food defense plan. As another example, a facility may elect to protect
its liquid storage tank actionable process step with a policy to
require two or more employees to be in the area at all times. The
facility's explanation would include the rationale that this ``buddy
system'' reduces the opportunity and ability of an attacker to bring a
contaminant into the vulnerable production area and introduce the
contaminant into the food without being detected by his or her co-
workers. These two examples show that the same actionable process step
can be protected in a variety of ways. The explanation will clarify the
facility's thinking and rationale as to how a mitigation strategy
significantly minimizes or prevents a significant vulnerability.
    We believe that the explanation accompanying the mitigation
strategy(ies) will be highly beneficial to the facility in gauging the
proper implementation of the mitigation strategy during required
verification activities. In identifying and implementing appropriate
mitigation strategies, the facility will need to reason through how and
why the mitigation strategy(ies) will be protective of the respective
actionable process step in question. This explanation and the
monitoring of the mitigation strategy play key roles in enabling the
facility to determine if the mitigation strategy is achieving its
intended aim and, therefore, is properly implemented.
    For example, for a facility that secures its liquid storage tank
with a lock, a review of monitoring records may show that the lock is
consistently in place and locked, therefore reducing accessibility and
significantly reducing the vulnerability associated with the liquid
storage tank. By being consistently implemented as intended, the lock
is achieving the aim as explained in the food defense plan to reduce
access to the liquid food held in the liquid storage tank. In this
case, the facility can conclude that this mitigation strategy is
properly implemented and is reducing a significant vulnerability.
    In contrast, consider a lock on a mixer that is not achieving its
intended aim. In this example, the worker at the mixer must routinely
open the mixer's lid to determine if the product is being sufficiently
mixed. The worker finds the lock to be interfering with his or her
responsibilities and frequently does not engage the lock after checking
on the product, repeatedly leaving the mixer unsecured. This deviation
is documented in monitoring records by the production supervisor. In
this case, the facility's explanation as to how the mitigation strategy
would be protective of the mixer included the rationale that the lock
would reduce access to the product. A component of the facility's
corrective action procedure for this mitigation strategy was to retrain
the employee on the importance of locking the mixer, but the employee
continues to repeatedly leave the mixer unlocked due to its
interference with his or her responsibilities. Since the mitigation
strategy, as determined through a review of monitoring and corrective
action records, was not consistently implemented, it is not achieving
the aim as specified in the mitigation strategy's explanation.
Therefore, the mitigation strategy cannot be determined to be properly
implemented and is not reducing significant vulnerabilities associated
with the mixer. Since the facility has found that the mitigation
strategy is not properly implemented, the facility must reanalyze this
portion of the food defense plan under the requirements of Sec.
121.157(b)(3) and then identify and implement a different mitigation
strategy, or combination of strategies, for the mixer that would reduce
the likelihood that an act of intentional adulteration would be
successful.
    Additionally, we believe that the explanation for how the
mitigation strategy(ies) are suitable and intended to reduce the
significant vulnerability will also be highly beneficial in
establishing common understanding and communication between the
facility and inspectors during inspections.
    (Comment 82) Many comments support our proposed requirement that
mitigation strategies be targeted at high vulnerability process steps
instead of setting requirements for general facility-level protections.
Further, some comments assert that significant vulnerabilities by
nature present themselves at particular points in a process and that
these individual points, steps, or procedures must be protected. These
comments also state that broad mitigation strategies would be far
reaching and require significantly more capital investment from
industry, while not directly protecting the most vulnerable processes.
    (Response 82) We agree with comments supporting the direction of
mitigation strategies to those areas where vulnerability is highest. As
discussed previously, we now refer to mitigation strategies, rather
than broad and focused mitigation strategies. However, we continue to
believe that to be sufficient and appropriate mitigation strategies
must be specifically tailored to the significant vulnerability and
customized to the actionable process step where they are applied rather
than applied to the entire facility (e.g., locking exterior doors, or
ensuring employees and visitors have identification badges). We would
not consider these two examples to be adequate to significantly reduce
or prevent a significant vulnerability because they do not address an
inside attacker.
    However, we believe that many policies or procedures that a
facility currently has in place can be modified or altered to provide
protection against acts of intentional adulteration without the
facility incurring significant costs, or requiring additional capital
investment. For example, consider a liquid food storage tank with an
inward opening hatch. When the tank is full, the pressure of the liquid
prevents the hatch from being opened, rendering the tank inaccessible.
However, when the tank is empty, the hatch may be opened and a
contaminant added. It may be part of normal facility practice for a
supervisor to conduct a visual check of storage tanks after a cleaning
cycle to ensure the cleaning has been conducted properly. Rather than
incur the cost of installing a lock or other access control on the
hatch, the facility may elect to implement a food defense mitigation
strategy by altering its visual check procedure so that the visual
check by the supervisor is conducted

immediately prior to food being added to the storage tank so that the
tank is observed after the tank has been empty and accessible for an
extended period of time. Alternatively, the facility could elect to
secure the tank's hatch with a tamper-evident seal or tape after the
visual inspection. This slight modification of an existing facility
practice could be implemented with little, if any, cost to the facility
and serve to protect the actionable process step--in this case the
storage tank--from an attacker adding a contaminant to the tank while
it is empty and accessible after it been cleaned and visually
inspected.
    (Comment 83) Some comments state that those strategies previously
termed as broad mitigation strategies should be considered as being
among appropriate mitigation strategies for compliance with the
requirements, with the majority of those comments indicating that FDA
should not distinguish between focused and broad mitigation strategies
in the final rule. Some comments disagree with FDA's statement in the
proposed rule that the implementation of focused mitigation strategies
at actionable process steps in a food operation is necessary to
minimize or prevent the significant vulnerabilities that are identified
in a vulnerability assessment regardless of the existence of broad
mitigation strategies. These comments contend that mitigation
strategies (whether broad or focused) can work in concert with one
another and play an important role in a facility's food defense
approach. Additionally, some comments state that broad mitigation
strategies can sometimes achieve the same results as focused mitigation
strategies and some comments state that the differentiation between the
two types of strategies is confusing and subjective.
    (Response 83) We believe this comment is largely addressed by
changing the regulatory text to refer to only mitigation strategies in
this final rule. We agree with comments that mitigation strategies
exist across a spectrum from those that are very broad and facility-
wide in nature to those that are very specific and tailored to unique
processing steps and areas. If implemented in a directed manner, a
strategy that may tend to be thought of as ``broad'' can be effective
at reducing vulnerability associated with a specific actionable process
step and could sufficiently minimize the likelihood of a successful act
of intentional adulteration at the actionable process step.
    Based on the results of our vulnerability assessments, we believe
that mitigation strategies implemented at actionable process steps that
are customized to the processing step at which they are applied,
tailored to existing facility practices and procedures, and consider
the actionable process step's vulnerability to an insider attack are
sufficient to protect the actionable process step. An insider attack
must be considered because an attacker who has achieved access to the
facility will have already circumvented the facility's general
facility-level protections. During the course of our vulnerability
assessments, we determined that if an actionable process step was
sufficiently protected against an attack perpetrated by an insider with
legitimate access to the facility, it would be similarly protected
against the actions of an outside attacker who has circumvented
perimeter protections. Facility-wide security measures can support or
compliment the mitigation strategy(ies) the facility implements;
however the significant vulnerability associated with the actionable
process step must be significantly reduced or prevented.
    For example, if a facility implements a strategy to restrict access
at an actionable process step to only those authorized individuals who
work in the area, and the facility leverages identification badges to
enforce this strategy, then the strategy becomes much more targeted. In
this case, the strategy is simply not about identifying personnel who
work anywhere in the facility, but rather, restricting access to a
specifically vulnerable area. In this case, the pre-existing badging
process the facility had in place to positively identify employees and
visitors serves as the foundation upon which the more tailored
mitigation strategy is built. However, the badging process itself is
not a mitigation strategy sufficient to significantly reduce or prevent
a significant vulnerability at the actionable process step because the
badging process alone does not restrict access to the actionable
process step.
    Another example to illustrate how different practices can work in
concert with each other to achieve protection is that of vetting
employees. In the proposal we described a hypothetical scenario where a
facility's secondary ingredient handling area was identified as
significantly vulnerable and was, therefore, identified as an
actionable process step. In the scenario, the facility elected to
mitigate this vulnerability by (1) reducing the time ingredients were
open and accessible, (2) entrusting the handling of secondary
ingredients to one of the most trusted employees, and (3) increasing
observation over the secondary ingredient handling area. To implement
the second mitigation strategy (use of most trusted employees), the
facility could utilize either senior and/or long-term employees who had
earned their trust over time, or the facility could conduct a more
detailed background check on specific employees.
    Much the same way the Federal government assigns more sensitive
tasks to Federal workers based on a multi-layered classification and
security clearance process, the facility could require basic level pre-
employment screening for most employees, but for those employees
working at actionable process steps, a mitigation strategy could be to
require a more detailed level of background check. The facility would
also conduct periodic review of the background check, as appropriate.
By applying a more targeted approach to establishing trust for the
employee working in the secondary ingredient handing area, the facility
leveraged what was previously described in the proposal as a ``broad''
mitigation strategy in a much more directed and targeted way such that
it was specifically addressing the significant vulnerability associated
with the secondary ingredient staging area. This example shows how what
were ``broad'' and ``focused'' mitigation strategies can work together
to protect an actionable process step.
    We caution against using background checks as the sole mitigation
strategy to reduce significant vulnerabilities at an actionable process
step because a background check may not identify all indicators of an
insider threat. Additionally, information within a background check may
be outdated or missing more recent key information that could be
indicators of an insider threat. Background checks should be used in
concert with other mitigation strategies to counter the risk of an
insider attack. In this example, the facility also mitigated
vulnerability at the secondary ingredient staging area by reducing the
staging time of ingredients and increasing observation of the area.
    Similarly, some other mitigation strategies may not be adequate
when used in isolation. For example, ensuring adequate lighting around
an actionable process step would generally be a mitigation strategy
that must be used in concert with other strategies to significantly
reduce the likelihood of, or prevent, successful acts of intentional
adulteration at an actionable process step. The increased lighting can
support other mitigation strategies (i.e., increased supervision of an
actionable process step) but, generally, increased

