[Federal Register Volume 81, Number 103 (Friday, May 27, 2016)]
[Rules and Regulations]
[Pages 34165-34223]
[FR Doc No: 2016-12373]

Vol. 81

Friday,

No. 103

May 27, 2016

Part IV

Department of Health and Human Services

-----------------------------------------------------------------------

 Food and Drug Administration

-----------------------------------------------------------------------

21 CFR Parts 11 and 121

Mitigation Strategies To Protect Food Against Intentional Adulteration;
Final Rule

Federal Register / Vol. 81 , No. 103 / Friday, May 27, 2016 / Rules
and Regulations

-----------------------------------------------------------------------

DEPARTMENT OF HEALTH AND HUMAN SERVICES

Food and Drug Administration

21 CFR Parts 11 and 121

[Docket No. FDA-2013-N-1425]
RIN 0910-AG63

Mitigation Strategies To Protect Food Against Intentional
Adulteration

AGENCY: Food and Drug Administration, HHS.

ACTION: Final rule.

-----------------------------------------------------------------------

SUMMARY: The Food and Drug Administration (FDA or we) is issuing this
final rule to require domestic and foreign food facilities that are
required to register under the Federal Food, Drug, and Cosmetic Act
(the FD&C Act) to address hazards that may be introduced with the
intention to cause wide scale public health harm. These food facilities
are required to conduct a vulnerability assessment to identify
significant vulnerabilities and actionable process steps and implement
mitigation strategies to significantly minimize or prevent significant
vulnerabilities identified at actionable process steps in a food
operation. FDA is issuing these requirements as part of our
implementation of the FDA Food Safety Modernization Act (FSMA).

DATES: This rule is effective July 26, 2016. See section VIII for
compliance dates.

FOR FURTHER INFORMATION CONTACT: Ryan Newkirk, Center for Food Safety
and Applied Nutrition (HFS-005), Food and Drug Administration, 5100
Paint Branch Pkwy., College Park, MD 20740,<PHONE_NUMBER>, email:
<EMAIL_ADDRESS>
SUPPLEMENTARY INFORMATION:

Table of Contents

 Executive Summary
    Purpose and Coverage of the Rule
    Summary of the Major Provisions of the Rule
    Costs and Benefits
I. Background
    A. FDA Food Safety Modernization Act
    B. Proposed Rule on Intentional Adulteration
    C. Appendix 4 to Draft Risk Assessment
    D. Public Comments
II. Legal Authority
    A. Section 103 of FSMA
    B. Section 106 of FSMA
    C. Intrastate Activities
III. General Comments on the Proposed Rule
    A. Comments on Overall Framework for the Regulatory Approach
    B. One Set of Requirements Under Sections 418 and 420 of the
FD&C Act
    C. Require Measures Only in the Event of a Credible Threat
    D. General Comments on Implementation and Compliance
    E. Comments on Requests for Additional Exemptions
    F. Other General Comments
    G. Other Issues Discussed in the Proposed Rule
IV. Subpart A: Comments on Specific Provisions
    A. Revisions to Definitions Also Used in Section 415
Registration Regulations (21 CFR Part 1, Subpart H) and Section 414
Recordkeeping Regulations (21 CFR Part 1, Subpart J)
    B. Other Definitions That We Proposed To Establish in Part 121
    C. Additional Definitions to Clarify Terms Not Defined in the
Proposed Rule
    D. Comments Asking FDA to Establish Additional Definitions or
Otherwise Clarify Terms Not Defined in the Rule
    E. Proposed Sec.  121.5--Exemptions
V. Subpart C: Comments on Food Defense Measures
    A. Proposed Sec.  121.126--Requirement for a Food Defense Plan
    B. Proposed Sec.  121.130--Identification of Actionable Process
Steps
    C. Proposed Sec.  121.135--Focused Mitigation Strategies for
Actionable Process Steps
    D. Final Sec.  121.138--Mitigation Strategies Management
Components
    E. Proposed Sec.  121.140--Monitoring
    F. Proposed Sec.  121.145--Corrective Actions
    G. Proposed Sec.  121.150--Verification
    H. Proposed Sec.  121.160--Training (Final Sec.  121.4)
    VI. Subpart D: Comments on Requirements Applying to Records That
Must Be Established and Maintained
    A. Proposed Sec.  121.301--Records Subject to the Requirements
of This Subpart D
    B. Proposed Sec.  121.305--General Requirements Applying to
Records
    C. Proposed Sec.  121.310--Additional Requirements Applying to
the Food Defense Plan
    D. Proposed Sec.  121.315--Requirements for Record Retention
    E. Proposed Sec.  121.320--Requirements for Official Review
    F. Proposed Sec.  121.325--Public Disclosure
    G. Proposed Sec.  121.330--Use of Existing Records
VII. Subpart E: Comments on Compliance--Proposed Sec.  121.401
VIII. Effective and Compliance Dates
IX. Executive Order 13175
X. Final Regulatory Impact Analysis
XI. Paperwork Reduction Act of 1995
XII. Analysis of Environmental Impact
XIII. Federalism
XIV. References

Executive Summary

Purpose and Coverage of the Rule

    This regulation implements three provisions of the FD&C Act, as
amended by FSMA, that relate to the intentional adulteration of food.
Section 418 of the FD&C Act (21 U.S.C. 350g) addresses intentional
adulteration in the context of facilities that manufacture, process,
pack, or hold food and are required to register under section 415 of
the FD&C Act (21 U.S.C. 350d). Section 419 of the FD&C Act (21 U.S.C.
350h) addresses intentional adulteration in the context of fruits and
vegetables that are raw agricultural commodities. Section 420 of the
FD&C Act (21 U.S.C. 350i) addresses intentional adulteration in the
context of high-risk foods and exempts farms except for farms that
produce milk. FDA is implementing the intentional adulteration
provisions in sections 418, 419, and 420 of the FD&C Act in this
rulemaking.
    The purpose of this rule is to protect food from intentional acts
of adulteration where there is an intent to cause wide scale public
health harm. This rule applies to both domestic and foreign facilities
that are required to register under section 415 of the FD&C Act. This
rule establishes several exemptions as follows:
     The rule does not apply to a very small business (i.e., a
business, including any subsidiaries or affiliates, averaging less than
$10,000,000, adjusted for inflation, per year, during the 3-year period
preceding the applicable calendar year in both sales of human food plus
the market value of human food manufactured, processed, packed, or held
without sale, e.g., held for a fee), except that the facility is
required to provide for official review, upon request, documentation
sufficient to show that the facility qualifies for this exemption.
     This rule does not apply to the holding of food, except
the holding of food in liquid storage tanks.
     This rule does not apply to the packing, re-packing,
labeling, or re-labeling of food where the container that directly
contacts the food remains intact.
     This rule does not apply to activities of a farm that are
subject to section 419 of the Federal Food, Drug, and Cosmetic Act
(Standards for Produce Safety).
     This rule does not apply with respect to alcoholic
beverages at a facility that meets certain conditions.
     This rule does not apply to the manufacturing, processing,
packing, or holding of food for animals other than man.
     This rule does not apply to on-farm manufacturing,
processing, packing, or holding by a small or very small business of
certain foods identified as having low-risk production practices if
such activities are the only activities conducted by the business
subject to section 418 of the FD&C Act.

Summary of the Major Provisions of the Final Rule

    This rule establishes various food defense measures that an owner,
operator, or agent in charge of a facility is required to implement to
protect against the intentional adulteration of food. Specifically:
     Prepare and implement a written food defense plan that
includes a vulnerability assessment to identify significant
vulnerabilities and actionable process steps, mitigation strategies,
and procedures for food defense monitoring, corrective actions, and
verification (Sec.  121.126).
     Identify any significant vulnerabilities and actionable
process steps by conducting a vulnerability assessment for each type of
food manufactured, processed, packed, or held at the facility using
appropriate methods to evaluate each point, step, or procedure in a
food operation (Sec.  121.130).
     Identify and implement mitigation strategies at each
actionable process step to provide assurances that the significant
vulnerability at each step will be significantly minimized or prevented
and the food manufactured, processed, packed, or held by the facility
will not be adulterated. For each mitigation strategy implemented at
each actionable process step, include a written explanation of how the
mitigation strategy sufficiently minimizes or prevents the significant
vulnerability associated with the actionable process step (Sec.
121.135).
     Establish and implement mitigation strategies management
components, as appropriate to ensure the proper implementation of each
such mitigation strategy, taking into account the nature of the
mitigation strategy and its role in the facility's food defense system
(Sec.  121.138).
     Establish and implement food defense monitoring
procedures, for monitoring the mitigation strategies, as appropriate to
the nature of the mitigation strategy and its role in the facility's
food defense system (Sec.  121.140).
     Establish and implement food defense corrective action
procedures that must be taken if mitigation strategies are not properly
implemented, as appropriate to the nature of the actionable process
step and the nature of the mitigation strategy (Sec.  121.145).
     Establish and implement specified food defense
verification activities, as appropriate to the nature of the mitigation
strategy and its role in the facility's food defense system (Sec.
121.150).
     Conduct a reanalysis of the food defense plan (Sec.
121.157).
     Ensure that all individuals who perform required food
defense activities are qualified to perform their assigned duties
(Sec.  121.4).
     Establish and maintain certain records, including the
written food defense plan (vulnerability assessment, mitigation
strategies and procedures for food defense monitoring, corrective
actions, and verification) and documentation related to training of
personnel. All records are subject to certain general recordkeeping and
record retention requirements (Sec. Sec.  121.301 to 121.330).
     The effective date is 60 days after this final rule is
published. However, we are providing for a longer timeline for
facilities to come into compliance. Facilities, other than small and
very small businesses, have 3 years after the effective date to comply
with part 121. Small businesses (i.e., those employing fewer than 500
full-time equivalent employees) have 4 years after the effective date
to comply with part 121. Very small businesses (i.e., businesses that
have less than $10,000,000, adjusted for inflation, per year, during
the 3-year period preceding the applicable calendar year in both sales
of human food plus the market value of human food manufactured,
processed, packed, or held without sale, e.g., held for a fee) have 5
years after the effective date to comply with Sec.  121.5(a).
    As discussed in detail in later sections of the rule, we made
several major revisions to the provisions of this rule, mainly in
response to comments, to provide for greater flexibility and clarity.
These major revisions to the regulatory text include the following:
     We removed the key activity types (KATs); however, the use
of the KATs is still permissible to conduct a vulnerability assessment
and will be further discussed in guidance.
     We specified three elements that must be evaluated when
conducting a vulnerability assessment: (1) The potential public health
impact (e.g., severity and scale) if a contaminant were added; (2) the
degree of physical access to the product; and (3) the ability of an
attacker to successfully contaminate the product.
     We specified that the vulnerability assessment must
consider the possibility of an inside attacker.
     We removed the distinction between ``broad'' and
``focused'' mitigation strategies.
     We made the mitigation strategy management components
(food defense monitoring, corrective actions, and verification) more
flexible by providing that they are required ``as appropriate to ensure
the proper implementation of the mitigation strategies, taking into
account the nature of each such mitigation strategy and its role in the
facility's food defense system.''
     We revised the terminology used for the food defense
management components such that monitoring, corrective actions, and
verification are now food defense monitoring, food defense corrective
actions, and food defense verification.
     We made the requirement to document food defense
monitoring more flexible by providing for use of exception records.
     We made the food defense corrective actions requirement
more flexible by providing that it is required ``as appropriate to the
nature of the actionable process step and the nature of the mitigation
strategy.''
     We made the requirement for verifying proper
implementation of mitigation strategies more flexible by providing for
``other activities appropriate for verification of proper
implementation of mitigation strategies.''
     We exempted records required by this rule from the
requirements of 21 Code of Federal Regulations, part 11.
     We provided for the use of existing records if certain
conditions are met.
     We removed the term ``qualified facility'' and instead
refer to ``very small business'' in the exemption under 121.5(a).
     We established an exemption for certain on-farm
manufacturing, processing, packing, or holding by small and very small
businesses of certain foods identified as having low-risk production
processes.
     We added a new definition for ``qualified individual'' and
included new requirements to ensure that all individuals who perform
activities required under subpart C are qualified to perform their
assigned activities.
     We provided longer timelines for facilities to come into
compliance with the rule.

