Proposed Sec.  121.150(b) would require that the owner, operator, or
agent in charge of a facility verify that appropriate decisions about
corrective actions are being made. An example of verification that
appropriate decisions about corrective actions are being made is
observation of the corrective actions being taken, e.g., by a
supervisor. Proposed Sec.  121.150(b) would not specify the
verification activities that must be conducted for corrective actions.
We request comment on whether proposed Sec.  121.150(b) should do so,
and if so, what verification activities should be required.
    d. Proposed Sec.  121.150(c)--Implementation and effectiveness.
Proposed Sec.  121.150(c) would require that the owner, operator, or
agent in charge of a facility verify that the focused mitigation
strategies are consistently implemented and are effectively and
significantly minimizing or preventing the significant vulnerabilities.
As appropriate to the facility and the food, this must include review
of the monitoring and corrective action records within appropriate
timeframes to ensure that the records are complete, the activities
reflected in the records occurred in accordance with the food defense
plan, the focused mitigation strategies are effective, and appropriate
decisions were made about corrective actions.
    Proposed Sec.  121.150(c) would establish that the purpose of the
review of records is to ensure that the records are complete, the
activities reflected in the records occurred in accordance with the
food defense plan, the focused mitigation strategies are effective, and
appropriate decisions are made about corrective actions. We tentatively
conclude that review of the records required by proposed Sec.
121.150(c) would accomplish these purposes. Reviewing monitoring
records can reveal whether they contain information on all of the
activities or measures that were to be monitored to determine whether a
focused mitigation strategy is being consistently implemented in
accordance with the food defense plan. For example, a review of
monitoring records can show if the shift supervisor is consistently
storing and securing chemicals at the end of each shift as may be
required by a food defense plan. Review of monitoring records also can
reveal whether any information is missing--e.g., a date or time--so
that the missing information can be quickly identified and added to the
record if necessary.
    Review of records also can reveal whether appropriate decisions
were made about corrective actions. The review would determine whether
all the corrective action procedures required by proposed Sec.  121.145
have been followed to prevent recurrence of the problem. For example,
in the previous example on corrective actions, a review of records
could reveal that the supervisor spoke to the staff about always having
two staff present at the work station as required in the food defense
plan and, as appropriate, enrolled the staff in a refresher course on
food defense awareness.
    Proposed Sec.  121.150(c) would require review of the monitoring
and corrective action records within an appropriate time after the
records are made. We are not proposing to require review of records
within a specified timeframe. While the PC proposed rule contains a
requirement that monitoring and corrective action records be reviewed
within a week after the records are made, in the case of food defense,
we do not believe specifying a timeframe for records review is
necessary. As discussed previously, some focused mitigation strategies
may be monitored less frequently than are preventive controls for food
safety. In a HACCP-

type system for food safety, monitoring and corrective action records
are often reviewed a short time after their creation to enable action
to be taken relative to food that may be adulterated (e.g., recall). It
is unlikely that an improperly implemented focused mitigation strategy
would result in adulterated food (i.e., because adulteration of food
would require not only opportunity but also a simultaneous intent to
cause adulteration). A focused mitigation strategy such as ``adequate
lighting at the bulk truck unloading bay'' or ``secure air vents on a
cooling tank with one-way valves'' may be monitored on a weekly or
monthly basis. Because the focused mitigation strategies may be
monitored less frequently and because these frequencies may vary
significantly from one focused mitigation strategy to another, we
believe it is appropriate for owners, operators, or agents in charge of
a facility to determine when review of the monitoring and corrective
action records is best performed.
    e. Proposed Sec.  121.150(d)--Reanalysis. To implement section
418(i) of the FD&C Act, proposed Sec.  121.150(d)(1) would require that
the owner, operator, or agent in charge of a facility conduct a
reanalysis of the food defense plan as follows:
    1. At least once every 3 years (proposed Sec.  121.150(d)(1)(i)).
    2. Whenever a significant change is made in the activities
conducted at a facility operated by such owner, operator, or agent in
charge if the change creates a reasonable potential for a new
vulnerability or a significant increase in a previously identified
vulnerability (proposed Sec.  121.150(d)(1)(ii)). For example, if a
facility adds a new product line, then the food defense plan must be
reanalyzed to consider whether it includes one of the key activity
types, and, if so to implement appropriate focused mitigation
strategies.
    3. Whenever such owner, operator or agent in charge becomes aware
of new information about potential vulnerabilities associated with the
food operation or facility (proposed Sec.  121.150(d)(1)(iii)). For
example, an owner, operator, or agent in charge of a facility may
become aware that access to a particular piece of equipment is greater
than was thought to be the case when they initially considered whether
a key activity type is applicable to their food process.
    4. Whenever a focused mitigation strategy is found to be
ineffective (proposed Sec.  121.150(d)(1)(iv)). Proposed Sec.
121.150(d)(1)(iv) would require that the owner, operator, or agent in
charge of a facility reanalyze the food defense plan to determine
whether modification of the plan is required if a focused mitigation
strategy is found to be ineffective. For example, if the owner,
operator, or agent in charge of a facility finds that color coding of
employee hard hats according to their assigned work stations or areas
is not effective in preventing employees from crossing into areas where
they are not assigned because employees have found that adhering to the
system adversely affects product, the owner, operator, or agent in
charge may need to consider other focused mitigation strategies to
ensure that staff access at actionable process steps is controlled.
    5. Whenever FDA requires reanalysis to respond to new
vulnerabilities and developments in scientific understanding including,
as appropriate, results from a DHS biological, chemical, radiological,
or other terrorism risk assessment (proposed Sec.  121.150(d)(1)(v)).
Risk assessments or vulnerability assessments conducted by DHS or
others may reveal a significant vulnerability in process steps in
addition to the significant vulnerabilities associated with the key
activity types that FDA has identified. FDA would require reanalysis of
food defense plans, as necessary, to respond to any new knowledge about
threats or vulnerabilities to food operations based on information
available to the agency. This requirement for reanalysis could involve
a requirement to consider whether a new key activity type is relevant
to a facility's food processes. It could also involve a requirement to
reconsider existing key activity types in light of a credible threat of
terrorist attack on a specific food type, product, brand, or company.
    Proposed Sec.  121.150(d)(2) would require that the owner,
operator, or agent in charge of a facility complete the required
reanalysis and implement any additional focused mitigation strategies
needed to address the significant vulnerabilities identified, if any,
before the change in activities at the facility is operative or, when
necessary, during the first six weeks of production. The purpose of the
reanalysis is to identify the need for, and implement, focused
mitigation strategies in light of a reasonable potential for a new
significant vulnerability, or a significant increase in a previously
identified significant vulnerability.
    Proposed Sec.  121.150(d)(3) would require that the owner,
operator, or agent in charge of a facility revise the written plan if a
significant change is made or document the basis for the conclusion
that no additional or revised focused mitigation strategies are needed.
It is important to document that a reanalysis has been conducted and
the plan has been revised accordingly or that no change has been made.
Such documentation demonstrates that a facility has considered all
relevant information on the defense of the operation, including new
information that has become available since the last analysis. The
documentation further demonstrates that appropriate changes have been
made or that current procedures for implementing focused mitigation
strategies are adequate to significantly minimize or prevent
significant vulnerabilities.
    f. Proposed Sec.  121.150(e)--Requirement for records for
verification. To implement sections 418(g) and 420(b)(2) of the FD&C
Act, proposed Sec.  121.150(e) would require that all verification
activities taken in accordance with this section be documented in
records.
    g. Verification proposed to be required by part 117 but not part
121. In the PC proposed rule, we proposed to require, as part of
verification, the validation of the adequacy of the preventive controls
implemented to control the hazards identified in the hazard analysis as
reasonably likely to occur. In this proposed rule, we are not including
a similar proposed requirement. Unlike preventive controls, which often
involve processing parameters that can be scientifically validated,
focused mitigations strategies for food defense (which correspond to
preventive controls for food safety) often are not of a nature that
they can be scientifically validated. For example, it would not be
practical for a facility to attempt to validate the effectiveness of a
lock on a tank or the use of a `buddy system' at a particular process
step to prevent or significantly minimize intentional adulteration of
food caused by a terrorist attack. Most of the recommended mitigation
strategies in the MSD (Ref. 30) are similar in nature to the two
mentioned in the example above in that validation would be impractical.
Therefore, we have tentatively concluded not to propose a requirement
for validation of focused mitigation strategies.
    However, if a facility chooses to use a processing parameter (e.g.,
thermal kill step) as a focused mitigation strategy, the facility
should employ such a processing parameter if it has been demonstrated
to be effective in significantly minimizing or preventing the
associated significant vulnerability. In many circumstances it is not
appropriate to use such strategies