lighting would not by itself be sufficient to address the significant
vulnerability associated with the actionable process step.
    (Comment 84) Some comments state that existing facility practices
and facility-level measures should be considered when a facility is
identifying appropriate mitigation strategies.
    (Response 84) We agree. As discussed previously, mitigation
strategies should be tailored to existing facility practices and
procedures, and take into account the nature of the actionable process
step's significant vulnerability. Mitigation strategies can be
complemented by or built on top of existing practices or facility-level
measures. For example, a facility might prepare secondary ingredients
in an area near the process step where they will be added to the
product line. The facility weighs and measures ingredients the night
before use so they are ready for introduction into the product line in
the morning. To identify a suitable and appropriate mitigation
strategy, the facility would consider its normal practice of staging
ingredients the night before and any other relevant practices the
facility engages in regarding its handling of secondary ingredients in
this area. The facility might conclude that staging ingredients the
night before is unnecessary and elect to implement the mitigation
strategy that ingredients will only be handled immediately before their
introduction into the product line to prevent them from being open and
accessible for extended periods of time. Alternatively, if the facility
concludes that their operating practices prevent this approach, it
could implement the mitigation strategy to place the ingredients in
tamper evident storage containers overnight to prevent an attacker from
being able to introduce an agent without indications of tampering with
the ingredients. The facility would implement the most appropriate
mitigation strategy taking into consideration its existing practices
and procedures.
    (Comment 85) One comment asserts broad mitigation strategies offer
significant protections to the food supply and that focused mitigation
strategies are of questionable or at least unproved efficacy. This
comment goes on to request that FDA focus requirements only on broad
mitigation strategies that limit access to bulk foods prior to and at
process steps that may disperse contamination in a large volume of
finished food.
    (Response 85) During the course of our vulnerability assessments,
we found that appropriate mitigation strategies must be specifically
tailored to the significant vulnerability they are addressing and
customized to the actionable process step where they are applied, while
taking into account existing facility practices and procedures. We
disagree with the comment's assertion that strategies previously termed
as ``focused mitigation strategies'' are questionable or of unproven
efficacy. Indeed, we conclude as determined through our vulnerability
assessments that mitigation strategies specifically designed to protect
the most vulnerable points in a food operation are the most effective
at reducing the likelihood that an act of intentional adulteration
would be successful. General facility-level security measures have
questionable value in protecting actionable processing steps from
significant vulnerabilities, especially those significant
vulnerabilities associated with attackers with legitimate access to the
facility. However, this comment illustrates why we are changing the
codified to refer to only ``mitigation strategies.'' We would consider
the efforts described by this comment to be focused mitigation
strategies as we used that term in the proposed rule. We agree that
``bulk foods prior to and at process steps that may disperse
contamination in a large volume of finished food'' would most likely be
significantly vulnerable and thus require appropriate mitigation
strategies.
    (Comment 86) Some comments state that some of the mitigation
strategies identified in the preamble of the proposed rule may not be
appropriate or suitable in certain circumstances. For example, some
comments mention that one-way sample ports as a mitigation strategy may
not be appropriate for products that require aseptic sampling. Some
comments contend that making engineering enhancements to equipment or
repositioning equipment to increase visual observation may be
prohibitively costly.
    (Response 86) We agree that certain mitigation strategies may not
be appropriate or suitable in some situations. Therefore, we are not
requiring any specific mitigation strategies in this rule. A facility
may identify the most appropriate and suitable mitigation strategies
for its facility, the food being processed, the actionable process step
being protected, and the nature of the significant vulnerability being
mitigated.
    (Comment 87) Some comments urge FDA to permit requirements that are
already in place by other government agencies to count as mitigation
strategies, when appropriate based on a thoughtful vulnerability
assessment. In particular, these comments suggest the C-TPAT program
has proved successful in requiring that broad mitigation strategies be
implemented, including physical security, personnel security,
ingredient storage and inventory procedures, and crisis management
planning.
    (Response 87) As discussed in section III.D, we believe that
participation in other security programs, such as C-TPAT or CFATS for
example, raises the overall security posture for a facility and can be
beneficial along with the requirements of the final rule. In certain
circumstances, security measures implemented under other security
programs may also prove to be effective mitigation strategies once
actionable process steps are identified. These security measures should
be evaluated on a case-by-case basis to determine if they significantly
reduce or prevent significant vulnerabilities at actionable process
steps. If so, the facility may consider these protections as mitigation
strategies under Sec.  121.135 and document them in the food defense
plan. However, FDA will not consider a facility's participation with
other security programs as de facto compliance with this rule.

D. Final Sec.  121.138--Mitigation Strategies Management Components

    We have added a new Sec.  121.138 (Mitigation Strategies Management
Components) to establish that mitigation strategies required under
Sec.  121.135 are subject to the following mitigation strategies
management components as appropriate to ensure the proper
implementation of the mitigation strategies, taking into account the
nature of each such mitigation strategy and its role in the facility's
food defense system: (1) Food defense monitoring in accordance with
Sec.  121.140; (2) Food defense corrective actions in accordance with
Sec.  121.145; and (3) Food defense verification in accordance with
Sec.  121.150. We have created this new section to provide clarity and
understanding regarding the application of the three management
components to the mitigation strategies as required by Sec.  121.135.