Costs and Benefits

    The total cost of the rule, annualized over 10 years at a 7 percent
discount rate, is between $280 and $490 million. With a 3 percent
discount rate, the annualized cost is between $270 and $480 million.
The first-year cost is between $680 and $930 million. Counting only
domestic firms, the total annualized costs are between $90 and $150
million, with initial costs of between $220 and $300 million. The
average annualized cost per covered facility is between $9,000 and
$16,000,

and the average annualized cost per covered firm is between $27,000 and
$47,000.
    The benefits of the actions required by the rule are a reduction in
the possibility of illness and death resulting from intentional
adulteration of food. We monetize the damage that various intentional
adulteration scenarios might cause, and present a breakeven analysis
showing the number of prevented attacks at which the benefits are
larger than the costs. For attacks that are similar in impact to acts
of intentional adulteration that have happened in the United States in
the past, the breakeven threshold, counting only producer costs, is 28
to 48 attacks prevented every year. For attacks causing similar
casualties as major historical outbreaks of food-related illness, the
breakeven threshold is one or two attacks every year. For catastrophic
terrorist attacks causing thousands of fatalities, the breakeven
threshold is one attack prevented every 270 to 460 years.
    The table shows the approximate, rounded, mean values for various
cost components of the rule:

                  Annualized Cost and Benefit Overview
------------------------------------------------------------------------
  All Numbers are USD 2014 (millions),
        annualized over 10 years            3% Discount     7% Discount
------------------------------------------------------------------------
Costs:
    Learning about Rule.................              $3              $4
    Creating Food Defense Plans.........              10              11
    Mitigation Costs....................              26              28
    Monitoring, Corrective Action,                    62              62
     Verification.......................
    Employee Training...................               5               6
    Documentation.......................               9               9
    Subtotal (Domestic cost)............             115             119
    Cost to Foreign Firms...............             247             256
                                         -------------------------------
      Total.............................             362             375
Benefits:
                                         -------------------------------
    Lower Chance of Intentional
     Adulteration.......................           Unquantified
------------------------------------------------------------------------

I. Background

A. FDA Food Safety Modernization Act

    The FDA Food Safety Modernization Act (FSMA) (Pub. L. 111-353),
signed into law by President Obama on January 4, 2011, is intended to
allow FDA to better protect public health by helping to ensure the
safety and security of the food supply. FSMA enables us to focus more
on preventing food safety problems rather than relying primarily on
reacting to problems after they occur. The law also provides new
enforcement authorities to help achieve higher rates of compliance with
risk-based, prevention-oriented safety standards and to better respond
to and contain problems when they do occur. In addition, the law
contains important new tools to better ensure the safety of imported
foods and encourages partnerships with State, local, tribal, and
territorial authorities. A top priority for FDA are those FSMA-required
regulations that provide the framework for industry's implementation of
preventive controls and enhance our ability to oversee their
implementation for both domestic and imported food. To that end, we
proposed the seven foundational rules listed in table 1 and requested
comments on all aspects of these proposed rules.

    Table 1--Published Foundational Rules for Implementation of FSMA
------------------------------------------------------------------------
              Title                  Abbreviation         Publication
------------------------------------------------------------------------
Current Good Manufacturing        2013 proposed       78 FR 3646,
 Practice and Hazard Analysis      human preventive    January 16, 2013.
 and Risk-Based Preventive         controls rule.
 Controls for Human Food.
Standards for the Growing,        2013 proposed       78 FR 3504,
 Harvesting, Packing, and          produce safety      January 16, 2013.
 Holding of Produce for Human      rule.
 Consumption.
Current Good Manufacturing        2013 proposed       78 FR 64736,
 Practice and Hazard Analysis      animal preventive   October 29, 2013.
 and Risk-Based Preventive         controls rule.
 Controls for Food for Animals.
Foreign Supplier Verification     2013 proposed FSVP  78 FR 45730, July
 Programs (FSVP) for Importers     rule.               29, 2013.
 of Food for Humans and Animals.
Accreditation of Third-Party      2013 proposed       78 FR 45782, July
 Auditors/Certification Bodies     third-party         29, 2013.
 to Conduct Food Safety Audits     certification
 and to Issue Certifications.      rule.
Focused Mitigation Strategies To  2013 proposed       78 FR 78014,
 Protect Food Against              intentional         December 24,
 Intentional Adulteration.         adulteration rule.  2013.
Sanitary Transportation of Human  2014 proposed       79 FR 7006,
 and Animal Food.                  sanitary            February 5, 2014.
                                   transportation
                                   rule.
------------------------------------------------------------------------

    We also issued a supplemental notice of proposed rulemaking for the
rules listed in table 2 and requested comments on specific issues
identified in each supplemental notice of proposed rulemaking.

 Table 2--Published Supplemental Notices of Proposed Rulemaking for the
              Foundational Rules for Implementation of FSMA
------------------------------------------------------------------------
              Title                  Abbreviation         Publication
------------------------------------------------------------------------
Current Good Manufacturing        2014 supplemental   79 FR 58524,
 Practice and Hazard Analysis      human preventive    September 29,
 and Risk-Based Preventive         controls notice.    2014.
 Controls for Human Food.
Standards for the Growing,        2014 supplemental   79 FR 58434,
 Harvesting, Packing, and          produce safety      September 29,
 Holding of Produce for Human      notice.             2014.
 Consumption.
Current Good Manufacturing        2014 supplemental   79 FR 58476,
 Practice and Hazard Analysis      animal preventive   September 29,
 and Risk-Based Preventive         controls notice.    2014.
 Controls for Food for Animals.
Foreign Supplier Verification     2014 supplemental   79 FR 58574,
 Programs (FSVP) for Importers     FSVP notice.        September 29,
 of Food for Humans and Animals.                       2014.
------------------------------------------------------------------------

    We have finalized six of the foundational rulemakings, as listed in
table 3.

 Table 3--Published Foundational Final Rules for Implementation of FSMA
------------------------------------------------------------------------
              Title                  Abbreviation         Publication
------------------------------------------------------------------------
Current Good Manufacturing        PCHF final rule...  80 FR 55908,
 Practice, Hazard Analysis and                         September 17,
 Risk-Based Preventive Controls                        2015.
 for Human Food.
Current Good Manufacturing        PCAF final rule...  80 FR 56170,
 Practice, Hazard Analysis and                         September 17,
 Risk-Based Preventive Controls                        2015.
 for Food for Animals.
Standards for the Growing,        Produce final rule  80 FR 74354,
 Harvesting, Packing, and                              November 27,
 Holding of Produce for Human                          2015.
 Consumption.
Foreign Supplier Verification     FSVP final rule...  80 FR 74226,
 Programs (FSVP) for Importers                         November 27,
 of Food for Humans and Animals.                       2015.
Accreditation of Third-Party      Third-party final   80 FR 74570,
 Certification Bodies to Conduct   rule.               November 27,
 Food Safety Audits and to Issue                       2015.
 Certifications.
Sanitary Transportation of Human  Transport final     81 FR 20092, April
 and Animal Food.                  rule.               6, 2016.
------------------------------------------------------------------------

    As FDA finalizes these seven foundational rulemakings, we are
putting in place a framework for food safety that is modern and brings
to bear the most recent science on provisions to enhance food safety
and food defense, that is risk-based and focuses effort where the
hazards are most significant, and that is flexible and practical given
our current knowledge of food safety and food defense practices. To
achieve this, FDA has engaged in a great deal of outreach to the
stakeholder community to find the right balance in these regulations of
flexibility and accountability.
    Since FSMA was enacted in 2011, we have been involved in
approximately 600 engagements on FSMA and the proposed rules, including
public meetings, Webinars, listening sessions, farm tours, and
extensive presentations and meetings with various stakeholder groups
(Ref. 1) (Ref. 2). As a result of this stakeholder dialogue, FDA
decided to issue the four supplemental notices of proposed rulemaking
to share our current thinking on key issues and get additional
stakeholder input on those issues. As we move forward into the next
phase of FSMA implementation, we intend to continue this dialogue and
collaboration with our stakeholders, through guidance, education,
training, and assistance, to ensure that stakeholders understand and
engage in their roles in food safety and food defense. FDA believes
these seven foundational final rules, when implemented, will fulfill
the paradigm shift toward prevention that was envisioned in FSMA and be
a major step forward for food safety and food defense that will protect
consumers into the future.

B. Proposed Rule on Intentional Adulteration

    In the Federal Register of December 24, 2013 (78 FR 78014), we
issued a proposed rule to implement the intentional adulteration
provisions in sections 103, 105, and 106 of FSMA (proposed rule). We
initially requested public comments on the proposed rule by March 31,
2014. We extended the comment period for the proposed rule until June
30, 2014, in response to several requests for an extension.
    The proposed rule proposed to require various food defense measures
that an owner, operator, or agent in charge of a facility would be
required to implement to protect against the intentional adulteration
of food, and can be summarized as follows:
     Prepare and implement a written food defense plan that
includes actionable process steps, focused mitigation strategies, and
procedures for monitoring, corrective actions, and verification
(proposed Sec.  121.126).
     Identify any actionable process steps, using one of two
procedures. In the proposed rule, we explained that FDA has analyzed
vulnerability assessments conducted using the CARVER+Shock methodology
and identified four key activity types: Bulk liquid receiving and
loading; Liquid storage and handling; Secondary ingredient handling;
and Mixing and similar activities. We further explained that FDA has
determined that the presence of one or more of these key activity types
at a process step (e.g., manufacturing, processing, packing, or holding
of food) indicates a significant vulnerability under section 418 of the
FD&C Act and that the food is at high risk of intentional adulteration
caused by acts of terrorism under section 420 of the FD&C Act. We
proposed that facilities may identify actionable process steps using
the FDA-identified key activity types as described in proposed Sec.
121.130(a) or conduct their own facility-specific vulnerability
assessments as provided in proposed Sec.  121.130(b).
     Identify and implement focused mitigation strategies at
each actionable

process step to provide assurances that the significant vulnerability
at each step will be significantly minimized or prevented and the food
manufactured, processed, packed, or held by the facility will not be
adulterated (proposed Sec.  121.135).
     Establish and implement procedures, including the
frequency with which they are to be performed, for monitoring the
focused mitigation strategies (proposed Sec.  121.140)
     Establish and implement corrective action procedures that
must be taken if focused mitigation strategies are not properly
implemented (proposed Sec.  121.145).
     Verify that monitoring is being conducted and appropriate
decisions about corrective actions are being made; verify that the
focused mitigation strategies are consistently implemented and are
effectively and significantly minimizing or preventing the significant
vulnerabilities; and conduct a reanalysis of the food defense plan
(proposed Sec.  121.150).
     Ensure that personnel and supervisors assigned to
actionable process steps receive appropriate training in food defense
awareness and their respective responsibilities in implementing focused
mitigation strategies (proposed Sec.  121.160).
     Establish and maintain certain records, including the
written food defense plan; written identification of actionable process
steps and the assessment leading to that identification; written
focused mitigation strategies; written procedures for monitoring,
corrective actions, and verification; and documentation related to
training of personnel. All such records are subject to certain
recordkeeping requirements, record retention requirements, requirements
for official review and public disclosure requirements (proposed
Sec. Sec.  121.301 to 121.325).
     Proposed the effective date as 60 days after this final
rule is published. However, we proposed for a longer timeline for
facilities to come into compliance. Facilities, other than small and
very small businesses, would have 1 year after the effective date to
comply with part 121. Small businesses (i.e., those employing fewer
than 500 persons) would have 2 years after the effective date to comply
with part 121. Very small businesses (i.e., businesses that have less
than $10,000,000 in total annual sales of food, adjusted for inflation)
would be considered a qualified facility and have 3 years after the
effective date to comply with Sec.  121.5(a).
    We requested comment on all aspects of the proposed requirements.
In addition, we described our thinking and sought comment on other
issues, including the framework of the rule; activities that occur on
produce farms; transportation carriers; food for animals; acts of
disgruntled employees, consumers, or competitors; economically
motivated adulteration; low-risk activities at farm mixed-type
facilities; activities that occur on dairy farms; and other ways to
focus on foods with a high risk of intentional adulteration caused by
terrorism.