because they are usually effective against one or several, but not all,
potential contaminants. See section XII.G of the PC proposed rule for
additional discussion of validation.
    The PC proposed rule also includes proposed requirements for
calibration of process monitoring instruments and verification
instruments and also records associated with these activities. As
discussed previously, it is our expectation that most of the focused
mitigation strategies will not be continuously monitored and will not
require process monitoring instruments or instruments to verification
purposes. Therefore, we do not believe it would be necessary to include
those requirements in this part.
    We ask for comment on our tentative decision not to include
validation of the focused mitigation strategies and calibration of
monitoring and verification instruments in codified requirements in
proposed Sec.  121.150.
7. Training of Personnel
    Proposed Sec.  121.160 would establish requirements related to
training of certain personnel working in a food operation. Proposed
Sec.  121.160(a) would require that personnel and supervisors assigned
to actionable process steps receive appropriate training in food
defense awareness and their respective responsibilities in implementing
focused mitigation strategies. Because the effectiveness of a
mitigation strategy, which is applied at an actionable process step, is
dependent on the proper implementation by personnel and supervisors of
the strategy, we are proposing to require that personnel and
supervisors assigned to actionable process steps be appropriately
trained in food defense. The purpose of training a supervisor, in
addition to personnel at actionable process steps, is so that the
supervisor can help train employees, recognize conditions that could
lead to intentional contamination, and take necessary actions to
correct those conditions.
    We are proposing that training required under this provision must
cover food defense awareness and the respective responsibilities of
personnel and supervisors assigned to actionable steps in implementing
focused mitigation strategies. At a minimum, such training must include
the general principles of food defense, including simple procedures for
employees to follow to adhere to those principles in their jobs. We
have tentatively concluded that completion of FDA's training course on
Food Defense Awareness for the Front-line Employee (described in this
section of the document), which takes about 20 minutes to complete,
would be sufficient to satisfy this element of the proposed training
requirement. Additionally, training must contain specifics about the
actionable process steps where employees are working and their roles in
the proper implementation of the focused mitigation strategy(ies)
applied at those actionable process steps. Training on the application
of focused mitigation strategies, which is likely to be specific to
each facility or actionable process step, may be added to existing on-
the-job training programs or provided separately.
    FDA has developed training tools that are available for use by the
industry. FDA revamped its online food defense courses in 2013, and the
revamped courses, entitled ``Food Defense 101'' (Ref. 27), address the
types of intentional contamination that have occurred in the United
States in recent years and reflect FDA's current thinking on how to
minimize the likelihood and impact of such incidents. The courses
included in Food Defense 101 are: (1) Food Defense Awareness for the
Food Professional; (2) Food Defense Awareness for the Front-line
Employee; (3) Food Defense Regulations; and (4) ALERT, for owners and
operators of food facilities. The course on Food Defense Awareness for
the Food Professional provides an understanding of food defense and
information for professionals in the food industry. The course modules
progress through food defense planning including broad mitigation
strategies, vulnerability assessments, focused mitigation strategies,
and food defense plans. The course on Food Defense Awareness for Front-
line Employees provides information specific to front-line workers and
simple procedures for these employees to follow in food defense. The
course on Food Defense Regulations presents an overview of the Public
Health Security and Bioterrorism Preparedness and Response Act of 2002
(the Bioterrorism Act), FSMA, and FDA's Reportable Food Registry.
Finally, the course on ALERT, which was developed by FDA to help
stakeholders better understand food defense and how food defense
applies to the food industry, provides specific examples of ways to
protect a firm from the threat of intentional contamination. FDA's Food
Defense 101 online courses are available free-of-charge on our Web site
at http://www.fda.gov/Food/FoodDefense/default.htm.
    We expect these existing courses will assist industry to comply
with this training requirement, if finalized as proposed. We are also
aware of training seminars and programs offered by private sector
entities (Ref. 59, Ref. 60, Ref. 61, Ref. 62) that may also assist
industry to comply with this training requirement. We seek comment on
the adequacy of FDA's Food Defense 101 training materials, and whether
there is a need for revisions to these existing FDA courses or the
development of additional FDA training materials.
    FDA also previously issued guidance documents for industry on food
defense (Ref. 22, Ref. 23, Ref. 24, Ref. 25, Ref. 26), which include
recommendations related to personnel training. In these guidance
documents, we recommended that all employees have training in food
defense awareness, including information on how to prevent, detect, and
respond to an intentional contamination incident at their facility. As
noted in these guidance documents, we recommended incorporating
periodic reminders of the importance of food defense procedures into
routine facility communications, such as brochures, staff meetings or
payroll stuffers. We further recommended that facilities encourage all
employees to report unusual or suspicious individuals or activities to
management. We reiterate these recommendations described in our
guidance documents. However, in this proposed rule, we are not
proposing to include additional specific training requirements to
reflect all of those recommendations. For example, although we are not
requiring that all employees at a facility receive training in food
defense, we recognize the importance of training as a measure to
protect against intentional adulteration of food and, therefore,
reiterate our recommendation that all personnel working in a food
operation receive training in food defense awareness. We request
comment on this issue, including on whether we should require, in a
final rule, that basic food defense awareness training be completed by
all employees at a facility. We also request comment on whether we
should require training to be repeated periodically, including when
significant changes are made to food defense plans.
    Proposed Sec.  121.160(b) would require that all training received
in accordance with section Sec.  121.160 be documented in records.
Under proposed Sec.  121.305, records would include such information as
the date of the training, the topics covered, and the person(s)
trained. An example of records that would comply with proposed Sec.
121.160(b) is an attendance sheet with the date, list of those in
attendance, and the particular topics covered (such as an overview of
food defense principles or food defense

planning). The records required by proposed Sec.  121.160(b) would
enable a facility to track the training that personnel received,
thereby enabling identification of personnel that have the prerequisite
awareness training for an assignment at an actionable process step.
Such records could be used to document that a person has, as would be
required under proposed Sec.  121.160(a), successfully completed
training appropriate to the person's duties at an actionable process
step.
    We recognize that industry has already begun to implement food
defense measures to meet certain industry standards, which include
guidelines for food defense training (Ref. 63, Ref. 33, Ref. 35). Our
proposed minimum requirements for training are consistent with these
standards, as well as with WHO recommendations for personnel training
in its guidance on food defense (Ref. 6). We seek comment on the
feasibility of our proposed training requirements, in light of the
current state of food defense awareness in the industry and available
training resources.