E. Proposed Sec.  121.140--Monitoring

1. Proposed Sec.  121.140(a)-(b) Requirement for Written Procedures for
and Frequency of Monitoring
    We proposed that you must establish and implement written
procedures, including the frequency with which they are to be
performed, for monitoring the mitigation strategies, and you must
monitor the mitigation strategies with

sufficient frequency to provide assurance that they are consistently
applied.
    Some comments support the proposed requirements. In the following
paragraphs, we discuss comments that disagree with the proposed
requirements, ask us to clarify the proposed requirements, or suggest
one or more changes to the proposed requirements. Some comments request
that we provide more flexibility than a traditional HACCP framework,
with specific requests for flexibility in the management components,
including monitoring.
    After considering these comments, we are making three revisions to
the requirements for monitoring in Sec.  121.140. First, we are adding
the qualification ``as appropriate to the nature of the mitigation
strategy and its role in the facility's food defense system,'' to the
beginning of the provision. Second, we are changing ``sufficient'' to
``adequate'' in Sec.  121.140(b), which now states that ``you must
monitor the mitigation strategies with adequate frequency to provide
assurances that they are consistently performed.'' We are substituting
the term ``adequate'' for the term ``sufficient'' to be consistent with
the PCHF final rule definition for monitoring. We conclude that there
is no meaningful difference between ``adequate'' and ``sufficient'' for
the purposes of part 121. We have also added a definition for the term
``adequate'' in the regulatory text to mean that which is needed to
accomplish the intended purpose in keeping with good public health
practice. We also conclude that the regulations will be clearer if we
use the single term ``adequate'' throughout the regulations. Third, we
are changing ``applied'' to ``performed'' to address comments that
state the language was unclear. Section 121.140(b) now states that
``you must monitor the mitigation strategies with adequate frequency to
provide assurances that they are consistently performed.''
    (Comment 88) Some comments argue that the language of section
418(d) of the FD&C Act is ambiguous, and state that monitoring in
section 418(d) does not require that facilities conduct monitoring as
described in the National Advisory Committee on Microbiological
Criteria for Foods' HACCP Principles and Application Guidelines. These
comments state that the statute sets a standard for facilities to
``monitor the effectiveness of the preventive controls.'' The comments
state that the statute does not indicate how facilities are to monitor
the effectiveness of the mitigation strategies; it does not indicate
that each mitigation strategy must be monitored, and it does not
specify the frequency at which monitoring must occur. However, the
comments agree that facilities should assess whether mitigation
strategies are in place and are fully implemented. The comments agree
that facilities should have written procedures regarding how, and the
frequency at which, observations take place, but also indicate that
these procedures and frequencies should be less rigorous than
procedures and frequencies for preventive controls.
    (Response 88) We agree that facilities must assess whether
mitigation strategies are in place. We also agree that facilities must
provide written procedures regarding how, and the frequency at which,
monitoring occurs. This rule implements section 103 of FSMA, and
therefore includes components for monitoring (section 418(d) of the
FD&C Act). We agree that monitoring in the intentional adulteration
regulatory framework should be more flexible than monitoring as
described in the National Advisory Committee on Microbiological
Criteria for Foods' HACCP Principles and Application Guidelines.
Therefore, we have modified the requirement for monitoring in the
regulatory text to include ``as appropriate to ensure the proper
implementation of the mitigation strategies, taking into account the
nature of each such mitigation strategy and its role in the facility's
food defense system'' (see Sec. Sec.  121.138, 121.140) and to provide
for the use of exception records (see Sec.  121.140(c)(2)). These
changes allow a facility to select the appropriate rigor and frequency
of its monitoring based on its particular circumstances and are similar
to those made in the PCHF final rule regulatory text for monitoring in
the preventive controls management components.
    For example, a facility stages ingredients overnight so the first
shift can immediately begin adding ingredients to a hopper. The
facility identifies staged ingredient containers as an actionable
process step because the overnight staging makes the ingredient
containers significantly vulnerable. The facility then identifies a
mitigation strategy of reducing ingredient staging time. The facility
establishes and implements food defense monitoring procedures to
include observations of the staging area to ensure the ingredients are
staged immediately prior to addition into the hopper rather than
overnight. This monitoring procedure is tailored to the facility's
circumstances and is appropriate to the mitigation strategy (i.e.,
suitable for a particular purpose and capable of being applied) because
it allows for the assessment or observation that the ingredient staging
time is being reduced. When establishing the monitoring procedure, the
facility considered the nature of the mitigation strategy (i.e., an
observation would determine if reducing the staging time was being
consistently performed) and its role in the facility's food defense
system (i.e., the facility deemed it necessary to conduct the
monitoring for the mitigation strategy because the reducing the staging
time significantly minimized the significant vulnerability associated
with the ingredient containers). Additionally, the facility reasoned
that monitoring the staging area immediately prior to the addition of
the ingredients to the hopper met the requirement for monitoring to be
conducted on an adequate frequency because this frequency meets the
definition of adequate (i.e., that which is needed to accomplish the
intended purpose in keeping with good public health practice) in that
monitoring prior to ingredient addition to the hopper ensures that
employees will properly implement the reduced staging time and reduce
the significant vulnerability.
2. Proposed Sec.  121.140(c)--Requirement for Records
    We proposed that all monitoring of focused mitigation strategies in
accordance with this section must be documented in records that are
subject to verification in accordance with proposed Sec.  121.150(a)
and records review in accordance with proposed Sec.  121.150(c).
    In the following paragraphs, we discuss comments that disagree with
the proposed requirements, ask us to clarify the proposed requirements,
or suggest one or more changes to the proposed requirements. After
considering these comments, we have revised the regulatory text to
provide that exception records may be adequate in some circumstances
(see Sec.  121.140(c)(2)).
    (Comment 89) Some comments state that a facility will be much more
likely to document a deviation from an established mitigation strategy
(i.e., a light is broken or turned off) rather than a confirmation that
the light was working properly each day. These comments seem to
indicate that this could be a potential area where greater flexibility
is needed regarding how monitoring is documented.
    (Response 89) New Sec.  121.140(c)(2) provides for exception
records and states records may be affirmative records demonstrating the
mitigation strategy is functioning as intended and

that exception records demonstrating the mitigation strategy is not
functioning as intended may be adequate in some circumstances. This
revision to the regulatory text was made to clarify that exception
records, in certain circumstances, are acceptable. We understand
exception reporting as a structure where automated systems are designed
to alert operators and management on an exception basis--i.e., only
when a deviation from food safety parameter limits are observed by the
system.
    Exception reporting would be an acceptable monitoring system in
some circumstances. A facility must be able to verify that food defense
monitoring is being conducted (Sec.  121.150(a)(1)). This is
straightforward with affirmative monitoring records but can be more
difficult or impossible with exception records. The following example
provides an instance where a facility may choose exception records when
monitoring a mitigation strategy. A facility identifies an ingredient
storage area as an actionable process step, and identifies and
implements a restricted access system that uses electronic swipe/key
cards to limit access to the area. The restricted access system is
designed to allow authorized personnel to open a door to the area,
while also alerting management when the door is left unlocked. While
the system would not need to produce a record for every authorized
access to the area, the system would produce a record for each instance
that the door is left unlocked and alert operators to those instances.
In this example, the facility would periodically verify that the
restricted access system is working properly, in part, by leaving the
door unlocked, and ensuring the system alerts the operator by
generating a record that documents the door being unlocked. Exception
records are not always appropriate. For example, it would not be
appropriate to create a record that indicates adequate lighting is not
functioning as intended, rather than documenting adequate lighting is
functioning as intended, unless the facility devised an approach that
would allow it to verify that food defense monitoring was being
conducted as required.

