[Federal Register Volume 78, Number 247 (Tuesday, December 24, 2013)]
[Proposed Rules]
[Pages 78013-78061]
[FR Doc No: 2013-30373]

Vol. 78

Tuesday,

No. 247

December 24, 2013

Part III

Department of Health and Human Services

-----------------------------------------------------------------------

Food and Drug Administration

-----------------------------------------------------------------------

21 CFR Parts 16 and 121

Focused Mitigation Strategies To Protect Food Against Intentional
Adulteration; Proposed Rule

Federal Register / Vol. 78 , No. 247 / Tuesday, December 24, 2013 /
Proposed Rules

-----------------------------------------------------------------------

DEPARTMENT OF HEALTH AND HUMAN SERVICES

Food and Drug Administration

21 CFR Parts 16 and 121

[Docket No. FDA-2013-N-1425]
RIN 0910-AG63

Focused Mitigation Strategies To Protect Food Against Intentional
Adulteration

AGENCY: Food and Drug Administration, HHS.

ACTION: Proposed rule.

-----------------------------------------------------------------------

SUMMARY: The Food and Drug Administration (FDA or we) is proposing to
require domestic and foreign food facilities that are required to
register under the Federal Food, Drug, and Cosmetic Act (the FD&C Act)
to address hazards that may be intentionally introduced by acts of
terrorism. These food facilities would be required to identify and
implement focused mitigation strategies to significantly minimize or
prevent significant vulnerabilities identified at actionable process
steps in a food operation. FDA is proposing these requirements as part
of our implementation of the FDA Food Safety Modernization Act (FSMA).
Further, as part of the proposal, FDA discusses an approach to
addressing economically motivated intentional adulteration. We expect
the proposed rule, if finalized as proposed, would help to protect food
from intentional adulteration caused by acts of terrorism.

DATES: Submit either electronic or written comments on the proposed
rule by March 31, 2014. Submit comments on information collection
issues under the Paperwork Reduction Act of 1995 by January 23, 2014,
(see the ``Paperwork Reduction Act of 1995'' section of this document).

ADDRESSES: You may submit comments, identified by Docket No. FDA-2013-
N-1425 and/or Regulatory Information Number (RIN) 0910-AG63, by any of
the following methods, except that comments on information collection
issues under the Paperwork Reduction Act of 1995 must be submitted to
the Office of Information and Regulatory Affairs, Office of Management
and Budget (OMB) (see the ``Paperwork Reduction Act of 1995'' section
of this document).

Electronic Submissions

    Submit electronic comments in the following way:
     Federal eRulemaking Portal: http://www.regulations.gov.
Follow the instructions for submitting comments.
    Written Submissions
    Submit written submissions in the following ways:
     Mail/Hand delivery/Courier (for paper or CD-ROM
submissions): Division of Dockets Management (HFA-305), Food and Drug
Administration, 5630 Fishers Lane, rm. 1061, Rockville, MD 20852.
    Instructions: All submissions received must include the Agency name
and Docket No. FDA-2013-N-1425 and Regulatory Information Number (RIN)
0910-AG63 for this rulemaking. All comments received may be posted
without change to http://www.regulations.gov, including any personal
information provided. For additional information on submitting
comments, see the ``Comments'' heading of the SUPPLEMENTARY INFORMATION
section of this document.
    Docket: For access to the docket to read background documents or
comments received, go to http://www.regulations.gov and insert the
docket number, found in brackets in the heading of this document, into
the ``Search'' box and follow the prompts and/or go to the Division of
Dockets Management, 5630 Fishers Lane, rm. 1061, Rockville, MD 20852.

FOR FURTHER INFORMATION CONTACT: Regarding the provisions with respect
to human food: Ryan Newkirk, Center for Food Safety and Applied
Nutrition (HFS-005), Food and Drug Administration, 5100 Paint Branch
Pkwy., College Park, MD 20740,<PHONE_NUMBER>. Regarding the provisions
with respect to food for animals: Alfred Montgomery, Center for
Veterinary Medicine (HFV-200), Food and Drug Administration, 7519
Standish Pl., Rockville, MD 20855,<PHONE_NUMBER>.

SUPPLEMENTARY INFORMATION:

Table of Contents

Executive Summary

    Scope of Coverage of the Proposed Rule
    Summary of the Major Provisions of the Proposed Rule
    Costs and Benefits
I. Introduction
II. Background
    A. Incidents of Intentional Adulteration of Food
    B. Interagency Approach to Food Defense
    C. Resources for the Food Sector
    D. Outreach
    E. Industry Standards
    F. International Food Defense Guidelines
III. Legal Authority
    A. Section 103 of FSMA
    B. Section 106 of FSMA
    C. Intrastate Activities
IV. Regulatory Approach
    A. Framework of the Rule
    B. Activities That Occur on Produce Farms
    C. Transportation Carriers
    D. Food for Animals
    E. Acts of Disgruntled Employees, Consumers, or Competitors
    F. Economically Motivated Adulteration
    G. Low-Risk Activities at Farm Mixed-Type Facilities
    H. Activities That Occur on Dairy Farms
    I. Other Ways To Focus on Foods With a High Risk of Intentional
Adulteration Caused by Terrorism
V. The Proposal
    A. Definitions
    B. Exemptions
    C. Food Defense Measures
    D. Requirements Applying to Records That Must Be Established and
Maintained
    E. Compliance
VI. Preliminary Regulatory Impact Analysis
VII. Analysis of Environmental Impact
VIII. Federalism
IX. Comments
X. References

Executive Summary

    This proposed regulation implements three provisions of the Federal
Food, Drug, and Cosmetic (FD&C) Act, as amended by the FDA Food Safety
Modernization Act (FSMA), that relate to the intentional adulteration
of food. Section 418 of the FD&C Act (21 U.S.C. 350g) addresses
intentional adulteration in the context of facilities that manufacture,
process, pack, or hold food and are required to register under section
415 of the FD&C Act (21 U.S.C. 350d). Section 419 of the FD&C Act (21
U.S.C. 350h) addresses intentional adulteration in the context of
fruits and vegetables that are raw agricultural commodities. Section
420 of the FD&C Act (21 U.S.C. 350i) addresses intentional adulteration
in the context of high risk foods and exempts farms except for farms
that produce milk. FDA is implementing the intentional adulteration
provisions in sections 418, 419, and 420 of the FD&C Act in this
rulemaking.

Scope of Coverage of the Proposed Rule

    The subject of this proposed rule is protection of food against
intentional adulteration caused by acts of terrorism. This proposed
rule would apply to both domestic and foreign facilities that are
required to register under section 415 of the FD&C Act. However, as
explained in the remainder of this document and shown in Diagram 1 and
Table 1, the proposed rule contains several exemptions. (The diagrams
and table below are intended to illustrate the proposed scope and
requirements of this rule, and do not include all aspects of the
proposed regulation.) These exemptions are:
     The proposed rule would not apply to a qualified facility,
except that the

facility would be required to provide for official review, upon
request, documentation that was relied upon to demonstrate that the
facility qualifies for this exemption. As proposed, a qualified
facility would be: (1) A very small business (i.e., a business that has
less than $10,000,000 in total annual sales of food, adjusted for
inflation), or (2) a facility that meets two requirements, i.e., (a)
During the 3-year period preceding the applicable calendar year, the
average annual monetary value of the food manufactured, processed,
packed or held at such facility that is sold directly to qualified end-
users (as defined in this part) during such period exceeded the average
annual monetary value of the food sold by such facility to all other
purchasers; and (b) the average annual monetary value of all food sold
during the 3-year period preceding the applicable calendar year was
less than $500,000, adjusted for inflation.
     This proposed rule would not apply to the holding of food,
except the holding of food in liquid storage tanks.
     This proposed rule would not apply to the packing, re-
packing, labeling, or re-labeling of food where the container that
directly contacts the food remains intact.
     This proposed rule would not apply to activities of a
facility that are subject to section 419 of the Federal Food, Drug, and
Cosmetic Act (Standards for Produce Safety).
     This proposed rule would not apply with respect to
alcoholic beverages at a facility that meets certain conditions.
     This proposed rule would not apply to the manufacturing,
processing, packing, or holding of food for animals other than man.
    We seek comment on these exclusions and whether additional
exclusions are warranted.
BILLING CODE 4160-01-P

[GRAPHIC] [TIFF OMITTED] TP24DE13.026

BILLING CODE 4160-01-C

 Table 1--Scope of Intentional Adulteration and Proposed Exclusions and
                               Exemptions
------------------------------------------------------------------------
                                                    Brief rationale, and
                                 Coverage within          relevant
     Type of intentional      scope of proposed 21      corresponding
        adulteration                 CFR 121         section of the rule
                                                              *
------------------------------------------------------------------------
    I. Types of Intentional Adulteration Considered in this Proposed
                               Rulemaking
------------------------------------------------------------------------
1. Acts of disgruntled        Not within the scope  [ssquf] Not
 employees, consumers, or      of intentional        considered ``high
 competitors intended to       adulteration          risk'' because not
 attack the reputation of a    covered under         intended to cause
 company, and not to cause     proposed 21 CFR 121.  widespread,
 public health harm,                                 significant public
 although public health harm                         health harm.
 may occur.                                         [ssquf] See section
                                                     IV.E of this
                                                     document.
2. Economically motivated     Not within the scope  [ssquf] Considering
 adulteration (EMA) intended   of intentional        addressing as part
 to obtain economic gain,      adulteration          of hazard analysis
 and not to cause public       covered under         in a preventive
 health harm, although         proposed 21 CFR 121.  controls framework
 public health harm may                              where EMA is
 occur.                                              ``reasonably likely
                                                     to occur.''
                                                    [ssquf] See section
                                                     IV.F of this
                                                     document.
3. Acts intended to cause     Covered within        [ssquf] Considered
 massive public health harm,   scope, and is the     ``high risk''
 including acts of terrorism.  focus of proposed     because intent of
                               21 CFR 121.           the act is to cause
                                                     widespread,
                                                     significant public
                                                     health harm.
                                                    [ssquf] See section
                                                     IV.A of this
                                                     document.
------------------------------------------------------------------------
 II. Facilities or Operations Excluded or Exempted from Proposed 21 CFR
                                   121
------------------------------------------------------------------------
    Facility or Operation         Exclusion or      Brief rationale, and
                                Exemption (and any         relevant
                               associated modified      corresponding
                                  requirements)      section of the rule
                                                              *
------------------------------------------------------------------------
Activities that fall within   Excluded............  [ssquf] Activities
 the definition of ``farm''                          that occur on
 (as defined in 21 CFR Sec.                          produce farms are
  1.227).                                            not considered
                                                     ``high risk.''
                                                    [ssquf] Activities
                                                     that occur on dairy
                                                     farms are addressed
                                                     below.
                                                    [ssquf] Activities
                                                     that occur on other
                                                     farms are outside
                                                     the scope of 103,
                                                     105, and 106 of
                                                     FSMA.
                                                    [ssquf] See section
                                                     IV.B of this
                                                     document.
Transportation carriers.....  Excluded............  [ssquf]
                                                     Transportation of
                                                     bulk liquids is
                                                     addressed by
                                                     coverage of
                                                     shippers and
                                                     receivers.
                                                    [ssquf] Other
                                                     transportation
                                                     activities are not
                                                     considered ``high
                                                     risk.''
                                                    [ssquf] See section
                                                     IV.C of this
                                                     document.
------------------------------------------------------------------------
Activities that occur on      [ssquf] Fluid milk storage and loading
 dairy farms.                  appear to pose a significant
                               vulnerability.
                              [ssquf] We seek comment on practical and
                               effective approach to address this
                               vulnerability.
                              [ssquf] See section IV.H of this document.
------------------------------------------------------------------------
Qualified facility, as        Exempt, except must   [ssquf] Very small
 defined in proposed Sec.      provide for FDA       businesses are not
 121.3.                        review, upon          considered ``high
                               request,              risk.''
                               documentation        [ssquf] See section
                               relied on to          V.B.1 of this
                               demonstrate that      document.
                               the facility
                               qualifies for this
                               exemption.
Holding of food, except the   Exempt..............  [ssquf] Not
 holding of food in liquid                           considered ``high
 storage tanks.                                      risk'' because
                                                     these activities do
                                                     not fit within any
                                                     of the FDA-
                                                     identified key
                                                     activity types.
                                                    [ssquf] See section
                                                     V.B.2 of this
                                                     document.
------------------------------------------------------------------------
Packing, re-packing,          Exempt..............  [ssquf] Not
 labeling, or re-labeling of                         considered ``high
 food where the container                            risk'' because
 that directly contacts the                          these activities do
 food remains intact.                                not fit within any
                                                     of the FDA-
                                                     identified key
                                                     activity types.
                                                    [ssquf] See section
                                                     V.B.3 of this
                                                     document.
Activities of a facility      Exempt..............  [ssquf] Activities
 that are subject to                                 that occur on
 Standards for Produce                               produce farms are
 Safety (proposed 21 CFR                             not considered
 112).                                               ``high risk.''
                                                    [ssquf] See section
                                                     V.B.4 of this
                                                     document.
Alcoholic beverages at        Exempt..............  [ssquf] Alcoholic
 certain alcohol-related                             beverages at these
 facilities, and certain                             facilities are
 prepackaged food sold in                            outside the scope
 limited quantities along                            of 103, 105, and
 with alcoholic beverages at                         106 of FSMA.
 the same facilities (see                           [ssquf] See section
 proposed Sec.   121.5(e)).                          V.B.5 of this
                                                     document.
Manufacturing, processing,    Exempt..............  [ssquf] Not
 packing, or holding of food                         considered ``high
 for animals.                                        risk'' because
                                                     unlikely to impact
                                                     human health.
                                                    [ssquf] See section
                                                     V.B.6 of this
                                                     document.
------------------------------------------------------------------------
* Please see the corresponding sections of the rule identified in the
  column for a complete discussion of our analysis, rationale, and
  tentative conclusions related to the proposed exclusions or exemption.