D. Requirements Applying to Records That Must Be Established and
Maintained

    When a HACCP-type system is implemented for food safety, records
are a critical part of the system because they aid facilities in
compliance with the requirements, including all the elements of a food
safety plan as proposed in Part 117, and allow facilities to show, and
FDA to determine, compliance with the requirements. This concept is
discussed in detail in section XV of the PC proposed rule. We have
tentatively concluded that records are critical to protect food from
intentional adulteration caused by acts of terrorism.
    In subpart D of proposed part 121, FDA is proposing to establish
requirements applying to records that must be established and
maintained according to the requirements of this proposed rule. This
subpart implements numerous provisions in section 418 of the FD&C Act,
including sections 418(a), (b)(3), (g), (h), and (n)(1)(A), as well as
section 420(b) of the FD&C Act.
1. Proposed Sec.  121.301--Records Subject to the Requirements of this
Subpart D
    Proposed Sec.  121.301(a) would establish that, except as provided
by proposed Sec.  121.301(b), all records required by proposed subpart
C of part 121 would be subject to all requirements of proposed subpart
D. We have tentatively concluded that the requirements in subpart D
describing how records must be established and maintained, including
the general requirements, record retention requirements, and
requirements for official review and public disclosure, are applicable
to all records that would be required under subpart C. Such records
would aid facilities in compliance with the requirements of proposed
part 121, and allow facilities to show, and FDA to determine,
compliance with the requirements of part 121. The proposed requirements
of subpart D are discussed in this document.
    Proposed Sec.  121.301(b) would establish that the requirements of
proposed Sec.  121.310 apply only to the written food defense plan and
is discussed in more detail in section V.D.3 of this document.
2. Proposed Sec.  121.305--General Requirements Applying to Records
    Proposed Sec.  121.305 contains general requirements that would
apply to records that would be required under proposed part 121,
including the format for required records, the recording of actual
values and observations obtained during monitoring, when records must
be created, and information that must be included in each record.
    a. Proposed Sec.  121.305(a). Proposed Sec.  121.305(a) would
require that the records be kept as original records, true copies (such
as photocopies, pictures, scanned copies, microfilm, microfiche, or
other accurate reproductions of the original records), or electronic
records. True copies of records should be of sufficient quality to
detect whether the original record was changed or corrected in a manner
that obscured the original entry (e.g., through the use of white-out).
Proposed Sec.  121.305(a) would provide flexibility for mechanisms for
keeping records while maintaining the integrity of the recordkeeping
system. The proposed requirement allowing true copies provides options
that may be compatible with the way records are currently being kept in
facilities.
    Proposed Sec.  121.305(a) also would require that electronic
records be kept in accordance with part 11 (21 CFR part 11). Part 11
provides criteria for acceptance by FDA, under certain circumstances,
of electronic records, electronic signatures, and handwritten
signatures executed to electronic records as equivalent to paper
records and handwritten signatures executed on paper. The proposed
requirement clarifies and acknowledges that records required by
proposed part 121 may be retained electronically, provided that they
comply with part 11.
    In the PC proposed rule, FDA tentatively concluded that it would be
appropriate to apply the requirements of part 11 to the records that
would be required to be kept under proposed part 117. However, we
requested comment on whether there are any circumstances that would
warrant not applying part 11 to records that would be kept under
proposed part 117. In section XV.C of that document, we provided
examples of circumstances in which we exempted records from the
requirements of part 11 (21 CFR 1.329(b)) to avoid the necessity of
establishing new recordkeeping systems as long as current practices
would satisfy the requirements of the Act. In the PC proposed rule, we
also asked for comment on whether we should allow additional time for
electronic records to be kept in accordance with part 11. We seek
similar comment with regard to circumstances that would warrant not
applying part 11 to records that would be kept under proposed part 121
and whether we should allow additional time for electronic records to
be kept in accordance with part 11. Comments should provide the basis
for any view that the requirements of part 11 are not warranted.
    b. Proposed Sec.  121.305(b). Proposed Sec.  121.305(b) would
require that records contain the actual values and observations
obtained during monitoring. For example, monitoring of the locking of
an access door to an actionable process step could be recorded as
``locked'' or ``unlocked'' (or ``yes'' or ``no'') and the monitoring of
the presence of staff with only appropriate color uniforms in a
designated area could be recorded as ``100% staff (or 10 of 10 staff)
with blue uniforms'' or conversely ``80% staff (or 8 of 10 staff) with
blue uniforms'' in the case of an improperly implemented focused
mitigation strategy. In the case of an improperly implemented focused
mitigation strategy, it is important to document the extent to which
the strategy was incorrectly applied, as monitoring data can show a
trend toward loss of control at an actionable process step. So, in the
example in which 8 of 10 staff have blue uniforms, a facility may also
consider documenting what color the remaining two staff were wearing if
such information would be valuable in establishing a trend. If the
recording of numerical values is possible in the monitoring of a
focused mitigation strategy (e.g., if a facility is using a processing
parameter such as heat treatment), then the actual times and
temperatures or other appropriate processing data should be recorded.
    c. Proposed Sec.  121.305(c), (d) and (e). Proposed Sec.
121.305(c), (d) and (e) would require that records be accurate,
indelible, and legible (proposed

Sec.  121.305(c)); be created concurrently with performance of the
activity documented (proposed Sec.  121.305(d)); and be as detailed as
necessary to provide a history of work performed (proposed Sec.
121.305(e)). Proposed Sec.  121.305(c) and (d) would ensure that the
records are useful to the owner, operator, or agent in charge of a
facility in complying with the requirements of proposed part 121, for
example, in documenting compliance with monitoring requirements and
verifying compliance with the food defense plan. These proposed
requirements would also ensure that the records would be useful to FDA
in determining compliance with the requirements of proposed part 121.
Proposed Sec.  121.305(e) would provide flexibility to facilities to
tailor the amount of detail to the nature of the record.
    d. Proposed Sec.  121.305(f). Proposed Sec.  121.305(f) would
require that the records include the following: (1) The name and
location of the facility; (2) the date and time of the activity
documented; (3) the signature or initials of the person performing the
activity; and (4) where appropriate, the identity of the product and
the production code, if any. The name and location of the facility and
the date and time would allow the owner, operator, or agent in charge
of a facility (and, during inspection, an FDA investigator) to assess
whether the record is current, to identify when and where any deviation
occurred, and to track corrective actions. The signature of the
individual who made the observation would ensure responsibility and
accountability. In addition, if there is a question about the record, a
signature would ensure that the source of the record will be known.
Linking a record to a specific product (and, when applicable, the
production code) would enable the owner, operator, or agent in charge
of a facility covered by this rule to isolate product if there is a
question that food has been adulterated. We seek comment on the scope
and potential burden associated with these proposed requirements.
    The proposed requirement (proposed Sec.  121.305(f)(4)) for the
identity of the product and production code, if any, is important in
the context of food safety, where the production of potentially
adulterated product may result from loss of control during processing,
such as an improper cook temperature, and a recall may be necessary. It
is also especially applicable for food safety in cases of continuous
monitoring, when the loss of control can be associated with a
particular product or production code. Consistent with the PC proposed
rule, we have qualified the proposed requirement to indicate that the
identity of the product and the production code should be included as
part of the record ``where appropriate.'' We note that, in many cases,
it will likely be more difficult to include this information for a
focused mitigation strategy. As noted in the discussion on monitoring
in section V.C.5 of this proposed rule, some focused mitigation
strategies may be monitored weekly or monthly. In that case, it may not
be appropriate to include all of the products and production codes that
may have been affected by an improperly implemented focused mitigation
strategy. Further, in many cases the identity of the product and the
production code will not be relevant because the monitoring will be
performed in the area surrounding one or more production lines, used
for one or more products, rather than of processing parameters on a
production line for a specific lot of product. On the other hand, if
control of processing parameters, such as pasteurization time and
temperature, are used as a focused mitigation strategy, it would be
appropriate to document the product and production code, if any, that
was being processed at the time of monitoring. The nature of the
focused mitigation strategy should drive the decision by an owner,
operator, or agent in charge of a facility regarding whether or not to
include the identity of the product and the production code, if any, in
records.
3. Proposed Sec.  121.310--Additional Requirements Applying to the Food
Defense Plan
    Proposed Sec.  121.310 would require that the owner, operator, or
agent in charge of a facility sign and date the food defense plan upon
initial completion (proposed Sec.  121.310(a)) and upon any
modification (proposed Sec.  121.310(b)). Such a signature would
provide direct evidence of the owner, operator, or agent's acceptance
of the plan and commitment to implementation of the plan. Additionally,
the signature, along with the date of signing, would serve to minimize
potential confusion over the authenticity of any differing versions or
editions of the document that might exist.
4. Proposed Sec.  121.315--Requirements for Record Retention
    Proposed Sec.  121.315 contains requirements on the length of time
records that would be required under proposed part 121 must be retained
and allowances for offsite storage of records under certain
circumstances.
    a. Proposed Sec.  121.315(a) and (b). Proposed Sec.  121.315(a)
would require that all records that would be required by proposed part
121 be retained at the facility for at least 2 years after the date
they were prepared. Proposed Sec.  121.315(b) would require that the
food defense plan be retained at the facility for at least 2 years
after its use is discontinued (e.g., because the facility has updated
the written food defense plan. The 2-year timeframe for all records
required by proposed part 121 is consistent with the length of time
that nonperishable food products, on average, can be expected to be in
commercial distribution plus a reasonable time thereafter to ensure
that the records are available for verification activities. This
proposed requirement is similar to the proposed records retention
requirement in the PC proposed rule, which contains a discussion of
similar requirements found in other FDA regulations and in particular
the proposed and final rules implementing the recordkeeping
requirements of the Bioterrorism Act. This 2-year retention period
would run from either the date the record is prepared, for day-to-day
operational records, or the date at which use of the record is
discontinued, for the food defense plan. We seek comment on this
proposal.
    b. Proposed Sec.  121.315(c). Proposed Sec.  121.315(c) would
provide that, except for the food defense plan, use of offsite storage
for records is permitted after 6 months following the date that the
record was made if such records can be retrieved and provided onsite
within 24 hours of request for official review. The food defense plan
would be required to remain onsite. FDA realizes that the proposed
requirements for recordkeeping could require some facilities to store a
significant quantity of records, and that there may not be adequate
storage space in the facility for all of these records. Providing for
offsite storage of most records after 6 months would enable a facility
to comply with the proposed requirements for record retention while
reducing the amount of space needed for onsite storage of the records
without interfering with the purpose of record retention, because the
records will be readily available.
    Proposed Sec.  121.315(c) also would provide that electronic
records are considered to be onsite if they are accessible from an
onsite location. Computerized systems within corporations can be
networked, allowing for the sending and receiving of information in a
secure fashion to all of the different food processing facilities of
that corporation worldwide. This

type of system can be used to provide access at multiple locations to
records from multiple facilities.
    c. Proposed Sec.  121.315(d). Proposed Sec.  121.315(d) would
provide that if the facility is closed for a prolonged period, the
records may be transferred to some other reasonably accessible location
but must be returned to the facility within 24 hours for official
review upon request. Allowing for transfer of records will give
practical storage relief to seasonal operations or those closed for
other reasons for prolonged periods.
5. Proposed Sec.  121.320--Requirements for Official Review
    Proposed Sec.  121.320 would require that all records required by
proposed part 121 be made promptly available to a duly authorized
representative of the Secretary of Health and Human Services upon oral
or written request.
6. Proposed Sec.  121.325--Public Disclosure
    Proposed Sec.  121.325 would establish that all records required by
proposed part 121 will be protected from public disclosure to the
extent allowable under part 20 of this chapter. Our general policies,
procedures, and practices relating to the protection of confidential or
otherwise protected information received from third parties would apply
to information received under this rule.

