisors of 
the strategy, we are proposing to require that personnel and 
supervisors assigned to actionable process steps be appropriately 
trained in food defense. The purpose of training a supervisor, in 
addition to personnel at actionable process steps, is so that the 
supervisor can help train employees, recognize conditions that could 
lead to intentional contamination, and take necessary actions to 
correct those conditions.
    We are proposing that training required under this provision must 
cover food defense awareness and the respective responsibilities of 
personnel and supervisors assigned to actionable steps in implementing 
focused mitigation strategies. At a minimum, such training must include 
the general principles of food defense, including simple procedures for 
employees to follow to adhere to those principles in their jobs. We 
have tentatively concluded that completion of FDA's training course on 
Food Defense Awareness for the Front-line Employee (described in this 
section of the document), which takes about 20 minutes to complete, 
would be sufficient to satisfy this element of the proposed training 
requirement. Additionally, training must contain specifics about the 
actionable process steps where employees are working and their roles in 
the proper implementation of the focused mitigation strategy(ies) 
applied at those actionable process steps. Training on the application 
of focused mitigation strategies, which is likely to be specific to 
each facility or actionable process step, may be added to existing on-
the-job training programs or provided separately.
    FDA has developed training tools that are available for use by the 
industry. FDA revamped its online food defense courses in 2013, and the 
revamped courses, entitled ``Food Defense 101'' (Ref. 27), address the 
types of intentional contamination that have occurred in the United 
States in recent years and reflect FDA's current thinking on how to 
minimize the likelihood and impact of such incidents. The courses 
included in Food Defense 101 are: (1) Food Defense Awareness for the 
Food Professional; (2) Food Defense Awareness for the Front-line 
Employee; (3) Food Defense Regulations; and (4) ALERT, for owners and 
operators of food facilities. The course on Food Defense Awareness for 
the Food Professional provides an understanding of food defense and 
information for professionals in the food industry. The course modules 
progress through food defense planning including broad mitigation 
strategies, vulnerability assessments, focused mitigation strategies, 
and food defense plans. The course on Food Defense Awareness for Front-
line Employees provides information specific to front-line workers and 
simple procedures for these employees to follow in food defense. The 
course on Food Defense Regulations presents an overview of the Public 
Health Security and Bioterrorism Preparedness and Response Act of 2002 
(the Bioterrorism Act), FSMA, and FDA's Reportable Food Registry. 
Finally, the course on ALERT, which was developed by FDA to help 
stakeholders better understand food defense and how food defense 
applies to the food industry, provides specific examples of ways to 
protect a firm from the threat of intentional contamination. FDA's Food 
Defense 101 online courses are available free-of-charge on our Web site 
at http://www.fda.gov/Food/FoodDefense/default.htm.
    We expect these existing courses will assist industry to comply 
with this training requirement, if finalized as proposed. We are also 
aware of training seminars and programs offered by private sector 
entities (Ref. 59, Ref. 60, Ref. 61, Ref. 62) that may also assist 
industry to comply with this training requirement. We seek comment on 
the adequacy of FDA's Food Defense 101 training materials, and whether 
there is a need for revisions to these existing FDA courses or the 
development of additional FDA training materials.
    FDA also previously issued guidance documents for industry on food 
defense (Ref. 22, Ref. 23, Ref. 24, Ref. 25, Ref. 26), which include 
recommendations related to personnel training. In these guidance 
documents, we recommended that all employees have training in food 
defense awareness, including information on how to prevent, detect, and 
respond to an intentional contamination incident at their facility. As 
noted in these guidance documents, we recommended incorporating 
periodic reminders of the importance of food defense procedures into 
routine facility communications, such as brochures, staff meetings or 
payroll stuffers. We further recommended that facilities encourage all 
employees to report unusual or suspicious individuals or activities to 
management. We reiterate these recommendations described in our 
guidance documents. However, in this proposed rule, we are not 
proposing to include additional specific training requirements to 
reflect all of those recommendations. For example, although we are not 
requiring that all employees at a facility receive training in food 
defense, we recognize the importance of training as a measure to 
protect against intentional adulteration of food and, therefore, 
reiterate our recommendation that all personnel working in a food 
operation receive training in food defense awareness. We request 
comment on this issue, including on whether we should require, in a 
final rule, that basic food defense awareness training be completed by 
all employees at a facility. We also request comment on whether we 
should require training to be repeated periodically, including when 
significant changes are made to food defense plans.
    Proposed Sec.  121.160(b) would require that all training received 
in accordance with section Sec.  121.160 be documented in records. 
Under proposed Sec.  121.305, records would include such information as 
the date of the training, the topics covered, and the person(s) 
trained. An example of records that would comply with proposed Sec.  
121.160(b) is an attendance sheet with the date, list of those in 
attendance, and the particular topics covered (such as an overview of 
food defense principles or food defense

[[Page 78053]]

planning). The records required by proposed Sec.  121.160(b) would 
enable a facility to track the training that personnel received, 
thereby enabling identification of personnel that have the prerequisite 
awareness training for an assignment at an actionable process step. 
Such records could be used to document that a person has, as would be 
required under proposed Sec.  121.160(a), successfully completed 
training appropriate to the person's duties at an actionable process 
step.
    We recognize that industry has already begun to implement food 
defense measures to meet certain industry standards, which include 
guidelines for food defense training (Ref. 63, Ref. 33, Ref. 35). Our 
proposed minimum requirements for training are consistent with these 
standards, as well as with WHO recommendations for personnel training 
in its guidance on food defense (Ref. 6). We seek comment on the 
feasibility of our proposed training requirements, in light of the 
current state of food defense awareness in the industry and available 
training resources.