Summary of the Major Provisions of the Proposed Rule

    This proposed rule would establish various food defense measures
that an owner, operator, or agent in charge of a facility would be
required to implement to protect against the intentional adulteration
of food, as summarized in Diagram 2. Specifically:
     Prepare and implement a written food defense plan that
includes actionable process steps, focused mitigation strategies, and
procedures for monitoring, corrective actions, and verification
(proposed Sec.  121.126).
     Identify any actionable process steps, using one of two
procedures. FDA has analyzed vulnerability assessments conducted using
the CARVER+Shock methodology and identified four key activity types:
Bulk liquid receiving and loading; Liquid storage and handling;
Secondary ingredient handling; and Mixing and similar activities. FDA
has determined that the presence of one or more of these key activity
types at a process step (e.g., manufacturing, processing, packing, or
holding of food) indicates a significant vulnerability under section
418 of the FD&C Act and that the food is at high risk of intentional
adulteration caused by acts of terrorism under section 420 of the FD&C
Act. Facilities may identify actionable process steps using the FDA-
identified key activity types as described in proposed Sec.  121.130(a)
or conduct their own facility-specific vulnerability assessments as
provided in proposed Sec.  121.130(b).
     Identify and implement focused mitigation strategies at
each actionable process step to provide assurances that the significant
vulnerability at each step will be significantly minimized or prevented
and the food manufactured, processed, packed, or held by the facility
will not be adulterated (proposed Sec.  121.135).
     Establish and implement procedures, including the
frequency with which they are to be performed, for monitoring the
focused mitigation strategies (proposed Sec.  121.140).
     Establish and implement corrective action procedures that
must be taken if focused mitigation strategies are not properly
implemented (proposed Sec.  121.145).
     Verify that monitoring is being conducted and appropriate
decisions about corrective actions are being made; verify that the
focused mitigation strategies are consistently implemented and are
effectively and significantly minimizing or preventing the significant
vulnerabilities; and conduct a reanalysis of the food defense plan
(proposed Sec.  121.150).
     Ensure that personnel and supervisors assigned to
actionable process steps receive appropriate training in food defense
awareness and their respective responsibilities in implementing focused
mitigation strategies (proposed Sec.  121.160).
     Establish and maintain certain records, including the
written food defense plan; written identification of actionable process
steps and the assessment leading to that identification; written
focused mitigation strategies; written procedures for monitoring,
corrective actions, and verification; and documentation related to
training of personnel (proposed Sec. Sec.  121.301 to 121.325).
    As proposed, the effective date is 60 days after a final rule is
published. However, we are providing for a longer timeline for
facilities to come into compliance. Facilities, other than small and
very small businesses, would have one year after the effective date to
comply with proposed part 121. Small businesses (i.e., those employing
fewer than 500 persons) would have 2 years after the effective date to
comply with proposed part 121. Very small businesses (i.e., businesses
that have less than $10,000,000 in total annual sales of food, adjusted
for inflation) would be considered a qualified facility and would have
3 years after the effective date to comply with proposed Sec.
121.5(a).
BILLING CODE 4160-01-P

[GRAPHIC] [TIFF OMITTED] TP24DE13.027

BILLING CODE 4160-01-C

    In addition, we describe our current thinking and seek comment on
other issues, including activities that occur on dairy farms and
economically motivated adulteration. Finally, elsewhere in this issue
of the Federal Register, FDA is publishing for comment its evaluation
that identifies low-risk activities that occur at farm mixed-type
facilities, with a specific focus on the risk presented by hazards that
may be intentionally introduced by acts of terrorism.

Costs and Benefits

    As described in the Preliminary Regulatory Impact Analysis (PRIA),
we estimate the annualized costs of the actions required by this
proposed rule to be about $370 million. The benefits of these actions
are a reduction in the possibility of illness, death, and economic
disruption resulting from intentional adulteration of food. We are
unable to quantify these benefits. However, we monetize the damage that
various intentional adulteration scenarios might cause, and present a
breakeven analysis showing the number of prevented attacks at which the
benefits are larger than the costs.

                  Annualized Cost and Benefit Overview
------------------------------------------------------------------------
    All numbers are USD millions,
      annualized over 10 years           3% discount       7% discount
------------------------------------------------------------------------
Costs:
    Learning about Rule.............                $3                $3
    Mitigation Costs................                59                63
    Monitoring and Corrective Action               100               100
    Employee Training...............                 4                 5
    Documentation...................                 6                 6
                                     -----------------------------------
        Subtotal (Domestic cost)....               172               177
    Cost to Foreign Firms...........               185               190
                                     -----------------------------------
        Total.......................               357               367
                                     -----------------------------------
Benefits: Lower Chance of
 Intentional Adulteration...........             Unquantified.
------------------------------------------------------------------------

I. Introduction

    The FDA Food Safety Modernization Act (FSMA) (Pub. L. 111-353),
signed into law on January 4, 2011, enables FDA to better protect
public health by helping to ensure the safety and security of the food
supply. FSMA enables us to focus more on preventing food safety
problems rather than primarily reacting to problems after they occur.
The law also provides us with new enforcement authorities to help us
achieve higher rates of compliance with prevention- and risk-based
safety standards and to better respond to and contain problems when
they do occur. In addition, the law gives us important new tools to
better ensure the safety of imported foods and directs us to build an
integrated national food safety system in partnership with State,
local, tribal, and territorial authorities.
    Section 103 of FSMA directs FDA to issue regulations establishing
requirements for facilities that manufacture, process, pack or hold
food and requires facilities to consider hazards that may be
intentionally introduced, including by acts of terrorism. Section 106
of FSMA requires FDA to issue regulations to protect food for which
there is a high risk of intentional contamination and for which such
intentional contamination could cause serious adverse health
consequences or death to humans or animals. In addition, section 105 of
FSMA directs FDA to issue regulations setting forth science-based
minimum standards for the safe production and harvesting of produce,
and requires that the rulemaking consider hazards that may be
intentionally introduced, including by acts of terrorism.
    Efforts to protect against intentional adulteration require a shift
in perspective from that applied to traditional food safety. In
proposed rules entitled ``Current Good Manufacturing Practice and
Hazard Analysis and Risk-Based Preventive Controls for Human Food'' (78
FR 3646, January 16, 2013) (Docket No. FDA-2011-N-0920; hereafter
referred to as ``the PC proposed rule''), ``Current Good Manufacturing
Practice and Hazard Analysis and Risk-Based Preventive Controls for
Food for Animals'' (78 FR 64736, October 29, 2013) (Docket No. FDA-
2011-N-0922; hereafter referred to as ``the Animal Food PC proposed
rule''), and ``Standards for the Growing, Harvesting, Packing and
Holding of Produce for Human Consumption'' (78 FR 3504, January 16,
2013) (Docket No. FDA-2011-N-0921; hereafter referred to as ``the
Produce Safety proposed rule''), FDA tentatively decided not to include
requirements to address ``hazards that may be intentionally introduced,
including by acts of terrorism'' (sections 418(b)(2) and 419(a)(3)(C)
of the FD&C Act (21 U.S.C. 350g(b)(2) and 350h(a)(3)(C))) and to
implement sections 103 and 105 of FSMA regarding such hazards in a
separate rulemaking (this proposed rule). As noted in those proposed
rules, FDA tentatively concluded that intentional adulteration, which
is not addressed by traditional Hazard Analysis and Critical Controls
Point (HACCP) or other food safety systems, likely will require
different kinds of controls. FDA is taking the action described in this
proposed rule to implement the intentional adulteration provisions in
sections 103, 105, and 106 of FSMA.

II. Background

    Intentional adulteration of the food supply can result in
catastrophic public health consequences, widespread public fear, loss
of public confidence in the safety of food and the ability of
government to ensure food safety, and significant adverse economic
impacts, including disruption of trade (Ref. 1, Ref. 2, Ref. 3, Ref.
4). Acts of intentional adulteration may take several forms, including
acts of terrorism; acts of disgruntled employees, consumers, or
competitors; and economically motivated adulteration. Acts of terrorism
are associated with an intent to cause massive public health harm and,
to a lesser extent, economic disruption (Ref. 5, Ref. 2, Ref. 3, Ref.
6). Acts of disgruntled employees, consumers, or competitors are
generally understood to be directed at attacking the reputation of the
company and not at public health harm. The primary purpose of
economically motivated adulteration is to obtain economic gain, and not
to impact public health (Ref. 7, Ref. 8, Ref. 9), although public
health harm may occur (Ref. 10, Ref. 11).

    ``Food defense'' and ``food security'' are terms that are sometimes
used interchangeably. We use the term ``food defense'' to refer to the
effort to protect food from acts of intentional adulteration where
there is an intent to cause public health harm and economic disruption.
``Food security'' is defined by the World Health Organization (WHO) to
mean ``when all people at all times have access to sufficient, safe,
nutritious food to maintain a healthy and active life'' (Ref. 12). To
avoid confusion, we use the term ``food defense'' and not the term
``food security'' in the context of intentional adulteration.

A. Incidents of Intentional Adulteration of Food

    Several cases of intentional adulteration with the intent to cause
public health harm and economic disruption in the United States have
been documented. For example, in 1984, in an attempt to prevent the
general public from voting in the local elections, members of a local
religious commune in The Dalles, OR, intentionally contaminated food in
restaurants with Salmonella. A total of 751 people became ill and 45
were hospitalized (Ref. 4). In another incident, in 1996, 12 laboratory
workers at a large medical facility in Texas became ill from consuming
anonymously donated pastries that were intentionally contaminated with
Shigella dysenteriae type 2, which was later discovered to have
originated from the facility's stock culture (Ref. 13). In 2009, two
related incidents resulted in 49 individuals reporting rapid and acute
onset of gastrointestinal and neurological symptoms after eating meals
at a restaurant in Lenexa, KS. Investigations concluded that the
illnesses were caused by methomyl (an insecticide) poisoning associated
with the consumption of salsa at the restaurant. Two former employees
of the restaurant were found guilty of intentionally contaminating the
salsa (Ref. 14).
    A widespread incident of economically motivated adulteration
occurred in China in 2008. Some Chinese milk firms added melamine, a
nitrogen-rich industrial by-product, to diluted dairy products to
increase the apparent protein content. This adulteration resulted in
significant public health consequences, with more than 290,000 ill
infants and 6 deaths in China. In addition, this incident caused
significant economic disruption within the Chinese dairy industry, with
estimates approaching $3 billion in loss to industry (Ref. 10, Ref.
11).