E. Compliance

    Section 103(e) of FSMA amends section 301 of the FD&C Act (21
U.S.C. 331) by adding a new section--(uu)--to the list of acts and the
causing thereof that are prohibited. Under section 301(uu) of the FD&C
Act, the following act, and the causing thereof, are prohibited:
``[t]he operation of a facility that manufactures, processes, packs, or
holds food for sale in the United States if the owner, operator, or
agent in charge of such facility is not in compliance with section 418
[of the FD&C Act].'' To clearly communicate that failure to comply with
the regulations established under section 418 of the FD&C Act is a
prohibited act, proposed Sec.  121.401(a) in subpart E would establish
that the operation of a facility that manufactures, processes, packs,
or holds food for sale in the United States if the owner, operator, or
agent in charge of such facility is required to comply with, and is not
in compliance with, section 418 or subparts C or D of part 121 is a
prohibited act under section 301(uu) of the FD&C Act.
    Section 106(d) of FSMA amends section 301 of the FD&C Act by adding
a new section--(ww)--to the list of acts and the causing thereof that
are prohibited. Under section 301(ww) of the FD&C Act, the following
act, and the causing thereof, are prohibited: ``[t]he failure to comply
with section 420 [of the FD&C Act].'' To clearly communicate that
failure to comply with the regulations established under section 420 of
the FD&C Act is a prohibited act, proposed Sec.  121.401(b) would
establish that the failure to comply with section 420 of the FD&C Act
or subparts C or D of part 121 is a prohibited act under section
301(ww) of the FD&C Act.

VI. Preliminary Regulatory Impact Analysis

A. Overview

    FDA has examined the impacts of the proposed rule under Executive
Order 12866, Executive Order 13563, the Regulatory Flexibility Act (5
U.S.C. 601-612), and the Unfunded Mandates Reform Act of 1995 (Pub. L.
104-4). Executive Orders 12866 and 13563 direct Agencies to assess all
costs and benefits of available regulatory alternatives and, when
regulation is necessary, to select regulatory approaches that maximize
net benefits (including potential economic, environmental, public
health and safety, and other advantages; distributive impacts; and
equity). We believe that this proposed rule is a significant regulatory
action under Executive Order 12866.

B. Regulatory Flexibility Act

    The Regulatory Flexibility Act requires Agencies to analyze
regulatory options that would minimize any significant impact of a rule
on small entities. The annualized costs per entity due to this proposed
rule are about $13,000 for a one-facility firm with 100 employees, and
there are about 4,100 small businesses that would be affected by the
proposed rule, so we tentatively conclude that the proposed rule could
have a significant economic impact on a substantial number of small
entities.

C. Small Business Regulatory Enforcement Fairness Act of 1996

    The Small Business Regulatory Enforcement Fairness Act of 1996
(Pub. L. 104-121) defines a major rule for the purpose of congressional
review as having caused or being likely to cause one or more of the
following: An annual effect on the economy of $100 million or more; a
major increase in costs or prices; significant adverse effects on
competition, employment, productivity, or innovation; or significant
adverse effects on the ability of U.S.-based enterprises to compete
with foreign-based enterprises in domestic or export markets. In
accordance with the Small Business Regulatory Enforcement Fairness Act,
the Office of Management and Budget (OMB) has determined that this
proposed rule is a major rule for the purpose of congressional review.

D. Unfunded Mandates Reform Act of 1995

    Section 202(a) of the Unfunded Mandates Reform Act of 1995 requires
that Agencies prepare a written statement, which includes an assessment
of anticipated costs and benefits, before proposing ``any rule that
includes any Federal mandate that may result in the expenditure by
State, local, and tribal governments, in the aggregate, or by the
private sector, of $100,000,000 or more (adjusted annually for
inflation) in any one year.'' The current threshold after adjustment
for inflation is $141 million, using the most current (2012) Implicit
Price Deflator for the Gross Domestic Product. We expect this proposed
rule may result in a 1-year expenditure that would meet or exceed this
amount.

E. Paperwork Reduction Act of 1995

    This proposed rule contains information collection requirements
that are subject to review by the Office of Management and Budget (OMB)
under the Paperwork Reduction Act of 1995 (PRA) (44 U.S.C. 3501-3520).
A description of these provisions is given in the Description section
of this document with an estimate of the annual reporting,
recordkeeping, and third-party disclosure burden. Included in the
estimate is the time for reviewing instructions, searching existing
data sources, gathering and maintaining the data needed, and completing
and reviewing each collection of information.
    FDA invites comments on: (1) Whether the proposed collection of
information is necessary for the proper performance of FDA's functions,
including whether the information will have practical utility; (2) the
accuracy of FDA's estimate of the burden of the proposed collection of
information, including the validity of the methodology and assumptions
used; (3) ways to enhance the quality, utility, and clarity of the
information to be collected; and (4) ways to minimize the burden of the
collection of information on respondents, including through the use of
automated collection techniques, when appropriate, and other forms of
information technology.
    To ensure that comments on information collection are received, OMB
recommends that written

comments be faxed to the Office of Information and Regulatory Affairs,
OMB, Attn: FDA Desk Officer, FAX:<PHONE_NUMBER>, or emailed to<EMAIL_ADDRESS>All comments should be identified with the
title ``Focused Mitigation Strategies to Protect Food Against
Intentional Adulteration.''
    In compliance with the Paperwork Reduction Act of 1995 (44. U.S.C.
3407(d)), the agency has submitted the information collection
provisions of this proposed rule to OMB for review. Interested persons
are requested to send comments regarding information collection by
January 23, 2014 to the Office of Information and Regulatory Affairs,
OMB. To ensure that comments on information collection are received,
OMB recommends that written comments be faxed to the Office of
Information and Regulatory Affairs, OMB, Attn: FDA Desk Officer, FAX:
202-395-6974, or emailed to<EMAIL_ADDRESS>All comments
should be identified with the title, ``Focused Mitigation Strategies to
Protect Food Against Intentional Adulteration.''

F. Public Access to the Analyses

    The analyses that we have performed to examine the impacts of this
proposed rule under Executive Order 12866, Executive Order 13563, the
Regulatory Flexibility Act (5 U.S.C. 601-612), the Unfunded Mandates
Reform Act of 1995 (Pub. L. 104-4), and the Paperwork Reduction Act of
1995 (44 U.S.C. 3501-3520) are available to the public in the docket
for this final rule (Ref. 64).

VII. Analysis of Environmental Impact

    The Agency has determined under 21 CFR 25.30(h) that this action is
of a type that does not individually or cumulatively have a significant
effect on the human environment (Ref. 65). Therefore, neither an
environmental assessment nor an environmental impact statement is
required.

VIII. Federalism

    FDA has analyzed this proposed rule in accordance with the
principles set forth in Executive Order 13132. FDA has determined that
the proposed rule, if finalized, would not contain policies that would
have substantial direct effects on the States, on the relationship
between the National Government and the States, or on the distribution
of power and responsibilities among the various levels of government.
Accordingly, the Agency tentatively concludes that the proposed rule
does not contain policies that have federalism implications as defined
in the Executive order and, consequently, a federalism summary impact
statement is not required.

IX. Comments

    We invite public comment on the matters specified in this document
as well as any other matters concerning this proposed rule that are of
interest. Interested persons may submit either electronic comments
regarding this document to http://www.regulations.gov or written
comments to the Division of Dockets Management (see ADDRESSES). It is
only necessary to send one set of comments. Identify comments with the
docket number found in brackets in the heading of this document.
Received comments may be seen in the Division of Dockets Management
between 9 a.m. and 4 p.m., Monday through Friday, and will be posted to
the docket at http://www.regulations.gov.

X. References

    The following references have been placed on display in the
Division of Dockets Management (see ADDRESSES) and may be seen by
interested persons between 9 a.m. and 4 p.m., Monday through Friday.
(FDA has verified the Web site addresses, but FDA is not responsible
for any subsequent changes to the Web sites after this document
publishes in the Federal Register.)