D. Requirements Applying to Records That Must Be Established and 
Maintained

    When a HACCP-type system is implemented for food safety, records 
are a critical part of the system because they aid facilities in 
compliance with the requirements, including all the elements of a food 
safety plan as proposed in Part 117, and allow facilities to show, and 
FDA to determine, compliance with the requirements. This concept is 
discussed in detail in section XV of the PC proposed rule. We have 
tentatively concluded that records are critical to protect food from 
intentional adulteration caused by acts of terrorism.
    In subpart D of proposed part 121, FDA is proposing to establish 
requirements applying to records that must be established and 
maintained according to the requirements of this proposed rule. This 
subpart implements numerous provisions in section 418 of the FD&C Act, 
including sections 418(a), (b)(3), (g), (h), and (n)(1)(A), as well as 
section 420(b) of the FD&C Act.
1. Proposed Sec.  121.301--Records Subject to the Requirements of this 
Subpart D
    Proposed Sec.  121.301(a) would establish that, except as provided 
by proposed Sec.  121.301(b), all records required by proposed subpart 
C of part 121 would be subject to all requirements of proposed subpart 
D. We have tentatively concluded that the requirements in subpart D 
describing how records must be established and maintained, including 
the general requirements, record retention requirements, and 
requirements for official review and public disclosure, are applicable 
to all records that would be required under subpart C. Such records 
would aid facilities in compliance with the requirements of proposed 
part 121, and allow facilities to show, and FDA to determine, 
compliance with the requirements of part 121. The proposed requirements 
of subpart D are discussed in this document.
    Proposed Sec.  121.301(b) would establish that the requirements of 
proposed Sec.  121.310 apply only to the written food defense plan and 
is discussed in more detail in section V.D.3 of this document.
2. Proposed Sec.  121.305--General Requirements Applying to Records
    Proposed Sec.  121.305 contains general requirements that would 
apply to records that would be required under proposed part 121, 
including the format for required records, the recording of actual 
values and observations obtained during monitoring, when records must 
be created, and information that must be included in each record.
    a. Proposed Sec.  121.305(a). Proposed Sec.  121.305(a) would 
require that the records be kept as original records, true copies (such 
as photocopies, pictures, scanned copies, microfilm, microfiche, or 
other accurate reproductions of the original records), or electronic 
records. True copies of records should be of sufficient quality to 
detect whether the original record was changed or corrected in a manner 
that obscured the original entry (e.g., through the use of white-out). 
Proposed Sec.  121.305(a) would provide flexibility for mechanisms for 
keeping records while maintaining the integrity of the recordkeeping 
system. The proposed requirement allowing true copies provides options 
that may be compatible with the way records are currently being kept in 
facilities.
    Proposed Sec.  121.305(a) also would require that electronic 
records be kept in accordance with part 11 (21 CFR part 11). Part 11 
provides criteria for acceptance by FDA, under certain circumstances, 
of electronic records, electronic signatures, and handwritten 
signatures executed to electronic records as equivalent to paper 
records and handwritten signatures executed on paper. The proposed 
requirement clarifies and acknowledges that records required by 
proposed part 121 may be retained electronically, provided that they 
comply with part 11.
    In the PC proposed rule, FDA tentatively concluded that it would be 
appropriate to apply the requirements of part 11 to the records that 
would be required to be kept under proposed part 117. However, we 
requested comment on whether there are any circumstances that would 
warrant not applying part 11 to records that would be kept under 
proposed part 117. In section XV.C of that document, we provided 
examples of circumstances in which we exempted records from the 
requirements of part 11 (21 CFR 1.329(b)) to avoid the necessity of 
establishing new recordkeeping systems as long as current practices 
would satisfy the requirements of the Act. In the PC proposed rule, we 
also asked for comment on whether we should allow additional time for 
electronic records to be kept in accordance with part 11. We seek 
similar comment with regard to circumstances that would warrant not 
applying part 11 to records that would be kept under proposed part 121 
and whether we should allow additional time for electronic records to 
be kept in accordance with part 11. Comments should provide the basis 
for any view that the requirements of part 11 are not warranted.
    b. Proposed Sec.  121.305(b). Proposed Sec.  121.305(b) would 
require that records contain the actual values and observations 
obtained during monitoring. For example, monitoring of the locking of 
an access door to an actionable process step could be recorded as 
``locked'' or ``unlocked'' (or ``yes'' or ``no'') and the monitoring of 
the presence of staff with only appropriate color uniforms in a 
designated area could be recorded as ``100% staff (or 10 of 10 staff) 
with blue uniforms'' or conversely ``80% staff (or 8 of 10 staff) with 
blue uniforms'' in the case of an improperly implemented focused 
mitigation strategy. In the case of an improperly implemented focused 
mitigation strategy, it is important to document the extent to which 
the strategy was incorrectly applied, as monitoring data can show a 
trend toward loss of control at an actionable process step. So, in the 
example in which 8 of 10 staff have blue uniforms, a facility may also 
consider documenting what color the remaining two staff were wearing if 
such information would be valuable in establishing a trend. If the 
recording of numerical values is possible in the monitoring of a 
focused mitigation strategy (e.g., if a facility is using a processing 
parameter such as heat treatment), then the actual times and 
temperatures or other appropriate processing data should be recorded.
    c. Proposed Sec.  121.305(c), (d) and (e). Proposed Sec.  
121.305(c), (d) and (e) would require that records be accurate, 
indelible, and legible (proposed

[[Page 78054]]

Sec.  121.305(c)); be created concurrently with performance of the 
activity documented (proposed Sec.  121.305(d)); and be as detailed as 
necessary to provide a history of work performed (proposed Sec.  
121.305(e)). Proposed Sec.  121.305(c) and (d) would ensure that the 
records are useful to the owner, operator, or agent in charge of a 
facility in complying with the requirements of proposed part 121, for 
example, in documenting compliance with monitoring requirements and 
verifying compliance with the food defense plan. These proposed 
requirements would also ensure that the records would be useful to FDA 
in determining compliance with the requirements of proposed part 121. 
Proposed Sec.  121.305(e) would provide flexibility to facilities to 
tailor the amount of detail to the nature of the record.
    d. Proposed Sec.  121.305(f). Proposed Sec.  121.305(f) would 
require that the records include the following: (1) The name and 
location of the facility; (2) the date and time of the activity 
documented; (3) the signature or initials of the person performing the 
activity; and (4) where appropriate, the identity of the product and 
the production code, if any. The name and location of the facility and 
the date and time would allow the owner, operator, or agent in charge 
of a facility (and, during inspection, an FDA investigator) to assess 
whether the record is current, to identify when and where any deviation 
occurred, and to track corrective actions. The signature of the 
individual who made the observation would ensure responsibility and 
accountability. In addition, if there is a question about the record, a 
signature would ensure that the source of the record will be known. 
Linking a record to a specific product (and, when applicable, the 
production code) would enable the owner, operator, or agent in charge 
of a facility covered by this rule to isolate product if there is a 
question that food has been adulterated. We seek comment on the scope 
and potential burden associated with these proposed requirements.
    The proposed requirement (proposed Sec.  121.305(f)(4)) for the 
identity of the product and production code, if any, is important in 
the context of food safety, where the production of potentially 
adulterated product may result from loss of control during processing, 
such as an improper cook temperature, and a recall may be necessary. It 
is also especially applicable for food safety in cases of continuous 
monitoring, when the loss of control can be associated with a 
particular product or production code. Consistent with the PC proposed 
rule, we have qualified the proposed requirement to indicate that the 
identity of the product and the production code should be included as 
part of the record ``where appropriate.'' We note that, in many cases, 
it will likely be more difficult to include this information for a 
focused mitigation strategy. As noted in the discussion on monitoring 
in section V.C.5 of this proposed rule, some focused mitigation 
strategies may be monitored weekly or monthly. In that case, it may not 
be appropriate to include all of the products and production codes that 
may have been affected by an improperly implemented focused mitigation 
strategy. Further, in many cases the identity of the product and the 
production code will not be relevant because the monitoring will be 
performed in the area surrounding one or more production lines, used 
for one or more products, rather than of processing parameters on a 
production line for a specific lot of product. On the other hand, if 
control of processing parameters, such as pasteurization time and 
temperature, are used as a focused mitigation strategy, it would be 
appropriate to document the product and production code, if any, that 
was being processed at the time of monitoring. The nature of the 
focused mitigation strategy should drive the decision by an owner, 
operator, or agent in charge of a facility regarding whether or not to 
include the identity of the product and the production code, if any, in 
records.
3. Proposed Sec.  121.310--Additional Requirements Applying to the Food 
Defense Plan
    Proposed Sec.  121.310 would require that the owner, operator, or 
agent in charge of a facility sign and date the food defense plan upon 
initial completion (proposed Sec.  121.310(a)) and upon any 
modification (proposed Sec.  121.310(b)). Such a signature would 
provide direct evidence of the owner, operator, or agent's acceptance 
of the plan and commitment to implementation of the plan. Additionally, 
the signature, along with the date of signing, would serve to minimize 
potential confusion over the authenticity of any differing versions or 
editions of the document that might exist.
4. Proposed Sec.  121.315--Requirements for Record Retention
    Proposed Sec.  121.315 contains requirements on the length of time 
records that would be required under proposed part 121 must be retained 
and allowances for offsite storage of records under certain 
circumstances.
    a. Proposed Sec.  121.315(a) and (b). Proposed Sec.  121.315(a) 
would require that all records that would be required by proposed part 
121 be retained at the facility for at least 2 years after the date 
they were prepared. Proposed Sec.  121.315(b) would require that the 
food defense plan be retained at the facility for at least 2 years 
after its use is discontinued (e.g., because the facility has updated 
the written food defense plan. The 2-year timeframe for all records 
required by proposed part 121 is consistent with the length of time 
that nonperishable food products, on average, can be expected to be in 
commercial distribution plus a reasonable time thereafter to ensure 
that the records are available for verification activities. This 
proposed requirement is similar to the proposed records retention 
requirement in the PC proposed rule, which contains a discussion of 
similar requirements found in other FDA regulations and in particular 
the proposed and final rules implementing the recordkeeping 
requirements of the Bioterrorism Act. This 2-year retention period 
would run from either the date the record is prepared, for day-to-day 
operational records, or the date at which use of the record is 
discontinued, for the food defense plan. We seek comment on this 
proposal.
    b. Proposed Sec.  121.315(c). Proposed Sec.  121.315(c) would 
provide that, except for the food defense plan, use of offsite storage 
for records is permitted after 6 months following the date that the 
record was made if such records can be retrieved and provided onsite 
within 24 hours of request for official review. The food defense plan 
would be required to remain onsite. FDA realizes that the proposed 
requirements for recordkeeping could require some facilities to store a 
significant quantity of records, and that there may not be adequate 
storage space in the facility for all of these records. Providing for 
offsite storage of most records after 6 months would enable a facility 
to comply with the proposed requirements for record retention while 
reducing the amount of space needed for onsite storage of the records 
without interfering with the purpose of record retention, because the 
records will be readily available.
    Proposed Sec.  121.315(c) also would provide that electronic 
records are considered to be onsite if they are accessible from an 
onsite location. Computerized systems within corporations can be 
networked, allowing for the sending and receiving of information in a 
secure fashion to all of the different food processing facilities of 
that corporation worldwide. This