F. Proposed Sec.  121.145--Corrective Actions

1. Proposed Sec.  121.145(a)(1)-(2) Requirement To Establish and
Implement Corrective Action Procedures That Must Describe Steps To Be
Taken
    We proposed that you must establish and implement written
corrective action procedures that must be taken if the mitigation
strategy is not properly implemented. The corrective action procedures
must describe the steps to be taken to ensure that appropriate action
is taken to identify and correct a problem with implementation of a
mitigation strategy to reduce the likelihood that the problem will
recur.
    Some comments support the proposed requirements. In the following
paragraphs, we discuss comments that disagree with the proposed
requirements, ask us to clarify the proposed requirements, or suggest
one or more changes to the proposed requirements. Some comments request
that the intentional adulteration requirements provide more flexibility
than a traditional HACCP framework, with specific requests for
flexibility in the management components, including corrective actions.
After considering these comments, we are making several revisions to
the proposed requirements for corrective actions. First, we are adding
the qualification ``as appropriate to the nature of the actionable
process step and the nature of the mitigation strategy'' to the
beginning of the provision in Sec.  121.145(a). Second, we are
separating the requirements to take appropriate action to identify and
correct a problem that has occurred from the requirement to take
appropriate action, when necessary, to reduce the likelihood that the
problem will recur. The separated requirements are now included in the
regulatory text as Sec.  121.145(a)(2)(i) and Sec.  121.145(a)(2)(ii),
respectively. Similar changes were made to the PCHF final rule
regulatory text for corrective actions, as comments related to that
rule asserted the proposed corrective action regulatory text could have
been misunderstood as a requirement to establish a new preventive
control after implementing a corrective action procedure. These
comments also asserted that it would be inappropriate to assume that
corrective action procedures always correct a problem with the
implementation of a new or additional preventive control. We have
addressed these comments to the requirement to identify and correct a
problem by adding ``that has occurred'' after ``correct a problem'' in
Sec.  121.145(a)(2)(i). We have also addressed these comments by
qualifying the requirement that the corrective action procedures must
describe the steps to be taken to ensure that appropriate action is
taken to reduce the likelihood that the problem will recur by inserting
``when necessary'' after ``appropriate action is taken'' in Sec.
121.145(a)(2)(ii).
    (Comment 90) A few comments state that greater flexibility is
needed to reflect the differences between mitigation strategies and
preventive controls and that corrective actions is one potential area
in which to increase flexibility. While comments agree that a facility
should take action when a mitigation strategy is not properly or fully
implemented, these comments further state that detailed, written
corrective action procedures should not be required to address every
possible deviation for each mitigation strategy. In addition, comments
state that facility employees should make corrections, rather than take
corrective actions, in some circumstances. These comments provide an
example of corrections where a door is simply closed, and the action is
not documented, in response to a single, isolated event where a door is
propped open.
    (Response 90) As described previously, we have modified the
provision to provide that corrective action procedures are established
and implemented based on the nature of the actionable process step in
addition to the nature of the mitigation strategy (see Sec.
121.145(a)). The rule allows for a facility's corrective action
procedures to reflect the extent of the deviation. For example, a
facility's monitoring indicates that a peer monitoring mitigation
strategy is not implemented as intended because one of the employees
does not accompany the other employee at the actionable process step. A
component of the facility's written corrective action is to retrain the
employee on the importance of accompanying the other employee while at
the actionable process step. We expect, in most cases, that food
defense corrective action procedures will be simple and easy to
undertake. Further, we agree that written corrective action procedures
need not address every possible deviation, and the rule does not
require this. Written corrective action procedures should address
circumstances where deviations are likely to occur. The reason to have
corrective action procedures is to consider the likely scenarios in
advance, rather than react to these scenarios on an ad hoc basis.
    We do not agree that certain situations are more appropriate for
corrections rather than corrective actions. A ``correction'' does not
include, among other things, actions to reduce the likelihood that the
problem will recur. The comment describes a situation where a facility
is locking the door to serve as the mitigation strategy, and the

monitoring of the mitigation strategy indicates the strategy is not
performing as intended (i.e., the door is not locked, and it is propped
open). Because monitoring has indicated the mitigation strategy is not
properly implemented, a corrective action is required (Sec.
121.145(a)(1)). While the example includes a corrective action that is
quite simplistic and easy to undertake, it is important that a
corrective action, and not a correction, be taken because the
corrective action includes actions to reduce the likelihood that the
problem will recur, while the correction does not. An unlocked door
leaves the significant vulnerability unmitigated, and therefore, this
seemingly isolated problem directly impacts product vulnerability.
    Furthermore, corrections, such as those discussed in the PCHF final
rule (e.g., facility observes food residue on ``clean'' equipment prior
to production of food, and then cleans the equipment), are appropriate
for minor and isolated problems that do not directly impact product
safety. An analogous situation does not exist in the context of
intentional adulteration where requirements of this rule are designed
to reduce significant vulnerabilities associated with an insider
attack. Additionally, food defense corrective action requirements are
less rigorous and resource-intensive than corrective actions for food
safety purposes. Food defense corrective actions do not include
requirements to evaluate all affected food for safety, prevent affected
food from entering commerce, or include requirements for unanticipated
problems.
2. Proposed Sec.  121.145(a)(3)--Documentation
    We proposed that all corrective actions taken in accordance with
this section must be documented in records that are subject to
verification in accordance with proposed Sec.  121.150(b) and records
review in accordance with proposed Sec.  121.150(c).
    Some comments support the proposed requirements without change. One
comment states that documentation would not be needed in a single,
isolated event, such as where a door is propped open, and the
corrective action would simply result in the door being closed. While
the example includes a corrective action that is simple and easy to
undertake, it is necessary that it be documented. Without such
documentation, verification of proper implementation of the mitigation
strategy, as required in Sec.  121.150(a)(3), may not be possible
because there are no records to review which reflect failure to
implement the mitigation strategy. Further, without documentation, it
may not be known whether it was a one-time event or the door was
propped up more regularly. Documentation of the corrective actions and
review of the documentation to verify proper implementation of
mitigation strategies is necessary to identify trends and patterns of
implementation of mitigation strategies over time, and is also
necessary to ensure appropriate decisions about corrective actions are
being made. After considering the comment, we are finalizing these
requirements as proposed.

G. Proposed Sec.  121.150--Verification

    We proposed to require verification of monitoring, verification of
corrective actions, verification of implementation and effectiveness,
reanalysis, and documentation of all verification activities.
Specifically regarding verification of implementation and
effectiveness, (proposed Sec.  121.150(c)), we proposed that you must
verify that the focused mitigation strategies are consistently
implemented and are effectively and significantly minimizing or
preventing the significant vulnerabilities. We proposed that this must
include, as appropriate to the facility and the food, review of the
monitoring and corrective actions records within appropriate timeframes
to ensure that the records are complete, the activities reflected in
the records occurred in accordance with the food defense plan, the
focused mitigation strategies are effective, and appropriate decisions
were made about corrective actions. We also requested comment on
whether we should specify the verification activities that must be
conducted for verification of monitoring and for verification of
corrective actions and, if so, what verification activities should be
required.
1. Verification of Monitoring, Corrective Actions and Implementation
and Effectiveness
    Some comments support the proposed requirements. In the following
paragraphs, we discuss comments that disagree with the proposed
requirements, ask us to clarify the proposed requirements, or suggest
one or more changes to the proposed requirements. Some comments request
that the intentional adulteration requirements provide more flexibility
than a traditional HACCP framework, with specific requests for
flexibility in the management components, including verification. Most
of the comments addressing verification activities request
clarification specifically related to implementation and effectiveness.
One comment requests that we provide for other activities appropriate
for verification of implementation and effectiveness. After considering
these comments, we are making several changes to the requirements for
verification.
    First, we are adding text to Sec.  121.150(a) (Food defense
verification) to reflect that verification procedures are established
and implemented based on the nature of the mitigation strategy and its
role in the facility's food defense system. Second, we made edits to
reflect new Sec.  121.138. We have changed proposed Sec.  121.150(a) to
final Sec.  121.150(a)(1), which now states ``Verification that food
defense monitoring is being conducted as required by Sec.  121.138 (and
in accordance with Sec.  121.140).'' We have changed proposed Sec.
121.150(b) to final Sec.  121.150(a)(2), which now states
``Verification that appropriate decisions about food defense corrective
actions are being made as required by Sec.  121.138 (and in accordance
with Sec.  121.145).'' We have changed proposed Sec.  121.150(c) to
final Sec.  121.150(a)(3) which requires verification that mitigation
strategies are properly implemented and significantly minimizing the
significant vulnerabilities.
    Third, we have removed the requirement to verify that mitigation
strategies are effectively significantly minimizing or preventing
significant vulnerabilities in Sec.  121.150(c) because it is more
appropriate to verify mitigation strategies are being properly
implemented, in accordance with the food defense plan, rather than
verifying these strategies are effective. In the food safety context,
verification of effectiveness is mainly accomplished via validation and
testing, which are not required in this final rule due to the nature of
mitigation strategies. Fourth, we are adding a new section Sec.
121.150(a)(3)(ii) to provide for ``other activities appropriate for
verification of proper implementation'' to allow for increased
flexibility in verifying mitigation strategies are properly implemented
beyond what is included in Sec.  121.150(a)(3)(i). Fifth, we added a
requirement (Sec.  121.150(b)), to establish and implement written
procedures, including the frequency for which they are performed, for
verification activities. This requirement was added because the
flexibility, provided in Sec.  121.150(a)(3)(ii), is significant but
not unbounded. Written procedures are essential to ensure these
activities are occurring in accordance with the food defense plan.
Sixth, we moved the more