    1. Kennedy, S.K. and F.F. Busta, ``Chapter 5 Biosecurity: Food
Protection and Defense,'' Food Microbiology: Fundamentals and
Frontiers, Edited by M.P. Doyle and L.R. Beuchat, American Society
for Microbiology Press: Washington, DC, pp. 87-102, 2007. Accessed
October 30, 2013.
    2. Khan A.S., D.L. Swerdlow, and D.D. Juranek, ``Precautions
Against Biological and Chemical Terrorism Directed at Food and Water
Supplies,'' Public Health Reports, 116(1):3-14, 2001.
    3. Sobel, J., A.S. Khan, and D.L. Swerdlow, ``Threat of a
Biological Terrorist Attack on the US Food Supply: The CDC
Perspective,'' The Lancet, 359(9309):874-880, March 9, 2002.
    4. T[ouml]r[ouml]k, T.J., R.V. Tauxe, R.P. Wise, et al., ``A
Large Community Outbreak of Salmonellosis Caused by Intentional
Contamination of Restaurant Salad Bars,'' Journal of American
Medical Association, 278(5):389-395, August 1997.
    5. British Standards Institute and Centre for the Protection of
National Infrastructure. ``Publicly Available Specification 96:2010
Defending Food and Drink,'' March 2010. http://www.cpni.gov.uk/documents/publications/non-cpni_pubs/pas96_vis14.pdf. Accessed
September 25, 2013.
    6. World Health Organization. ``Terrorist Threats to Food:
Guidance for Establishing and Strengthening Prevention and Response
Systems,'' Food Safety Issues, Revision May 2008. http://www.who.int/foodsafety/publications/general/en/terrorist.pdf.
Accessed September 23, 2013.
    7. Everstine, K., S. Kennedy, and J. Spink, ``Economically
Motivated Adulteration (EMA) of Food: Common Characteristics of EMA
Incidents,'' Journal of Food Protection, 76(4):723-735, 2013.
    8. U.S. Food and Drug Administration. ``Economically Motivated
Adulteration; Public Meeting; Request for Comment,'' Federal
Register, 74(64):15497-15499, 2009. http://www.gpo.gov/fdsys/pkg/FR-2009-04-06/pdf/E9-7843.pdf. Accessed September 23, 2013.
    9. Spink, J. and DC Moyer, ``Defining the Public Health Threat
of Food Fraud,'' Journal of Food Science, 75(9):R157-R163, 2011.
    10. Ingelfinger, J.R., ``Melamine and the Global Implications of
Food Contamination,'' New England Journal of Medicine, 359(26):2745-
2748, 2008.
    11. Xiu, C. and K.K. Klein, ``Melamine in Milk Products in
China: Examining the Factors That Led to Deliberate Use of the
Contaminant,'' Food Policy, 35(5):463-470, 2010.
    12. World Health Organization. Food Security Page. http://www.who.int/trade/glossary/story028/en. Accessed September 23, 2013
    13. Kolavic, S., A. Kimura, S. Simons, L. Slutsker, S. Barth,
and C. Haley, ``An Outbreak of Shigella dysenteriae Type 2 Among
Laboratory Workers Due to Intentional Food Contamination,'' Journal
of American Medical Association, 278(5):396-398, August 1997.
    14. Anderson, S., J. DeMent, C.B. Ocfemia, and D.C. Hunt,
Outbreaks of Methomyl Poisoning Caused by the Intentional
Contamination of Salsa at the Mi Ranchito Restaurant in Lenexa, KS--
August 2009, Kansas Department of Health and Environment, April 12,
2011. http://www.kdheks.gov/epi/download/Final_Mi_Ranchito_Report.pdf. Accessed October 22, 2013.
    15. U.S. Government Printing Office. Senate Hearing 108-491,
``Agroterrorism: The Threat to America's Breadbasket,'' p. 1,
November 19, 2003. http://www.gpo.gov/fdsys/pkg/CHRG-108shrg91045/html/CHRG-108shrg91045.htm. Accessed September 23, 2013.
    16. The White House, Office of the Press Secretary. Homeland
Security Presidential Directive/HSPD-8, December, 17, 2003. https://www.fas.org/irp/offdocs/nspd/hspd-8.html. Accessed October 17, 2013.
    17. The White House, Office of the Press Secretary. Homeland
Security Presidential Directive 7: Critical Infrastructure
Identification, Prioritization, and Protection, December, 17, 2003.
https://www.dhs.gov/homeland-security-presidential-directive-7.
Accessed October 17, 2013.
    18. The White House, Office of the Press Secretary. Homeland
Security Presidential Directive/HSPD-9, January, 30, 2004. https://www.fas.org/irp/offdocs/nspd/hspd-9.html. Accessed October 17, 2013.
    19. The White House, Office of the Press Secretary. Presidential
Policy Directive/PPD-8: National Preparedness, March 30, 2011.
http://www.dhs.gov/presidential-policy-directive-8-national-preparedness. Accessed October 17, 2013.
    20. The White House, Office of the Press Secretary. Presidential
Policy Directive 21:

Critical Infrastructure Security and Resilience, February 12, 2013.
http://www.whitehouse.gov/the-press-office/2013/02/12/presidential-policy-directive-critical-infrastructure-security-and-resil.
Accessed October 7, 2013.
    21. U.S. Food and Drug Administration. Strategic Partnership
Program Agroterrorism (SPPA) Initiative: Final Summary Report
September 2005--September 2008, December 2008. http://www.fda.gov/Food/FoodDefense/FoodDefensePrograms/ucm170509.htm. Accessed
September 23, 2013.
    22. U.S. Food and Drug Administration, Center for Food Safety
and Applied Nutrition. ``Guidance for Industry: Food Producers,
Processors, and Transporters: Food Security Preventive Measures
Guidance,'' March 2003, Revision October 2007. http://www.fda.gov/Food/GuidanceRegulation/GuidanceDocumentsRegulatoryInformation/FoodDefense/ucm083075.htm. Accessed September 23, 2013.
    23. U.S. Food and Drug Administration, Center for Food Safety
and Applied Nutrition. ``Guidance for Industry: Importers and
Filers: Food Security Preventive Measures Guidance,'' March 2003,
Revision October 2007. http://www.fda.gov/Food/GuidanceRegulation/GuidanceDocumentsRegulatoryInformation/FoodDefense/ucm078978.htm.
Accessed September 23, 2013.
    24. U.S. Food and Drug Administration, Center for Food Safety
and Applied Nutrition. ``Guidance for Industry: Dairy Farms, Bulk
Milk Transporters, Bulk Milk Transfer Stations and Fluid Milk
Processors: Food Security Preventive Measures Guidance,'' July 2003,
Revision October 2007. http://www.fda.gov/Food/GuidanceRegulation/GuidanceDocumentsRegulatoryInformation/FoodDefense/ucm078978.htm.
Accessed September 23, 2013.
    25. U.S. Food and Drug Administration, Center for Food Safety
and Applied Nutrition. ``Guidance for Industry: Retail Food Stores
and Food Service Establishments: Food Security Preventive Measures
Guidance,'' December 2003, Revision October 2007. http://www.fda.gov/Food/GuidanceRegulation/GuidanceDocumentsRegulatoryInformation/FoodDefense/ucm082751.htm.
Accessed September 23, 2013.
    26. U.S. Food and Drug Administration, Center for Food Safety
and Applied Nutrition. ``Guidance for Industry: Cosmetics Processors
and Transporters of Cosmetics Security Preventive Measures
Guidance,'' November 2003, Revision October 2007. http://www.fda.gov/Food/GuidanceRegulation/GuidanceDocumentsRegulatoryInformation/FoodDefense/ucm082716.htm.
Accessed September 23, 2013.
    27. U.S. Food and Drug Administration. Food Defense 101 Page.
http://www.fda.gov/Food/FoodDefense/ToolsEducationalMaterials/ucm353774.htm. Accessed October 17, 2013.
    28. U.S. Food and Drug Administration. Employees FIRST Page.
http://www.fda.gov/Food/FoodDefense/ToolsEducationalMaterials/ucm295997.htm. Accessed and printed on October 17, 2013.
    29. U.S. Food and Drug Administration. Vulnerability Assessment
Software Page, Version 2.4, November 2011. http://www.fda.gov/Food/FoodDefense/ToolsEducationalMaterials/ucm295900.htm. Accessed
September 25, 2013.
    30. U.S. Food and Drug Administration. Mitigation Strategies
Database Page. http://www.fda.gov/Food/FoodDefense/ToolsEducationalMaterials/ucm295898.htm. Accessed September 25,
2013.
    31. U.S. Food and Drug Administration. Food Defense Plan Builder
Software Page. http://www.fda.gov/Food/FoodDefense/ToolsEducationalMaterials/ucm349888.htm. Accessed September 25,
2013.
    32. U.S. Food and Drug Administration. Food Related Emergency
Exercise Bundle (FREE-B) Page. http://www.fda.gov/Food/FoodDefense/ToolsEducationalMaterials/ucm295902.htm. Accessed October 17, 2013.
    33. Global Food Safety Initiative. GFSI Guidance Document,
Version 6.1, 6(2), August 2011. http://www.mygfsi.com/gfsifiles/Guidance_Document_Sixth_Edition_Version_6.1.pdf. Accessed
September 23, 2013.
    34. Safe Quality Food Institute. SQF Code: A HACCP-Based
Supplier Assurance Code for the Food Industry, Edition 7.1, April
2013. http://www.sqfi.com/wp-content/uploads/SQF-Code-Ed-7.1-4-3-13.pdf. Accessed October 17, 2013.
    35. International Featured Standards. Events and Academy Page.
http://www.ifs-certification.us/events. Accessed November 5, 2013.
    36. China Inspection and Quarantine Service, Administrative
Provisions on Filing of Export Food Production Enterprises Page.
http://en.ciqcid.com/Zjl/Comprehensives/51829.htm. Accessed
September 25, 2013.
    37. German Federal Office of Consumer Protection and Food
Safety. ``General Recommendations for Protection of Animal Feed and
Food Supply Chain From the Intentional Release of Agents,'' February
2011. Accessed October 22, 2013.
    38. French Republic. Guide Containing Recommendations for the
Protection of the Food Chain From Threats of Malevolent, Criminal,
or Terrorist Acts, May 2007. http://www.frenchfoodintheus.org/IMG/pdf/I07008308-imtnea-Guide_des_recommandations-ENG_3_.pdf.
Accessed and printed on September 23, 2013.
    39. Trusted Information Sharing Network for Critical
Infrastructure Protection. A National Strategy for Enhancing the
Safety and Security of our Food Supply, March 2006. http://www.daff.gov.au/__data/assets/pdf_file/0004/183325/enhancing_safety_security_strategy.pdf. Accessed September 23, 2013.
    40. U.S. Food and Drug Administration. Memorandum to the File:
Evaluation of the potential for intentional adulteration of produce
during activities that occur on produce farms, September 2013.
    41. Buttars, N.K., A.J. Young, D. Bailey, ``Adoption of Security
Systems by Dairy Farms To Address Bioterrorist Threats in the
Intermountain United States,'' Journal of Dairy Science, 89:1822-
1829, 2006. Accessed October 22, 2013.
    42. International Dairy Foods Association. Global Markets Page.
http://www.idfa.org/key-issues/category/global-markets/map/#us.
Accessed October 23, 2013.
    43. Newkirk, R., C. Hedberg, and J. Bender, ``Establishing a
Milkborne Disease Outbreak Profile: Potential Food Defense
Implications,'' Foodborne Pathogens and Disease, 8(3):433-437, 2011.
    44. Popkin, B., ``Patterns of Beverage Use Across the
Lifecycle,'' Physiology and Behavior, 100(1):4-9, 2010.
    45. Sebastian, R.S., J.D. Goldman, C.W. Enns, and R.P. LaComb,
``Fluid Milk Consumption in the United States: What We Eat In
America, NHANES 2005-2006,'' Food Surveys Research Group Dietary
Data Brief No. 3, September 2010. http://ars.usda.gov/SP2UserFiles/Place/12355000/pdf/DBrief/3_milk_consumption_0506.pdf. Accessed
October 23, 2013.
    46. U.S. Department of Agriculture and Economic Research
Service. Dairy Products: Per capita consumption, United States
(Annual), 2013. http://www.ers.usda.gov/data-products/dairy-data.aspx. Accessed October 23, 2013.
    47. Wein, L.M. and Y. Lui, ``Analyzing a Bioterror Attack on the
Food Supply: The Case of Botulinum Toxin in Milk,'' Proceedings of
the National Academy of Sciences of the United States of America,
102(28):9984-9989, 2005.
    48. Blayney, D.P., ``The Changing Landscape of U.S. Milk
Production,'' Statistical Bulletin No. 978, U.S. Department of
Agriculture, June 2002. http://usda.mannlib.cornell.edu/usda/nass/sb/sb978.pdf. Accessed October 23, 2013.
    49. Codex Alimentarius Commission. General Principles of Food
Hygiene, CAC/RCP 1-1969, 2003.
    50. Sobel J. and J. Watson, ``Chapter 10: Intentional Terrorism
Contamination of Food and Water,'' Beyond Anthrax, Springer Link,
2009.
    51. Stinson, T.F., J. Kinsey, D. Degeneffe, and K. Ghosh, How
Should America's Anti-Terrorism Budget Be Allocated? Findings From a
National Survey of Attitudes of U.S. Residents About Terrorism, The
Food Industry Center, March 2006. http://ageconsearch.umn.edu/bitstream/14351/1/tr06-01.pdf. Accessed October 21, 2013.
    52. Merriam-Webster. Vulnerability Page. http://www.merriam-webster.com/dictionary/vulnerability. Accessed October 21, 2013.
    53. U.S. Food and Drug Administration, Study and Report on the
Food Processing Sector, 2011.
    54. U.S. Food and Drug Administration. Analysis of Results for
FDA Food Defense Vulnerability Assessments and Identification of
Activity Types, April 2013. http://www.fda.gov/food/guidanceregulation/fsma/ucm347023.htm. Accessed September 25, 2013.
    55. U.S. Food and Drug Administration. Memorandum to the File:
Evaluation of the potential for intentional adulteration of animal
feed from acts of terrorism, December 2013.
    56. U.S. Department of Health and Human Services, Public Health
Service, and National

Toxicology Program. Report on Carcinogens, 12th Edition, 2011.
    57. U.S. Department of Health and Human Services, Centers for
Disease Control and Prevention, and U.S. Department of Agriculture.
HHS and USDA Select Agents and Toxins 7 CFR Part 331, 9 CFR Part
121, and 42 CFR Part 73, September 10, 2013. http://www.selectagents.gov/resources/List_of_Select_Agents_and_Toxins_2013-09-10.pdf. Accessed October 21, 2013.
    58. U.S. Food and Drug Administration. Vulnerability Assessments
of Food Systems: Final Summary Report, June 2009-February 2012.
http://www.fda.gov/downloads/Food/FoodDefense/UCM317547.pdf.
Accessed September 23, 2013.
    59. AIB International. Food Safety and Food Defense Education
Page. https://www.aibonline.org/foodsafetyeducation/index.html.
Accessed October 17, 2013.
    60. Center for Agriculture and Food Security and Preparedness
and University of Tennessee Knoxville. Instructor-Led Courses Page:
Agriculture and Food Vulnerability Assessment Training. http://www.vet.utk.edu/cafsp/courses.php. Accessed October 17, 2013.
    61. International Featured Standards. IFS Food: Standard for
Auditing Quality and Food Safety of Food Products, Version 6,
January 2012. http://www.ifs-certification.com/images/ifs_standards/ifs6/IFS_Food_V6_en.pdf. Accessed September 23, 2013.
    62. National Center for Food Protection and Defense. Food
Defense Online Modules Page. http://www.ncfpd.umn.edu/index.cfm/education/food-defense-online-modules/. Accessed October 17, 2013.
    63. AIB International. The AIB International Consolidated
Standards for Inspection: Prerequisite and Food Safety Programs,
January 2013. https://www.aibonline.org/Standards/2013FoodSafety_web_ENG.pdf. Accessed October 17, 2013.
    64. U.S. Food and Drug Administration. FDA's Preliminary
Regulatory Impact Analysis, Preliminary Regulatory Flexibility
Analysis, Preliminary Unfunded Mandates Reform Act Analysis,
Preliminary Paperwork Reduction Act Analysis, December 2013.
    65. U.S. Food and Drug Administration. Memorandum to the File:
Environmental analysis related to the proposed rule on focused
mitigation strategies to protect food against intentional
adulteration, November 2013.

List of Subjects in 21 CFR Part 121

    Food packaging, Foods.
    Therefore, under the Federal Food, Drug, and Cosmetic Act and under
authority delegated to the Commissioner of Food and Drugs, it is
proposed that 21 CFR chapter I be amended by adding part 121 to read as
follows:

PART 121--FOCUSED MITIGATION STRATEGIES TO PROTECT FOOD AGAINST
INTENTIONAL ADULTERATION

Subpart A--General Provisions
Sec.
121.3 Definitions.
121.5 Exemptions.
Subpart B--[Reserved]
Subpart C--Food Defense Measures
121.126 Requirement for a food defense plan.
121.130 Identification of actionable process steps.
121.135 Focused mitigation strategies for actionable process steps.
121.140 Monitoring.
121.145 Corrective actions.
121.150 Verification.
121.160 Training.
Subpart D--Requirements Applying to Records That Must Be Established
and Maintained
121.301 Records subject to the requirements of this subpart.
121.305 General requirements applying to records.
121.310 Additional requirements applying to the food defense plan.
121.315 Requirements for record retention.
121.320 Requirements for official review.
121.325 Public disclosure.
Subpart E--Compliance
121.401 Compliance.