C. Appendix 4 to Draft Risk Assessment

    We issued for public comment an ``Appendix 4 to Draft Qualitative
Risk Assessment of Risk of Activity/Food Combinations for Activities
(Outside the Farm Definition) Conducted in a Facility Co-Located on a
Farm'' (the draft RA Appendix) (78 FR 78064, December 24, 2013). The
purpose of the draft RA Appendix was to provide a science-based risk
analysis of those foods whose production processes would be considered
low risk with respect to the risk of intentional adulteration caused by
acts of terrorism. We used the tentative conclusions of the section
103(c)(1)(C) draft RA Appendix to seek comment in the proposed rule on
possible exemptions or modified requirements for this final rule (78 FR
78014 at 78029). We are including the final appendix to the risk
assessment in the docket established for this document (Ref. 3).

D. Public Comments

    We received more than 200 public submissions on the proposed rule,
each containing one or more comments. We received submissions from
diverse members of the public, including food facilities (including
facilities co-located on a farm); farms; cooperatives; coalitions;
trade organizations; consulting firms; law firms; academia; public
health organizations; public advocacy groups; consumers; consumer
groups; Congress, Federal, State, local, and tribal Governments; and
other organizations. Some submissions included signatures and
statements from multiple individuals. Comments addressed virtually
every provision of the proposed rule, including our requests for
comment on including additional provisions that we did not include in
the proposed regulatory text. In the remainder of this document, we
describe these comments, respond to them, and explain any revisions we
made to the proposed rule.
    Some comments address issues that are outside the scope of this
rule. For example, some comments express concern about overregulation
in general. Some comments believe the Department of Homeland Security
is the Federal Agency that should protect the food supply. Some
comments express concern about ``genetically modified organisms'',
while other comments express concern about the amount of chemicals in
food. Some comments express concern that extreme consolidation of our
food system is the main reason that it could be a target for terrorism
or other intentional acts aimed at causing widespread human casualties.
These comments state that decentralization is the most resilient
defense against those who wish to contaminate the food supply. We do
not discuss such comments in this document.

II. Legal Authority

    The proposed rule contained an explanation of its legal basis under
authorities in the FDA Food Safety Modernization Act and section 701 of
the FD&C Act. After considering the comments received in response to
the proposed rule, FDA made changes in the final rule. The legal
authorities relied on in the final rule are the same as those in the
proposed rule unless otherwise described in the sections that follow.

A. Section 103 of FSMA

    Section 103 of FSMA, Hazard Analysis and Risk-Based Preventive
Controls, amends the FD&C Act to create a new section 418, which
mandates rulemaking. Section 418(n)(1)(A) of the FD&C Act requires that
the Secretary issue regulations ``to establish science-based minimum
standards for conducting a hazard analysis, documenting hazards,
implementing preventive controls, and documenting the implementation of
the preventive controls. . . .'' Section 418(n)(1)(B) of the FD&C Act
requires that the regulations define the terms ``small business'' and
``very small business,'' taking into consideration the study of the
food processing sector required by section 418(l)(5) of the FD&C Act.
Further, section 103(e) of FSMA creates a new section 301(uu) in the
FD&C Act (21 U.S.C. 331(uu)) to prohibit ``[t]he operation of a
facility that manufactures, processes, packs, or holds food for sale in
the United States if the owner, operator, or agent in charge of such
facility is not in compliance with section 418 [of the FD&C Act].''
    In addition to rulemaking requirements, section 418 contains
requirements applicable to the owner, operator, or agent in charge of a
facility

required to register under section 415. Section 418(a) is a general
provision that requires the owner, operator, or agent in charge of a
facility to evaluate the hazards that could affect food manufactured,
processed, packed, or held by the facility, identify and implement
preventive controls, monitor the performance of those controls, and
maintain records of the monitoring. In addition to the general
requirements in section 418(a) of the FD&C Act, sections 418(b)-(i)
contain more specific requirements applicable to facilities, including
several provisions explicitly directed at intentional adulteration. For
example, section 418(b)(2) of the FD&C Act specifies that the owner,
operator, or agent in charge of a facility shall identify and evaluate
hazards that may be intentionally introduced, including by acts of
terrorism. Section 418(c)(2) of the FD&C Act specifies that the owner,
operator, or agent in charge of a facility shall identify and implement
preventive controls to provide assurances that any hazards that relate
to intentional adulteration will be significantly minimized or
prevented and addressed, consistent with section 420 of the FD&C Act.
    Sections 418(j)-(m) of the FD&C Act and sections 103(c)(1)(D) and
(g) of FSMA provide authority for certain exemptions and modifications
to the requirements of section 418 of the FD&C Act. These include
provisions related to seafood and juice hazard analysis critical
control point (HACCP), and low-acid canned food (section 418(j));
activities of facilities subject to section 419 of the FD&C Act
(Standards for Produce Safety) (section 418(k)); qualified facilities
(section 418(l)); facilities that are solely engaged in the production
of food for animals other than man, the storage of raw agricultural
commodities (other than fruits and vegetables) intended for further
distribution or processing, or the storage of packaged foods that are
not exposed to the environment (section 418(m)); facilities engaged
only in certain low risk on-farm activities on certain foods conducted
by small or very small businesses (section 103(c)(1)(D) of FSMA), and
dietary supplements (section 103(g) of FSMA). We are issuing all of the
provisions of the rule under section 418 of the FD&C Act, except with
respect to facilities that are exempt from its coverage.

B. Section 106 of FSMA

    Section 106 of FSMA, Protection Against Intentional Adulteration,
amends the FD&C Act to create a new section 420, which mandates
rulemaking. Section 420 of the FD&C Act requires FDA to issue
regulations to protect against the intentional adulteration of food.
Section 420(b)(1) of the FD&C Act requires that such regulations are to
specify how a person is to assess whether the person is required to
implement mitigation strategies or measures intended to protect against
the intentional adulteration of food. Section 420(b)(2) of the FD&C Act
requires that the regulations specify appropriate science-based
mitigation strategies or measures to prepare and protect the food
supply chain at specific vulnerable points, as appropriate. Section
420(c) of the FD&C Act provides that such regulations are to apply only
to food for which there is a high risk of intentional adulteration and
for which such intentional adulteration could cause serious adverse
health consequences or death to humans or animals. Section 420(c)(1)
provides that such foods are to include those for which FDA has
identified clear vulnerabilities. Section 420(d) of the FD&C Act limits
applicability on farms to farms that produce milk. Further, section
106(d) of FSMA creates a new section 301(ww) in the FD&C Act to
prohibit ``[t]he failure to comply with section 420 [of the FD&C
Act].'' We are issuing all of the provisions of the rule under section
420 of the FD&C Act.

C. Intrastate Activities

    FDA concludes that the rule should apply to activities that are
intrastate in character. Facilities are required to register under
section 415 of the FD&C Act regardless of whether the food from the
facility enters interstate commerce (Sec.  1.225(b)). The plain
language of section 418 of the FD&C Act applies to facilities that are
required to register under section 415 of the FD&C Act (section
418(o)(2)) and does not exclude a facility because food from such a
facility is not in interstate commerce. Similarly, the plain language
of section 420 of the FD&C Act requires FDA to issue regulations to
protect against the intentional adulteration of food and does not
include a limitation to interstate commerce. Further, the prohibited
act provisions in sections 301(uu) and (ww) of the FD&C Act (21 U.S.C.
331(uu) and (ww)) do not require an interstate commerce nexus. Notably,
other subsections in section 301 of the FD&C Act, and section 304 of
the FD&C Act (21 U.S.C. 334) demonstrate that Congress has included a
specific interstate commerce nexus in the provisions of the FD&C Act
when that is its intent. Accordingly, it is reasonable to interpret
sections 418, 420, 301(uu), and 301(ww) of the FD&C Act as not limited
to those facilities with a direct connection to interstate commerce.

III. General Comments on the Proposed Rule

A. Comments on Overall Framework for the Regulatory Approach

    We proposed a HACCP-type approach, like the one proposed for the
systematic control of food safety hazards in the PCHF proposed rule, as
the most effective means of ensuring that mitigation strategies are
consistently applied once the significant vulnerabilities are
identified and appropriate mitigation strategies are developed. We
requested comment on the appropriateness of a HACCP-type system to
ensure that mitigation strategies designed to significantly minimize or
prevent intentional adulteration related to terrorism are effective and
implemented as intended. We also requested comment about whether there
are other approaches that would be more suitable to address intentional
adulteration related to terrorism.
    In the following paragraphs, we discuss the comments that disagree
with, or request changes to, the proposed approach. After considering
these comments, we are continuing to require an approach based on an
analysis of hazards/vulnerabilities and the implementation of measures
to mitigate the identified hazards/vulnerabilities (a HACCP-type
approach); however, we are providing for additional flexibility, as
requested.
    (Comment 1) Some comments state food defense and food safety
require different approaches because they are different disciplines.
The comments explain that the science is different, that food safety
deals with known and identifiable risks whereas food defense deals with
unknown, often unidentifiable, and ever changing threats and that food
safety risks can be prevented or reduced to an acceptable level but
food defense threats only can be mitigated. The comments conclude that
regulatory requirements addressing food defense must reflect these key
differences between food defense and food safety and use different
terminology. Some comments state that FSMA does not require a
preventive controls approach for food defense, and a traditional HACCP
approach is too rigorous and prescriptive for food defense. Conversely,
other comments support regulatory requirements for food defense that
are based on the proactive approach found in HACCP, specifically HACCP
concepts related to