B. Interagency Approach to Food Defense

1. Homeland Security Presidential Directives and Presidential Policy
Directives for the Food and Agriculture Sector
    Intelligence gathered since the attacks on the United States on
September 11, 2001, indicates that terrorist organizations have
discussed contamination of the food supply as a means to harm U.S.
citizens and disrupt the global economy (Ref. 15). In response, FDA,
along with the Centers for Disease Control and Prevention (CDC), the
United States Department of Agriculture (USDA), the Department of
Homeland Security (DHS), the Federal Bureau of Investigation (FBI), the
Environmental Protection Agency (EPA), the Department of Defense, the
Department of Energy, the Department of Commerce, and the Department of
the Interior, as well as with State, local, tribal, territorial, and
private sector partners have coordinated efforts to prevent, prepare
for, and respond to threats against the food supply. Many of these
efforts were accomplished in accordance with applicable Homeland
Security Presidential Directives (HSPD), specifically HSPD-7, HSPD-8,
and HSPD-9, and Presidential Policy Directives (PPD), specifically PPD-
8 and PPD-21 (Ref. 16, Ref. 17, Ref. 18, Ref. 19, Ref. 20). In
accordance with these directives, FDA, USDA, DHS, State and local
governments and the food industry collaborated to conduct vulnerability
assessments of a variety of products and processes within the food and
agriculture sector.
2. The Evolution of Vulnerability Assessments
    Initially, FDA used Operational Risk Management (ORM), which is a
vulnerability assessment methodology that uses a six-step sequence of
identifying hazards and reducing the potential for negative public
health consequences. The ORM process resulted in three main outcomes:
(1) A calculation of risk by combining assessments of severity and
probability of an attack on a specific food; (2) calculations for
specific contaminants and specific food processes or related
activities; and (3) a categorization of specific food/contaminant/food
process or related activity into a high, medium, or low risk scheme.
    At first, ORM-based assessments were focused on reducing large
public health consequences of attacks on the food supply. FDA realized
that other significant considerations (i.e., large economic
disruptions, public alarm, loss of confidence in the food supply, and
interruption of the food stream) warranted incorporation into the
vulnerability assessment calculus. To incorporate these considerations,
FDA and USDA's Food Safety and Inspection Service (FSIS) adapted a
military targeting tool known as CARVER to assess vulnerabilities of
the food and agriculture sector. CARVER is an acronym for the following
six attributes used to evaluate the attractiveness of a target for
attack:
     Criticality--measure of public health and economic impacts
of an attack;
     Accessibility--ability to physically access and egress
from target;
     Recuperability--ability of a system to recover from an
attack;
     Vulnerability--ease of accomplishing an attack;
     Effect--amount of direct loss from an attack as measured
by loss in production; and
     Recognizability--ease of identifying a target.
    A seventh attribute, ``Shock'', was added to the original six
attributes to assess the combined health, economic, and psychological
impacts of an attack on the food industry. ORM and CARVER+Shock
assessment conclusions were consistent; however, the CARVER+Shock
methodology improved vulnerability assessment efforts because its
process allowed for the identification and estimation of economic and
psychological impacts throughout the food system.
    In 2005, the Strategic Partnership Program Agroterrorism (SPPA), a
public-private cooperative effort was established by FDA, USDA, FBI,
and DHS, in partnership with State and industry partners. The intent of
the SPPA Initiative was to collect the necessary data to identify food
and agriculture sector-specific vulnerabilities using the CARVER+Shock
method, develop mitigation strategies, identify research gaps, and
increase coordination between government and industry partners. The
SPPA initiative ran from 2005 to 2008, resulting in vulnerability
assessments of 36 food products and processes (Ref. 21). The SPPA
Initiative was a significant step towards identifying vulnerabilities,
mitigation strategies, and research needs within the food and
agriculture industries. This initiative also provided Federal, State,
and local government agencies with an in-depth look at the
vulnerabilities that may be associated with the food and agriculture
industry, and helped enhance communication among industry, government,
and law enforcement

stakeholders concerned with the protection of the U.S. food supply.
Since the conclusion of the SPPA Initiative, we have conducted
additional vulnerability assessments, which continue to help inform our
research and policy.

C. Resources for the Food Sector

    FDA has issued guidance documents and developed other resources to
assist industry in their efforts to protect the food supply against
intentional adulteration. In 2003, FDA issued five guidance documents
covering food defense preventive measures for various segments of the
food and cosmetic industry: (1) Guidance for Industry: Food Producers,
Processors, and Transporters: Food Security Preventive Measures
Guidance (Ref. 22); (2) Guidance for Industry: Importers and Filers:
Food Security Preventive Measures Guidance (Ref. 23); (3) Guidance for
Industry: Dairy Farms, Bulk Milk Transporters, Bulk Milk Transfer
Stations and Fluid Milk Processors: Food Security Preventive Measures
Guidance (Ref. 24); (4) Retail Food Stores and Food Service
Establishments: Food Security Preventive Measures Guidance (Ref. 25);
and(5) Cosmetics Processors and Transporters of Cosmetics Security
Preventive Measures Guidance (Ref. 26). These guidance documents
provide FDA's recommendations for best practices in food defense, and
describe preventive measures that establishments can take to minimize
the risk of intentional adulteration of food. We updated the guidance
documents in 2007 to include a self-assessment tool that guides the
user through an assessment of recommended preventive measures to
identify those most applicable to the facility.
    FDA also has made available other resources to help industry
identify and mitigate potential vulnerabilities for intentional
adulteration. These include:
     The ``ALERT'' program,
     The ``Employees FIRST'' training tool,
     The ``CARVER+Shock Vulnerability Assessment'' software
tool,
     The ``Mitigations Strategies Database,''
     The ``Food Defense Plan Builder'' software tool,
     The Food Related Emergency Exercise Bundle, and
     The ``Food Defense 101'' training courses.
    We describe each briefly in this section of the document.
    The ALERT program, originally released in 2006, is an educational
program intended to raise the awareness of State and local governments
and industry regarding food defense (Ref. 27). ALERT identifies five
key elements that industry can use in food defense planning:
     A--How do you ASSURE that the supplies and ingredients you
use are from safe and secure sources?
     L--How do you LOOK after the security of the products and
ingredients in your facility?
     E--What do you know about your EMPLOYEES and people coming
in and out of your facility?
     R--Could you provide REPORTS about the security of your
products while under your control?
     T--What do you do and who do you notify if you have a
THREAT or issue at your facility, including suspicious behavior?
    Similarly, the Employees FIRST educational tool, originally
released in 2008, is a food defense awareness training program for
front-line food industry workers about the risk of intentional
adulteration and the actions they can take to identify and reduce these
risks (Ref. 28). This tool identifies the following five key elements:
     F--Follow company food defense plan and procedures;
     I--Inspect your work area and surrounding areas;
     R--Recognize anything out of the ordinary;
     S--Secure all ingredients, supplies, and finished product;
and
     T--Tell management if you notice anything unusual or
suspicious.
    The CARVER+Shock Vulnerability Assessment software tool, originally
released in 2007, helps users conduct vulnerability assessments for
their establishments to identify and prioritize the ``critical nodes,''
(also known as critical process steps) the potential targets vulnerable
to intentional adulteration attacks (Ref. 29). It guides users through
a series of questions to determine the vulnerability of each of the
nodes within their facility. After the vulnerabilities are identified,
the software helps users to identify mitigation strategies for reducing
the risk of intentional adulteration. Using the software tool, the user
can focus resources on protecting the most susceptible points in their
system.
    The Mitigation Strategies Database (MSD), originally released in
2011, is a database of mitigation strategies that can be applied to
different steps in a food operation to reduce the risk of intentional
adulteration (Ref. 30). The database is searchable by key words and
processing steps common to agriculture and food operations (e.g.,
growing, harvesting, packing, manufacturing, processing, and holding).
See also the discussion in section V.C.3 of this document.
    The Food Defense Plan Builder (FDPB) software tool, released in
2013, is a user-friendly computer software program designed to assist
owners and operators of food facilities in developing food defense
plans for their facilities (Ref. 31). In addition to providing new
functionality for food defense planning and implementation, the FDPB
software tool harnesses our food defense guidance documents,
CARVER+Shock Vulnerability Assessment software tool, and the MSD into a
single application.
    The Food Related Emergency Exercise Bundle (FREE-B), which FDA
released in 2011 and developed in collaboration with CDC and FSIS and
USDA's Animal and Plant Health Inspection Service (APHIS), is a
compilation of scenarios based on both intentional and unintentional
food contamination events. The FREE-B is designed to assist the food
industry, government regulatory agencies, and public health
organizations in assessing existing food emergency response plans,
protocols, and procedures (Ref. 32). The FREE-B tool is designed to
allow an individual agency or industry entity to test its own plans,
protocols, and procedures independently. Additionally, the tool allows
multiple jurisdictions and organizations (e.g., medical community,
private sector, law enforcement, and first responder communities) to
jointly conduct exercises. The tool is a set of five scenarios, each of
which contains a Facilitator's Guide, a Lead Planner's guide, and a
Situation Manual.
    Finally, our food defense training courses, entitled ``Food Defense
101'' and released in 2013, reflect FDA's current thinking on how to
minimize the likelihood and impact of incidents of intentional
adulteration (Ref. 27). Four courses integrated into one module
include: (1) Food Defense Awareness for Professionals, (2) Food Defense
Awareness for Frontline Employees, (3) FDA Regulations, and (4) ALERT
for owners and operators of food facilities. The ALERT program is
described previously. The other programs are described in section V.C.7
of this document.

D. Outreach

    We have conducted food defense awareness outreach to international
and domestic stakeholders. Beginning in 2008, under the auspices of the
Asia-Pacific Economic Cooperation (APEC), we collaborated with the U.S.
Department of State, USDA's Foreign Agricultural Service, and FSIS to
launch the Food Defense Pilot Program for the

APEC member countries. The Pilot Program was developed with the intent
to implement the food defense principles endorsed by the APEC Counter
Terrorism Task Force. The goal of the program was to build and foster
global capacity to prevent and protect against deliberate tampering and
intentional contamination of the food supply through information
sharing, outreach, and technical assistance on food defense, thereby
safeguarding food trade and public health across the APEC member
countries. In addition, to support the international capacity building
goals of FSMA, we conducted several workshops in various countries to
discuss topics such as increasing food defense awareness, developing
food defense plans, conducting vulnerability assessments, and
implementing mitigation strategies.
    In 2013, we increased our domestic outreach activities with a
series of workshops in the United States. Using a similar format and
agenda as the international workshops, we conducted 1-day food defense
awareness workshops to provide industry, State and local governments,
and academic partners with information on food defense, and share tools
and resources. During these workshops, we shared information on how to
use the new FDPB software tool to develop a comprehensive food defense
plan. These workshops also served as a forum to discuss food defense
concerns, understand industry's current practices, and share ideas for
collaboration to better protect the food supply against intentional
adulteration. We plan to continue to hold additional workshops in 2014.

E. Industry Standards

    Guidelines accompanying industry standards in the United States
have addressed intentional adulteration of food. For example, the
Global Food Safety Initiative's (GFSI) Guidance Document Sixth Edition
(Ref. 33) addresses food defense. Some organizations that own and
manage industry standards have worked or are working to incorporate
food defense requirements into their standards to meet this GFSI
guideline. For example, the Safe Quality Foods (SQF) Code, edition 7.1,
issued in 2013, is a process and product certification standard that
specifies various food defense elements, including that the methods,
responsibility, and criteria for preventing food adulteration caused by
a deliberate act of sabotage or terrorist-like incident shall be
documented, implemented and maintained (Ref. 34). Another example of
industry standards that incorporate food defense elements is the
International Featured Standards (IFS) Food Version 6 Standard, which
specifies that areas critical to security be identified, food defense
hazard analysis and assessment of associated risks be conducted
annually or upon changes that affect food integrity, and an appropriate
alert system be defined and periodically tested for effectiveness (Ref.
35).