[[Page 78055]]

type of system can be used to provide access at multiple locations to 
records from multiple facilities.
    c. Proposed Sec.  121.315(d). Proposed Sec.  121.315(d) would 
provide that if the facility is closed for a prolonged period, the 
records may be transferred to some other reasonably accessible location 
but must be returned to the facility within 24 hours for official 
review upon request. Allowing for transfer of records will give 
practical storage relief to seasonal operations or those closed for 
other reasons for prolonged periods.
5. Proposed Sec.  121.320--Requirements for Official Review
    Proposed Sec.  121.320 would require that all records required by 
proposed part 121 be made promptly available to a duly authorized 
representative of the Secretary of Health and Human Services upon oral 
or written request.
6. Proposed Sec.  121.325--Public Disclosure
    Proposed Sec.  121.325 would establish that all records required by 
proposed part 121 will be protected from public disclosure to the 
extent allowable under part 20 of this chapter. Our general policies, 
procedures, and practices relating to the protection of confidential or 
otherwise protected information received from third parties would apply 
to information received under this rule.

E. Compliance

    Section 103(e) of FSMA amends section 301 of the FD&C Act (21 
U.S.C. 331) by adding a new section--(uu)--to the list of acts and the 
causing thereof that are prohibited. Under section 301(uu) of the FD&C 
Act, the following act, and the causing thereof, are prohibited: 
``[t]he operation of a facility that manufactures, processes, packs, or 
holds food for sale in the United States if the owner, operator, or 
agent in charge of such facility is not in compliance with section 418 
[of the FD&C Act].'' To clearly communicate that failure to comply with 
the regulations established under section 418 of the FD&C Act is a 
prohibited act, proposed Sec.  121.401(a) in subpart E would establish 
that the operation of a facility that manufactures, processes, packs, 
or holds food for sale in the United States if the owner, operator, or 
agent in charge of such facility is required to comply with, and is not 
in compliance with, section 418 or subparts C or D of part 121 is a 
prohibited act under section 301(uu) of the FD&C Act.
    Section 106(d) of FSMA amends section 301 of the FD&C Act by adding 
a new section--(ww)--to the list of acts and the causing thereof that 
are prohibited. Under section 301(ww) of the FD&C Act, the following 
act, and the causing thereof, are prohibited: ``[t]he failure to comply 
with section 420 [of the FD&C Act].'' To clearly communicate that 
failure to comply with the regulations established under section 420 of 
the FD&C Act is a prohibited act, proposed Sec.  121.401(b) would 
establish that the failure to comply with section 420 of the FD&C Act 
or subparts C or D of part 121 is a prohibited act under section 
301(ww) of the FD&C Act.

VI. Preliminary Regulatory Impact Analysis

A. Overview

    FDA has examined the impacts of the proposed rule under Executive 
Order 12866, Executive Order 13563, the Regulatory Flexibility Act (5 
U.S.C. 601-612), and the Unfunded Mandates Reform Act of 1995 (Pub. L. 
104-4). Executive Orders 12866 and 13563 direct Agencies to assess all 
costs and benefits of available regulatory alternatives and, when 
regulation is necessary, to select regulatory approaches that maximize 
net benefits (including potential economic, environmental, public 
health and safety, and other advantages; distributive impacts; and 
equity). We believe that this proposed rule is a significant regulatory 
action under Executive Order 12866.

B. Regulatory Flexibility Act

    The Regulatory Flexibility Act requires Agencies to analyze 
regulatory options that would minimize any significant impact of a rule 
on small entities. The annualized costs per entity due to this proposed 
rule are about $13,000 for a one-facility firm with 100 employees, and 
there are about 4,100 small businesses that would be affected by the 
proposed rule, so we tentatively conclude that the proposed rule could 
have a significant economic impact on a substantial number of small 
entities.

C. Small Business Regulatory Enforcement Fairness Act of 1996

    The Small Business Regulatory Enforcement Fairness Act of 1996 
(Pub. L. 104-121) defines a major rule for the purpose of congressional 
review as having caused or being likely to cause one or more of the 
following: An annual effect on the economy of $100 million or more; a 
major increase in costs or prices; significant adverse effects on 
competition, employment, productivity, or innovation; or significant 
adverse effects on the ability of U.S.-based enterprises to compete 
with foreign-based enterprises in domestic or export markets. In 
accordance with the Small Business Regulatory Enforcement Fairness Act, 
the Office of Management and Budget (OMB) has determined that this 
proposed rule is a major rule for the purpose of congressional review.

D. Unfunded Mandates Reform Act of 1995

    Section 202(a) of the Unfunded Mandates Reform Act of 1995 requires 
that Agencies prepare a written statement, which includes an assessment 
of anticipated costs and benefits, before proposing ``any rule that 
includes any Federal mandate that may result in the expenditure by 
State, local, and tribal governments, in the aggregate, or by the 
private sector, of $100,000,000 or more (adjusted annually for 
inflation) in any one year.'' The current threshold after adjustment 
for inflation is $141 million, using the most current (2012) Implicit 
Price Deflator for the Gross Domestic Product. We expect this proposed 
rule may result in a 1-year expenditure that would meet or exceed this 
amount.

E. Paperwork Reduction Act of 1995

    This proposed rule contains information collection requirements 
that are subject to review by the Office of Management and Budget (OMB) 
under the Paperwork Reduction Act of 1995 (PRA) (44 U.S.C. 3501-3520). 
A description of these provisions is given in the Description section 
of this document with an estimate of the annual reporting, 
recordkeeping, and third-party disclosure burden. Included in the 
estimate is the time for reviewing instructions, searching existing 
data sources, gathering and maintaining the data needed, and completing 
and reviewing each collection of information.
    FDA invites comments on: (1) Whether the proposed collection of 
information is necessary for the proper performance of FDA's functions, 
including whether the information will have practical utility; (2) the 
accuracy of FDA's estimate of the burden of the proposed collection of 
information, including the validity of the methodology and assumptions 
used; (3) ways to enhance the quality, utility, and clarity of the 
information to be collected; and (4) ways to minimize the burden of the 
collection of information on respondents, including through the use of 
automated collection techniques, when appropriate, and other forms of 
information technology.
    To ensure that comments on information collection are received, OMB 
recommends that written

[[Page 78056]]

comments be faxed to the Office of Information and Regulatory Affairs, 
OMB, Attn: FDA Desk Officer, FAX: 202-395-7285, or emailed to oira_submission@omb.eop.gov. All comments should be identified with the 
title ``Focused Mitigation Strategies to Protect Food Against 
Intentional Adulteration.''
    In compliance with the Paperwork Reduction Act of 1995 (44. U.S.C. 
3407(d)), the agency has submitted the information collection 
provisions of this proposed rule to OMB for review. Interested persons 
are requested to send comments regarding information collection by 
January 23, 2014 to the Office of Information and Regulatory Affairs, 
OMB. To ensure that comments on information collection are received, 
OMB recommends that written comments be faxed to the Office of 
Information and Regulatory Affairs, OMB, Attn: FDA Desk Officer, FAX: 
202-395-6974, or emailed to oira_submission@omb.eop.gov. All comments 
should be identified with the title, ``Focused Mitigation Strategies to 
Protect Food Against Intentional Adulteration.''