    Authority:  21 U.S.C. 331, 342, 350g, 350(i), 371, 374.

Subpart A--General Provisions

Sec.  121.3  Definitions.

    The definitions and interpretations of terms in section 201 of the
Federal Food, Drug, and Cosmetic Act are applicable to such terms when
used in this part. The following definitions also apply:
    Actionable process step means a point, step, or procedure in a food
process at which food defense measures can be applied and are essential
to prevent or eliminate a significant vulnerability or reduce such
vulnerability to an acceptable level.
    Contaminant means any biological, chemical, physical or
radiological agent that may be intentionally added to food and that may
cause illness, injury or death.
    Facility means a domestic facility or a foreign facility that is
required to register under section 415 of the Federal Food, Drug, and
Cosmetic Act (21 U.S.C. 350d), in accordance with the requirements of
21 CFR part 1, subpart H.
    Farm means farm as defined in Sec.  1.227 of this chapter.
    FDA means the Food and Drug Administration.
    Focused mitigation strategies mean those risk-based, reasonably
appropriate measures that a person knowledgeable about food defense
would employ to significantly minimize or prevent significant
vulnerabilities identified at actionable process steps, and that are
consistent with the current scientific understanding of food defense at
the time of the analysis.
    Food means food as defined in section 201(f) of the Federal Food,
Drug, and Cosmetic Act (21 U.S.C. 321(f)) and includes raw materials
and ingredients.
    Food defense means the effort to protect food from intentional acts
of adulteration where there is an intent to cause public health harm
and economic disruption.
    Holding means storage of food. Holding facilities include
warehouses, cold storage facilities, storage silos, grain elevators,
and liquid storage tanks. For farms and farm mixed-type facilities,
holding also includes activities traditionally performed by farms for
the safe or effective storage of raw agricultural commodities grown or
raised on the same farm or another farm under the same ownership, but
does not include activities that transform a raw agricultural
commodity, as defined in section 201(r) of the Federal Food, Drug, and
Cosmetic Act, into a processed food as defined in section 201(gg).
    Manufacturing/processing means making food from one or more
ingredients, or synthesizing, preparing, treating, modifying or
manipulating food, including food crops or ingredients. Examples of
manufacturing/processing activities are cutting, peeling, trimming,
washing, waxing, eviscerating, rendering, cooking, baking, freezing,
cooling, pasteurizing, homogenizing, mixing, formulating, bottling,
milling, grinding, extracting juice, distilling, labeling, or
packaging. For farms and farm mixed-type facilities, manufacturing/
processing does not include activities that are part of harvesting,
packing, or holding.
    Mixed-type facility means an establishment that engages in both
activities that are exempt from registration under section 415 of the
Federal Food, Drug, and Cosmetic Act and activities that require the
establishment to be registered. An example of such a facility is a
``farm mixed-type facility,'' which is an establishment that grows and
harvests crops or raises animals and may conduct other activities
within the farm definition, but also conducts activities that require
the establishment to be registered.
    Monitor means to conduct a planned sequence of observations or
measurements to assess whether focused mitigation strategies are
consistently applied and to produce an accurate record for use in
verification.

    Packing means placing food into a container other than packaging
the food. For farms and farm mixed-type facilities, packing also
includes activities traditionally performed by farms to prepare raw
agricultural commodities grown or raised on the same farm or another
farm under the same ownership for storage and transport, but does not
include activities that transform a raw agricultural commodity, as
defined in section 201(r) of the Federal Food, Drug, and Cosmetic Act,
into a processed food as defined in section 201(gg).
    Qualified end-user, with respect to a food, means the consumer of
the food (where the term consumer does not include a business); or a
restaurant or retail food establishment (as those terms are defined in
Sec.  1.227 of this chapter) that:
    (1) Is located:
    (i) In the same State as the qualified facility that sold the food
to such restaurant or establishment; or
    (ii) Not more than 275 miles from such facility; and
    (2) Is purchasing the food for sale directly to consumers at such
restaurant or retail food establishment.
    Qualified facility means (when including the sales by any
subsidiary; affiliate; or subsidiaries or affiliates, collectively, of
any entity of which the facility is a subsidiary or affiliate) a
facility that is:
    (1) A very small business as defined in this part; or
    (2) A facility to which both of the following apply:
    (i) During the 3-year period preceding the applicable calendar
year, the average annual monetary value of the food manufactured,
processed, packed or held at such facility that is sold directly to
qualified end-users (as defined in this part) during such period
exceeded the average annual monetary value of the food sold by such
facility to all other purchasers; and
    (ii) The average annual monetary value of all food sold during the
3-year period preceding the applicable calendar year was less than
$500,000, adjusted for inflation.
    Significant vulnerability means a vulnerability for which a prudent
person knowledgeable about food defense would employ food defense
measures because of the potential for serious adverse health
consequences or death and the degree of accessibility to that point in
the food process.
    Significantly minimize means to reduce to an acceptable level,
including to eliminate.
    Small business means a business employing fewer than 500 persons.
    Verification means those activities, other than monitoring, that
establish that the system is operating according to the food defense
plan.
    Very small business means a business that has less than $10,000,000
in total annual sales of food, adjusted for inflation.
    Vulnerability means the susceptibility of a point, step, or
procedure in a facility's food process to intentional adulteration.

Sec.  121.5  Exemptions.

    (a) This part does not apply to a qualified facility, except that
qualified facilities must, upon request, provide for official review
documentation that was relied upon to demonstrate that the facility
meets this exemption. Such documentation must be retained for 2 years.
    (b) This part does not apply to the holding of food, except the
holding of food in liquid storage tanks.
    (c) This part does not apply to the packing, re-packing, labeling,
or re-labeling of food where the container that directly contacts the
food remains intact.
    (d) This part does not apply to activities of a facility that are
subject to section 419 of the Federal Food, Drug, and Cosmetic Act (21
U.S.C. 350h) (Standards for Produce Safety).
    (e)(1) This part does not apply with respect to alcoholic beverages
at a facility that meets the following two conditions:
    (i) Under the Federal Alcohol Administration Act (27 U.S.C. 201 et
seq.) or chapter 51 of subtitle E of the Internal Revenue Code of 1986
(26 U.S.C. 5001 et seq.) the facility is required to obtain a permit
from, register with, or obtain approval of a notice or application from
the Secretary of the Treasury as a condition of doing business in the
United States, or is a foreign facility of a type that would require
such a permit, registration, or approval if it were a domestic
facility; and
    (ii) Under section 415 of the Federal Food, Drug, and Cosmetic Act
(21 U.S.C. 350d) the facility is required to register as a facility
because it is engaged in manufacturing, processing, packing, or holding
one or more alcoholic beverages.
    (2) This part does not apply with respect to food other than
alcoholic beverages at a facility described in paragraph (e)(1) of this
section, provided such food:
    (i) Is in prepackaged form that prevents any direct human contact
with such food; and
    (ii) Constitutes not more than 5 percent of the overall sales of
the facility, as determined by the Secretary of the Treasury.
    (f) This part does not apply to the manufacturing, processing,
packing, or holding of food for animals other than man.

Subpart B--[Reserved]

Subpart C--Food Defense Measures

Sec.  121.126  Requirement for a food defense plan.

    (a) Food defense plan. The owner, operator, or agent in charge of a
facility must prepare, or have prepared, and implement a written food
defense plan.
    (b) Contents of a food defense plan. The food defense plan must
include:
    (1) The written identification of actionable process steps as
required by Sec.  121.130;
    (2) The written focused mitigation strategies as required by Sec.
121.135(b);
    (3) The written procedures for monitoring as required by Sec.
121.140(a);
    (4) The written corrective action procedures as required by Sec.
121.145(a)(1); and
    (5) The written verification procedures as required by Sec.
121.150(e).

Sec.  121.130  Identification of actionable process steps.