analyzing problems and devising appropriate solutions.
    (Response 1) We disagree that food safety and food defense require
entirely different approaches to ensure that food is not adulterated.
We agree that there are important, specific differences between food
safety and food defense, and these differences require different
requirements for particular components of the approaches. However, we
believe that food safety and food defense are more similar than they
are different. For both food safety and food defense, the framework for
preventing adulteration, whether it is intentional or unintentional, is
the same: (1) An analysis is needed to identify the hazards for which
measures should be taken to mitigate the hazard; (2) appropriate
measures must be identified and implemented; and (3) management
components are needed to ensure systematically that the measures are
functioning as intended. This is the foundation of the HACCP approach,
and we continue to believe this approach is appropriate for food
defense as well as food safety. In food defense terms, the three
elements are as follows: (1) A vulnerability assessment is needed to
identify significant vulnerabilities; (2) mitigation strategies must be
identified and implemented; and (3) mitigation strategy management
components are needed to ensure systematically that the mitigation
strategies are functioning as intended. See the proposed rule (78 FR
78014 at 78025) for a discussion of how the hazard analysis/preventive
control model is consistent with a vulnerability assessment/mitigation
strategy model.
    We agree that the nature of the hazards being analyzed for food
safety and food defense purposes are different, but we disagree that
this means they need a different analytical approach. As discussed more
in the responses to Comment 71 and Comment 72, the vulnerabilities
considered for food defense, while not as predictable as some food
safety hazards, lend themselves to analytical assessment because they
have commonalities that would make them attractive to an attacker,
particularly an inside attacker. In this rule, we are focusing on
preventing the actions of an inside attacker. Our interactions with the
intelligence community, as well as the conclusions reached during
vulnerability assessments conducted in collaboration with industry,
have identified the inside attacker as the highest threat. Though FDA
is not aware of any information that points to an imminent, credible
threat to the food supply, achieving public health harm through an
attack via food remains an advocated option for terrorist groups (Ref.
4). Additionally, recent events have shown a general evolution in
terrorist activity away from large, centrally planned attacks to
attacks that are locally planned and implemented. These locally planned
attacks may be conducted by assailants inspired by terrorist groups but
who otherwise have no formal connection to, or regular contact with, a
terrorist organization (Ref. 5, 6, 7). Moreover, recent attacks
indicate that terrorist groups are adept at responding to protections
put in place to harden certain targets and will evolve their thinking
toward less-protected targets. Given the potential for wide scale
public health harm from intentional adulteration of the food supply, we
believe that a comprehensive, systematic approach, such as a HACCP-type
approach, is the most appropriate one and is not too rigorous. Further,
as an example of what can happen when someone intending harm has inside
access, in December 2013 a contract employee at Aqlifoods (a subsidiary
of Naruha Nichiro Holdings, Japan's largest seafood company),
intentionally adulterated several frozen foods with the pesticide
malathion. Japanese authorities believe the assailant brought malathion
to the plant and injected it into frozen foods during the manufacturing
process (Ref. 8). The employee exploited his access to the food prior
to packaging to introduce the agent. The adulteration resulted in at
least 2,843 mild foodborne illnesses and a recall of 6.4 million
packages of frozen seafood (Ref. 9). Though this assailant was most
likely trying to harm the company and not trying to cause massive
public health harm, this example indicates the damage that can be done
by an inside attacker.
    Section 103 of FSMA reflects a Congressional determination that the
``hazard analysis and risk-based preventive controls'' approach is
appropriate for food defense. Section 103 directs us to promulgate a
framework for intentional adulteration that includes concepts that are
similar to those in HACCP. Section 103 of FSMA contains requirements
applicable to the owner, operator, or agent in charge of a facility
required to register under section 415 of the FD&C Act. Section 103(a)
of FSMA is a general provision that requires the owner, operator, or
agent in charge of a facility to evaluate the hazards that could affect
food manufactured, processed, packed, or held by the facility, identify
and implement preventive controls, monitor the performance of those
controls, and maintain records of the monitoring. Section 103(a)
specifies that the purpose of the preventive controls is to ``prevent
the occurrence of such hazards and provide assurances that such food is
not adulterated under section 402 [of the FD&C Act] or misbranded under
section 403(w) [of the FD&C Act]. . . .'' In addition to the general
requirements in section 418(a) of the FD&C Act, sections 418(b)-(i)
contain more specific requirements applicable to facilities. These
include hazard analyses for both unintentionally and intentionally
introduced hazards (section 418(b)(1)(2)), preventive controls for both
unintentionally and intentionally introduced hazards (section 418(c)
(1)(2)), monitoring (section 418(d)), corrective actions (section
418(e)), verification (section 418(f)), recordkeeping (section 418(g)),
a written plan and documentation (section 418(h)), and reanalysis of
hazards (section 418(i)). Therefore, we believe that FSMA directs us to
take a ``preventive controls approach'' for food defense, as well as
food safety.
    We agree that, while the regulatory approaches for food defense and
food safety fundamentally should be similar, there need to be
differences in how the approach is implemented for food defense. We do
not agree that a HACCP-type approach is too prescriptive in general for
food defense, but additional flexibility is needed in the application
of the approach for food defense given the difference in the nature of
the potential adulteration and the implementation of mitigation
strategies that are not likely to be process-oriented or readily lend
themselves to validation. We also agree that differences in terminology
are appropriate. (See responses to Comment 2, Comment 45, and Comment
47.)
    (Comment 2) While some comments acknowledge that section 103 of
FSMA directs us to promulgate a framework for intentional adulteration
that includes concepts that are similar to those in HACCP, these
comments also request that we provide more flexibility than a
traditional HACCP framework, with specific requests for flexibility in
the management components of monitoring, corrective actions, and
verification.
    (Response 2) We agree that the intentional adulteration regulatory
framework should provide more flexibility than that of a traditional
HACCP approach. We believe there are key disciplinary differences
between food safety and food defense that argue for additional
flexibility in the intentional adulteration framework. Most
significantly, improper implementation of preventive controls is more
likely to result in adulterated

food than is improper implementation of mitigation strategies.
Preventive controls are more likely to be process-oriented and lend
themselves to being scientifically validated. Mitigation strategies are
more likely to be implemented to reduce physical access to a point,
step, or procedure, and/or reduce the opportunity for an attacker to
successfully contaminate the food and, in most instances, do not lend
themselves to scientific validation. These differences indicate a need
to apply the concepts of the HACCP approach in a more flexible manner
for food defense.
    Recognizing the differences in the likelihood of adulteration and
the differences in mitigation strategies compared to the process-
oriented preventive controls, the intentional adulteration corrective
actions requirements contain neither provisions for the evaluation of
all affected food for safety in the event a corrective action is
required nor provisions for unanticipated corrective actions (see Sec.
121.145). Further, the intentional adulteration verification
requirement does not contain provisions for validation, calibration,
product testing, environmental monitoring, review of records for
calibration, testing, or supplier verification (see Sec.  121.150). We
believe this more flexible approach for food defense is appropriate and
adds flexibility compared to the provisions of the PCHF final rule.
    We also have added flexibility to the identification of mitigation
strategies similar to the flexibility added to the identification of
preventive controls in the PCHF final rule (80 FR 55908 at 56020).
Although each facility subject to this rule must prepare and implement
a food defense plan, the mitigation strategies that the facility would
establish and implement would depend on the facility, the food, and the
outcome of the facility's vulnerability assessment to identify
actionable process steps (Sec. Sec.  121.130 and 121.135). For examples
of this added flexibility related to mitigation strategies, see the
discussion in section V.C.
    As requested in comments, we also have changed regulatory text to
reflect the inclusion of more flexibility in monitoring, corrective
actions, and verification (see Sec. Sec.  121.138, 121.140, 121.145,
and 121.150 and discussed in more detail in the relevant sections later
in this document). These changes are similar to those made in the
regulatory text for preventive controls management components.
    As we have concluded that similar regulatory approaches are
appropriate for both food safety and food defense, we have adopted the
flexibility included in the PCHF final rule management components
regulatory text, as appropriate for these intentional adulteration
requirements. The intentional adulteration provisions for mitigation
strategies management components make clear that mitigation strategies
management components are required as appropriate to ensure the proper
implementation of each such mitigation strategy, taking into account
the nature of the mitigation strategy and its role in the facility's
food defense system, and we have added Sec.  121.138 to reflect this
change. Likewise, the provisions for each of the individual mitigation
strategies management components (i.e., food defense monitoring, food
defense corrective actions and food defense verification) individually
provide flexibility, either by specifying that the provisions apply as
appropriate to the nature of the mitigation strategy and its role in
the facility's food defense system (i.e., for food defense monitoring
and food defense verification) or as appropriate to both the nature of
the mitigation strategy and the nature of the significant vulnerability
(i.e., for food defense corrective actions) (see Sec. Sec.  121.140,
121.145, and 121.150). For additional discussion of the flexibility
added for the mitigation strategies management components, see sections
V.E, V.F, and V.G and in particular the responses to Comment 88,
Comment 89, Comment 90, Comment 92, Comment 93, and Comment 95.
    (Comment 3) Some comments state that the intentional adulteration
proposed HACCP approach is ``one size fits all.''
    (Response 3) We disagree. The intentional adulteration requirements
to conduct a vulnerability assessment to identify actionable process
steps, identify and implement mitigation strategies, and use mitigation
strategies management components provide significant flexibility, are
tailored to the facility and its processes, and are therefore not
``one-size-fits-all.'' Although each facility with significant
vulnerabilities is required to identify and implement mitigation
strategies, the mitigation strategies that the facility would establish
and implement would depend on the facility, the food, and the outcome
of the facility's vulnerability assessment (Sec. Sec.  121.130 and
121.135). In addition, the mitigation strategies management components
(i.e., food defense monitoring, food defense corrective actions, and
food defense verification) that a facility would establish and
implement for its mitigation strategies would be established as
appropriate to ensure the proper implementation of the mitigation
strategies, taking into account the nature of each such mitigation
strategy and its role in the facility's food safety system (Sec.
121.138).
    (Comment 4) Some comments state that management and oversight
activities of mitigation strategies should occur if they are
``appropriate'' (suitable for a particular purpose or capable of being
applied) and ``necessary'' (taking into account the nature of both the
significance of the vulnerability and the particular mitigation
strategy) for food defense.
    (Response 4) We agree that mitigation strategies management
components of the HACCP-type framework should occur if they are
appropriate and necessary. As we have concluded that similar regulatory
approaches are appropriate for food safety and food defense, we have
adopted the flexibility included in the PCHF final rule management
components regulatory text (Sec.  117.140(a)), as appropriate for these
intentional adulteration requirements. The intentional adulteration
provisions for mitigation strategies management components make clear
that mitigation strategies management components are required as
appropriate to ensure the proper implementation of the mitigation
strategies, taking into account the nature of each such mitigation
strategy and its role in the facility's food defense system, and we
have revised proposed requirements for monitoring, corrective actions,
and verification to reflect these changes (see Sec. Sec.  121.138,
121.140, 121.145, and 121.150).
    (Comment 5) Some comments state that the requirement for the amount
of paperwork associated with a HACCP-type approach, and the information
contained therein, may be counterproductive to the goal of mitigating
or preventing vulnerabilities because individuals or groups interested
in conducting these types of attacks may try to access this
information.
    (Response 5) We disagree. A written food defense plan and its
required contents, which include the vulnerability assessment, the
identification and implementation of mitigation strategies, and
mitigation strategies management components, are essential to
significantly minimizing or preventing significant vulnerabilities
related to intentional adulteration of food, where the intent of the
adulteration is to cause wide scale public health harm. The required
documentation of the plan and implementation of the plan are necessary
so that both the facility and FDA can ensure that the significant

vulnerabilities are being addressed properly. We encourage facilities
covered by this rule to adequately protect food defense plans and
associated information and records. For a more detailed discussion
related to protecting food defense plan information, see section VI.F.
    (Comment 6) One comment disagrees with the HACCP framework, and
requests we use a current good manufacturing practice (CGMP) approach.
This comment states that such an approach provides facilities with
sufficient flexibility to address intentional adulteration. Another
comment supports using a HACCP approach in the context of allowing
facilities to utilize prerequisite programs.
    (Response 6) We disagree that a CGMP approach is the most
appropriate approach. We address the appropriateness and flexibility of
the HACCP-type approach in responses to Comment 1 and Comment 2. We
address the potential to consider pre-existing activities while
conducting a vulnerability assessment and identifying and implementing
mitigation strategies in Response 72 and Response 83.
    We are requiring a HACCP-type approach rather than a CGMP-type
approach for several reasons. First, the management components in a
HACCP-type approach are the most effective means, as discussed in the
response to Comment 1, of ensuring that the mitigation strategies are
consistently applied. Second, as with food safety, there are hazards
(or in food defense terms, vulnerabilities) that warrant requirements
that are more rigorous than general, non-targeted CGMP provisions. The
vulnerabilities that warrant such requirements are those that we have
concluded are the highest risk, namely intentional adulteration
conducted at actionable process steps, including those vulnerabilities
associated with an inside attacker, intended to cause wide scale public
health harm. It is precisely these attacks at these points that require
the most robust and rigorous system to ensure that vulnerabilities are
assessed, significant vulnerabilities are identified, and mitigation
strategies are properly implemented to reduce these significant
vulnerabilities. General, non-targeted CGMP requirements (e.g.,
restricting access to outsiders) would not necessarily focus on the
significant vulnerabilities or ensure that mitigation strategies are
implemented to harden the potential targets. Finally, section 418 of
the FD&C Act requires that hazards intentionally introduced be
addressed in a HACCP-type framework.
    (Comment 7) One comment asserts that because we already have
required food safety plans for facilities under a separate rulemaking,
and because an act of intentional adulteration of food that would cause
wide scale public health harm is not likely to occur, a separate food
defense plan, and thus this rule, is not necessary.
    (Response 7) We disagree. Although it is true that most facilities
covered by this rule will also have a food safety or HACCP plan, the
focus of those plans is on preventing the contamination of food from
hazards that are unintentionally introduced and, therefore, the control
points and the measures implemented in those plans differ from those in
a food defense plan. It is unlikely that a facility would choose
preventive controls under the PCHF final rule that would be sufficient
to address vulnerabilities to intentional adulteration. For example, it
is unlikely that a facility conducting a hazard analysis would identify
the step of holding a liquid, such as a syrup, in a tank in a facility
as a hazard requiring a preventive control. In conducting a hazard
analysis, the facility would likely be considering whether there are
hazards associated with the incoming syrup or ingredients for the syrup
or the syrup production process (inadequate heating), but would not
likely identify the step of holding the syrup as requiring a preventive
control. However, in a vulnerability assessment, the step of holding
liquid syrup may be identified as a significant vulnerability if (1)
there would be significant public health consequences if a contaminant
were added, (2) there is access to the product while being held, and
(3) an attacker would be able to successfully contaminate the product.
    With regard to the statement that an act of intentional
adulteration is not likely to occur, we agree that the likelihood of an
incident is low. However, given the potential for a successful
intentional adulteration of food to cause wide scale public health
harm, it is prudent for the largest facilities to take preventive
measures, and it is required by sections 418 and 420 of the FD&C Act
that they do so.