F. Public Access to the Analyses

    The analyses that we have performed to examine the impacts of this 
proposed rule under Executive Order 12866, Executive Order 13563, the 
Regulatory Flexibility Act (5 U.S.C. 601-612), the Unfunded Mandates 
Reform Act of 1995 (Pub. L. 104-4), and the Paperwork Reduction Act of 
1995 (44 U.S.C. 3501-3520) are available to the public in the docket 
for this final rule (Ref. 64).

VII. Analysis of Environmental Impact

    The Agency has determined under 21 CFR 25.30(h) that this action is 
of a type that does not individually or cumulatively have a significant 
effect on the human environment (Ref. 65). Therefore, neither an 
environmental assessment nor an environmental impact statement is 
required.

VIII. Federalism

    FDA has analyzed this proposed rule in accordance with the 
principles set forth in Executive Order 13132. FDA has determined that 
the proposed rule, if finalized, would not contain policies that would 
have substantial direct effects on the States, on the relationship 
between the National Government and the States, or on the distribution 
of power and responsibilities among the various levels of government. 
Accordingly, the Agency tentatively concludes that the proposed rule 
does not contain policies that have federalism implications as defined 
in the Executive order and, consequently, a federalism summary impact 
statement is not required.

IX. Comments

    We invite public comment on the matters specified in this document 
as well as any other matters concerning this proposed rule that are of 
interest. Interested persons may submit either electronic comments 
regarding this document to http://www.regulations.gov or written 
comments to the Division of Dockets Management (see ADDRESSES). It is 
only necessary to send one set of comments. Identify comments with the 
docket number found in brackets in the heading of this document. 
Received comments may be seen in the Division of Dockets Management 
between 9 a.m. and 4 p.m., Monday through Friday, and will be posted to 
the docket at http://www.regulations.gov.

X. References

    The following references have been placed on display in the 
Division of Dockets Management (see ADDRESSES) and may be seen by 
interested persons between 9 a.m. and 4 p.m., Monday through Friday. 
(FDA has verified the Web site addresses, but FDA is not responsible 
for any subsequent changes to the Web sites after this document 
publishes in the Federal Register.)

    1. Kennedy, S.K. and F.F. Busta, ``Chapter 5 Biosecurity: Food 
Protection and Defense,'' Food Microbiology: Fundamentals and 
Frontiers, Edited by M.P. Doyle and L.R. Beuchat, American Society 
for Microbiology Press: Washington, DC, pp. 87-102, 2007. Accessed 
October 30, 2013.
    2. Khan A.S., D.L. Swerdlow, and D.D. Juranek, ``Precautions 
Against Biological and Chemical Terrorism Directed at Food and Water 
Supplies,'' Public Health Reports, 116(1):3-14, 2001.
    3. Sobel, J., A.S. Khan, and D.L. Swerdlow, ``Threat of a 
Biological Terrorist Attack on the US Food Supply: The CDC 
Perspective,'' The Lancet, 359(9309):874-880, March 9, 2002.
    4. T[ouml]r[ouml]k, T.J., R.V. Tauxe, R.P. Wise, et al., ``A 
Large Community Outbreak of Salmonellosis Caused by Intentional 
Contamination of Restaurant Salad Bars,'' Journal of American 
Medical Association, 278(5):389-395, August 1997.
    5. British Standards Institute and Centre for the Protection of 
National Infrastructure. ``Publicly Available Specification 96:2010 
Defending Food and Drink,'' March 2010. http://www.cpni.gov.uk/documents/publications/non-cpni_pubs/pas96_vis14.pdf. Accessed 
September 25, 2013.
    6. World Health Organization. ``Terrorist Threats to Food: 
Guidance for Establishing and Strengthening Prevention and Response 
Systems,'' Food Safety Issues, Revision May 2008. http://www.who.int/foodsafety/publications/general/en/terrorist.pdf. 
Accessed September 23, 2013.
    7. Everstine, K., S. Kennedy, and J. Spink, ``Economically 
Motivated Adulteration (EMA) of Food: Common Characteristics of EMA 
Incidents,'' Journal of Food Protection, 76(4):723-735, 2013.
    8. U.S. Food and Drug Administration. ``Economically Motivated 
Adulteration; Public Meeting; Request for Comment,'' Federal 
Register, 74(64):15497-15499, 2009. http://www.gpo.gov/fdsys/pkg/FR-2009-04-06/pdf/E9-7843.pdf. Accessed September 23, 2013.
    9. Spink, J. and DC Moyer, ``Defining the Public Health Threat 
of Food Fraud,'' Journal of Food Science, 75(9):R157-R163, 2011.
    10. Ingelfinger, J.R., ``Melamine and the Global Implications of 
Food Contamination,'' New England Journal of Medicine, 359(26):2745-
2748, 2008.
    11. Xiu, C. and K.K. Klein, ``Melamine in Milk Products in 
China: Examining the Factors That Led to Deliberate Use of the 
Contaminant,'' Food Policy, 35(5):463-470, 2010.
    12. World Health Organization. Food Security Page. http://www.who.int/trade/glossary/story028/en. Accessed September 23, 2013
    13. Kolavic, S., A. Kimura, S. Simons, L. Slutsker, S. Barth, 
and C. Haley, ``An Outbreak of Shigella dysenteriae Type 2 Among 
Laboratory Workers Due to Intentional Food Contamination,'' Journal 
of American Medical Association, 278(5):396-398, August 1997.
    14. Anderson, S., J. DeMent, C.B. Ocfemia, and D.C. Hunt, 
Outbreaks of Methomyl Poisoning Caused by the Intentional 
Contamination of Salsa at the Mi Ranchito Restaurant in Lenexa, KS--
August 2009, Kansas Department of Health and Environment, April 12, 
2011. http://www.kdheks.gov/epi/download/Final_Mi_Ranchito_Report.pdf. Accessed October 22, 2013.
    15. U.S. Government Printing Office. Senate Hearing 108-491, 
``Agroterrorism: The Threat to America's Breadbasket,'' p. 1, 
November 19, 2003. http://www.gpo.gov/fdsys/pkg/CHRG-108shrg91045/html/CHRG-108shrg91045.htm. Accessed September 23, 2013.
    16. The White House, Office of the Press Secretary. Homeland 
Security Presidential Directive/HSPD-8, December, 17, 2003. https://www.fas.org/irp/offdocs/nspd/hspd-8.html. Accessed October 17, 2013.
    17. The White House, Office of the Press Secretary. Homeland 
Security Presidential Directive 7: Critical Infrastructure 
Identification, Prioritization, and Protection, December, 17, 2003. 
https://www.dhs.gov/homeland-security-presidential-directive-7. 
Accessed October 17, 2013.
    18. The White House, Office of the Press Secretary. Homeland 
Security Presidential Directive/HSPD-9, January, 30, 2004. https://www.fas.org/irp/offdocs/nspd/hspd-9.html. Accessed October 17, 2013.
    19. The White House, Office of the Press Secretary. Presidential 
Policy Directive/PPD-8: National Preparedness, March 30, 2011. 
http://www.dhs.gov/presidential-policy-directive-8-national-preparedness. Accessed October 17, 2013.
    20. The White House, Office of the Press Secretary. Presidential 
Policy Directive 21:

[[Page 78057]]

Critical Infrastructure Security and Resilience, February 12, 2013. 
http://www.whitehouse.gov/the-press-office/2013/02/12/presidential-policy-directive-critical-infrastructure-security-and-resil. 
Accessed October 7, 2013.
    21. U.S. Food and Drug Administration. Strategic Partnership 
Program Agroterrorism (SPPA) Initiative: Final Summary Report 
September 2005--September 2008, December 2008. http://www.fda.gov/Food/FoodDefense/FoodDefensePrograms/ucm170509.htm. Accessed 
September 23, 2013.
    22. U.S. Food and Drug Administration, Center for Food Safety 
and Applied Nutrition. ``Guidance for Industry: Food Producers, 
Processors, and Transporters: Food Security Preventive Measures 
Guidance,'' March 2003, Revision October 2007. http://www.fda.gov/Food/GuidanceRegulation/GuidanceDocumentsRegulatoryInformation/FoodDefense/ucm083075.htm. Accessed September 23, 2013.
    23. U.S. Food and Drug Administration, Center for Food Safety 
and Applied Nutrition. ``Guidance for Industry: Importers and 
Filers: Food Security Preventive Measures Guidance,'' March 2003, 
Revision October 2007. http://www.fda.gov/Food/GuidanceRegulation/GuidanceDocumentsRegulatoryInformation/FoodDefense/ucm078978.htm. 
Accessed September 23, 2013.
    24. U.S. Food and Drug Administration, Center for Food Safety 
and Applied Nutrition. ``Guidance for Industry: Dairy Farms, Bulk 
Milk Transporters, Bulk Milk Transfer Stations and Fluid Milk 
Processors: Food Security Preventive Measures Guidance,'' July 2003, 
Revision October 2007. http://www.fda.gov/Food/GuidanceRegulation/GuidanceDocumentsRegulatoryInformation/FoodDefense/ucm078978.htm. 
Accessed September 23, 2013.
    25. U.S. Food and Drug Administration, Center for Food Safety 
and Applied Nutrition. ``Guidance for Industry: Retail Food Stores 
and Food Service Establishments: Food Security Preventive Measures 
Guidance,'' December 2003, Revision October 2007. http://www.fda.gov/Food/GuidanceRegulation/GuidanceDocumentsRegulatoryInformation/FoodDefense/ucm082751.htm. 
Accessed September 23, 2013.
    26. U.S. Food and Drug Administration, Center for Food Safety 
and Applied Nutrition. ``Guidance for Industry: Cosmetics Processors 
and Transporters of Cosmetics Security Preventive Measures 
Guidance,'' November 2003, Revision October 2007. http://www.fda.gov/Food/GuidanceRegulation/GuidanceDocumentsRegulatoryInformation/FoodDefense/ucm082716.htm. 
Accessed September 23, 2013.
    27. U.S. Food and Drug Administration. Food Defense 101 Page. 
http://www.fda.gov/Food/FoodDefense/ToolsEducationalMaterials/ucm353774.htm. Accessed October 17, 2013.
    28. U.S. Food and Drug Administration. Employees FIRST Page. 
http://www.fda.gov/Food/FoodDefense/ToolsEducationalMaterials/ucm295997.htm. Accessed and printed on October 17, 2013.
    29. U.S. Food and Drug Administration. Vulnerability Assessment 
Software Page, Version 2.4, November 2011. http://www.fda.gov/Food/FoodDefense/ToolsEducationalMaterials/ucm295900.htm. Accessed 
September 25, 2013.
    30. U.S. Food and Drug Administration. Mitigation Strategies 
Database Page. http://www.fda.gov/Food/FoodDefense/ToolsEducationalMaterials/ucm295898.htm. Accessed September 25, 
2013.
    31. U.S. Food and Drug Administration. Food Defense Plan Builder 
Software Page. http://www.fda.gov/Food/FoodDefense/ToolsEducationalMaterials/ucm349888.htm. Accessed September 25, 
2013.
    32. U.S. Food and Drug Administration. Food Related Emergency 
Exercise Bundle (FREE-B) Page. http://www.fda.gov/Food/FoodDefense/ToolsEducationalMaterials/ucm295902.htm. Accessed October 17, 2013.
    33. Global Food Safety Initiative. GFSI Guidance Document, 
Version 6.1, 6(2), August 2011. http://www.mygfsi.com/gfsifiles/Guidance_Document_Sixth_Edition_Version_6.1.pdf. Accessed 
September 23, 2013.
    34. Safe Quality Food Institute. SQF Code: A HACCP-Based 
Supplier Assurance Code for the Food Industry, Edition 7.1, April 
2013. http://www.sqfi.com/wp-content/uploads/SQF-Code-Ed-7.1-4-3-13.pdf. Accessed October 17, 2013.
    35. International Featured Standards. Events and Academy Page. 
http://www.ifs-certification.us/events. Accessed November 5, 2013.
    36. China Inspection and Quarantine Service, Administrative 
Provisions on Filing of Export Food Production Enterprises Page. 
http://en.ciqcid.com/Zjl/Comprehensives/51829.htm. Accessed 
September 25, 2013.
    37. German Federal Office of Consumer Protection and Food 
Safety. ``General Recommendations for Protection of Animal Feed and 
Food Supply Chain From the Intentional Release of Agents,'' February 
2011. Accessed October 22, 2013.
    38. French Republic. Guide Containing Recommendations for the 
Protection of the Food Chain From Threats of Malevolent, Criminal, 
or Terrorist Acts, May 2007. http://www.frenchfoodintheus.org/IMG/pdf/I07008308-imtnea-Guide_des_recommandations-ENG_3_.pdf. 
Accessed and printed on September 23, 2013.
    39. Trusted Information Sharing Network for Critical 
Infrastructure Protection. A National Strategy for Enhancing the 
Safety and Security of our Food Supply, March 2006. http://www.daff.gov.au/__data/assets/pdf_file/0004/183325/enhancing_safety_security_strategy.pdf. Accessed September 23, 2013.
    40. U.S. Food and Drug Administration. Memorandum to the File: 
Evaluation of the potential for intentional adulteration of produce 
during activities that occur on produce farms, September 2013.
    41. Buttars, N.K., A.J. Young, D. Bailey, ``Adoption of Security 
Systems by Dairy Farms To Address Bioterrorist Threats in the 
Intermountain United States,'' Journal of Dairy Science, 89:1822-
1829, 2006. Accessed October 22, 2013.
    42. International Dairy Foods Association. Global Markets Page. 
http://www.idfa.org/key-issues/category/global-markets/map/#us. 
Accessed October 23, 2013.
    43. Newkirk, R., C. Hedberg, and J. Bender, ``Establishing a 
Milkborne Disease Outbreak Profile: Potential Food Defense 
Implications,'' Foodborne Pathogens and Disease, 8(3):433-437, 2011.
    44. Popkin, B., ``Patterns of Beverage Use Across the 
Lifecycle,'' Physiology and Behavior, 100(1):4-9, 2010.
    45. Sebastian, R.S., J.D. Goldman, C.W. Enns, and R.P. LaComb, 
``Fluid Milk Consumption in the United States: What We Eat In 
America, NHANES 2005-2006,'' Food Surveys Research Group Dietary 
Data Brief No. 3, September 2010. http://ars.usda.gov/SP2UserFiles/Place/12355000/pdf/DBrief/3_milk_consumption_0506.pdf. Accessed 
October 23, 2013.
    46. U.S. Department of Agriculture and Economic Research 
Service. Dairy Products: Per capita consumption, United States 
(Annual), 2013. http://www.ers.usda.gov/data-products/dairy-data.aspx. Accessed October 23, 2013.
    47. Wein, L.M. and Y. Lui, ``Analyzing a Bioterror Attack on the 
Food Supply: The Case of Botulinum Toxin in Milk,'' Proceedings of 
the National Academy of Sciences of the United States of America, 
102(28):9984-9989, 2005.
    48. Blayney, D.P., ``The Changing Landscape of U.S. Milk 
Production,'' Statistical Bulletin No. 978, U.S. Department of 
Agriculture, June 2002. http://usda.mannlib.cornell.edu/usda/nass/sb/sb978.pdf. Accessed October 23, 2013.
    49. Codex Alimentarius Commission. General Principles of Food 
Hygiene, CAC/RCP 1-1969, 2003.
    50. Sobel J. and J. Watson, ``Chapter 10: Intentional Terrorism 
Contamination of Food and Water,'' Beyond Anthrax, Springer Link, 
2009.
    51. Stinson, T.F., J. Kinsey, D. Degeneffe, and K. Ghosh, How 
Should America's Anti-Terrorism Budget Be Allocated? Findings From a 
National Survey of Attitudes of U.S. Residents About Terrorism, The 
Food Industry Center, March 2006. http://ageconsearch.umn.edu/bitstream/14351/1/tr06-01.pdf. Accessed October 21, 2013.
    52. Merriam-Webster. Vulnerability Page. http://www.merriam-webster.com/dictionary/vulnerability. Accessed October 21, 2013.
    53. U.S. Food and Drug Administration, Study and Report on the 
Food Processing Sector, 2011.
    54. U.S. Food and Drug Administration. Analysis of Results for 
FDA Food Defense Vulnerability Assessments and Identification of 
Activity Types, April 2013. http://www.fda.gov/food/guidanceregulation/fsma/ucm347023.htm. Accessed September 25, 2013.
    55. U.S. Food and Drug Administration. Memorandum to the File: 
Evaluation of the potential for intentional adulteration of animal 
feed from acts of terrorism, December 2013.
    56. U.S. Department of Health and Human Services, Public Health 
Service, and National