extensive section for reanalysis (proposed Sec.  121.150(d)) to a new
section (final Sec.  121.157) to improve readability and clarity. As a
result, we created a new Sec.  121.150(a)(4) (``Verification of
Reanalysis in accordance with Sec.  121.157'') to include in Sec.
121.150 the requirement to verify that reanalysis has been conducted.
Some of these changes are similar to those made in the PCHF final rule
regulatory text for verification and preventive controls management
components.
    (Comment 91) Some comments request clarification and elaboration
for verification activities related to implementation and effectiveness
of mitigation strategies (proposed Sec.  121.150(c)).
    (Response 91) As mentioned previously, we have removed the
requirement to verify the effectiveness of mitigation strategies. As
part of food defense verification, a facility must determine if each
mitigation strategy is properly implemented and significantly
minimizing or preventing significant vulnerabilities. To do this, a
facility would determine whether the mitigation strategies are
consistently implemented and functioning as intended. Part of this
determination would be based on review of monitoring and corrective
action records. In addition, as mentioned in section V.D, facilities
may use, but are not limited to, two important factors to determine the
proper implementation of mitigation strategies to significantly
minimize or prevent significant vulnerabilities: (1) The degree of
physical access to the product at the actionable process step and (2)
the ability of an attacker to successfully contaminate the product at
the actionable process step.
    For example, if a mitigation strategy is significantly minimizing
the degree of physical access to the product at an actionable process
step, and the strategy is consistently implemented as determined by
record review, the strategy can be considered properly implemented.
Likewise, if the mitigation strategy is significantly minimizing the
ability of an attacker to successfully contaminate the product at the
actionable process step, and the strategy is consistently implemented
as determined by record review, the strategy can be considered properly
implemented. These factors are the same as two of the factors required
to be evaluated in a vulnerability assessment (Sec.  121.130(a)(2) and
(3)).
    We are not including the third factor (the potential for public
health impact (Sec.  121.130(a)(1)) because it has been our experience
that mitigation strategies either directly reduce access to a point,
step, or procedure, or directly reduce the ability of an attacker to
contaminate the food at a point, step, or procedure, and in doing so,
indirectly reduce the potential public health impact if a contaminant
were added at a point, step, or procedure.
    As a facility reasons through its explanation of how the mitigation
strategy significantly minimizes or prevents the significant
vulnerability (Sec.  121.135(a)), the facility's explanation will most
likely include the rationale for how the mitigation strategy reduces,
to an acceptable level, either the degree of unauthorized access to the
actionable process step or the ability of an attacker to successfully
contaminate the product at the actionable process step. When the
facility reviews the monitoring and corrective action records to ensure
that activities reflected in the records occur as envisioned by the
food defense plan (Sec.  121.135(a)) and are consistently implemented
(Sec.  121.150(a)(3)), the facility can then determine whether the
mitigation strategy is properly implemented and is significantly
minimizing the significant vulnerability at the actionable process
step.
    (Comment 92) One comment states that verification methods other
than those required by proposed Sec.  121.150(c) may be appropriate,
and provides suggestions of such methods, including direct observation
of monitoring, such as a supervisor observing monitoring conducted by
an employee, and review of monitoring and corrective actions activities
during team meetings.
    (Response 92) We agree that the rule should provide flexibility for
additional activities related to verification of properly implemented
mitigation strategies, and have revised the specific requirements to
provide for other activities appropriate for verification of proper
implementation of mitigation strategies in Sec.  121.150(a)(3)(ii).
Providing specific requirements for verification of implementation
(Sec.  121.150(a)(3)(i)), but allowing for other activities appropriate
for verification of implementation (Sec.  121.150(a)(3)(ii)),
addresses, in part, comment requests that mitigation strategies
management components need to provide more flexibility.
    (Comment 93) One comment disagrees with the requirement that, as
part of verification, monitoring and corrective action records must be
reviewed and further states that the proposed requirement is too
prescriptive and not applicable to food defense.
    (Response 93) Review of monitoring and corrective action records is
a key component of verification in a food defense system. Review of
monitoring records is necessary to determine whether mitigation
strategies are implemented as intended and are therefore significantly
minimizing significant vulnerabilities. For example, review of
monitoring records for a mitigation strategy of using a lock to secure
an access hatch on top of a silo could indicate that the lock is
functioning as intended because the securing mechanism is fully
engaged, and the hatch cannot be accessed without a key to the lock.
The significant vulnerability has been significantly minimized because
the food in the silo is no longer accessible. The facility determines
the mitigation strategy is properly implemented because it is
functioning as intended and minimizes the significant vulnerability.
    Review of corrective action records is necessary to determine
whether appropriate decisions are being made to identify and correct
any problems with the implementation of a mitigation strategy and
whether actions are being taken to reduce the likelihood that a problem
would recur. To continue with the example, if the review of monitoring
records indicated that the lock was not properly implemented due to
employee error, the facility implements the corrective action, which
consists of engaging the securing mechanism of the lock on the access
hatch, and retraining the employee assigned to this step in how to
properly use the securing mechanism. During the review of the
corrective action records, the facility determines that appropriate
decisions about corrective actions were made because the problem was
identified that the lock was not properly implemented due to employee
error, the problem was corrected because the facility engaged the
securing mechanism of the lock to lock the access hatch, and actions
were taken to reduce the likelihood the problem would recur by training
the employee on how to successfully engage the securing mechanism of
the lock in order to lock the access hatch.
    Further, FDA has provided a flexible time period for review,
allowing review of monitoring and corrective action records to take
place in an ``appropriate timeframe.'' For example, a facility chooses
to use several mitigation strategies, including adequate lighting, at
the bulk truck unloading bay to protect the actionable process step,
and the lighting may be monitored each time a shipment is received or
on a weekly basis depending on the facility's determination of the
frequency of the monitoring procedures. The review of these monitoring
records may occur on