F. International Food Defense Guidelines

    In 2008, WHO issued its ``Terrorist Threats to Food--Guidelines for
Establishing and Strengthening Prevention and Response Systems'' to
provide policy guidance to its Member States for integrating
consideration of deliberate acts of sabotage of food into existing
prevention and response programs (Ref. 6). WHO uses the term ``food
terrorism'' and defines it as ``an act or threat of deliberate
contamination of food for human consumption with biological, chemical
and physical agents or radionuclear materials for the purpose of
causing injury or death to civilian populations and/or disrupting
social, economic or political stability.'' Focusing on the two key
strategies of prevention and response, WHO recommends that all segments
of the food industry consider the development of security and response
plans for their establishments, proportional to the threat and their
resources. The guidelines state that the key to preventing food
terrorism is enhancing existing food safety programs and implementing
reasonable security measures on the basis of vulnerability assessments.
The guidelines further state that the most vulnerable foods, food
ingredients, and food processes should be identified, including: the
most readily accessible food processes; foods that are most vulnerable
to undetected tampering; foods that are the most widely disseminated or
spread; and the least supervised food production areas and processes.
    Other national governments, including Australia, China, France,
Germany, and the United Kingdom, also have issued guidelines to assist
their food industry stakeholders in protecting food against intentional
adulteration (Ref. 5, Ref. 36, Ref. 37, Ref. 38, Ref. 39).

III. Legal Authority

    FDA is proposing this regulation under the FD&C Act as amended by
FSMA. Under sections 103 and 106 of FSMA, FDA is proposing the
requirements applicable to the owner, operator, or agent in charge of a
facility required to register under section 415 of the FD&C Act. Under
section 106 of FSMA, FDA is proposing the requirements applicable to
activities at some facilities not covered by section 103 of FSMA (i.e.,
activities subject to and in compliance with the juice and seafood
HACCP regulations in parts 120 and 123 (21 CFR parts 120 and 123) and
the manufacturing, processing, packing, or holding of a dietary
supplement in compliance with certain requirements). Under section
701(a) of the FD&C Act (21 U.S.C. 371(a)), FDA is authorized to issue
regulations for the efficient enforcement of the FD&C Act.

A. Section 103 of FSMA

    Section 103 of FSMA, Hazard Analysis and Risk-Based Preventive
Controls, amends the FD&C Act to create a new section 418 that mandates
rulemaking. Section 418(n)(1)(A) of the FD&C Act requires that the
Secretary of Health and Human Services issue regulations ``to establish
science-based minimum standards for conducting a hazard analysis,
documenting hazards, implementing preventive controls, and documenting
the implementation of the preventive controls . . ..'' Section
418(n)(1)(B) of the FD&C Act requires that the regulations define the
terms ``small business'' and ``very small business,'' taking into
consideration the study of the food processing sector required by
section 418(l)(5) of the FD&C Act. Further, section 103(e) of FSMA
creates a new section 301(uu) in the FD&C Act (21 U.S.C. 331(uu)) to
prohibit ``[t]he operation of a facility that manufactures, processes,
packs, or holds food for sale in the United States if the owner,
operator, or agent in charge of such facility is not in compliance with
section 418 [of the FD&C Act].''
    In addition to rulemaking requirements, section 418 of the FD&C Act
contains requirements applicable to the owner, operator, or agent in
charge of a facility required to register under section 415 of the FD&C
Act. Section 418(a) of the FD&C Act is a general provision that
requires the owner, operator, or agent in charge of a facility to
evaluate the hazards that could affect food manufactured, processed,
packed, or held by the facility, identify and implement preventive
controls, monitor the performance of those controls, and maintain
records of the monitoring. In addition to the general requirements in
section 418(a) of the FD&C Act, sections 418(b) to (i) of the FD&C Act
contain more specific requirements applicable to facilities, including
several provisions explicitly directed at intentional adulteration. For
example, section 418(b)(2) of the FD&C Act specifies that the owner,
operator, or

agent in charge of a facility shall identify and evaluate hazards that
may be intentionally introduced, including by acts of terrorism.
Section 418(c)(2) of the FD&C Act specifies that the owner, operator,
or agent in charge of a facility shall identify and implement
preventive controls to provide assurances that any hazards that relate
to intentional adulteration will be significantly minimized or
prevented and addressed, consistent with section 420 of the FD&C Act.
In sections IV and V of this document, we discuss proposed requirements
(proposed subparts C and D of part 121) that would implement these
provisions of section 418 of the FD&C Act.
    Sections 418(j) to (m) of the FD&C Act and sections 103(c)(1)(D)
and (g) of FSMA provide authority for certain exemptions and
modifications to the requirements of section 418 of the FD&C Act. These
include provisions related to seafood and juice HACCP, and low-acid
canned food (section 418(j) of the FD&C Act); activities of facilities
subject to section 419 of the FD&C Act (Standards for Produce Safety)
(section 418(k)); qualified facilities (section 418(l)); facilities
that are solely engaged in the production of food for animals other
than man, the storage of raw agricultural commodities (other than
fruits and vegetables) intended for further distribution or processing,
or the storage of packaged foods that are not exposed to the
environment (section 418(m)); facilities engaged only in certain low-
risk on-farm activities on certain foods conducted by small or very
small businesses (section 103(c)(1)(D) of FSMA), and dietary
supplements (section 103(g) of FSMA). In sections IV and V of this
document, we discuss the related proposed provisions that would
implement these provisions of section 418 of the FD&C Act and section
103 of FSMA.

B. Section 106 of FSMA

    Section 106 of FSMA, Protection Against Intentional Adulteration,
amends the FD&C Act to create a new section 420, which mandates
rulemaking. Section 420 of the FD&C Act requires FDA to issue
regulations to protect against the intentional adulteration of food.
Section 420(b)(1) of the FD&C Act requires that such regulations are to
specify how a person is to assess whether the person is required to
implement mitigation strategies or measures intended to protect against
the intentional adulteration of food. Section 420(b)(2) of the FD&C Act
requires that the regulations specify appropriate science--based
mitigation strategies or measures to prepare and protect the food
supply chain at specific vulnerable points, as appropriate. Section
420(c) of the FD&C Act provides that such regulations are to apply only
to food for which there is a high risk of intentional adulteration and
for which such intentional adulteration could cause serious adverse
health consequences or death to humans or animals. Section 420(c)(1)
provides that such foods are to include those for which FDA has
identified clear vulnerabilities. Section 420(d) of the FD&C Act limits
applicability on farms to farms that produce milk. Further, section
106(d) of FSMA creates a new section 301(ww) in the FD&C Act to
prohibit ``[t]he failure to comply with section 420 [of the FD&C
Act].'' We are proposing all of the provisions under section 420 of the
FD&C Act.

C. Intrastate Activities

    FDA tentatively concludes that the provisions in the proposed rule
should be applicable to activities that are intrastate in character.
Facilities are required to register under section 415 of the FD&C Act
regardless of whether the food from the facility enters interstate
commerce (Sec.  1.225(b)). The plain language of section 418 of the
FD&C Act applies to facilities that are required to register under
section 415 of the FD&C Act (section 418(o)(2)) and does not exclude a
facility because food from such a facility is not in interstate
commerce. Similarly, the plain language of section 420 of the FD&C Act
requires FDA to issue regulations to protect against the intentional
adulteration of food and does not include a limitation to interstate
commerce. Further, the prohibited act provisions in sections 301(uu)
and (ww) of the FD&C Act (21 U.S.C. 331(uu) and (ww)) do not require an
interstate commerce nexus. Notably, other subsections in section 301 of
the FD&C Act, and section 304 of the FD&C Act (21 U.S.C. 334)
demonstrate that Congress has included a specific interstate commerce
nexus in the provisions of the FD&C Act when that is its intent.
Accordingly, it is reasonable to interpret sections 418, 420, 301(uu)
and (ww) of the FD&C Act as not limiting the application of the
proposed rule only to those facilities with a direct connection to
interstate commerce. However, we seek comment on this interpretation
and potential alternatives.

IV. Regulatory Approach

A. Framework of the Rule

    This proposed regulation implements three provisions of FSMA that
relate to the intentional adulteration of food. Section 103 of FSMA
addresses intentional adulteration in the context of facilities that
manufacture, process, pack, or hold food and are required to register
under section 415 of the FD&C Act. Section 105 of FSMA addresses
intentional adulteration in the context of fruits and vegetables that
are raw agricultural commodities. Section 106 of FSMA addresses
intentional adulteration in the context of high risk foods and exempts
farms except for farms that produce milk.
1. Scope of Intentional Adulteration Covered by this Rule
    As noted in section I of this document, acts of intentional
adulteration may take several forms, including: (1) Acts of terrorism;
(2) acts of disgruntled employees, consumers, or competitors; and (3)
economically motivated adulteration. With regard to intentional
adulteration from acts of terrorism, we are proposing to require
certain facilities covered by this rule to address significant
vulnerabilities by implementing focused mitigation strategies at
actionable process steps. While we refer to the protection of the food
supply from ``acts of terrorism'' throughout this rule, we expect our
proposed approach and the proposed implementation of focused mitigation
strategies would generally address acts intended to cause massive
public health harm and, to a lesser extent, economic disruption,
whether committed by terrorists, terrorist organizations, individuals,
or groups of individuals. For the reasons described in section IV.E of
this document, we have tentatively concluded not to propose additional
requirements for the protection of food against intentional
adulteration caused by acts of disgruntled employees, consumers, or
competitors. We describe our approach to address economically motivated
adulteration in section IV.F of this document, and seek comment on our
current thinking on this issue.
2. Identification of Key Activity Types
    Terrorist attacks on the U.S. food supply have been exceedingly
rare. However, vulnerability assessments performed by FDA, USDA, DHS,
and FBI, under the SPPA Initiative (Ref. 21), show that an attack could
have devastating public health and economic consequences. Because such
an attack is a low probability but potentially exceedingly high
consequence event, we have tentatively determined that requirements
should focus on those facilities and process steps within those
facilities that pose the greatest risk. To

assess this risk, FDA and USDA, in collaboration with DHS, FBI, and
State and local government and industry partners, performed
vulnerability assessments using the CARVER+Shock methodology. This
methodology is specifically tailored to assess the risk of a terrorist
attack and is different from an assessment of risk posed by food safety
hazards (i.e., unintentional adulteration).
    As discussed in section V.C.2 of this document, based on an
analysis of the vulnerability assessments that FDA has conducted using
the CARVER+Shock methodology, we have identified four key activity
types: Bulk liquid receiving and loading; Liquid storage and handling;
Secondary ingredient handling; and Mixing and similar activities. FDA
has tentatively determined that the presence of one or more of these
key activity types at a process step (e.g., manufacturing, processing,
packing, or holding of food) indicates a significant vulnerability
under section 418 of the FD&C Act and that the food is at high risk of
intentional adulteration caused by acts of terrorism under section 420
of the FD&C Act. We seek comment on the inclusion of these key activity
types.
    Designation of these key activity types would serve two purposes.
First, it would provide a facility with a means to assess whether it is
required to implement focused mitigation strategies or measures
intended to protect against intentional adulteration under section
420(b)(1) of the FD&C Act. Second, it would assist a facility subject
to section 418 of the FD&C Act with the performance of a hazard
analysis to identify and evaluate hazards that may be intentionally
introduced by acts of terrorism, in accordance with section 418(b)(2).
    Facilities would be able to determine whether their operations
involve one or more of the key activity types or choose to perform a
vulnerability assessment. Our experience is that the most challenging
part of developing a system of controls for intentional adulteration
related to terrorism is identifying the points in the food operation
that are most vulnerable to attack by performing a vulnerability
assessment. By using the FDA-identified key activity types, facilities
would be able to concentrate their efforts on the identification of
appropriate focused mitigation strategies and the development and
implementation of the HACCP-type system for ensuring that those
strategies are consistently and effectively implemented.
3. Requirement for a HACCP-Type System of Controls
    We have tentatively concluded that a preventive controls approach
like the one we proposed for the systematic control of food safety
hazards in the PC proposed rule is the most effective means of ensuring
that the focused mitigation strategies are consistently applied once
the significant vulnerabilities are identified and appropriate focused
mitigation strategies are developed. The evolution and advantages of
this system, derived from the HACCP methodology, is discussed in detail
in section II.C of the PC proposed rule. The application of HACCP-type
controls for ensuring the implementation of food defense mitigation
strategies is consistent with the approach taken in Publicly Available
Specification (PAS) 96, developed by the Centre for the Protection of
National Infrastructure in collaboration with the British Standards
Institution, entitled ``The Threat Assessment Critical Control Point
(TACCP) Approach'' (Ref. 5). It is also consistent with WHO
recommendations on protection against intentional adulteration (Ref.
6). We request comment on the appropriateness of a HACCP-type system to
ensure that mitigation strategies designed to significantly minimize or
prevent intentional adulteration related to terrorism and whether there
are approaches that would be more suitable.
    Section 418 of the FD&C Act exempts several kinds of activities
(e.g., those related to seafood, juice, dietary supplements, low-acid
canned food [for certain microbiological hazards]). These activities
are subject to preventive control-type regulations that address food
safety, but not food defense, concerns. Section 420 of the FD&C Act
instructs FDA to issue regulations to require that science-based
mitigation strategies or measures be applied to foods that are at high
risk of intentional adulteration. The exemptions set out in section 418
of the FD&C Act are not applicable to the provisions of section 420 of
the FD&C Act. We also have tentatively determined that some activities
that are not subject to section 418 of the FD&C Act that involve
manufacturing, processing, packing, or holding of food are likely to
involve one of the key activity types (e.g., juice manufacturing,
breaded seafood manufacturing, and mixing activity in a low-acid canned
food process). Based on our tentative conclusion that the HACCP-type
system in section 418 of the FD&C Act is generally appropriate for
application to intentional adulteration related to terrorism, this same
system would be required for these activities. Applying the same
regulatory framework under sections 418 and 420 of the FD&C Act would
facilitate a concise and consistent approach to protection against
intentional adulteration of food and the efficient enforcement of the
requirements. Further, this approach would be consistent with the
approach for unintentional adulteration that many of these facilities
(those subject to section 418 of the FD&C Act relative to the control
of food safety hazards) would already be required to take for
unintentional hazards under the PC proposed rule.
    We acknowledge that regulation of entities in the food production
system (in this case, facilities) to reduce the risk of intentional
adulteration of food caused by acts of terrorism is, essentially,
without precedent. Such an endeavor is further complicated by the low
probability and potentially high impact nature of such an attack which
makes estimating potential public health benefits and establishing an
appropriate threshold for requiring action difficult. We are further
challenged by the paucity of data on the extent to which facilities
have already implemented programs to mitigate this risk, and the
effectiveness of various strategies to prevent intentional adulteration
of food caused by acts of terrorism.
    In developing this proposed rule we have relied on our experience
in both implementing preventive control schemes targeting unintentional
food safety hazards as well as working with the U.S. intelligence
community on the threat of a terrorist attack on the food and
agriculture sector, including performing vulnerability assessments and
developing guidance for industry. While these activities have provided
us with a useful foundation on which to develop this proposed rule, the
challenges described previously remain. We request comment on our
proposed approach, including on the following issues:
     From which entities would implementation of measures to
protect against intentional adulteration derive the greatest benefit to
public health protection? How could this proposed regulation be
modified to better target such entities?
     Would it be feasible to require measures to protect
against intentional adulteration only in the event of a credible
threat? If so, would such an approach be consistent with the
intentional adulteration provisions of FSMA? How would such
requirements