    The owner, operator, or agent in charge of a facility must identify
any actionable process steps, using the procedures described in either
paragraph (a) or paragraph (b) of this section. The identification of
actionable process steps and the assessment leading to that
identification must be written.
    (a) Key activity types. The owner, operator, or agent in charge of
a facility must assess, for each type of food manufactured, processed,
packed or held at the facility, whether the facility has one or more of
the following key activity types and identify the actionable process
steps associated with any key activity types present:
    (1) Bulk liquid receiving and loading--a step in which a bulk
liquid is received and unloaded from an inbound conveyance or loaded
into an outbound conveyance where a contaminant can be intentionally
introduced and, if it is, it is likely that the contaminant will be
distributed throughout the liquid due to sloshing, movement, or
turbulence caused by the receiving and unloading or loading activity.
    (2) Liquid storage and handling--a step in which a liquid is
contained in bulk storage tanks or in holding, surge,

or metering tanks where a contaminant can be intentionally introduced
and, if it is, it is likely that the contaminant will be distributed
into the food.
    (3) Secondary ingredient handling--a staging, preparation,
addition, or rework step where a contaminant can be intentionally
introduced into a relatively small amount of ingredient or rework and,
if it is, it is likely that the contaminant will be distributed into a
larger volume of food.
    (4) Mixing and similar activities--a step, such as mixing,
blending, homogenizing, or grinding where a contaminant can be
intentionally introduced and, if it is, it is likely that the
contaminant will be distributed into the food.
    (b) Vulnerability assessment. The owner, operator, or agent in
charge of a facility must conduct or have conducted, for each type of
food manufactured, processed, packed or held at the facility, an
evaluation to identify and prioritize the points, steps, and procedures
in a food operation based on their vulnerability to intentional
adulteration and to identify actionable process steps. Such
vulnerability assessments must be performed by an individual(s)
qualified by experience and/or training using appropriate methods.

Sec.  121.135  Focused mitigation strategies for actionable process
steps.

    (a) The owner, operator, or agent in charge of a facility must
identify and implement focused mitigation strategies at each actionable
process step to provide assurances that the significant vulnerability
at each step will be significantly minimized or prevented and the food
manufactured, processed, packed, or held by such facility will not be
adulterated under section 402 of the Federal Food, Drug, and Cosmetic
Act (21 U.S.C. 342).
    (b) Focused mitigation strategies must be written.
    (c) Focused mitigation strategies required under this section are
subject to:
    (1) Monitoring as required by Sec.  121.140;
    (2) Corrective actions as required by Sec.  121.145; and
    (3) Verification as required by Sec.  121.150.

Sec.  121.140  Monitoring.

    (a) The owner, operator, or agent in charge of a facility must
establish and implement written procedures, including the frequency
with which they are to be performed, for monitoring the focused
mitigation strategies.
    (b) The owner, operator, or agent in charge of a facility must
monitor the focused mitigation strategies with sufficient frequency to
provide assurances that they are consistently applied.
    (c) All monitoring of focused mitigation strategies in accordance
with this section must be documented in records that are subject to
verification in accordance with Sec.  121.150(a) and records review in
accordance with Sec.  121.150(c).

Sec.  121.145  Corrective actions.

    (a) Corrective action procedures. (1) The owner, operator, or agent
in charge of a facility must establish and implement written corrective
action procedures that must be taken if focused mitigation strategies
are not properly implemented.
    (2) The corrective action procedures must describe the steps to be
taken to ensure that appropriate action is taken to identify and
correct a problem with implementation of a focused mitigation strategy
to reduce the likelihood that the problem will recur.
    (b) Documentation. All corrective actions taken in accordance with
this section must be documented in records that are subject to
verification in accordance with Sec.  121.150(b) and records review in
accordance with Sec.  121.150(c).

Sec.  121.150  Verification.

    (a) Monitoring. The owner, operator, or agent in charge of a
facility must verify that monitoring is being conducted, as required by
Sec.  121.140.
    (b) Corrective actions. The owner, operator, or agent in charge of
a facility must verify that appropriate decisions about corrective
actions are being made, as required by Sec.  121.145.
    (c) Implementation and effectiveness. The owner, operator, or agent
in charge of a facility must verify that the focused mitigation
strategies are consistently implemented and are effectively and
significantly minimizing or preventing the significant vulnerabilities.
As appropriate to the facility and the food, this must include review
of the monitoring and corrective actions records within appropriate
timeframes to ensure that the records are complete, the activities
reflected in the records occurred in accordance with the food defense
plan, the focused mitigation strategies are effective, and appropriate
decisions were made about corrective actions.
    (d) Reanalysis. The owner, operator, or agent in charge of a
facility must:
    (1) Conduct a reanalysis of the food defense plan:
    (i) At least once every 3 years;
    (ii) Whenever a significant change is made in the activities
conducted at a facility operated by such owner, operator, or agent in
charge if the change creates a reasonable potential for a new
vulnerability or a significant increase in a previously identified
vulnerability;
    (iii) Whenever such owner, operator or agent in charge becomes
aware of new information about potential vulnerabilities associated
with the food operation or facility;
    (iv) Whenever a focused mitigation strategy is found to be
ineffective; and
    (v) Whenever FDA requires reanalysis to respond to new
vulnerabilities and developments in scientific understanding including,
as appropriate, results from the Department of Homeland Security
biological, chemical, radiological, or other terrorism risk assessment.
    (2) Complete such reanalysis and implement any additional focused
mitigation strategies needed to address the significant vulnerabilities
identified, if any, before the change in activities at the facility is
operative or, when necessary, during the first 6 weeks of production;
and
    (3) Revise the written plan if a significant change is made or
document the basis for the conclusion that no additional or revised
focused mitigation strategies are needed.
    (e) Documentation. All verification activities taken in accordance
with this section must be documented in records.

Sec.  121.160  Training.

    (a) Personnel and supervisors assigned to actionable process steps
must receive appropriate training in food defense awareness and their
respective responsibilities in implementing focused mitigation
strategies.
    (b) All training received in accordance with this section must be
documented in records.

Subpart D--Requirements Applying to Records That Must Be
Established and Maintained

Sec.  121.301  Records subject to the requirements of this subpart D.

    (a) Except as provided by paragraph (b) of this section, all
records required by subpart C of this part are subject to all
requirements of this subpart D.
    (b) The requirements of Sec.  121.310 apply only to the written
food defense plan.

Sec.  121.305  General requirements applying to records.

    Records must:
    (a) Be kept as original records, true copies (such as photocopies,
pictures, scanned copies, microfilm, microfiche,

or other accurate reproductions of the original records), or electronic
records, which must be kept in accordance with part 11 of this chapter;
    (b) Contain the actual values and observations obtained during
monitoring;
    (c) Be accurate, indelible, and legible;
    (d) Be created concurrently with performance of the activity
documented;
    (e) Be as detailed as necessary to provide history of work
performed; and
    (f) Include:
    (1) The name and location of the facility;
    (2) The date and time of the activity documented;
    (3) The signature or initials of the person performing the
activity; and
    (4) Where appropriate, the identity of the product and the
production code, if any.

Sec.  121.310  Additional requirements applying to the food defense
plan.

    The food defense plan must be signed and dated by the owner,
operator, or agent in charge of the facility:
    (a) Upon initial completion; and
    (b) Upon any modification.

Sec.  121.315  Requirements for record retention.

    (a) All records required by this part must be retained at the
facility for at least 2 years after the date they were prepared.
    (b) The food defense plan must be retained for at least 2 years
after its use is discontinued;
    (c) Except for the food defense plan, offsite storage of records is
permitted after 6 months following the date that the record was made if
such records can be retrieved and provided onsite within 24 hours of
request for official review. The food defense plan must remain onsite.
Electronic records are considered to be onsite if they are accessible
from an onsite location.
    (d) If the facility is closed for a prolonged period, the records
may be transferred to some other reasonably accessible location but
must be returned to the facility within 24 hours for official review
upon request.

Sec.  121.320  Requirements for official review.

    All records required by this part must be made promptly available
to a duly authorized representative of the Secretary of Health and
Human Services upon oral or written request.

Sec.  121.325  Public disclosure.

    Records required by this part will be protected from public
disclosure to the extent allowable under part 20 of this chapter.

Subpart E--Compliance

Sec.  121.401  Compliance.

    (a) The operation of a facility that manufactures, processes,
packs, or holds food for sale in the United States if the owner,
operator, or agent in charge of such facility is required to comply
with, and is not in compliance with, section 418 of the Federal Food,
Drug, and Cosmetic Act (21 U.S.C. 350g) or subparts C or D of this part
is a prohibited act under section 301(uu) of the Federal Food, Drug,
and Cosmetic Act (21 U.S.C. 331(uu)).
    (b) The failure to comply with section 420 of the Federal Food,
Drug, and Cosmetic Act (21 U.S.C. 350i) or subparts C or D of this part
is a prohibited act under section 301(ww) of the Federal Food, Drug,
and Cosmetic Act.

    Dated: December 13, 2013.
Leslie Kux,
Assistant Commissioner for Policy.
[FR Doc. 2013-30373 Filed 12-20-13; 8:45 am]
BILLING CODE 4160-01-P