B. One Set of Requirements Under Sections 418 and 420 of the FD&C Act

    (Comment 8) One comment asserts that the proposed rule blends
sections 103 and 106 of FSMA into one set of requirements and disagrees
with that approach. The comment states that section 103 requires basic
foundational food defense activities, including food defense plans at
all registered food facilities. The comment contrasts this with section
106, which it states provides FDA with the authority to designate
certain foods as ``high risk,'' and to require certain escalated food
defense activities for those foods. The comment asserts that FDA should
designate foods as ``high risk'' based on real-time actionable
intelligence of a credible threat. The comment acknowledges that
section 103 of FSMA does not apply to facilities required to comply
with the seafood HACCP program, the juice HACCP program, or the dietary
supplement CGMPs, but because none of these regulations address food
defense programs, the comment asserts the Agency can use other legal
authority to require these food facilities to have food defense
programs.
    (Response 8) The final rule requires ``basic foundation[al] food
defense activities'' as well as providing for ``escalated food
defensive activities'' where warranted. To provide for foundational
food defense, the rule requires a food defense plan (i.e., a
vulnerability assessment, mitigation strategies, and procedures for
food defense monitoring, corrective actions, and verification) and
associated actions. These requirements are the minimum measures
necessary to provide assurances that hazards that relate to intentional
adulteration intended to cause wide scale public health harm will be
significantly minimized or prevented. Weakening these provisions, such
as by eliminating the requirement to implement mitigation strategies to
address significant vulnerabilities at each actionable process step,
would result in food defense measures inadequate to address the threat
of an inside attacker. As discussed in response to Comment 1, our
interactions with the intelligence community, as well as the
conclusions reached during vulnerability assessments conducted in
collaboration with industry, have identified an inside attacker as the
highest threat.
    Further, the suggested approach would place too much reliance on
FDA having real-time actionable intelligence of a credible threat. As
discussed in the responses to Comment 11 and Comment 12, there are a
number of limitations to this approach. FDA may not receive specific,
real-time, credible threat intelligence. Further, rapidly communicating
even specific, actionable information to the food industry so that it
is received by all of the relevant facilities would present challenges.
Although some facilities may be able to identify some or all actionable
process steps and implement mitigation strategies within a short

timeframe, many other facilities would not be able to identify and
implement the necessary mitigation strategies and the mitigation
strategies management components (e.g., food defense monitoring,
corrective actions, verification) within the short time period that
could be required in the event of a credible threat. In addition,
taking action only in the event of a credible threat may not be
sufficient to prevent wide scale public health harm. Measures taken
after the threat is known may not be sufficient to prevent an attack if
the intelligence does not provide enough specific information, such as
the food product, contaminant, point of attack in a facility, and
geographic location of an attack.
    Because the vulnerability assessment identifies the specific foods
at specific process steps at greatest risk, it also serves to identify
those foods that must be protected against intentional adulteration
under section 420. Having one set of requirements for food defense
measures helps ensure that the significant vulnerabilities will be
significantly minimized or prevented and addressed consistently across
sections 418 and 420 (see section 418(c)(2)). Further, as suggested by
the comment, the rule provides for escalated food defense activities
when necessary. Specifically, Sec.  121.157(b)(4) requires reanalysis
of a food defense plan (which could lead to the identification of
additional needed mitigation strategies) whenever FDA requires it to
respond to new vulnerabilities or credible threats to the food supply.
    (Comment 9) One comment asserts that the proposed combination of
provisions under sections 418 and 420 of the FD&C Act has created
complexity that could be eliminated by removing acts intended to cause
massive public health harm from section 418 and covering them solely
under section 420. The comment further asserts that although section
418 includes ``acts of terrorism'' within the hazard analysis, Congress
did not intend to add this level of complexity to the rule and create
new work that is inconsistent with materials previously created to
address food defense. Further, the comment states that it appears these
new requirements were included in the rule as a consequence of the
statutory language rather than to reduce risk.
    The comment states that one key difference between sections 418 and
420 is that section 418 requires the facility to identify hazards
related to intentional adulteration while section 420 requires FDA to
identify vulnerabilities that could result in serious adverse health
consequences. The comment asserts that due to the confidentiality of
information that serves as the basis for the FDA vulnerability
assessments, it would be more appropriate for FDA to perform the
assessment for acts that could cause massive public health harm and for
the facility to perform a vulnerability assessment for other types of
intentional adulteration that may be specific to a facility and are
outside of the FDA's vulnerability assessment.
    (Response 9) FDA believes that a single unified set of requirements
(i.e., this rule) is more clear and less complex than dividing the
types of intentional adulteration covered by this rule into two
categories with two sets of requirements, as suggested by the comment.
It is not clear what would be covered under section 418 if it applied
only to ``other types of intentional adulteration that may be specific
to a facility,'' as suggested by the comment. Further, we do not
believe the provisions of the rule are inconsistent with our current
guidance; rather, they are more comprehensive and robust. FDA believes
that these new requirements will reduce risk beyond what is contained
in our current guidance documents. Our guidance documents mainly focus
on assessing vulnerabilities and identifying mitigation strategies, but
do not include recommendations for mitigation strategy management
components. We believe the management components (part of a HACCP-type
framework) are critical to ensuring that any hazards that relate to
intentional adulteration intended to cause wide scale public health
harm will be significantly minimized or prevented. Further, the
confidentiality of vulnerability assessments that FDA conducted is not
a barrier to a facility conducting a vulnerability assessment under
this rule. The key activity types that FDA has identified were derived
from FDA's vulnerability assessments and using key activity types to
conduct a vulnerability assessment remains a permissible option under
the final rule.
    In addition, as recognized by the comment, section 418 explicitly
applies to ``acts of terrorism.'' Specifically, 418(b)(2) requires that
a hazard analysis identify and evaluate hazards that may be
intentionally introduced, including by acts of terrorism. Further,
section 418(i) authorizes FDA to require a reanalysis to respond to new
hazards including, as appropriate, results from terrorism risk
assessments. Generally, acts of terrorism involving the food supply
would be committed with the intention to cause wide scale public health
harm. Therefore, they are clearly covered by section 418.
    (Comment 10) Some comments suggest that FDA require a hybrid
approach where all facilities subject to section 103 are required to
conduct a vulnerability assessment and develop and implement a basic
food defense plan. Under the hybrid approach, if a credible threat is
identified, then section 106 would serve as an escalation provision and
allow FDA to designate specific food(s) associated with the credible
threat as ``high risk.'' Comments suggest that FDA could then require
facilities with these high risk foods to reassess their food defense
plans and implement appropriate mitigation strategies that FDA may
specify to address the threat. Comments argue that if all potential
mitigation strategies need to be identified through the vulnerability
assessment and are managed in the absence of actionable intelligence of
a credible threat, then there is no ability to escalate the plan with
respect to certain mitigation strategies when needed.
    (Response 10) FDA agrees with the comment in part. As discussed in
response to Comment 8, this rule requires facilities to conduct a
vulnerability assessment and develop and implement foundational food
defense activities. Further, the rule provides a mechanism which serves
a similar function to the ``escalation provision'' described in the
comment. Specifically, under Sec.  121.157(b)(4), FDA can require
facilities to reassess their food defense plans, which could trigger a
requirement to implement additional mitigation strategies.
    FDA disagrees that the rule requires ``all potential mitigation
strategies'' to be identified and managed. We believe we have
appropriately balanced the need to provide assurances that hazards
associated with intentional adulteration are being prevented with the
low likelihood of a successful attack on the food supply. The rule does
not mandate specific mitigation strategies be implemented at actionable
process steps but rather allows strategies to be tailored to the
facility and its procedures. We also disagree that there is ``no
ability to escalate the plan with respect to certain mitigation
strategies.'' In response to a credible threat involving a specific
agent, a covered facility could reanalyze its food defense plan with
specific focus on the relevant agent. The facility then could implement
specific mitigation strategies to counter this threat (such as
processing changes, product testing, or other appropriate measures)
that are not currently required by the rule.

C. Require Measures Only in the Event of a Credible Threat

    In the proposed rule, we sought comment on whether it would be
feasible to require measures to protect against intentional
adulteration only in the event of a credible threat. We also sought
comment on whether such an approach would be consistent with the
intentional adulteration provisions of FSMA and how such requirements
would be communicated to industry in a timely and actionable manner.
    Many comments agree with the requirements as proposed that measures
to protect food against intentional adulteration be required even in
the absence of a credible threat but some comments support requirements
only in the event of a credible threat. Some comments assert that FDA
has the tools available in the Registration of Food Facility database
to establish a communications protocol to notify industry if there is a
credible threat. A few comments express concern over the difficulty of
developing and implementing food defense plans in a timely manner in
the event of a credible threat.
    In the following paragraphs, we discuss these comments and our
responses. After considering the comments, we have revised the
regulatory text in Sec.  121.157(b)(4) to include specific language
that provides for FDA to require facilities to conduct a reanalysis of
their food defense plans to, among other things, respond to credible
threats to the food supply.
    (Comment 11) Some comments state that this rule should only go into
effect in the event of a credible threat. One of these comments argues
that the oilseed processing industry that they represent has never been
the target of attacks or threats and therefore they are unlikely
targets for intentional adulteration and should be exempted from the
rule unless there is a credible threat against a facility or industry
as a whole.
    (Response 11) We disagree with these comments. The fact that the
oilseed processing industry and other food industry sectors have not
been attacked in the past does not mean that these industry sectors
will never be attacked. Nor does it mean that preventive mitigation
strategies are unnecessary. As discussed in response to Comment 8,
taking action only in the event of a credible threat may not be
sufficient to prevent wide scale public health harm.
    (Comment 12) Some comments encourage FDA to collaborate with the
U.S. Department of Homeland Security (DHS), the Federal Bureau of
Investigation (FBI), and other Federal and State Agencies to ensure
that the relevant stakeholders of the food industry are notified in a
timely manner upon discovery of a credible threat. These comments
discuss that alerting the food industry to known credible threat
information would be valuable because there may be additional
mitigation strategies that could be put into place when there is a
threat. The comments further explain that having such knowledge would
allow for industry stakeholders with specific, technical knowledge of
their products, equipment and plant security to better collaborate and
support the efforts of law enforcement. Some comments recommend that we
establish and formalize a mechanism and process to communicate credible
threat information to relevant stakeholders in industry and that the
Food Facility Registration database could help facilitate this. The
comments also recommend that we conduct exercises to test this
mechanism so that all stakeholders are aware of the established
communications process and can make adjustments and improvements as
necessary. Several comments recommended that we convene a panel of
industry stakeholders annually to discuss threat intelligence at the
``Secret'' level.
    (Response 12) We concur with the recommendation that we should
collaborate with our Federal and State Agency partners on the discovery
and communication of credible threats in a timely manner. Currently,
FDA regularly meets and communicates with DHS, FBI, the U.S. Department
of Agriculture (USDA), and State and local Agency partners through the
Food and Agriculture Sector Government Coordinating Council (GCC) to
discuss food defense issues and research activities and introduce new
initiatives for mutual evaluation, implementation, and education. FDA's
Office of Criminal Investigations (OCI) works closely with the FBI and
other Agencies on a regular basis on threats against FDA-regulated
products, including food. We also agree that notifying relevant
stakeholders within industry of credible threats is essential to
protecting the food supply. The Food and Agriculture Sector GCC and
Sector Coordinating Council (consisting of private sector members) hold
in-person joint meetings twice a year and, when needed, classified
meetings at the ``Secret'' level are held to exchange information. As
we move towards implementing this rule, we will continue to work with
our partners--both in government and the private sector--to include
them in discussions regarding communicating credible threat
information.
    (Comment 13) One comment states that the term ``credible threat''
is not adequately defined in the proposed rule, nor is the relationship
between a ``credible threat'' and a ``reasonably foreseeable hazard''
adequately described. The same comment also notes that because the term
``credible threat'' is commonly used to discuss sensitive or classified
information, the use of the term may place an unrealistic expectation
for sharing of sensitive or classified threat information between
government agencies and the private sector. The comment suggests either
removing the term ``credible threat'' from the rule or including a
definition with an explanation of the mechanism for sharing information
about credible threats with the food industry.
    (Response 13) We disagree with this comment and decline the request
to include a definition for credible threat. It is not possible to
identify with precision what constitutes a credible threat. There are
many factors to consider in regards to how, what, when, or why those
who intend to cause harm may take action. As such, it is not possible
to write a definition for credible threat that is neither so broad that
it covers potentially any piece of intelligence, nor so narrow that it
is unnecessarily limiting. FDA routinely works with other agencies to
maintain situational awareness of potential threats to the food supply
and will consider that information in determining whether intelligence
rises to the level of a credible threat.
    Within the context of protecting food against intentional
adulteration with the intent to cause wide scale public health harm, we
see no direct relationship between a ``credible threat'' and a
``reasonably foreseeable hazard.'' ``Known or reasonably foreseeable
hazard'' is defined in the PCHF final rule to mean a biological,
chemical (including radiological), or physical hazard that is known to
be, or has the potential to be, associated with the facility or the
food. We do not use the phrase ``reasonably foreseeable'' within the
context of intentional adulteration because it does not apply.
    We acknowledge that there will be challenges to sharing sensitive
or classified threat information between government agencies and the
private sector. That is one of several reasons that we are not making
the requirement for mitigation strategies dependent on a particular
credible threat. In the event such information was to become known, FDA
intends to work with its