be communicated to industry in a timely and actionable manner?
     What is an appropriate level of public health protection
with respect to intentional adulteration, considering the intentional
adulteration provisions of FSMA?
     Are there other ways to further focus the scope of the
rule (see also section IV.I of this document)?
4. Compliance Dates
    Section 103(i)(1) of FSMA, General Rule, provides that ``[t]he
amendments made by this section shall take effect 18 months after the
date of enactment'' (i.e., by July 4, 2012). Section 103(i)(2) of FSMA,
Flexibility for Small Businesses, provides that ``[n]otwithstanding
paragraph (1),'' the amendments made by this section ``shall apply'' to
a small business and very small business beginning on the date that are
6 months and 18 months, respectively, ``after the effective date'' of
FDA's final regulation. Section 106 of FSMA does not contain similar
language. FDA is implementing the amendments made by sections 103 and
106 of FSMA to the FD&C Act, as they relate to intentional
adulteration, through this rulemaking.
    We have tentatively concluded that it is appropriate to provide a
sufficient time period following publication of the final regulation
for facilities to come into compliance with proposed part 121. FDA
recognizes that it can take time to develop and implement a food
defense plan that would require, among other things, identification of
actionable process steps, implementation of focused mitigation
strategies, and monitoring of focused mitigation strategies.
    FDA is proposing that the final rule would be effective 60 days
after publication in the Federal Register, with staggered compliance
dates, consistent with the proposed effective dates in the PC proposed
rule and Produce Safety proposed rule. Similarly, we recognize that
businesses of all sizes may need more time to comply with the new
requirements established under FSMA. As noted in section VII of the PC
proposed rule, FDA believes that it is reasonable to allow for 1 year
after the date of publication of the final rule for businesses other
than small and very small businesses to come into compliance with the
new requirements established under FSMA. FDA also believes that it is
reasonable to allow for 2 years after the date of publication of the
final rule for small businesses to come into compliance with the new
requirements established under FSMA, and 3 years after the date of
publication of the final rule for very small businesses to come into
compliance with the new requirements established under FSMA.
    Therefore, as proposed, facilities, other than small and very small
businesses, that are subject to part 121 would have 1 year after the
effective date to comply with proposed part 121. Small businesses would
have 2 years after the effective date to comply with proposed part 121
(see section V.A of this document for a discussion of the proposed
definition of a ``small business''). With respect to very small
businesses, we are proposing to exempt qualified facilities, which
include very small businesses, from the requirements of proposed part
121, except that such facilities must, upon request, provide for
official review documentation that was relied upon to demonstrate that
the facility meets this exemption. Very small businesses then would
have 3 years after the effective date to comply with proposed Sec.
121.5(a). FDA intends to work closely with the food industry, extension
and education organizations, and State partners to develop any
necessary additional tools and training programs needed to facilitate
implementation of this rule.

B. Activities That Occur on Produce Farms

    Section 419 of the FD&C Act requires FDA to issue regulations to
establish science-based minimum standards for the safe production and
harvesting of fruits and vegetables. In developing these regulations,
the Act requires us to consider, among others, those hazards that may
be intentionally introduced, including by acts of terrorism (section
419(a)(3)(C) and (c)(1)(A) of the FD&C Act). Note that neither section
418 of the FD&C Act nor section 420 of the FD&C Act apply to these
activities. Section 420 of the FD&C Act specifically exempts farms,
except those that produce milk, and section 418 of the FD&C Act exempts
activities of facilities subject to section 419 of the FD&C Act.
    In implementing section 419 of the FD&C Act, we considered the
risks posed by a terrorist attack on the kinds of activities that occur
on produce farms. We considered those activities that fall within the
definition of ``farm'' (as defined in 21 CFR 1.227) (e.g., planting,
tilling, irrigating, treating with pesticides, harvesting, drying for
purposes of storing or transporting, hydro-cooling, packing,
refrigerating, waxing, shelling, sifting, removing leaves, stems and
husks, culling, shelling, and washing). We utilized data gathered from
vulnerability assessments that we conducted employing the CARVER+Shock
methodology, and evaluated whether activities that occur on produce
farms pose significant vulnerabilities (Ref. 40).
    Our evaluation found that activities that are typically performed
on produce farms are at relatively low risk for intentional
adulteration of food from acts of terrorism (Ref. 40). Based on this
evaluation, we have tentatively concluded that requirements for produce
farms are not necessary to minimize the risk of serious adverse health
consequences or death from this type of adulteration. Further, we have
tentatively concluded that requirements relating to this form of
adulteration are not reasonably necessary to prevent the introduction
of known or reasonably foreseeable hazards and to provide reasonable
assurances that the produce is not adulterated under section 402 of the
FD&C Act. For these reasons, we are not proposing requirements for
produce farms to specifically address intentional adulteration related
to terrorism. We seek comment on this tentative conclusion and our
analysis that informed this tentative decision.
    We acknowledge that there may be activities that occur on produce
farms for which we are not proposing requirements that are similar to
off-farm activities for which we are proposing to require the
implementation of focused mitigation strategies. However, there are
aspects of the specific on-farm activities that minimize the risk for
intentional adulteration caused by acts of terrorism. For example,
waxing is an on-farm activity that is similar to coating and that fits
within one of the key activity types. However, there are key
differences that make an on-farm waxing operation less vulnerable
compared to a coating operation. With waxing, there is difficulty of
mixing a contaminant into a clear, heated wax in a tank in close
proximity to the busy packing line in an on-farm packing house.
Conversely, a coating operation involves an opaque, ambient or
refrigerated, aqueous coating mix in a tank and occurs in a relatively
isolated part of the manufacturing plant. In addition, the uncertainty
about whether the produce leaving the farm is destined for direct
consumption or for further processing, such as removal of the wax,
which could inactivate or remove any contaminant intentionally added,
makes it a relatively less likely target for intentional adulteration.

C. Transportation Carriers

    One of the key activity types that we have tentatively determined
indicates a significant vulnerability to intentional adulteration
caused by acts of terrorism

is Bulk liquid receiving and loading. As proposed, receiving and
loading of other types of foods (e.g., non-bulk liquids, solid foods,
gaseous foods) are not identified as key activity types because we
determined that they do not present this same level of risk. By
requiring that shippers and receivers of bulk liquids implement focused
mitigation strategies at actionable process steps involving this key
activity, as proposed in Sec.  121.135(a), we expect that shippers and
receivers will institute focused mitigation strategies that will
significantly minimize or prevent the potential for intention
adulteration of these foods during transportation. Such mitigation
strategies may include sealing or locking outbound conveyances of bulk
liquid, or requiring that inbound conveyances be sealed or locked as a
condition of receipt of the bulk liquid. Where such measures are
implemented by the shippers and receivers of bulk liquids, we have
tentatively concluded that the food would be sufficiently protected
from intentional adulteration caused by acts of terrorism, and that no
further actions by a carrier would be needed to ensure the safety of
the food. For this reason, we are not proposing to cover transportation
carriers in this proposed rule. We request comment on our analysis of
this issue, and our tentative conclusion.
    Note that FDA will issue a proposed rule in the near future related
to transportation carriers and sanitary transportation practices.

D. Food for Animals

    As discussed in section V.B.6 of this document, we are proposing to
exempt the manufacturing, processing, packing, and holding of animal
food from this proposed regulation with respect to intentional
adulteration caused by acts of terrorism.

E. Acts of Disgruntled Employees, Consumers, or Competitors

    While the goals and outcomes of acts of disgruntled employees,
consumers or competitors can overlap with acts of terrorism, generally,
the distinction has to do with differences in scale. Disgruntled
employees are generally understood to be interested primarily in
attacking the reputation of the company, and otherwise have little
interest in public health harm. On the other hand, terrorist
organizations are generally understood to be interested in maximizing
public health harm and, to a lesser extent, economic disruption (Ref.
5, Ref. 6).
    Section 420(c) of the FD&C Act requires that the regulation
prepared under that section apply to ``food for which there is a high
risk of intentional contamination.'' In the spectrum of risk associated
with intentional adulteration of food, attacks perpetrated by terrorist
organizations intent on causing massive casualties and, to a lesser
extent, economic disruption would be ranked as relatively high risk. On
the other hand, attacks by disgruntled employees, consumers, or
competitors would be consistently ranked as relatively low risk;
although these events occur annually, their public health and economic
impact would be generally quite small. In general, the target food and
the point in its production are those of convenience (i.e., a point to
which the employee, consumer, or competitor has ready access). Should a
disgruntled employee, consumer, or competitor choose to attack at an
actionable process step, where the adverse public health and economic
consequences could be greater, the provisions of this proposed rule
would be effective in minimizing the opportunity for success. Actions
taken to mitigate the potential for a terrorist attack against the food
supply are likely to have collateral benefits in reducing the potential
for an attack by a disgruntled employee, consumer, or competitor (as
well as on other security related issues, such as theft and vandalism).
As a practical matter, hardening the food supply (i.e., reducing the
opportunity for attack) to attacks by disgruntled employees, consumers,
or competitors could require taking steps at many more points in the
food system than would be required to harden the food supply to
minimize the potential for terrorist attack. We have tentatively
concluded that the latter can be accomplished by focusing on those
points in the food system where an attack would be expected to cause
massive adverse public health impact, and, to a lesser extent, economic
disruption.