a weekly or monthly basis, depending on the frequency of the monitoring
procedures and the role this mitigation strategy plays in a facility's
food defense system. We disagree that this requirement is too
prescriptive.
    (Comment 94) Some comments assert that industry cannot be held to a
standard of absolute prevention of intentional adulteration, and given
this assertion, one of these comments further states that effectiveness
of mitigation strategies should be interpreted reasonably by both FDA
and industry. The comment agrees that facilities should be expected to
take reasonably appropriate measures to mitigate vulnerabilities and
also states that facilities should have discretion to determine how
mitigation strategies are effective. This comment goes on to state that
facilities should not be expected to employ a certain measure just
because the measure is available, particularly when the added benefit
might be minimal. Finally, the comment states that, in the context of
interpreting effectiveness of mitigation strategies in a reasonable
manner, FDA should be mindful of the extremely low likelihood of an
intentional adulteration event that may cause massive public health
harm or economic disruption.
    (Response 94) We acknowledged the low probability of an intentional
adulteration event that may cause wide scale public health harm in the
proposed rule (78 FR 78014 at 78024). The rule does not create a
standard of absolute prevention at every identified actionable process
step. Mitigation strategies are, among other things, ``risk-based'' and
``reasonably appropriate measures.'' They are employed to
``significantly minimize or prevent'' significant vulnerabilities.
    Furthermore, each facility has some degree of discretion in
determining how, and whether, each mitigation strategy is properly
implemented, as part of the facility's written explanation of how the
mitigation strategy sufficiently minimizes or prevents the significant
vulnerability associated with the actionable process step.
    Additionally, facilities are not required to employ measures just
because they are available or convenient. Rather, facilities are
required to identify and implement mitigation strategies that reflect
the specific circumstances of the actionable process step and the
facility. Because the facility considers these circumstances when
identifying and implementing an appropriate mitigation strategy, and
provides a written explanation of how the mitigation strategy
sufficiently minimizes or prevents the significant vulnerability
associated with an actionable process step, a facility may choose a
mitigation strategy that it believes provides maximum benefit,
regardless of availability or convenience, if it complies with the
requirement to significantly minimize, or prevent, the significant
vulnerability.
2. Proposed Sec.  121.150(d)--Reanalysis (Final Sec.  121.157)
    We proposed that you must conduct a reanalysis of the food defense
plan (1) At least once every 3 years; (2) Whenever a significant change
in the activities conducted at your facility creates a reasonable
potential for a new vulnerability or a significant increase in a
previously identified vulnerability; (3) Whenever you become aware of
new information about potential vulnerabilities associated with the
food operation or facility; (4) Whenever you find that a focused
mitigation strategy is ineffective; and (5) Whenever FDA requires
reanalysis to respond to new vulnerabilities and developments in
scientific understanding including, as appropriate, results from the
Department of Homeland Security biological, chemical, radiological, or
other terrorism risk assessments. These requirements for reanalysis of
the food defense plan were proposed within Sec.  121.150 Verification.
    Many comments responded to Sec.  121.150 (Verification) as a whole,
without specifically referring to reanalysis as an area needing edits.
However, some comments regarding verification potentially apply to
reanalysis, and these are addressed in this section. Some comments
support the proposed requirements without change and some support the
proposed provisions but ask for more flexibility and suggest
alternative regulatory text. After considering these comments, to
improve clarity and readability and to be consistent with the PCHF
final rule with respect to the regulatory text for reanalysis, we have
removed reanalysis from Sec.  121.150 and created a new section Sec.
121.157 devoted entirely to requirements for reanalysis. We have
revised the regulatory text within this section to clarify which
portions of the food defense plan will need reanalysis and how often
(e.g., the whole plan needs reanalysis at least every 3 years, and the
whole plan or the applicable portions of the plan need reanalysis for
all other reasons required in the text), to expand the scope of
situations that trigger a reanalysis (e.g., added a reanalysis
requirement when required by FDA based on credible threats to the food
supply), and we increased clarity for when the reanalysis requires a
revision to the food defense plan (e.g., the proposed language stated a
revision to the food defense plan is required when a significant change
is made, and the text was edited to state that a revision to the food
defense plan is required when a significant change in activities
conducted at your facility creates a reasonable potential for a new
significant vulnerability or a significant increase in a previously
identified vulnerability). Also, the new reanalysis section provides
more flexibility in the timeframe for when a reanalysis must be
completed, and clarifies when a reanalysis requires a revision to the
food defense plan.
    In the following paragraphs, we discuss comments that suggest one
or more changes to the proposed requirements.
    (Comment 95) Some comments state that greater flexibility is needed
to reflect the differences between mitigation strategies and preventive
controls and that verification is one potential area in which to
increase flexibility. These comments believe that the oversight burden
and the records burden associated with verification could be lessened
by adding more flexibility.
    (Response 95) We interpreted these comments to include reanalysis
in the verification activities mentioned. We agree that the overall
regulatory framework for this rule should provide more flexibility than
that of a traditional HACCP approach and have described our general
thinking in Comment 1 and Comment 2 of this document. To align with
this thinking we have made specific changes to the reanalysis
requirements. We removed reanalysis from Sec.  121.150 and created a
new section Sec.  121.157 devoted entirely to requirements for
reanalysis to help clarify activities for the purpose of verification
versus activities specific to reanalysis. Within this section we
provide for reanalysis of an applicable portion of the food defense
plan (rather than the complete food defense plan) in specified
circumstances. We have revised the regulatory text to state that when
reanalysis is conducted for any reason other than Sec.  121.157(a)
(every 3 years), the food defense plan as a whole may need to be
reanalyzed, or just the applicable portion of the food defense plan
that may be affected by the proposed change or the new information (see
Sec.  121.157(a) and 121.157(b)). In the proposed rule, the portions of
the plan that required reanalysis were not detailed, and the
implication was that the entire plan must be reanalyzed in all cases.
Our clarification of this language

allows flexibility for the facility to determine the extent of the
required reanalysis based on the nature of the reanalysis trigger. In
addition, we made associated editorial changes for the intentional
adulteration reanalysis requirements to improve the readability of the
requirement to conduct reanalysis ``whenever a mitigation strategy, a
combination of mitigation strategies, or the food defense plan as a
whole, is not properly implemented'' (see Sec.  121.157(b)(3)). In the
proposed rule this requirement applied only to the ineffective nature
of a mitigation strategy and did not take into account other areas of
the food defense plan that may be contributing to an ineffective food
defense plan. We also added new text to the reanalysis requirement to
allow FDA to require a reanalysis ``when credible threats are made to
the food supply'', as discussed more fully in section III.C.
    Further, additional flexibility has been provided with respect to
timeframes associated with completing reanalysis. The proposed rule
required that reanalysis be completed ``before the change in activities
at the facility were operative'' or ``when necessary, during the first
6 weeks of production.'' The new requirement states that the reanalysis
must be complete ``before any changes in activities (including any
change in mitigation strategy) at the facility is operative,'' or
``when necessary, within 90 days of production'' or ``within a
reasonable timeframe, providing a written justification is prepared for
a timeframe that exceeds 90 days after production of the applicable
food first begins.'' This flexibility in timeframes lessens the burden
on the facility. We believe the 90-day timeframe is sufficient for
completing the reanalysis but recognize that there may be instances
where the 90-day timeframe is exceeded and this is allowed with
sufficient written justification.
    We lessened the documentation burden by only requiring a revision
to the food defense plan ``if a significant change in the activities
conducted at your facility creates a reasonable potential for a new
significant vulnerability or a significant increase in a previously
identified vulnerability.'' The proposed rule required a revision to
the food defense plan if ``a significant change was made.'' By stating
specifically that revisions are only required if a change is made in
activities that affect vulnerabilities, we eliminate the revision
requirements for changes that are not directly related to the risk of
intentional adulteration. Both the proposed and final rules provide for
the option to conclude that a revision to the food defense plan is not
needed as long as the basis for that conclusion has been documented.
    Many of the changes we made to the reanalysis provisions are
similar to changes made in the PCHF final rule, and we believe this
consistency will assist with overall understanding and implementation
of these rules.
    (Comment 96) Some comments ask us to recognize other terminologies
suggesting reanalysis could be referred to as ``reassessment.''
    (Response 96) We decline this request. We have acknowledged that
the terminology used in relation to the concept of ``reanalysis''
varies in current regulations and guidelines for systems such as HACCP
(78 FR 3646 at 3759). A facility may choose to use a term such as
``reassessment'' in its records--e.g., if it relies on existing records
that use the term ``reassessment'' to satisfy some or all of the
requirements of this rule for reanalysis. However, the rule will use a
single term to minimize the potential for confusion about whether
different terms have a different meaning for the purposes of the rule.