government partners to determine the appropriate course of action.
    (Comment 14) Some comments recommend that in the event of a
credible threat, a facility could conduct a reassessment or reanalysis
of its food defense plan so that it could better tailor its mitigation
strategies to the threat. Some comments recommend that FDA revise the
regulatory text within proposed Sec.  121.150 for reanalysis to require
facilities to reassess their food defense plans when the Agency has
actionable intelligence of a credible threat of intentional
adulteration.
    (Response 14) In the proposed rule, we describe that we may require
a reanalysis of the food defense plan in the event of a credible
threat. However, this was not specifically stated within the regulatory
text. Therefore, we have revised Sec.  121.157(b)(4) to provide that
reanalysis may be required by FDA to respond to credible threats to the
food supply. We did not see the need to include ``actionable
intelligence'' in the regulatory text because we believe that
``credible threat to the food supply'' implies a threat that also
requires actionable intelligence.

D. General Comments on Implementation and Compliance

    We received a substantial number of comments with regard to how the
Agency will implement this rule. Many comments focused specifically on
the need for inspectors to be provided food defense training to enable
them to make informed decisions during inspections and compliance
activities. Another issue raised by many comments is that the Agency
should make available guidance resources, tools, training, and other
information to help facilities comply with the final rule. In the
section that follows, comments related to implementation and compliance
are discussed.
    (Comment 15) Some comments state that existing regulatory
inspections should include evaluation of the intentional adulteration
rule requirements for the best use of time and resources.
    (Response 15) FDA is currently considering the best approach for
structuring and conducting food defense inspections. We recognize that
inspections require resources from facilities and recognize that some
facilities may prefer that food defense inspections be conducted as
part of an inspection for other regulatory programs, such as preventive
controls for human food. We will consider this when developing our
enforcement strategy.
    (Comment 16) Some comments express concern about the level of
training that will be needed for inspectors. These comments state that
the inspectors must be trained specifically on food defense and that
FDA should be transparent about the training that we provide the
inspectors. Comments emphasize the importance that FDA provide
specialized training to ensure consistent compliance and enforcement
activity by the Agency.
    (Response 16) FDA understands and agrees with comments that state
that training for inspectors conducting food defense inspections is
critical to a consistent and adequate inspection, compliance, and
enforcement system. We agree with the comment that specialized training
in food defense will be required for inspection and compliance staff to
evaluate a facility's compliance with this rule. FDA has begun the
process of assessing its training needs for inspectors on food defense.
It is our intention that training provided to our inspection and
compliance staff will be consistent with that training for industry
that will be provided by the Intentional Adulteration subcommittee
organized within the Food Safety Preventive Controls Alliance (see
Comment 105) to facilitate consistent implementation of this rule. This
strategy is consistent with the other FSMA food safety regulations and
training strategies.
    (Comment 17) Some comments state that inspections should have a
``big picture'' focus, and focus on the evaluation of the facility's
vulnerability assessment. Additionally, comments state that this
inspection should not compare the mitigation strategies used at other
facilities to the facility being inspected.
    (Response 17) We agree. The rule is designed to provide flexibility
such that facilities can select appropriate mitigation strategies that
are best suited for their operations. FDA investigators will consider a
facility's written explanations regarding identification of actionable
process steps and selection of mitigation strategies when evaluating a
food defense plan to understand a facility's rationale. In addition, we
will work to educate industry before and while we regulate to assist
industry to gain and maintain compliance with the rule.
    (Comment 18) Some comments request that FDA not cite food defense-
related items on FDA's Form 483 until the facilities and inspectors
learn about compliance with the intentional adulteration rule.
Additionally, some comments state concerns about FDA including
potentially sensitive information from food defense plans when citing
food defense-related items on Form 483.
    (Response 18) FDA is currently in the process of developing its
inspection and compliance strategy for the intentional adulteration
rule and an important part of this strategy development will include
methods and processes for information exchange with regulated industry.
We recognize that food defense inspections could include evaluation of
sensitive information, including vulnerability assessments and
mitigation strategies. For a more detailed discussion on how FDA will
protect food defense-related information, see section VI.F, Public
disclosure.
    (Comment 19) Some comments request that FDA include State
departments of agriculture in the process to develop and implement
inspection and compliance programs.
    (Response 19) As mentioned previously, FDA is currently in the
process of developing its inspection and compliance strategy for the
intentional adulteration rule. FDA's implementation working group for
this rule includes representation from State partners, and State
partners will continue to play an essential and collaborative role
throughout the process.
    (Comment 20) Several comments state that an alliance would be
beneficial for the implementation of the intentional adulteration rule.
    (Response 20) Training alliances have played an important role in
facilitating industry compliance with many regulations in the past. We
agree with the comment and are in the initial stages of organizing and
establishing the Intentional Adulteration subcommittee within the Food
Safety Preventive Controls Alliance operated out of the Institute for
Food Safety and Health at the Illinois Institute of Technology. We
anticipate the Intentional Adulteration training subcommittee will
assist industry compliance with this final rule by supporting the
development and dissemination of training resources. We further
anticipate that the curriculum developed through the Intentional
Adulteration subcommittee will form the basis of training for
regulators as well.
    (Comment 21) Some comments state that equal enforcement of this
rule across companies domestically and globally may require FDA to
adopt different enforcement mechanisms.
    (Response 21) We intend to enforce this rule in a consistent manner
with regard to imported and domestically produced foods. FDA is
currently in the

process of developing its inspection and compliance strategy, including
how facilities will be selected for inspections and how inspections
will be conducted for both domestic and foreign facilities. Further, we
intend to engage in significant outreach activities--both domestically
and internationally--to facilitate industry compliance with this rule
and to communicate the Agency's current thinking on inspection,
compliance, and enforcement strategies. Additionally, we intend to
develop fact sheets, FAQ documents, guidance documents, and other
informational materials as needed to support domestic and foreign
industry compliance with the rule.
    (Comment 22) Several comments recommend that food defense
activities conducted under programs, such as the Department of Homeland
Security's (DHS) Customs-Trade Partnership Against Terrorism (C-TPAT)
and mutually recognized international programs, the Chemical Facility
Anti-Terrorism Standards (CFATS), the USDA Food Safety and Inspection
Services (FSIS) food defense plan template, should be recognized as
meeting the requirements of this rule. Several comments state that
there are global food safety schemes that include food defense
requirements which could be leveraged in inspections and
implementation. Comments suggest that audits and private certifications
done under these food safety schemes should be sufficient for meeting
the requirements of this rule.
    (Response 22) We disagree. The programs identified by comments are
not sufficient to substitute for compliance with this rule. For
example, they do not require mitigation strategies at all actionable
process steps and therefore are not sufficient to significantly
minimize or prevent intentional adulteration intended to cause wide
scale public health harm. Further, even if currently they were
sufficient for compliance for this rule, they could change at any time.
    C-TPAT is a voluntary supply-chain security certification program
led by U.S. Customs and Border Protection (CBP) that focuses on private
companies (including food companies) implementing anti-terrorism
measures to protect their supply chains. When companies join C-TPAT,
they sign an agreement to work with CBP to identify supply chain
security gaps and implement specific security measures and best
practices. CBP has found that the security standards of some foreign
industry partnership programs are similar to those of the C-TPAT
program.
    CFATS is a DHS program which regulates high-risk chemical
facilities to ensure they have anti-terrorism measures in place to
reduce risks associated with the storage and use of these high-risk
chemicals. Any facility that possesses ``chemicals of interest,'' as
identified by DHS, in certain quantities is considered a covered
facility that must meet some or all of the requirements under CFATS.
Some agriculture and food facilities are subject to CFATS requirements.
Covered chemical facilities are required to prepare Security
Vulnerability Assessments that identify facility security
vulnerabilities and to develop and implement Site Security Plans that
identify measures that satisfy risk-based performance standards. These
risk-based performance standards focus on physical security of the
chemicals.
    Although both CFATS and C-TPAT programs address some of the
security concerns related to some food facilities, neither program
addresses the unique vulnerabilities associated with the food being
manufactured, processed, packed or held at the facility. In general,
voluntary security programs such as C-TPAT focus on global supply chain
security measures involved in the transportation of goods from location
to location. The CFATS program focuses on reducing risks related to
chemicals, even in facilities that are mainly geared toward food
production. In contrast, vulnerability assessments required by this
rule require identification of significant vulnerabilities at discrete
processing steps within a facility, where the intent of the attack is
to cause wide scale public health harm by contaminating the food
supply. Further, a vulnerability assessment must consider the threat
stemming from an inside attacker. Once these significant
vulnerabilities are identified, mitigation strategies are implemented
at or near those most vulnerable processing steps. Given these
differences, it is unlikely that facilities would be compliant with
this rule were they to rely wholly on assessments and mitigation
strategies conducted as part of other programs.
    The food defense plan template from USDA FSIS is voluntary for
FSIS-regulated facilities, and is organized in four sections: (1)
Outside Security Measures, (2) Inside Security Measures, (3) Personnel
Security Measures, and (4) Incident Response Security Measures. The
template focuses on a facility's physical security measures, which are
analogous to recommended, but not required, facility wide security
measures in this rule. FSIS-regulated facilities are encouraged to read
and sign the template, adopt it as their food defense plan, and then
implement, test, and maintain the plan.
    There are important similarities between the plan template and some
requirements in this rule. For example, some security measures listed
in the template are similar to some mitigation strategies included in
the FDA Mitigation Strategies Database. The testing of the plan is
somewhat similar to food defense monitoring. The plan template also
suggests awareness training for employees, which is similar to a food
defense awareness training requirement in this rule. The similarities
reflect FDA and USDA collaboration on food defense activities for many
years as discussed in the proposed rule (78 FR 78014 at 78021).
    However, food defense plans developed using the FSIS template would
not meet all requirements of this final rule. Specifically, FSIS's food
defense plan template does not include a vulnerability assessment of
the points, steps, or procedures in a food process, nor does it include
implementation of mitigation strategies specific to the vulnerable
points. Additionally, the plan template does not include food defense
monitoring, food defense corrective action, food defense verification,
and some training required by this rule.
    In addition, we recognize that there are existing global food
safety schemes that include food defense requirements and that many in
the food industry have already adopted and implemented these
requirements. For example, the Global Food Safety Initiative's (GFSI)
Guidance Document Sixth Edition (Ref. 10) addresses food defense.
Subsequently, many of the GFSI-recognized schemes include more specific
food defense requirements. The Safe Quality Foods (SQF) Code, edition
7.1 is a process and product certification standard that specifies
various food defense elements, including that the methods,
responsibility, and criteria for preventing food adulteration caused by
a deliberate act of sabotage or terrorist-like incident shall be
documented, implemented and maintained (Ref. 11). Another example of
industry standards that incorporate food defense elements is the
International Featured Standards (IFS) Food Version 6 Standard, which
specifies that areas critical to security be identified, food defense
hazard analysis and assessment of associated risks be conducted
annually or upon changes that affect food integrity, and an appropriate
alert system be defined and periodically tested for effectiveness (Ref.
12). We recognize that some in the food industry have already
voluntarily taken steps to incorporate and implement food