F. Economically Motivated Adulteration

    Efforts to protect against intentional adulteration require a shift
in perspective from that applied to traditional food safety. In the PC,
Animal Food PC, and Produce Safety proposed rules, we tentatively
concluded that hazards associated with intentional adulteration, which
are not addressed in traditional HACCP or other food safety systems,
likely will require different kinds of controls, and would be best
addressed in a separate rulemaking (this proposed rule). However, we
also explained how in some circumstances economically motivated
adulteration could be viewed as reasonably likely to occur. Further, we
requested comment on where to address those hazards that may be
intentionally introduced for economic gain. After additional
consideration, we present our current thinking in this section of the
document.
    For facilities subject to section 418 of the FD&C Act, we have
tentatively concluded that economically motivated adulteration would be
best addressed under the regulatory regime described in the PC and
Animal Food PC proposed rules and thus best addressed in those
rulemakings. Before we decide to finalize provisions on economically
motivated adulteration in the PC and Animal Food PC final rules, FDA
plans to provide new language and an analysis of costs associated with
these provisions, and seek comment. Under this approach, the owner,
operator, or agent in charge of a covered facility would be required to
perform a hazard analysis to identify those hazards related to
economically motivated adulteration that are reasonably likely to
occur. Economically motivated adulteration could be reasonably likely
to occur, for example, when obtaining certain ingredients from a
country in which economically motivated adulteration has occurred in
those ingredients in the past. Because of past incidents regarding the
addition of melamine to certain food products apparently to enhance
perceived quality and/or protein content, even if there is no known
history regarding the specific supplier or the specific food product, a
prudent person would implement preventive controls to address the
potential presence of this hazard in a food. The goal of the
perpetrator of economically motivated adulteration is for the
adulterant to be undetected in the product, so that the perpetrator can
continue to obtain the desired economic benefits (Ref. 7, Ref. 9).
Accordingly, unlike with acts of terrorism, such occurrences of
economic adulteration are expected to be long term, and would not be
appropriately viewed as a rare occurrence, but rather as reasonably
likely to occur.
    We have tentatively concluded that this hazard-analysis type
approach is better suited to address economically motivated
adulteration than the vulnerability assessment-type approach we are
proposing to address intentional adulteration related to terrorism. In
the latter approach, which we are not proposing, significant
vulnerabilities would be identified based either on the presence of key
activity types (which reflect FDA-conducted vulnerability assessments)
or facility-specific vulnerability assessments. Under a vulnerability
assessment-type approach,

the assessment would need to consider the degree to which a food is a
likely target for economically motivated adulteration based on the
attributes of the food (such as the nature of the food, its production
system, and its supply chain) and the capabilities of a perpetrator
(such as availability and access to adulterants that can be readily
disguised and undetected by currently accepted testing methods).
Factors to consider could include previous occurrences of economically
motivated adulteration; a highly complex supply chain; sudden changes
in commodity prices; known inadequacies in identification and assay
testing methods for potential adulterants; a highly complex and
variable food ingredient; the widespread availability of a potential
adulterant; the lack of organoleptic properties of a potential
adulterant; the high cost or scarcity of an ingredient; and variation
in the value of a food based on variations in levels of a high value
attribute of that food. The nature of economically motivated
adulteration makes it difficult to identify all relevant factors to be
considered in a vulnerability assessment to predict when novel events
of economic adulteration are expected to occur. Moreover, predictive
tools such as CARVER+Shock are not currently configured to assess the
risk of economically motivated adulteration, nor have extensive
vulnerability assessments for economically motivated adulteration in
food products been conducted by FDA or others. Therefore, we believe
the most appropriate framework to assess the risk of economically
motivated adulteration is to consider whether it is reasonably likely
to occur (such as whether it has occurred under similar circumstances
with some regularity in the past) as part of a hazard analysis.
    Under this approach, facilities subject to section 418 of the FD&C
Act would be expected to implement controls against economically
motivated adulteration under circumstances where there has been a
pattern of such adulteration in the past, even though the past
occurrences may not be associated with the specific supplier or the
specific food product but the pattern suggests a potential for
intentional adulteration. Further, a system of monitoring, corrective
action, verification, and recordkeeping that is similar to those in the
PC and Animal Food PC proposed rules would be appropriate for
economically motivated adulteration. In addition, the elements of a
preventive control system, including hazard analysis, preventive
controls, monitoring, corrective actions, verification, and
recordkeeping would be documented in a food safety plan that would
include control of economically motivated adulteration. We believe that
addressing both of these potential sources for contamination within the
same framework is likely to streamline requirements and reduce costs to
industry.
    We seek comment on our tentative conclusions presented above.
Specifically, we are interested in information on the specific factors
that are most relevant for determining whether economically motivated
adulteration is reasonably likely to occur, particularly in instances
where the specific product or supplier has not been previously
associated with such adulteration. In addition, we seek comment on
whether and how these relevant factors may be used to develop
appropriate predictive tools or establish a standard for when
preventive controls are necessary.
    Section 418 of the FD&C Act contains certain exemptions related to
compliance with FDA's seafood and juice HACCP regulations and with
regard to manufacturing, processing, packing or holding dietary
supplements that are in compliance with the requirements of sections
402(g)(2) and 761 of the FD&C Act. Section 420 of the FD&C Act does not
contain these exemptions and requires FDA to issue regulations to
protect against the intentional adulteration of food. Seafood and juice
are currently subject to HACCP-type regulations in Sec. Sec.  123 and
120, respectively, and our current thinking is that under section 420
economically motivated adulteration could be addressed through the
existing frameworks for these foods. Under this option, FDA would amend
the seafood and juice HACCP regulations to specify that economically
motivated adulteration is a hazard that must be considered in a hazard
analysis of these foods, and addressed in a HACCP plan. For example,
for seafood, we could propose to add ``economically motivated
adulteration that could result in serious adverse health consequences
or death'' to the list of hazards to be considered in a hazard analysis
in accordance with Sec.  123.6(c)(1). Similarly, for juice we could
propose to add ``economically motivated adulteration that could result
in serious adverse health consequences or death'' to the list of
hazards to be considered in a hazard analysis in accordance with Sec.
120.7(c). Also under this option, FDA would consider proposing to amend
part 111 (21 CFR part 111), the Dietary Supplements current good
manufacturing practice (CGMP) rule, to include economically motivated
adulteration that could result in serious adverse health consequences
or death. Current Sec.  111.70(b) and (c) require establishing
component specifications and in-process specifications to ensure the
identity, purity, strength, and composition of the dietary supplement,
and we could amend these provisions to cover economically motivated
adulteration that could result in serious adverse health consequences
or death.
    We have also tentatively concluded not to require produce farms
subject to section 419 of the FD&C Act and farms that produce milk
(also referred to in this document as ``dairy farms'') subject to
section 420 of the FD&C Act to take measures to address economically
motivated adulteration. With regard to produce farms subject to section
419 of the FD&C Act, we have tentatively concluded that there are not
procedures, processes, or practices that are reasonably necessary to be
implemented by these entities to prevent the introduction of known or
reasonably foreseeable biological, chemical, or physical hazards that
can cause serious adverse health consequences or death as a result of
economically motivated adulteration. With regard to farms that produce
milk subject to section 420 of the FD&C Act, we have tentatively
concluded that there are not appropriate science-based strategies or
measures intended to protect against economically motivated
adulteration that can be applied at the farm. These tentative
conclusions are based on our assessment that preventive controls for
economically motivated adulteration are suitable to address such
adulteration when it is perpetrated by the entity's supplier, but not
when it is perpetrated by the entity itself, as would be the case for
economically motivated adulteration at a produce farm or a farm that
produces milk. Actions such as auditing of suppliers or reliance upon
supplier-supplied test results or production control records are
generally considered unsuitable to address economically motivated
adulteration where the supplier, if intentionally adulterating the
food, would already be violating the law and would be able to subvert
these controls. For both types of farms, we are not aware of inputs
into the growing, harvesting, packing, or holding of produce or milk
(i.e., within our farm definition) that could be subject to
economically motivated adulteration that could cause serious adverse
health consequences or death under sections 419 and 420 of the FD&C
Act. We seek comment on this tentative conclusion.

G. Low-Risk Activities at Farm Mixed-Type Facilities

    Section 103(c)(1)(C) of FSMA directs the Secretary of Health and
Human Services to conduct a science-based risk analysis as part of the
section 103(c) rulemaking. The science-based risk analysis is to cover
``(i) specific types of on-farm packing or holding of food that is not
grown, raised, or consumed on such farm or another farm under the same
ownership, as such packing and holding relates to specific foods; and
(ii) specific on-farm manufacturing and processing activities as such
activities relate to specific foods that are not consumed on that farm
or on another farm under common ownership.'' In section VIII.G of the
PC proposed rule, we describe a draft Qualitative Risk Assessment (the
draft RA) we performed to satisfy this requirement. Section
103(c)(1)(D)(i) of FSMA requires FDA to use the results of this
analysis to establish exemptions and inspection frequencies, or modify
requirements, for facilities engaged only in specific types of on-farm
activities that FDA determines to be low risk.
    Elsewhere in this issue of the Federal Register, FDA is publishing
a notice announcing the availability for public comment Appendix 4 to
the draft RA (the draft RA Appendix). The purpose of the draft RA
Appendix is to provide a science-based risk analysis of those foods
whose production processes would be considered low risk with respect to
the risk of intentional adulteration caused by acts of terrorism. FDA
conducted this evaluation to satisfy the requirement in Section
103(c)(1)(C) of FSMA to conduct a science-based risk analysis with
respect to the risk of intentional adulteration caused by acts of
terrorism. We evaluated the production processes for the types of
finished foods we expect are produced at farm mixed-type facilities to
determine whether or not they are low-risk with respect to hazards that
may be intentionally introduced by acts of terrorism. For the purposes
of this analysis, we evaluated whether a production process involved
any of the four FDA-identified key activity types, and identified a
production process that did not involve any of the four key activity
types as a ``low risk production process.'' Based on this evaluation,
we concluded that the production processes for the following finished
foods are ``low-risk'':
     Eggs (In-Shell)
     Fruits & Vegetables Other Than Pods, Seeds for Direct
Consumption, and Hesperidia (Fresh, Intact)
     Game Meats (Whole or Cut, Not Ground or Shredded, Without
Secondary Ingredients)
     Peanuts & Tree Nuts (Raw, In-Shell)
     Sugarcane & Sugar Beets (Fresh, Intact)
    We are considering the results of this analysis in determining any
specific exemptions or modified requirements. We request comment on
whether we should exempt on-farm manufacturing, processing, packing, or
holding of the foods identified as having low-risk production practices
when conducted by a small or very small business if such activities are
the only activities conducted by the business that are subject to
section 418 of the FD&C Act. If we were to take this approach, only
facilities meeting all of the specified criteria would be exempt as a
result of being engaged in low-risk activities. Thus, a facility
located on-farm, that is a small or very small business, and only
produces fresh, intact apples as a finished product (e.g., by packing
apples grown on a different farm that is under different ownership)
would be exempt from this proposed rule. On the other hand, an apple-
packing facility that is off-farm would not be exempt, an apple packing
facility that is on-farm but that is not a small or very small business
would not be exempt, and an apple packing facility that also packs
green beans would not be exempt. We request comment on whether we
should broaden this potential exemption in any way, such as by removing
certain of the restrictions mentioned immediately above. We also seek
comment on whether we should instead establish modified requirements
for facilities that produce foods identified as having low-risk
production processes, and if so, what those modified requirements
should be and the scope of application of the modified requirements. In
addition, we seek comment on whether and how we should consider the
results of this analysis in determining whether to exempt or modify the
inspections frequency requirements under Section 421 of the FD&C Act,
Targeting of Inspection Resources for Domestic Facilities.