[[Page 78058]]

Toxicology Program. Report on Carcinogens, 12th Edition, 2011.
    57. U.S. Department of Health and Human Services, Centers for 
Disease Control and Prevention, and U.S. Department of Agriculture. 
HHS and USDA Select Agents and Toxins 7 CFR Part 331, 9 CFR Part 
121, and 42 CFR Part 73, September 10, 2013. http://www.selectagents.gov/resources/List_of_Select_Agents_and_Toxins_2013-09-10.pdf. Accessed October 21, 2013.
    58. U.S. Food and Drug Administration. Vulnerability Assessments 
of Food Systems: Final Summary Report, June 2009-February 2012. 
http://www.fda.gov/downloads/Food/FoodDefense/UCM317547.pdf. 
Accessed September 23, 2013.
    59. AIB International. Food Safety and Food Defense Education 
Page. https://www.aibonline.org/foodsafetyeducation/index.html. 
Accessed October 17, 2013.
    60. Center for Agriculture and Food Security and Preparedness 
and University of Tennessee Knoxville. Instructor-Led Courses Page: 
Agriculture and Food Vulnerability Assessment Training. http://www.vet.utk.edu/cafsp/courses.php. Accessed October 17, 2013.
    61. International Featured Standards. IFS Food: Standard for 
Auditing Quality and Food Safety of Food Products, Version 6, 
January 2012. http://www.ifs-certification.com/images/ifs_standards/ifs6/IFS_Food_V6_en.pdf. Accessed September 23, 2013.
    62. National Center for Food Protection and Defense. Food 
Defense Online Modules Page. http://www.ncfpd.umn.edu/index.cfm/education/food-defense-online-modules/. Accessed October 17, 2013.
    63. AIB International. The AIB International Consolidated 
Standards for Inspection: Prerequisite and Food Safety Programs, 
January 2013. https://www.aibonline.org/Standards/2013FoodSafety_web_ENG.pdf. Accessed October 17, 2013.
    64. U.S. Food and Drug Administration. FDA's Preliminary 
Regulatory Impact Analysis, Preliminary Regulatory Flexibility 
Analysis, Preliminary Unfunded Mandates Reform Act Analysis, 
Preliminary Paperwork Reduction Act Analysis, December 2013.
    65. U.S. Food and Drug Administration. Memorandum to the File: 
Environmental analysis related to the proposed rule on focused 
mitigation strategies to protect food against intentional 
adulteration, November 2013.

List of Subjects in 21 CFR Part 121

    Food packaging, Foods.
    Therefore, under the Federal Food, Drug, and Cosmetic Act and under 
authority delegated to the Commissioner of Food and Drugs, it is 
proposed that 21 CFR chapter I be amended by adding part 121 to read as 
follows:

PART 121--FOCUSED MITIGATION STRATEGIES TO PROTECT FOOD AGAINST 
INTENTIONAL ADULTERATION

Subpart A--General Provisions
Sec.
121.3 Definitions.
121.5 Exemptions.
Subpart B--[Reserved]
Subpart C--Food Defense Measures
121.126 Requirement for a food defense plan.
121.130 Identification of actionable process steps.
121.135 Focused mitigation strategies for actionable process steps.
121.140 Monitoring.
121.145 Corrective actions.
121.150 Verification.
121.160 Training.
Subpart D--Requirements Applying to Records That Must Be Established 
and Maintained
121.301 Records subject to the requirements of this subpart.
121.305 General requirements applying to records.
121.310 Additional requirements applying to the food defense plan.
121.315 Requirements for record retention.
121.320 Requirements for official review.
121.325 Public disclosure.
Subpart E--Compliance
121.401 Compliance.

    Authority:  21 U.S.C. 331, 342, 350g, 350(i), 371, 374.

Subpart A--General Provisions


Sec.  121.3  Definitions.

    The definitions and interpretations of terms in section 201 of the 
Federal Food, Drug, and Cosmetic Act are applicable to such terms when 
used in this part. The following definitions also apply:
    Actionable process step means a point, step, or procedure in a food 
process at which food defense measures can be applied and are essential 
to prevent or eliminate a significant vulnerability or reduce such 
vulnerability to an acceptable level.
    Contaminant means any biological, chemical, physical or 
radiological agent that may be intentionally added to food and that may 
cause illness, injury or death.
    Facility means a domestic facility or a foreign facility that is 
required to register under section 415 of the Federal Food, Drug, and 
Cosmetic Act (21 U.S.C. 350d), in accordance with the requirements of 
21 CFR part 1, subpart H.
    Farm means farm as defined in Sec.  1.227 of this chapter.
    FDA means the Food and Drug Administration.
    Focused mitigation strategies mean those risk-based, reasonably 
appropriate measures that a person knowledgeable about food defense 
would employ to significantly minimize or prevent significant 
vulnerabilities identified at actionable process steps, and that are 
consistent with the current scientific understanding of food defense at 
the time of the analysis.
    Food means food as defined in section 201(f) of the Federal Food, 
Drug, and Cosmetic Act (21 U.S.C. 321(f)) and includes raw materials 
and ingredients.
    Food defense means the effort to protect food from intentional acts 
of adulteration where there is an intent to cause public health harm 
and economic disruption.
    Holding means storage of food. Holding facilities include 
warehouses, cold storage facilities, storage silos, grain elevators, 
and liquid storage tanks. For farms and farm mixed-type facilities, 
holding also includes activities traditionally performed by farms for 
the safe or effective storage of raw agricultural commodities grown or 
raised on the same farm or another farm under the same ownership, but 
does not include activities that transform a raw agricultural 
commodity, as defined in section 201(r) of the Federal Food, Drug, and 
Cosmetic Act, into a processed food as defined in section 201(gg).
    Manufacturing/processing means making food from one or more 
ingredients, or synthesizing, preparing, treating, modifying or 
manipulating food, including food crops or ingredients. Examples of 
manufacturing/processing activities are cutting, peeling, trimming, 
washing, waxing, eviscerating, rendering, cooking, baking, freezing, 
cooling, pasteurizing, homogenizing, mixing, formulating, bottling, 
milling, grinding, extracting juice, distilling, labeling, or 
packaging. For farms and farm mixed-type facilities, manufacturing/
processing does not include activities that are part of harvesting, 
packing, or holding.
    Mixed-type facility means an establishment that engages in both 
activities that are exempt from registration under section 415 of the 
Federal Food, Drug, and Cosmetic Act and activities that require the 
establishment to be registered. An example of such a facility is a 
``farm mixed-type facility,'' which is an establishment that grows and 
harvests crops or raises animals and may conduct other activities 
within the farm definition, but also conducts activities that require 
the establishment to be registered.
    Monitor means to conduct a planned sequence of observations or 
measurements to assess whether focused mitigation strategies are 
consistently applied and to produce an accurate record for use in 
verification.