H. Proposed Sec.  121.160--Training (Final Sec.  121.4)

    We proposed in Sec.  121.160 to require that (1) Personnel and
supervisors assigned to actionable process steps must receive
appropriate training in food defense awareness and their respective
responsibilities in implementing focused mitigation strategies and (2)
All required training must be documented in records. We asked for
comment on several questions related to training, including whether we
should require that basic food defense awareness training be completed
by all employees and whether we should require training to be repeated
periodically. We also requested comment on the adequacy of FDA's Food
Defense 101 training materials and whether additional FDA training
materials are needed. Finally, we requested comment on the feasibility
of the proposed training requirements, in light of the current state of
food defense awareness in the industry and available training
resources.
    No comments disagree with the need for training for facilities to
be able to properly implement this rule, and many comments acknowledge
that training is crucial to creating an effective food defense
environment in a facility. Some comments agree with our proposed
training approach, and other comments request changes. After
considering the comments, we have changed the training requirements by
creating a new section, Sec.  121.4 (Qualifications of Individuals Who
Perform Activities Under Subpart C), which replaces Sec.  121.160 and
defining the term ``qualified individual'' in Sec.  121.3. In summary,
the final rule requires all individuals who perform activities under
Subpart C to be qualified through training or job experience or a
combination thereof. Individuals and their supervisors at actionable
process steps are required to take food defense awareness training and
individuals who prepare the food defense plan, conduct a vulnerability
assessment, identify and explain mitigation strategies and perform
reanalysis must have successfully completed training for the specific
activity at least equivalent to that received under a standardized
curriculum recognized as adequate by FDA or be otherwise qualified
through job experience to conduct the activities.
    Section 121.4 requires that individuals performing activities under
Subpart C have certain qualifications that vary based on the activity
performed. Section 121.4(a) requires that you ensure that each
individual who performs activities required under Subpart C is a
qualified individual. A qualified individual is ``a person who has the
education, training, or experience (or a combination thereof) necessary
to perform an activity required under Subpart C, as appropriate to the
individual's assigned duties. A qualified individual may be, but is not
required to be, an employee of the establishment'' (Sec.  121.3). See
section IV.C.4 for further discussion of this definition. Section
121.4(b) requires that each individual assigned to an actionable
process step (including temporary and seasonal personnel) or in the
supervision thereof must (1) be a qualified individual and (2) receive
training in food defense awareness. Section 121.4(c) requires that each
individual assigned to (1) the preparation of the food defense plan,
(2) the conduct of a vulnerability assessment, (3) the identification
and explanation of the mitigation strategies, or (4) the reanalysis of
the food defense plan must be a qualified individual and have
successfully completed training for the specific activity at least
equivalent to that received under a standardized curriculum recognized
as adequate by FDA or be otherwise qualified through job experience to
conduct the activities. Job experience may qualify an individual to
perform any of the activities listed previously if such experience has
provided an individual with knowledge at least equivalent to that
provided through the standardized

curriculum. Section 121.4(d) requires that responsibility for ensuring
compliance by individuals with the requirements be clearly assigned to
supervisory personnel with adequate qualifications to supervise the
activities. Section 121.4(e) requires that the training required by
Sec.  121.4(b) and (c) must be documented in records that include the
date of the training, the type of training, and the person trained, and
must be established and maintained in accordance with the requirements
of subpart D.
    In the following paragraphs, we discuss comments that respond to
our request for comment regarding the proposed training requirement and
comments that request changes to the training requirement as proposed.
    (Comment 97) Some comments assert that FDA should require
facilities to conduct food defense awareness training for all employees
and not just for employees and supervisors who work at actionable
process steps. Some comments indicate that, since food defense is a new
area of regulation, that training to increase general awareness by all
employees would be a useful requirement in gaining familiarity with the
risk and mitigation of intentional adulteration. Some comments state
that food defense awareness training for all employees is fundamental
for creating a food defense culture at a facility and may be the
critical element for preventing a successful attack. Alternatively,
some comments state that expanding the food defense awareness training
requirement to all employees will not advance food defense and could
create a generalized approach that may diminish the ability of the
facility to effectively train personnel who have significant roles in
implementing food defense requirements. Some comments state that the
cost of requiring training of all employees would be overly burdensome.
    (Response 97) Although we agree that food defense awareness
training would be useful for all employees, we believe that the best
use of training resources for industry would be to focus the
requirement for food defense awareness training on personnel who are
assigned to an actionable process step. We do not believe it is
necessary to require that facilities provide all employees with
awareness training to significantly minimize or prevent significant
vulnerabilities. Although we disagree that training all employees could
diminish the ability of a facility to effectively train personnel, we
agree that concentrating awareness training on certain individuals is
less burdensome than a general training requirement. We believe it is
the best use of resources to train individuals at actionable process
steps in food defense awareness because that is where intentional
adulteration, when intended to cause wide scale public health harm, is
most likely to occur. Our food defense guidance includes options for
increasing general awareness of food defense throughout a facility by
incorporating the importance of food defense procedures into routine
facility communications, such as brochures, staff meetings, or payroll
stuffers. We recommend that facilities encourage all employees to
report unusual or suspicious individuals or activities to management.
    In addition to requiring food defense awareness training for
certain individuals, the rule requires that each individual who
performs activities required by subpart C be a qualified individual as
that term is defined in Sec.  121.3. In addition, the rule requires
individuals performing certain activities, including the preparation of
the food defense plan or the conduct of a vulnerability assessment, to
have successfully completed training for the specific activity at least
equivalent to that received under a standardized curriculum recognized
as adequate by FDA or be otherwise qualified through job experience to
conduct the activities.
    (Comment 98) Some comments express a need for advanced food defense
training requirements for individuals conducting higher level food
defense activities such as food defense coordinators, individuals who
prepare, monitor, verify, or conduct corrective actions associated with
food defense plans, managers or quality control personnel or personnel
who would be responsible for identification of appropriate mitigation
strategies. Some comments assert that these food defense activities
require specialized knowledge that would not be covered in food safety
training and that qualified individuals should perform these higher
level functions.
    (Response 98) We agree with these comments and are requiring that
each individual engaged in activities in subpart C must be a qualified
individual with the appropriate education, training, or experience (or
a combination thereof) to perform the activity. Further, the rule
requires increased qualifications for individuals responsible for
higher level activities, such as preparation of the food defense plan,
conducting a vulnerability assessment, identifying and explaining
mitigation strategies, and reanalysis (Sec.  121.4(c)). These
individuals must have the appropriate education, training, or
experience (or a combination thereof) necessary to properly perform
their assigned activities and have successfully completed training at
least equivalent to that received under a standardized curriculum
recognized as adequate by FDA or be otherwise qualified through job
experience to conduct the activities. Job experience may qualify an
individual to perform these functions if such experience has provided
an individual with knowledge at least equivalent to that provided
through the standardized curriculum. We believe the activities listed
previously require an additional level of expertise and training than
other activities required under subpart C and, therefore, FDA is
establishing a standardized curriculum for training which individuals
performing these activities must successfully complete (or be otherwise
qualified through job experience). This approach is consistent with the
PCHF final rule, where additional food safety training is required for
individuals who prepare or oversee preparation of the food safety plan,
including conducting the hazard analysis (21 CFR 117.126(a)(2)).
    We anticipate that the standardized curriculum for activities other
than the conduct of a vulnerability assessment will be an approximately
4-hour training that will cover food defense awareness and food defense
planning components such as preparing, implementing, and reanalysis of
a food defense plan and selecting and explaining mitigation strategies.
We plan for the training to be available online.
    The training for conducting or overseeing a vulnerability
assessment will require in-depth analysis of the functional and thought
processes required to properly characterize significant vulnerabilities
associated with a facility's points, steps, or procedures and the
identification of actionable process steps. The process of conducting a
vulnerability assessment may be new to much of the industry and the
training will take this into consideration. The standardized curriculum
for conducting a vulnerability assessment will need to cover each
required component of the vulnerability assessment and provide enough
information for an individual to calibrate their decision making based
on the scientific analysis required by a vulnerability assessment. We
believe that the curriculum designed for this activity will require
multiple days and may be best offered in person. Based on the
vulnerability assessment method chosen, the length of the standardized
curriculum may vary, for example if a