defense measures; however, they are not adequate to substitute for
meeting the requirements of this rule.
    Although participation with global food safety schemes and other
programs administered by our Federal partners are not substitutes for
compliance with this rule, we believe that participation in programs
such as C-TPAT, CFATS, the use of the FSIS food defense plan template,
or international programs granted mutual recognition status as that of
C-TPAT, for example, decreases a facility's vulnerability to
intentional adulteration and can work in concert with the requirements
of the final rule. Additionally, a facility's participation in such
programs may be considered by FDA as we prioritize risk-based
inspections of facilities subject to the final rule. Further, we note
that a facility may use existing records (e.g., records that are kept
as part of these other programs) to meet the requirements of this rule,
if they contain all of the required information and, facilities may
supplement existing records as necessary to include all of the
information required by this rule (Sec.  121.330).
    (Comment 23) Some comments state that laws in the European Union
currently require food facilities to take necessary measures to prevent
intentional adulteration, and it is therefore not justified to request
additional safety or security requirements for facilities subject to
these laws.
    (Response 23) We disagree. This rule contains those measures FDA
has determined are necessary to protect food against intentional
adulteration. To the extent a facility is already taking actions that
are required by this rule, a facility will have to make fewer changes
to its operations. These security measures should be evaluated on a
case-by-case basis to determine if they qualify as a mitigation
strategy under this rule.
    (Comment 24) Some comments request that FDA focus on education over
enforcement and use discretion during inspections.
    (Response 24) As FSMA as a whole is a substantial change in how FDA
approaches regulating the food and agriculture sector, we recognize
that significant outreach, education, and training will be required to
facilitate industry compliance with all FSMA rules. As previously
stated by the Agency, one of the guiding principles for implementing
FSMA is that the Agency will educate before and while we regulate. This
includes a focus on sector-specific guidance, education, outreach, and
technical assistance for industry. The intentional adulteration rule
implementation will include these efforts to ensure facilities gain
understanding and awareness to comply with the rule. In addition, we
are providing for a longer timeline for facilities to come into
compliance, allowing for more outreach and dialogue with industry.
Facilities, other than small and very small businesses, have 3 years
after the effective date to comply with part 121. Small businesses
(i.e., those employing fewer than 500 full-time equivalent employees)
have 4 years after the effective date to comply with part 121. Very
small businesses (i.e., businesses that have less than $10,000,000,
adjusted for inflation, per year, during the 3-year period preceding
the applicable calendar year in both sales of human food plus the
market value of human food manufactured, processed, packed, or held
without sale, e.g., held for a fee) have 5 years after the effective
date to comply with Sec.  121.5(a).
    (Comment 25) Some comments recommend that FDA update the Food
Defense Plan Builder software tool to capture the elements of a food
defense plan required by the final rule, such as monitoring, corrective
actions, and verification.
    (Response 25) FDA plans to update existing tools and resources,
including the Food Defense Plan Builder software, to assist industry
with meeting the requirements for the final rule.
    (Comment 26) Several comments request that FDA periodically update
its online tools and resources for companies to have access to
information about broad mitigation strategies, although they are not
required under the rule.
    (Response 26) FDA intends to publish guidance to support industry
compliance with the final rule. This guidance will include information
relevant to the required provisions of the final rule and also will
likely include helpful information on facility-wide security measures
as well as other best practices and recommendations to assist
facilities in their development of a comprehensive food defense
program. In addition, FDA has a number of tools and resources currently
available on our Web site (http://www.fda.gov/fooddefense) that were
developed for our voluntary food defense program that can assist
industry.

E. Comments on Requests for Additional Exemptions

    In the proposed rule we specifically requested comments on whether
there are other ways in which the coverage of this regulation can be
further focused on foods that present a high risk of intentional
adulteration caused by acts of terrorism. In this document we discuss
comments we received with specific recommendations on foods or
activities to exempt from the rule.
    (Comment 27) Some comments assert that facilities engaged solely in
cooling, holding, handling, packing, repacking, packaging and shipping
of raw, intact fresh produce, similar to activities that may be
performed on farms, are unlikely to be engaged in any of the key
activity types and should be exempt from this rule. The comments
describe activities conducted by these facilities, including
application of fungicide, food grade wax coating, sorting and placing
whole intact produce into boxes for shipping. The comments further
state that whole intact produce would not be an attractive or feasible
target for an act of intentional adulteration with the intent to cause
wide scale public health harm, regardless of where the activities
occur.
    (Response 27) We decline the requested exemption for facilities
engaged solely in cooling, holding, handling, packing, repacking,
packaging and shipping of raw, intact fresh produce. We recognize that
some of these facilities may not have any significant vulnerabilities;
however, some may. For example, packaging may be a significant
vulnerability, depending on the degree of access to the food and the
characteristics of the packaging area (e.g., in a minimally trafficked
area where individuals are working alone for extended periods of time,
or if the product is being sprayed with fumigant or fungicide
applications that may serve to apply a contaminant onto the food).
Therefore, to determine whether any mitigation strategies are needed,
each facility must conduct a facility specific vulnerability assessment
that considers, at a minimum: (1) The potential public health impact if
a contaminant were added (e.g., severity and scale); (2) the degree of
physical access to product; and (3) the ability of an attacker to
successfully contaminate the product. Any of the activities described
in the comments that are otherwise covered by existing exemptions do
not need to be considered in the vulnerability assessment. For example,
holding of foods other than in liquid storage tanks is exempt from the
rule (Sec.  121.5(b)). Also, packing or re-packing of food where the
container that directly contacts the food remains intact is exempt
(Sec.  121.5(c)).
    If after conducting a vulnerability assessment, a facility
appropriately concludes that it has no actionable process steps, the
facility would not be required to implement mitigation strategies. The
facility's food defense plan would include the vulnerability

assessment, the conclusion that no actionable process steps are
present, and an explanation for this conclusion at each step. In
contrast, facilities with actionable process steps are required to
implement mitigation strategies and the appropriate mitigation
strategies management components.
    (Comment 28) One comment suggests that we exempt food additives
used in low dosages. The comment asserts that ``the dosage of food
additives are approximately 0.01--1 percent of the total food, and the
final amount of the food additive absorbed into the human body should
be very small, roughly 1/100--1/10,000 of the total food consumed.''
The comment further asserts that if a contaminant is added to a food
additive used in low dosages, the risk to public health is very small.
    (Response 28) We decline this request. Our vulnerability
assessments considered a number of factors when evaluating a product's
vulnerability to acts of intentional adulteration and the potential
public health consequences of such an act, including a wide variety of
threat agents. Our vulnerability assessments concluded that there were
situations where an act of intentional adulteration could still result
in wide scale public health harm even if the dose of the adulterant
were at or below the levels highlighted in this comment. Moreover, the
concentration of a food additive in the finished product may vary
depending on the nature of the product (e.g., citric acid can be added
to a food as a flavor enhancer in relatively low concentrations, or to
other foods in higher concentrations as a color retention agent).
    (Comment 29) One comment recommends that we exempt production and
packaging of food ingredients from the rule. The comment asserts that
terrorist groups are more likely to attack finished food production
than food ingredient production because they want the publicity
associated with seeing the harm that their act causes. The comment
further asserts that it may be months or years before a contaminated
ingredient reaches consumers, and therefore it would not be a likely or
attractive target for terrorists who want to make a more immediate
impact. The comment also states that a contaminant can be degraded,
inactivated, or destroyed in further processing or prolonged storage if
it is added to an ingredient. The comment maintains that it is far
easier to select an appropriate contaminant with some knowledge of what
types of processing it will have to survive. The comment requests that,
at a minimum, we exempt the production and packaging of food
ingredients from requirements for focused mitigation strategies and
make them subject only to requirements for broad mitigation strategies.
    (Response 29) We decline this request. As discussed in section
IV.B.3, the rule now refers to ``mitigation strategy'' rather than
``focused mitigation strategy.'' Further, our vulnerability assessments
concluded that an act of intentional adulteration could still result in
wide scale public health harm even if the adulteration occurred during
the production of an ingredient. Ingredients have many different
distribution paths. Many ingredients can be sold in bulk to
manufacturing facilities for inclusion in processed finished foods or
be sold in consumer sized packaging for home use. Some ingredients can
be used in later processing as a primary ingredient or as a secondary
ingredient added in much lower volumes. In either case, the ingredient
manufacturer could be an effective point for an attacker to achieve
wide scale public health harm.
    (Comment 30) One comment supports our proposed exemption Sec.
121.5(c) applicable to packing, repacking, labeling, or re-labeling of
food where the container that directly contacts the food remains
intact. The comment would like us to further exempt the transportation
and holding of foods in retail packaged form from coverage under this
rule.
    (Response 30) The holding of food, except for holding of food in
liquid storage tanks, is exempt under Sec.  121.5(b). Therefore, the
holding of foods in retail packaged form is exempt from this rule.
Furthermore, as explained in section III.G.1, transportation carriers
are not included in the scope of this rule.
    (Comment 31) One comment requests that food gases be considered for
an exemption for several reasons. The comment states that food gas
containers are extremely difficult to breach. Further, the comment
states that food gases may be stored in bulk storage tanks either
during manufacture, or prior to containerization (i.e., pressurized
cylinders) or transport (i.e., cryogenic tankers) but a person
intentionally trying to contaminate the product during storage or
transportation would require use and knowledge of specialized equipment
that is not readily available. The comment argues therefore that food
gases are not at high risk for intentional adulteration. In addition,
the comment notes that there are several uses for food gases, such as
processing aids (e.g., freezing, chilling, pressure transfer) that will
have minimal contact with the food provided to consumers, and whether
used as a food additive or an ingredient the gas comprises a very small
percentage of the final food product.
    (Response 31) We decline the request. The comment identifies that
food gases may be stored in bulk storage tanks either during
manufacture, or prior to containerization or transport. We recognize at
some facilities manufacturing food gas may not have any significant
vulnerabilities; however, each covered facility must conduct a facility
specific vulnerability assessment, and that assessment must consider,
at a minimum: (1) The potential public health impact if a contaminant
were added (e.g., severity and scale); (2) the degree of physical
access to product; (3) the ability of an aggressor to successfully
contaminate the product. The comment mentions that breaching food gas
containers would require use and knowledge of specialized equipment
that is not readily available. However, the vulnerability assessment
must include consideration of an inside attacker, so this information
may be available to such an individual. The comment also mentions that
gases can be stored or transported in liquid form. Based on our
vulnerability assessments, liquids storage and handling has been
identified as potentially significantly vulnerable. Therefore,
facilities manufacturing food gas would need to evaluate their
manufacturing process through a vulnerability assessment. If after
conducting a vulnerability assessment, the facility appropriately
concludes that there are no actionable process steps in the facility,
the facility would not be required to implement mitigation strategies.
The food defense plan at this facility would include the vulnerability
assessment, the conclusion that no actionable process steps are
present, and an explanation for this conclusion at each step.
    (Comment 32) Some comments request that FDA exempt research and
development (R&D) and pilot plants from the rule. These comments argue
that a vulnerability assessment conducted at such a facility would in
all likelihood conclude that there are no significant vulnerabilities
due to the low volume of product produced, because such products are
not typically for retail sale, and because of the narrow scope of
consuming individuals, if any.
    (Response 32) We decline the request. We note that if food at an
R&D facility is not for consumption, the facility is not required to
register and would not be subject to this rule. Food processed at R&D
facilities may be consumed as samples, distributed at special events,
or

may take other routes to public consumption. As with other facilities
covered by the rule, it is possible, based on a facility specific
vulnerability assessment, that an R&D facility may conclude that it
does not contain any significant vulnerabilities. If, after conducting
a vulnerability assessment, the facility appropriately concludes that
it has no actionable process steps, the facility would not be required
to implement mitigation strategies. The facility's food defense plan
would include the vulnerability assessment, the conclusion that no
actionable process steps are present, and an explanation for this
determination at each step. In contrast, an R&D facility with
actionable process steps is required to implement mitigation strategies
and the appropriate mitigation strategies management components.