H. Activities That Occur on Dairy Farms

1. Assessment of Vulnerabilities
    Under section 420 of the FD&C Act, we considered whether activities
that occur on farms that produce milk pose a high risk for intentional
adulteration of food caused by acts of terrorism that could cause
significant adverse health consequences or death. A preliminary
evaluation indicates that fluid milk storage appears to fit within the
key activity type, Liquid storage and handling, and fluid milk loading
appears to fit within the key activity type, Bulk liquid receiving and
holding. The fluid milk storage tank is one of the actionable process
steps that would be applicable to both of these activities on a dairy
farm.
    As discussed in section V.C.2 of this document, FDA is proposing to
require that the owner, operator, or agent in charge of a facility that
has one or more of the FDA-identified key activity types identify
actionable process steps for those key activity types and implement
focused mitigation strategies at any actionable process steps. Because
dairy farms generally are not facilities as defined in this rule, they
would not be subject to this requirement. However, section 420 is
applicable to dairy farms (see Sec.  420(d)) and fluid milk storage and
loading in a dairy farm operation appear to pose a significant
vulnerability.
    The risk posed by intentional adulteration of milk on-farm results
from a number of factors: (1) The system of milk collection from farms
and subsequent holding and processing serves to distribute contaminants
added to the milk on the farm into much larger quantities of fluid
milk, increasing the potential magnitude of an intentional adulteration
event; (2) in its fluid form milk has a short shelf life, increasing
the potential for significant adverse public health impacts before
detection and, once detected, before a public health intervention can
be implemented; (3) fluid milk is widely consumed across different sub-
populations, including infants and children, increasing the potential
for significant adverse public health impacts and, because of public
reaction to child and infant morbidity and mortality, decreasing public
confidence in the food supply; (4) fluid milk is consumed in a variety
of food forms, including as a beverage (finished food) and as an
ingredient in other finished foods, complicating public health
intervention; and (5) milk storage tanks are commonly left unlocked
(Ref. 41, Ref. 42, Ref. 43, Ref. 44, Ref. 45, Ref. 46, Ref. 47).
2. Mitigation Strategies
    Farms are not subject to the HACCP-type system of preventive
controls prescribed in section 418 of the FD&C Act, and our current
thinking is that, should we include requirements relative to dairy
farms in the final rule, we would not require HACCP-type controls for
dairy farms under section 420 of the FD&C Act. Similarly, under section
419 of the FD&C Act we did not propose to apply such an approach to
unintentional adulteration on produce

farms in the Produce Safety proposed rule (see section IV.D of the
Produce Safety proposed rule). Rather, as with produce farms, a more
appropriate approach might be a CGMP-type provision that relates
directly to the significant vulnerability. Generally, CGMPs set out
mandatory, broad, generally applicable practices and conditions that
are required to be met, and the criteria and definitions that are
applicable in determining whether the food is adulterated. For example,
a CGMP approach would identify the broad, generally applicable
mitigation strategies that dairy farm operators must implement (e.g.,
limiting access to fluid milk storage tanks), without specifying how
that strategy must be accomplished and without a further requirement
for monitoring, recordkeeping or the development of a plan. We seek
comment on this approach.
    FDA previously provided guidance for the dairy industry, including
dairy farms, on the potential for intentional contamination and
identified the types of food defense measures that dairy farms may take
to minimize the risk that fluid milk under their control will be
subject to tampering or other malicious, criminal, or terrorist actions
(Ref. 24). Among other recommendations, FDA's guidance recommends
``limiting access'' to raw and pasteurized milk storage as a food
defense preventive measure. We acknowledge the difficulties involved in
limiting access to many dairy farms, including multiple entries to the
milk house, multiple visitors with customary access to the milk house
(e.g., State food safety inspectors, vendors delivering veterinary
medications, and drivers collecting bulk milk for transport to
processing and storage facilities); continuous milk piping from the
milking parlor to the bulk milk tank, providing for access points to
the bulk milk tank from outside the milk house; open access to the
milking parlor for workers and cows; and automated milking operations
where employees are not necessarily present to escort cows into the
milking parlor.
    In light of these circumstances, we request comment on whether and
how access to the bulk milk storage tank and associated systems can be
limited, and the costs and other implications of doing so. In addition,
we are interested in comment on whether and what types of focused
mitigation strategies or other measures are currently employed by dairy
farms. Specifically for fluid milk storage tanks, we seek comment on
whether and what focused mitigation strategies would be appropriate and
feasible given current dairy farming practices.
    We also seek comment on whether it would be more appropriate for
FDA to require that dairy farm operators receive food defense awareness
training rather than requiring that they implement focused mitigation
strategies to limit access to certain steps of their operation. If you
support an approach based on training rather than mandated focused
mitigation strategies, we are further interested in how such an
approach would work at those farms where an agent of the farm may not
be present at all times, given that a system based on awareness
training is premised on the assumption that such training would provide
the operator with the tools to report and respond to suspicious
activity that they observe.
3. Scope of Dairy Farms Subject to any Requirement
    Finally, we seek comment on the scope of farms that produce milk
that should be subject to any requirements that we may establish in a
final rule. For example, the scope of dairy farms covered could be
determined based on the potential for adverse public health outcome
resulting from consumption of milk produced at a farm, if a contaminant
were intentionally introduced into the milk from that farm. Farms with
less than 50 milk-producing cows contribute a relatively small
proportion to the total volume of milk produced in the United States
(i.e., approximately 4.2 percent of total milk produced in the United
States), and the current trend in the dairy farm industry toward
consolidation (Ref. 48) likely further reduces the percentage of
production that such farms will contribute in the future. However, milk
from even very small dairy farms may be pooled with milk from other
farms in raw milk storage tanks at milk processing and storage
facilities, potentially resulting in a public health impact from
intentional adulteration that is disproportionate to the size of the
farm or its contribution to the milk supply. We request comment on the
appropriateness of determining the scope of dairy farms covered based
on the number of cows on a farm. Alternatively, should we consider
excluding farms based on how the milk from a farm is distributed (e.g.,
direct sale to consumers or other end users; pooling with milk from
other farms; supplied to the Grade A Milk system for the production of
fluid milk; or used in the production of cheese and other products that
have a different risk associated with intentional adulteration caused
by acts of terrorism)?

I. Other Ways to Focus on Foods With a High Risk of Intentional
Adulteration Caused by Terrorism

    We are requesting comment on whether, under section 420 of the FD&C
Act, there are other ways in which the coverage of this proposed
regulation can be further focused on foods that present a high risk of
intentional adulteration caused by acts of terrorism. For example, are
there ways in which a food's shelf life, turnover in the marketplace,
batch size, serving size and servings per batch, distribution and
consumption patterns, and intended consumer could be considered in
providing for an exemption or in setting modified requirements for that
food. Ordinarily, these considerations are part of a vulnerability
assessment, and in such assessments the risk reduction aspects of one
attribute may be offset or exacerbated by those of another attribute,
and may be very facility-specific. Such attributes specific to the
food(s) manufactured, processed, packed, or held at the facility can be
taken into account, should a facility choose to perform its own
vulnerability assessment and assign actionable process steps, as
provided for in proposed Sec.  121.130(b). However, as discussed in
section V.C.2 of this document, facilities would not be required to
perform a facility-specific vulnerability assessment and, instead,
would have the option of identifying actionable process steps using the
procedure in proposed Sec.  121.130(a). We are particularly interested
in how food-specific attributes can be taken into account in the
absence of a general requirement for a facility-specific vulnerability
assessment.

V. The Proposal

A. Definitions

    In subpart A of proposed part 121, under Sec.  121.3, FDA is
proposing the following definitions and interpretations of terms
relevant to proposed part 121. The definitions and interpretations of
terms in section 201 of the FD&C Act (21 U.S.C. 321) are applicable to
such terms when used in this part. As proposed, several terms in part
121 have the same definitions as in proposed part 117 and, therefore,
we have not included an extensive discussion of those terms in this
proposed rule. See section X.B of the PC proposed rule for a discussion
of the following terms: facility, farm, holding, manufacturing/
processing, mixed-type facility, packing, qualified end-user, qualified
facility, and small business.
    FDA is proposing to define the term ``actionable process step'' to
mean a

point, step, or procedure in a food process at which food defense
measures can be applied and are essential to prevent or eliminate a
significant vulnerability or reduce such vulnerability to an acceptable
level. The term ``actionable process step'' used in the food defense
context is analogous to the term ``critical control point'' (CCP),
which is defined as ``a point, step, or procedure in a food process at
which control can be applied and is essential to prevent or eliminate a
food safety hazard or reduce such hazard to an acceptable level.''
Similar to a CCP, in proposed part 121, an ``actionable process step''
is identified during a vulnerability assessment (analogous to a hazard
analysis) in relation to a significant vulnerability (analogous to a
hazard that is reasonably likely to occur), and is facility-specific.
    As discussed in section V.C.2 of this document, based on
vulnerability assessments, FDA has identified four key activity types
that we have tentatively concluded pose significant vulnerabilities in
a food operation. FDA identified and described these key activity types
(which are not facility-specific) with the expectation that an owner,
operator, or agent in charge would objectively determine whether the
processing steps in a facility fit within one or more of these key
activity types. The processing steps identified by facilities in their
food operation that fit within the FDA-identified key activity types
are ``actionable process steps,'' and are steps at which a focused
mitigation strategy would be employed to prevent or eliminate a
significant vulnerability or reduce it to an acceptable level.
Actionable process steps might also be identified in a vulnerability
assessment (proposed Sec.  121.130(b)). Though we use the term
``actionable process step'' in FDA's FDPB software tool (Ref. 31), we
recognize it is a relatively new term and, therefore, we solicit
comment on its appropriateness and any other more appropriate
alternative terms.
    FDA is proposing to define the term ``contaminant'' as any
biological, chemical, physical or radiological agent that may be
intentionally added to food and that may cause illness, injury or
death. We based the proposed definition, in part, on the definition of
``contaminant'' used in Codex Alimentarius guidelines (Ref. 49) that
refers to any biological or chemical agent, foreign matter or other
substances not intentionally added to feed or food that may compromise
feed and food safety or suitability. In this proposal, the term
``contaminant'' is used in the context of key activity types, which are
related to intentional acts of adulteration caused by acts of terrorism
with intent to cause public health harm and, to a lesser extent,
economic disruption. Therefore, for the purposes of proposed part 121,
we focused the definition of ``contaminant'' on agents that may be
intentionally added to food and that may cause illness, injury, or
death, which is consistent with our determination that the primary goal
of such an attack would be public health harm (i.e., illness, injury,
or death). Our proposed definition of ``contaminant'' in proposed 121.3
would be applicable to proposed part 121 only. We acknowledge that this
term has a broader meaning in other settings, as evidenced by its use
in the Codex Alimentarius guidelines.
    FDA is proposing to define the term ``facility'' to mean a domestic
facility or a foreign facility that is required to register under
section 415 of the FD&C Act in accordance with the requirements of part
1, subpart H (21 CFR part 1, subpart H). The proposed definition would
incorporate the definition in section 418(o)(2) of the FD&C Act.
    FDA is proposing to define the term ``farm'' by reference to the
definition of that term in proposed Sec.  1.227. We are proposing to
cross-reference the definition of ``farm'' rather than to define it in
proposed part 121 because the definition of ``farm,'' under both
current Sec.  1.227(b)(3) and proposed Sec.  1.227, includes the word
``facility'' with a meaning that is broader than the meaning of
``facility'' in section 418(o)(2) of the FD&C Act. Under part 1,
subpart H, the term ``facility'' is not limited to entities that are
required to register under section 415 of the FD&C Act. We are
proposing to cross-reference the definition to reduce the potential
confusion that could result if we used the term ``facility'' to have
two different meanings within proposed part 121. See sections X.B and
VIII of the PC proposed rule for additional information.
    FDA is proposing to define the term ``focused mitigation
strategies'' to mean those risk-based, reasonably appropriate measures
that a person knowledgeable about food defense would employ to
significantly minimize or prevent significant vulnerabilities
identified at actionable process steps, and that are consistent with
the current scientific understanding of food defense at the time of the
analysis. The term ``focused mitigation strategies'' used in the food
defense context is analogous to the term ``preventive controls'' in a
HACCP-type framework for food safety.
    As discussed in section V.C.3 of this document, a mitigation
strategy is a measure taken by a facility to reduce the potential for
intentional adulteration of food. A ``focused mitigation strategy'' is
such a strategy applied in response to the identification of a
significant vulnerability and at an actionable process step. Focused
mitigation strategies are customized to the processing step at which
they are applied, tailored to existing facility practices and
procedures, and depend on an evaluation of the vulnerabilities
identified in a facility. Because they are applied in response to a
significant vulnerability, we have determined that focused mitigation
strategies are essential to ensure that appropriate action is taken to
protect the food from intentional adulteration caused by acts of
terrorism.
    While an option to perform a vulnerability assessment is provided
under proposed Sec.  121.130(b), facilities may choose instead to rely
on the analysis performed by FDA that resulted in the identification of
the key activity types listed in proposed Sec.  121.130(a) when
identifying actionable process steps and, subsequently, focused
mitigation strategies, eliminating the need for a full vulnerability
assessment. See section V.C.3 of this document for examples of focused
mitigation strategies.
    FDA is proposing to define the term ``food defense'' as the effort
to protect food from intentional acts of adulteration where there is an
intent to cause public health harm and economic disruption. As
discussed in section IV.A of this document, acts of intentional
adulteration may take several forms, including acts of terrorism; acts
of disgruntled employees, consumers, or competitors; and economically
motivated adulteration. We are proposing to define the term ``food
defense'' to refer to the sum of actions and activities (including
identification of actionable process steps; implementation of focused
mitigation strategies; monitoring, corrective actions, verification,
and training activities) taken to protect food from intentional acts of
adulteration related to terrorism.
    FDA is proposing to define the term ``holding'' to mean the storage
of food. The proposed definition would also state that holding
facilities include warehouses, cold storage facilities, storage silos,
grain elevators, and liquid storage tanks; and that, for farms and farm
mixed-type facilities, holding also includes activities traditionally
performed by farms for the safe or effective storage of raw
agricultural commodities grown or raised on the same farm or another
farm under the