[[Page 78059]]

    Packing means placing food into a container other than packaging 
the food. For farms and farm mixed-type facilities, packing also 
includes activities traditionally performed by farms to prepare raw 
agricultural commodities grown or raised on the same farm or another 
farm under the same ownership for storage and transport, but does not 
include activities that transform a raw agricultural commodity, as 
defined in section 201(r) of the Federal Food, Drug, and Cosmetic Act, 
into a processed food as defined in section 201(gg).
    Qualified end-user, with respect to a food, means the consumer of 
the food (where the term consumer does not include a business); or a 
restaurant or retail food establishment (as those terms are defined in 
Sec.  1.227 of this chapter) that:
    (1) Is located:
    (i) In the same State as the qualified facility that sold the food 
to such restaurant or establishment; or
    (ii) Not more than 275 miles from such facility; and
    (2) Is purchasing the food for sale directly to consumers at such 
restaurant or retail food establishment.
    Qualified facility means (when including the sales by any 
subsidiary; affiliate; or subsidiaries or affiliates, collectively, of 
any entity of which the facility is a subsidiary or affiliate) a 
facility that is:
    (1) A very small business as defined in this part; or
    (2) A facility to which both of the following apply:
    (i) During the 3-year period preceding the applicable calendar 
year, the average annual monetary value of the food manufactured, 
processed, packed or held at such facility that is sold directly to 
qualified end-users (as defined in this part) during such period 
exceeded the average annual monetary value of the food sold by such 
facility to all other purchasers; and
    (ii) The average annual monetary value of all food sold during the 
3-year period preceding the applicable calendar year was less than 
$500,000, adjusted for inflation.
    Significant vulnerability means a vulnerability for which a prudent 
person knowledgeable about food defense would employ food defense 
measures because of the potential for serious adverse health 
consequences or death and the degree of accessibility to that point in 
the food process.
    Significantly minimize means to reduce to an acceptable level, 
including to eliminate.
    Small business means a business employing fewer than 500 persons.
    Verification means those activities, other than monitoring, that 
establish that the system is operating according to the food defense 
plan.
    Very small business means a business that has less than $10,000,000 
in total annual sales of food, adjusted for inflation.
    Vulnerability means the susceptibility of a point, step, or 
procedure in a facility's food process to intentional adulteration.


Sec.  121.5  Exemptions.

    (a) This part does not apply to a qualified facility, except that 
qualified facilities must, upon request, provide for official review 
documentation that was relied upon to demonstrate that the facility 
meets this exemption. Such documentation must be retained for 2 years.
    (b) This part does not apply to the holding of food, except the 
holding of food in liquid storage tanks.
    (c) This part does not apply to the packing, re-packing, labeling, 
or re-labeling of food where the container that directly contacts the 
food remains intact.
    (d) This part does not apply to activities of a facility that are 
subject to section 419 of the Federal Food, Drug, and Cosmetic Act (21 
U.S.C. 350h) (Standards for Produce Safety).
    (e)(1) This part does not apply with respect to alcoholic beverages 
at a facility that meets the following two conditions:
    (i) Under the Federal Alcohol Administration Act (27 U.S.C. 201 et 
seq.) or chapter 51 of subtitle E of the Internal Revenue Code of 1986 
(26 U.S.C. 5001 et seq.) the facility is required to obtain a permit 
from, register with, or obtain approval of a notice or application from 
the Secretary of the Treasury as a condition of doing business in the 
United States, or is a foreign facility of a type that would require 
such a permit, registration, or approval if it were a domestic 
facility; and
    (ii) Under section 415 of the Federal Food, Drug, and Cosmetic Act 
(21 U.S.C. 350d) the facility is required to register as a facility 
because it is engaged in manufacturing, processing, packing, or holding 
one or more alcoholic beverages.
    (2) This part does not apply with respect to food other than 
alcoholic beverages at a facility described in paragraph (e)(1) of this 
section, provided such food:
    (i) Is in prepackaged form that prevents any direct human contact 
with such food; and
    (ii) Constitutes not more than 5 percent of the overall sales of 
the facility, as determined by the Secretary of the Treasury.
    (f) This part does not apply to the manufacturing, processing, 
packing, or holding of food for animals other than man.

Subpart B--[Reserved]

Subpart C--Food Defense Measures


Sec.  121.126  Requirement for a food defense plan.

    (a) Food defense plan. The owner, operator, or agent in charge of a 
facility must prepare, or have prepared, and implement a written food 
defense plan.
    (b) Contents of a food defense plan. The food defense plan must 
include:
    (1) The written identification of actionable process steps as 
required by Sec.  121.130;
    (2) The written focused mitigation strategies as required by Sec.  
121.135(b);
    (3) The written procedures for monitoring as required by Sec.  
121.140(a);
    (4) The written corrective action procedures as required by Sec.  
121.145(a)(1); and
    (5) The written verification procedures as required by Sec.  
121.150(e).


Sec.  121.130  Identification of actionable process steps.

    The owner, operator, or agent in charge of a facility must identify 
any actionable process steps, using the procedures described in either 
paragraph (a) or paragraph (b) of this section. The identification of 
actionable process steps and the assessment leading to that 
identification must be written.
    (a) Key activity types. The owner, operator, or agent in charge of 
a facility must assess, for each type of food manufactured, processed, 
packed or held at the facility, whether the facility has one or more of 
the following key activity types and identify the actionable process 
steps associated with any key activity types present:
    (1) Bulk liquid receiving and loading--a step in which a bulk 
liquid is received and unloaded from an inbound conveyance or loaded 
into an outbound conveyance where a contaminant can be intentionally 
introduced and, if it is, it is likely that the contaminant will be 
distributed throughout the liquid due to sloshing, movement, or 
turbulence caused by the receiving and unloading or loading activity.
    (2) Liquid storage and handling--a step in which a liquid is 
contained in bulk storage tanks or in holding, surge,

[[Page 78060]]

or metering tanks where a contaminant can be intentionally introduced 
and, if it is, it is likely that the contaminant will be distributed 
into the food.
    (3) Secondary ingredient handling--a staging, preparation, 
addition, or rework step where a contaminant can be intentionally 
introduced into a relatively small amount of ingredient or rework and, 
if it is, it is likely that the contaminant will be distributed into a 
larger volume of food.
    (4) Mixing and similar activities--a step, such as mixing, 
blending, homogenizing, or grinding where a contaminant can be 
intentionally introduced and, if it is, it is likely that the 
contaminant will be distributed into the food.
    (b) Vulnerability assessment. The owner, operator, or agent in 
charge of a facility must conduct or have conducted, for each type of 
food manufactured, processed, packed or held at the facility, an 
evaluation to identify and prioritize the points, steps, and procedures 
in a food operation based on their vulnerability to intentional 
adulteration and to identify actionable process steps. Such 
vulnerability assessments must be performed by an individual(s) 
qualified by experience and/or training using appropriate methods.