F. Other General Comments

    (Comment 33) Some comments ask us to publish a revised proposed
rule or an interim rule before proceeding to a final rule because of
anticipated, significant changes resulting from comments that we
received in response to the proposed rule. Some comments state that
food defense is a new and evolving area without existing regulatory
requirements or a long history of broadly accepted practices and that
further substantive dialogue with industry is needed. Some comments
state that a reproposal would serve the same purpose as an Advance
Notice of Proposed Rulemaking which was FDA's stated intent prior to
the imposition of judicial deadlines. Some comments state that because
FSMA rules are dependent on one another, some proposed FSMA rules
should be issued concurrently so that a concurrent evaluation and
comment period may be conducted. Some comments state that industry must
first get used to the new food safety regulations and then concentrate
on new food defense regulations and believe reproposing at a later date
will give industry a chance to comply with all the new regulations.
    (Response 33) We decline these requests. These revisions in the
final rule more closely align the rule with many current food defense
best practices and increase flexibility for facilities to comply. With
regard to the suggestion that we should issue the FSMA foundational
proposed rules simultaneously for comment, this was not feasible given
our judicial deadlines for the seven rules (Ref. 13). We believe that
stakeholders were given adequate opportunity to comment on the proposed
rules, and we extended many comment periods. With regard to the
comments that suggest we repropose this rule to give industry more time
to comply, we have addressed this issue by extending the compliance
dates by an additional 2 years (see section VIII).
    (Comment 34) One comment disagrees with the exemption for holding
non-liquid bulk food. The comment asserts that most bulk foods,
irrespective of their physical form, are likely to be mixed or blended
at some point after receipt by the end-user (i.e., the manufacturer or
packager that will convert the bulk food into retail packaged food),
and are likely to be processed into a much larger volume of finished
food. Thus, the comment maintains that any contamination introduced
into a bulk food during storage prior to its use in the preparation of
a retail packaged food may affect a large volume of finished food and
may thereby cause massive public health harm.
    (Response 34) As discussed in the proposed rule, based on an
analysis of the vulnerability assessments that FDA has conducted using
the CARVER+Shock methodology, we identified four key activity types
(Bulk liquid receiving and loading; Liquid storage and handling;
Secondary ingredient handling; and Mixing and similar activities) as
production processes that require focused mitigation strategies. With
the exception of the holding of food in liquid storage tanks, which is
not included in the exemption, we are not aware of activities performed
during the holding of food that fit within any of these four key
activity types (see 78 FR 78014 at 78036). There is no likely way that
a contaminant can be homogeneously mixed throughout a non-liquid bulk
food during storage. We found in our vulnerability assessments that the
potential for uniform distribution of a contaminant into the food is a
major factor in elevating vulnerability. Since it is highly unlikely
that an inside attacker would be able to evenly distribute a
contaminant into a dry bulk ingredient during storage, the
vulnerability associated with these steps did not rise to the level
associated with the vulnerability associated with the key activity
types.

G. Other Issues Discussed in the Proposed Rule

1. Transportation Carriers
    In the proposed rule, we tentatively determined that there is a
significant vulnerability to intentional adulteration during bulk
liquid receiving and loading, one of the four key activity types
included in the proposal as an option to identify actionable process
steps. We did not identify receiving and loading of other types of
foods (e.g., non-bulk liquid, solid, gaseous) as key activity types
because we determined through our vulnerability assessments that they
do not present the same level of risk. Further, we tentatively
concluded that requiring receivers and shippers of bulk liquids to
implement mitigation strategies at actionable process steps involving
loading and receiving of bulk liquid foods would significantly minimize
or prevent the potential for intentional adulteration of these foods
during transportation.
    Based on our vulnerability assessments, we proposed to require that
mitigation strategies to ensure the integrity of food during transport
would be implemented by facilities, rather than carriers. Where such
measures are implemented by the shippers and receivers of bulk liquids,
we tentatively concluded that the food would be sufficiently protected,
and that no further actions by a carrier would be needed. For this
reason, we did not propose to cover transportation carriers in the
proposed rule. We requested comment on our analysis and tentative
conclusion.
    Some comments agree with the tentative conclusion in the proposed
rule to exclude transportation carriers. Some comments oppose this
approach. In the following paragraphs, we discuss comments that
disagree with the proposed approach. After considering the comments, we
are finalizing the rule as proposed with regard to transportation
carriers.
    (Comment 35) Some comments disagree with our conclusion that
implementing mitigation strategies at the receiving and loading steps
for bulk liquids will adequately protect food during transportation.
Some comments argue that transport of food is one of the most
vulnerable stages in a process, as food is not protected by a secure
facility and may often be parked at a truck stop or other unsecure
locations for extended periods of time which provides the opportunity
for an attacker to gain access. One comment states that food shipments
have consistently been documented as either the first or second most
stolen truckloads on U.S. highways, and if terrorists were to use this
mode of attack on the food supply, the result could be a major event
for which we were not only unprepared, but for which we could have
foreseen the risk.
    (Response 35) We disagree with these comments. Based on our
vulnerability assessments, we determined that the most practical
mitigation strategies to

ensure the integrity of food during transport would be implemented by
facilities, rather than by carriers. For example, to significantly
minimize or prevent the product from being intentionally adulterated
during transport, a shipper may elect to use seals to secure access
points, such as doors or hatches, on the transport conveyance. The
shipper seals the load prior to departure from its facility by using
seals with unique identification numbers. The shipper includes the seal
numbers on shipping documentation and transmits the seal numbers to the
receiving facility. Once the shipment arrives at the receiving
facility, the receiver would verify the seals are in place and that the
identification numbers match. This mitigation strategy ensures the food
was not accessible during transport. To ensure that the driver cannot
exploit his position to gain access and intentionally adulterate the
food during transport, the carrier has no role in the seal mitigation
strategy. If seals are missing or the identification numbers do not
match the shipping documentation, the receiving facility would reject
the load and notify the shipper.
    Facilities are required to implement mitigation strategies that
significantly minimize or prevent significant vulnerabilities
associated with actionable process steps. Therefore, if a food
operation has a significant vulnerability associated with
transportation, the facility must choose a mitigation strategy or
combination of strategies to significantly reduce the vulnerability at
the receiving or loading step. Mitigation strategies implemented at
inbound receiving and outbound shipping would work complementary to
each other to protect the food during transport. For example, if the
vulnerability assessment concludes that loading is an actionable
process step because of a vulnerability during transportation, the
facility would implement mitigation strategies to protect its outbound
food from intentional adulteration (e.g., sealing the bulk liquid
tanker truck access points). Likewise, if the facility receiving the
food identifies receiving as an actionable process step because of a
vulnerability during transportation, it would implement mitigation
strategies to reduce the vulnerability of the food to intentional
adulteration during shipping. The mitigations employed at the
receiving/unloading step may include procedures to accept only
scheduled shipments, verification of shipping documentation, procedures
to investigate delayed or missing shipments, inspecting loads prior to
receipt, and rejecting damaged or suspect items. These steps together
will then work to significantly reduce the significant vulnerabilities
associated with the transport of food. With respect to the prevalence
of theft of food during transport, such theft is economically
motivated; the scope of this rule is limited to acts of intentional
adulteration where the intent is to cause wide scale public health
harm.
    (Comment 36) One comment states that the use of seals or tamper-
evident containers is insufficient to protect bulk foods during
transportation and/or holding because tamper-evident seals can be
defeated and cannot be expected to prevent a determined attacker. The
comment further states that tamper-evident containers or seals should
be used in combination with other measures.
    (Response 36) Mitigation strategies are ``risk-based,''
``reasonably appropriate measures'' employed to ``significantly
minimize or prevent'' significant vulnerabilities. They cannot always
eliminate entirely any possibility of intentional adulteration.
Furthermore, each facility has some degree of discretion in determining
how, and whether, each mitigation strategy is properly implemented, as
part of the facility's written explanation of how the mitigation
strategy sufficiently minimizes or prevents the significant
vulnerability associated with the actionable process step. Facilities
are required to implement mitigation strategies that significantly
minimize or prevent the significant vulnerability; therefore, if a
significant vulnerability is identified, the mitigation strategy or
combination of strategies chosen by the facility must be sufficient to
reduce the vulnerability to an acceptable level at these steps.
    In many cases the use of tamper evident seals may be an appropriate
mitigation strategy for limiting access to the product. Additionally,
if a tamper evident seal had been circumvented by an attacker, a close
inspection of the seal at receiving may reveal suspicious activity or
tampering which reduces the likelihood of a successful attack. However
if the facility concludes that tamper evident seals are not by
themselves sufficient to significantly reduce the vulnerability, they
should employ other or additional measures (such as directing carriers
to travel directly to the end destination without stop-overs, or
requiring teamed drivers to prevent the load from being unsupervised
during transport).
    (Comment 37) One comment requests clarification of expectations in
situations where only one of the entities involved is covered by the
intentional adulteration rule (e.g., the shipper is covered, but the
receiver is exempt due to size or vice versa) and states that FDA may
need to take a closer look into exemption of carriers.
    (Response 37) A covered facility may ship food to or receive food
from a facility that is not covered by the rule (e.g., it is a very
small business). The covered facility is responsible for implementing
mitigation strategies to address transportation if it has a significant
vulnerability associated with transportation at the receiving or
shipping steps. The mitigation strategies used by the covered facility
must significantly minimize or eliminate the significant vulnerability
at this step. Mitigation strategies are available to protect the food
during transport regardless of whether the shipper or receiver is
exempt from the rule. If the receiving facility is exempt, the shipping
facility can address the vulnerability by implementing mitigation
strategies such as those discussed in Response 36. If the shipping
facility is exempt, the receiving facility can address the
vulnerability by implementing mitigation strategies such as visually
inspecting seals and cargo to identify any suspicious activity or
tampering, verifying shipping documents are accurate, ensuring only
scheduled deliveries are accepted, and investigating delayed or
inaccurate shipments. Additionally, we do not believe a shipping and/or
receiving facility that qualifies for the very small business exemption
is an attractive target for attackers intending to cause wide scale
public health harm, as detailed in section IV.B.11.
    (Comment 38) Some comments state that covering carriers under this
rule may not be the best approach and this component of the food sector
may be better addressed in guidance. Some comments ask us to continue
to develop materials, guidelines and other tools to promote voluntary
compliance of food defense measures by the transportation component of
the food sector.
    (Response 38) We agree with these comments. As resources allow, we
will continue to develop best practices for the transportation industry
to assist with voluntary compliance with food defense measures.

2. Other Types of Intentional Adulteration: Disgruntled Employees,
Consumers, and Competitors; and Economically Motivated Adulteration
a. Disgruntled Employees, Consumers, and Competitors
    In the proposed rule, we explained that when we considered the
spectrum of risk associated with intentional adulteration of food,
attacks conducted with the intent of causing massive casualties and to
a lesser extent, economic disruption, would be ranked as relatively
high risk. (Note that to further clarify the rule's focus we have
removed the reference to economic disruption from the definition of
``food defense.'') We further explained that attacks by disgruntled
employees, consumers, or competitors would be consistently ranked as
relatively low risk mainly because their public health and economic
impact would be generally quite small. We further stated that
disgruntled employees are generally understood to be interested
primarily in attacking the reputation of the company and otherwise have
little interest in public health harm. Typically, acts of disgruntled
employees, consumers, or competitors target food and the point(s) in
its production that are convenient (i.e., a point at which they can
easily access the food and contaminate it). To minimize or prevent this
type of adulteration would require restricting access to nearly all
points in the food system. Instead, we proposed to focus on those
points in the food system where an attack would be expected to cause
massive adverse public health impact.
    We received comments supporting the proposed approach; comments
stating that measures should be required to protect against acts of
terrorism and disgruntled employees; and a comment stating that
disgruntled employees can be recruited by terrorist organizations. The
final rule is focused on protecting food against intentional
adulteration where the intent of the adulteration is to cause wide