same ownership, but does not include activities that transform a raw
agricultural commodity, as defined in section 201(r) of the FD&C Act,
into a processed food as defined in section 201(gg) of the FD&C Act.
For consistency of terminology, we are proposing the same definition of
``holding'' as in the PC proposed rule (see proposed Sec. Sec.  1.227
and 117.3). For a detailed discussion of ``holding,'' see sections
VIII.E and X.B of the PC proposed rule.
    FDA is proposing to define the term ``manufacturing/processing'' to
mean making food from one or more ingredients, or synthesizing,
preparing, treating, modifying or manipulating food, including food
crops or ingredients. The proposed definition would also state that
examples of manufacturing/processing activities are cutting, peeling,
trimming, washing, waxing, eviscerating, rendering, cooking, baking,
freezing, cooling, pasteurizing, homogenizing, mixing, formulating,
bottling, milling, grinding, extracting juice, distilling, labeling, or
packaging. The proposed definition would also specify that, for farms
and farm mixed-type facilities, manufacturing/processing does not
include activities that are part of harvesting, packing, or holding.
For consistency of terminology, we are proposing the same definition of
``manufacturing/processing'' as in the PC proposed rule (see proposed
Sec. Sec.  1.227 and 117.3). For a detailed discussion of
``manufacturing/processing,'' see sections VIII.E and X.B of the PC
proposed rule.
    FDA is proposing to define the term ``mixed-type facility'' to mean
an establishment that engages in both activities that are exempt from
registration under section 415 of the FD&C Act and activities that
require the establishment to be registered. The proposed definition
would also state that an example of such a facility is a ``farm mixed-
type facility,'' which is an establishment that grows and harvests
crops or raises animals and may conduct other activities within the
farm definition, but also conducts activities that require the
establishment to be registered. For consistency of terminology, we are
proposing the same definition of ``mixed-type facility'' as in the PC
proposed rule (see proposed Sec. Sec.  1.227 and 117.3). For a detailed
discussion of ``mixed-type facilities,'' see sections VIII.E and X.B of
the PC proposed rule.
    FDA is proposing to define the term ``monitor'' to mean to conduct
a planned sequence of observations or measurements to assess whether
focused mitigation strategies are consistently applied and to produce
an accurate record for use in verification. In the intentional
adulteration framework, monitoring would be performed to ensure that
focused mitigation strategies are consistently applied and to provide a
record for use in verifying consistent application.
    FDA is proposing to define the term ``packing'' to mean placing
food into a container other than packaging the food. The proposed
definition would also specify that, for farms and farm mixed-type
facilities, packing also includes activities traditionally performed by
farms to prepare raw agricultural commodities grown or raised on the
same farm or another farm under the same ownership for storage and
transport, but does not include activities that transform a raw
agricultural commodity, as defined in section 201(r) of the FD&C Act,
into a processed food as defined in section 201(gg). We are proposing
to use the same definition of ``packing'' as in the PC proposed rule
(see proposed Sec. Sec.  1.227 and 117.3). For a detailed discussion of
``packing,'' see sections VIII.E and X.B of the PC proposed rule.
    FDA is proposing to define the term ``qualified end-user'' to mean,
with respect to a food, the consumer of the food (where the term
consumer does not include a business); or a restaurant or retail food
establishment (as those terms are defined in Sec.  1.227) that: (1) Is
located: (i) in the same State as the qualified facility that sold the
food to such restaurant or establishment; or (ii) not more than 275
miles from such facility; and (2) is purchasing the food for sale
directly to consumers at such restaurant or retail food establishment.
The proposed definition would incorporate the definition in section
418(l)(4)(B) of the FD&C Act.
    FDA is proposing to define the term ``qualified facility'' to mean
(when including the sales by any subsidiary; affiliate; or subsidiaries
or affiliates, collectively, of any entity of which the facility is a
subsidiary or affiliate) a facility that is: (1) A very small business
as defined in this part; or (2) a facility to which both of the
following apply: (i) During the 3-year period preceding the applicable
calendar year, the average annual monetary value of the food
manufactured, processed, packed or held at such facility that is sold
directly to qualified end-users (as defined in this part) during such
period exceeded the average annual monetary value of the food sold by
such facility to all other purchasers; and (ii) the average annual
monetary value of all food sold during the 3-year period preceding the
applicable calendar year was less than $500,000, adjusted for
inflation.
    We acknowledge that facilities would not need to consider the
applicability of previous paragraph (2) because facilities that meet
this second prong of the definition would be included in our proposed
definition of a very small business, which is broader.
    The proposed definition would incorporate the description of
``qualified facility'' in section 418(l)(1) of the FD&C Act with
editorial changes to improve clarity.
    FDA is proposing to define the term ``significant vulnerability''
to mean a vulnerability for which a prudent person knowledgeable about
food defense would employ food defense measures because of the
potential for serious adverse health consequences or death and the
degree of accessibility to that point in the food process. The term
``significant vulnerability'' is analogous to the term ``hazard that is
reasonably likely to occur'' in a HACCP-type framework for food safety.
As proposed, a ``significant vulnerability'' is a type of vulnerability
for which there is both: (1) The potential for serious adverse health
consequences or death from the intentional introduction of a
contaminant at the particular point in the process at which the
significant vulnerability exists; and (2) a significant degree of
accessibility at the particular point in the process. Unlike a ``hazard
that is reasonably likely to occur'' in a HACCP system, a ``significant
vulnerability'' exists at a particular point in a process (e.g., during
storage in a bulk tank or during mixing). As discussed in section V.C.2
of this document, we have determined that significant vulnerabilities
exist in a food operation at those actionable process steps that fit in
the FDA-identified key activity types or that are identified as part of
a vulnerability assessment.
    We have retained in this proposed definition the concept of a
``prudent person'' used in the definition of a ``hazard that is
reasonably likely to occur'' in the PC proposed rule. However, because
intentional adulteration is a potentially high consequence but low
probability occurrence, the portion of the proposed definition in the
PC proposed rule that reads, ``experience, illness data, scientific
reports, or other information provides a basis to conclude that there
is a reasonable possibility that the hazard will occur in the type of
food being manufactured, processed, packed, or held in the absence of
those controls,'' does not appear to be appropriate. Successful
intentional adulteration caused by an act of

terrorism requires not only the absence of focused mitigation
strategies designed to address a significant vulnerability, but also
simultaneous intent by an attacker to adulterate the food. As such, the
absence of focused mitigation strategies to address a significant
vulnerability alone may not present a reasonable possibility of
intentional adulteration. Instead, as described above, we have
tentatively concluded that the prudent person would consider the
potential for public health consequences should intentional
adulteration occur, and the degree of access by the attacker to commit
the intentional adulteration, in determining which vulnerabilities are
significant.
    FDA is proposing to define the term ``significantly minimize'' to
mean to reduce to an acceptable level, including to eliminate. As noted
in section X.B of the PC proposed rule, the term ``significantly
minimize'' is used in FSMA and is consistent with the outcome of a
``control measure'' as described in the HACCP regulations for seafood
(part 123), juice (part 120), and meat and poultry (9 CFR part 417).
Generally, a ``control measure'' is implemented so that hazards are
prevented, reduced to an acceptable level, or eliminated.
    FDA is proposing to define the term ``small business'' to mean, for
the purposes of proposed part 121, a business employing fewer than 500
persons. The proposed limit of 500 employees would include all
employees of the business rather than be limited to the employees of a
particular facility. We are proposing to establish the same definition
for small business as that which has been established by the U.S. Small
Business Administration under 13 CFR part 121 for most food
manufacturers.
    FDA is proposing to define the term ``verification'' to mean those
activities, other than monitoring, that establish that the system is
operating according to the food defense plan. As discussed in section
V.C.6 of this document, we are not proposing to require validation of
the focused mitigation strategies and, therefore, we are not proposing
to include a determination of the validity of the food defense plan
within the definition of verification in proposed Sec.  121.3.
    FDA is proposing to define the term ``very small business'' to
mean, for the purposes of proposed part 121, a business that has less
than $10,000,000 in total annual sales of food, adjusted for inflation.
In the discussion on the regulatory framework in section IV.A of this
document, we discuss our assessment that the goal of terrorist
organizations is to maximize public health harm and, to a lesser
extent, economic disruption. It is our assessment that such goals are
likely to drive terrorist organizations to target the product of
relatively large facilities, especially those for which the brand is
nationally or internationally recognizable. An attack on such a target
would potentially provide the wide-scale consequences desired by a
terrorist organization and the significant public attention that would
accompany an attack on a recognizable brand. Such facilities are likely
to have larger batch sizes, potentially resulting in greater human
morbidity and mortality. Further, an attack on a well-recognized,
trusted brand is likely to result in greater loss of consumer
confidence in the food supply and in the government's ability to ensure
its safety and, consequently, cause greater economic disruption than a
relatively unknown brand that is distributed regionally (Ref. 2, Ref.
50, Ref. 3, Ref. 51, Ref. 6). Therefore, we have set a threshold of
$10,000,000 in total food sales, adjusted for inflation, as the level
defining a very small business. Data from the Dun & Bradstreet Global
Business Database show that businesses with less than $10,000,000 in
total food sales represent about 3 percent of the market share of food
commodities, but include the majority of food facilities. Of a total of
65,900 domestic food facilities that are estimated to have actionable
process steps, about 51,700 are owned by businesses with less than
$10,000,000 in total annual sales. We request comment on our proposed
definition, and whether a dollar amount of sales more than or less than
$10,000,000 would be more appropriate. We also seek comment on whether
this threshold should be based on total food sold, as we proposed, or
on some appropriate proportion of food sales. For example, in the case
of foreign facilities, would it be more appropriate to consider the
proportion of food sold for marketing in the United States?
    FDA is proposing to define the term ``vulnerability'' to mean the
susceptibility of a point, step, or procedure in a facility's food
process to intentional adulteration. ``Vulnerability'' is used in the
term ``vulnerability assessment'' in section 420 of the FD&C Act and
may best be described in the food defense context as analogous to the
term ``hazard'' in a HACCP-type framework for food safety. While
hazards in the unintentional adulteration context may also be thought
of as analogous to agents or contaminants in the intentional
adulteration context, we have tentatively concluded that focusing on
individual agents or contaminants is generally not effective or
efficient in minimizing the risk of intentional adulteration caused by
acts of terrorism. There are a significant number of potential agents
or contaminants that could be used in a terrorist attack on food, with
one or more being suitable for essentially any point in the production
of any specific food. It would be extremely difficult, if not
impossible, to consider the multiple combinations of potential
contaminants, points in a food operation, and food categories, and to
determine a strategy that would effectively address all possible
agents. For this reason, determining whether there is an agent that
could be intentionally introduced to a specific food that would then
cause serious adverse health consequences or death would not be a
useful exercise. Further, many agents or contaminants that could be
used in such an attack are different from those that are associated
with foodborne illnesses caused by unintentional adulteration and, as
such, are not expected to be well understood by operators of food
facilities. Therefore, we have tentatively concluded that in the
intentional adulteration framework related to acts of terrorism, it is
appropriate to refer to ``vulnerabilities'' rather than ``hazards''.
According to the Merriam-Webster dictionary (Ref. 52), vulnerability is
a ``susceptibility,'' and we believe this concept best captures the
idea of a point, step, or procedure where someone intent on intentional
adulteration would focus an attack in a facility's food process. See