Sec.  121.135  Focused mitigation strategies for actionable process 
steps.

    (a) The owner, operator, or agent in charge of a facility must 
identify and implement focused mitigation strategies at each actionable 
process step to provide assurances that the significant vulnerability 
at each step will be significantly minimized or prevented and the food 
manufactured, processed, packed, or held by such facility will not be 
adulterated under section 402 of the Federal Food, Drug, and Cosmetic 
Act (21 U.S.C. 342).
    (b) Focused mitigation strategies must be written.
    (c) Focused mitigation strategies required under this section are 
subject to:
    (1) Monitoring as required by Sec.  121.140;
    (2) Corrective actions as required by Sec.  121.145; and
    (3) Verification as required by Sec.  121.150.


Sec.  121.140  Monitoring.

    (a) The owner, operator, or agent in charge of a facility must 
establish and implement written procedures, including the frequency 
with which they are to be performed, for monitoring the focused 
mitigation strategies.
    (b) The owner, operator, or agent in charge of a facility must 
monitor the focused mitigation strategies with sufficient frequency to 
provide assurances that they are consistently applied.
    (c) All monitoring of focused mitigation strategies in accordance 
with this section must be documented in records that are subject to 
verification in accordance with Sec.  121.150(a) and records review in 
accordance with Sec.  121.150(c).


Sec.  121.145  Corrective actions.

    (a) Corrective action procedures. (1) The owner, operator, or agent 
in charge of a facility must establish and implement written corrective 
action procedures that must be taken if focused mitigation strategies 
are not properly implemented.
    (2) The corrective action procedures must describe the steps to be 
taken to ensure that appropriate action is taken to identify and 
correct a problem with implementation of a focused mitigation strategy 
to reduce the likelihood that the problem will recur.
    (b) Documentation. All corrective actions taken in accordance with 
this section must be documented in records that are subject to 
verification in accordance with Sec.  121.150(b) and records review in 
accordance with Sec.  121.150(c).


Sec.  121.150  Verification.

    (a) Monitoring. The owner, operator, or agent in charge of a 
facility must verify that monitoring is being conducted, as required by 
Sec.  121.140.
    (b) Corrective actions. The owner, operator, or agent in charge of 
a facility must verify that appropriate decisions about corrective 
actions are being made, as required by Sec.  121.145.
    (c) Implementation and effectiveness. The owner, operator, or agent 
in charge of a facility must verify that the focused mitigation 
strategies are consistently implemented and are effectively and 
significantly minimizing or preventing the significant vulnerabilities. 
As appropriate to the facility and the food, this must include review 
of the monitoring and corrective actions records within appropriate 
timeframes to ensure that the records are complete, the activities 
reflected in the records occurred in accordance with the food defense 
plan, the focused mitigation strategies are effective, and appropriate 
decisions were made about corrective actions.
    (d) Reanalysis. The owner, operator, or agent in charge of a 
facility must:
    (1) Conduct a reanalysis of the food defense plan:
    (i) At least once every 3 years;
    (ii) Whenever a significant change is made in the activities 
conducted at a facility operated by such owner, operator, or agent in 
charge if the change creates a reasonable potential for a new 
vulnerability or a significant increase in a previously identified 
vulnerability;
    (iii) Whenever such owner, operator or agent in charge becomes 
aware of new information about potential vulnerabilities associated 
with the food operation or facility;
    (iv) Whenever a focused mitigation strategy is found to be 
ineffective; and
    (v) Whenever FDA requires reanalysis to respond to new 
vulnerabilities and developments in scientific understanding including, 
as appropriate, results from the Department of Homeland Security 
biological, chemical, radiological, or other terrorism risk assessment.
    (2) Complete such reanalysis and implement any additional focused 
mitigation strategies needed to address the significant vulnerabilities 
identified, if any, before the change in activities at the facility is 
operative or, when necessary, during the first 6 weeks of production; 
and
    (3) Revise the written plan if a significant change is made or 
document the basis for the conclusion that no additional or revised 
focused mitigation strategies are needed.
    (e) Documentation. All verification activities taken in accordance 
with this section must be documented in records.


Sec.  121.160  Training.

    (a) Personnel and supervisors assigned to actionable process steps 
must receive appropriate training in food defense awareness and their 
respective responsibilities in implementing focused mitigation 
strategies.
    (b) All training received in accordance with this section must be 
documented in records.

Subpart D--Requirements Applying to Records That Must Be 
Established and Maintained


Sec.  121.301  Records subject to the requirements of this subpart D.

    (a) Except as provided by paragraph (b) of this section, all 
records required by subpart C of this part are subject to all 
requirements of this subpart D.
    (b) The requirements of Sec.  121.310 apply only to the written 
food defense plan.


Sec.  121.305  General requirements applying to records.

    Records must:
    (a) Be kept as original records, true copies (such as photocopies, 
pictures, scanned copies, microfilm, microfiche,

[[Page 78061]]

or other accurate reproductions of the original records), or electronic 
records, which must be kept in accordance with part 11 of this chapter;
    (b) Contain the actual values and observations obtained during 
monitoring;
    (c) Be accurate, indelible, and legible;
    (d) Be created concurrently with performance of the activity 
documented;
    (e) Be as detailed as necessary to provide history of work 
performed; and
    (f) Include:
    (1) The name and location of the facility;
    (2) The date and time of the activity documented;
    (3) The signature or initials of the person performing the 
activity; and
    (4) Where appropriate, the identity of the product and the 
production code, if any.


Sec.  121.310  Additional requirements applying to the food defense 
plan.

    The food defense plan must be signed and dated by the owner, 
operator, or agent in charge of the facility:
    (a) Upon initial completion; and
    (b) Upon any modification.


Sec.  121.315  Requirements for record retention.

    (a) All records required by this part must be retained at the 
facility for at least 2 years after the date they were prepared.
    (b) The food defense plan must be retained for at least 2 years 
after its use is discontinued;
    (c) Except for the food defense plan, offsite storage of records is 
permitted after 6 months following the date that the record was made if 
such records can be retrieved and provided onsite within 24 hours of 
request for official review. The food defense plan must remain onsite. 
Electronic records are considered to be onsite if they are accessible 
from an onsite location.
    (d) If the facility is closed for a prolonged period, the records 
may be transferred to some other reasonably accessible location but 
must be returned to the facility within 24 hours for official review 
upon request.


Sec.  121.320  Requirements for official review.

    All records required by this part must be made promptly available 
to a duly authorized representative of the Secretary of Health and 
Human Services upon oral or written request.


Sec.  121.325  Public disclosure.

    Records required by this part will be protected from public 
disclosure to the extent allowable under part 20 of this chapter.

Subpart E--Compliance


Sec.  121.401  Compliance.

    (a) The operation of a facility that manufactures, processes, 
packs, or holds food for sale in the United States if the owner, 
operator, or agent in charge of such facility is required to comply 
with, and is not in compliance with, section 418 of the Federal Food, 
Drug, and Cosmetic Act (21 U.S.C. 350g) or subparts C or D of this part 
is a prohibited act under section 301(uu) of the Federal Food, Drug, 
and Cosmetic Act (21 U.S.C. 331(uu)).
    (b) The failure to comply with section 420 of the Federal Food, 
Drug, and Cosmetic Act (21 U.S.C. 350i) or subparts C or D of this part 
is a prohibited act under section 301(ww) of the Federal Food, Drug, 
and Cosmetic Act.

    Dated: December 13, 2013.
Leslie Kux,
Assistant Commissioner for Policy.
[FR Doc. 2013-30373 Filed 12-20-13; 8:45 am]
BILLING CODE 4160-01-P