facility is using the key activity types the training could be shorter.
    Finally, with regard to comments that suggest that individuals who
prepare, monitor, verify, or conduct corrective actions associated with
food defense plans receive specialized training, we agree that
individuals responsible for these activities should be qualified
individuals and may need training to perform such activities. However,
we are not standardizing a curriculum for such training and realize
that individuals may be qualified through education or experience to do
these activities because these concepts are not completely unique to
food defense planning and analogous food safety concepts have been in
routine practice in many food facilities for the purpose of food safety
plans and/or HACCP approaches.
    (Comment 99) Some comments state that food defense awareness
training should be recognized as a beneficial mitigation strategy
within food defense plans to create heightened awareness and that this
training can be used to address intentional contamination including
insider threats. Other comments state that the only requirement for
food defense should be training and that any requirements beyond this
approach are not necessary.
    (Response 99) We agree that food defense awareness training for
employees and supervisors assigned to actionable process steps would
increase awareness and could assist with recognizing or thwarting an
insider threat; however, the training alone will not protect the food
at that actionable process step. It is the properly implemented
mitigation strategies, which are designed to reduce the significant
vulnerability at that step, which would protect the food against
intentional adulteration.
    (Comment 100) Some comments recommend that FDA set a requirement
for periodic retraining, and some comments suggest the training
requirement should specify training intervals such as during an
employee ``onboarding'' process and periodically thereafter or when
significant changes are made to the food defense plan. One comment did
not request a requirement for retraining but stated that it should be
understood that education and training are not a one-time occurrence.
One comment asked for flexibility for training and retraining
frequencies so a facility can take into account facility size,
environment, seasonality of employees, and other circumstances.
    (Response 100) We agree that training should not be a one-time
occurrence and believe that by defining ``qualified individual'' in
terms of an ability to perform assigned responsibilities we have
provided the flexibility for firms to consider relevant factors in
determining how often to perform training. Individuals conducting
activities under subpart C must be qualified to successfully implement
the food defense measures contained in the food defense plan. If the
food defense plan changes, because of a production change resulting in
a mitigation strategy change, for example, employees and supervisors
may need retraining if their responsibilities under subpart C change.
Also, retraining may be needed as a component of corrective action. For
example, if during the course of monitoring a facility determines that
certain mitigations strategies are not being implemented consistently
or appropriately, a component of the corrective action may be to
retrain the responsible staff and their supervisors. To ensure that
employees remain qualified to perform their duties under subpart C,
facilities will need to retrain employees when the food defense plan
changes and when a problem has been identified that training would
address.
    (Comment 101) Some comments commend FDA on the development of a
broad range of free training materials that will be efficient and
useful to meet training requirements. Some comments suggest updating
and expanding these trainings to include options for free,
downloadable, and customizable materials to reach a broad range of
cultural and language groups, and to include information on how to
protect food defense-related documents. One comment recommends that FDA
update all of its food defense resources to reflect the requirements
ultimately included in this final rule. One comment suggests that FDA
develop a ``train-the-trainer'' course that could be effectively
utilized by industry to equip management of food companies with the
training materials needed to comply with the training requirements.
    (Response 101) We agree that many of our trainings and other
resources will assist industry in complying with this rule. However, we
recognize that many of our existing materials will need to be updated
to reflect the provisions of the rule and new training materials will
need to be developed. We intend to update our training materials to
provide an option to comply with the food defense awareness training
requirement, and we will be developing a standardized curriculum for
training in accordance with the requirements of Sec.  121.4(c). We
anticipate the standardized content of the training will be modular,
with certain modules varying based on the difficulty and skill level of
the activity being performed, with the vulnerability assessment
training module being the most in-depth and lengthy (See Comment 80 and
Comment 81).
    The training for individuals and supervisors assigned to actionable
process steps may require facility-specific information for proper
implementation of the mitigation strategy or strategies and, therefore,
will need to be developed and administered on the job and will not be
developed by FDA.
    We will continue to provide food defense training and other
materials in as many formats as resources allow, such as online, DVD,
and hard copy. FDA currently has some food defense materials in
languages other than English, but will work as we are able towards
translating more materials in other languages to reach a broader
audience.
    In response to the development of a ``train the trainer'' course to
assist management with meeting the training requirements of this rule,
we interpret this comment to mean that we should offer materials so
that companies can deliver their own food defense awareness training.
Since the requirement for awareness training has inherent flexibility,
facilities can deliver their own food defense awareness trainings. We
believe the training tools and resources that we intend to update,
based on the requirements of this rule, will assist facility management
with gaining knowledge necessary for delivering food defense awareness
training, and we intend to explore the development of a ``train the
trainer'' in consultation with the alliance to meet the needs of the
standardized curriculum requirements.
    (Comment 102) Some comments request that FDA support the
development and distribution of educational and training resources to
assist very small facilities exempt from the rule with voluntary
compliance. Some comments request that FDA clarify how it will work
with retail stakeholders to strengthen education and training for
retail facilities that want to take voluntary food defense risk
reduction measures.
    (Response 102) FDA offers free tools and food defense awareness
training, as well as guidance, that we intend to update based on the
final requirements which should assist non-covered entities, such as
those at the retail level, who wish to voluntarily comply with the
final provisions of this rule.
    (Comment 103) Some comments support the food defense awareness

training requirement but ask that FDA keep the requirement flexible and
make clear that online training or other non-FDA developed trainings
are acceptable. One comment asked us to state whether the ``Food
Defense 101'' training released in 2013 by FDA is the preferred
resource for employee awareness training. Some comments state that it
might not be possible to provide the same type of training to all staff
at various levels, and that it should be up to the facility to
determine which training to provide to which staff, based on their food
defense responsibilities.
    (Response 103) We agree with the need to avoid rigid requirements
with respect to training content for food defense awareness. We
recognize that many food defense awareness trainings exist and may
already be utilized at facilities, and mandating specific content in
trainings may lead to redundancy and additional cost. We intend to
update our ``Food Defense 101, Food Defense Awareness for the Front-
line Employee'' training such that it would satisfy the requirement for
food defense awareness training; however, it is not the only acceptable
training. In addition, we believe that there are several existing
trainings that would be acceptable for other activities that may
require training such as food defense monitoring, food defense
corrective actions, and food defense verification.
    (Comment 104) Some comments recommend that, because food defense is
a new and evolving area, and because this regulation will be the first
of its kind worldwide, training and education need to occur at many
levels to effectively implement this rule. These comments state that
FDA must provide significant outreach and education to both industry
and State regulatory Agencies with jurisdiction over the production of
human food. These comments emphasize that FDA and State and local
inspection personnel will need significant training in conducting food
defense inspections and that training developed for FDA investigators
should be extended to State and local governments as well as industry
to help food facilities understand what is expected and how compliance
will be determined.
    (Response 104) We appreciate these comments regarding consistency
of training between industry and Federal, State, local and tribal
regulators, and we agree that this is a novel area of regulation that
could benefit from alignment of training between the regulated industry
and its regulators. We have addressed the issue of training for the
purposes of inspection and compliance in section III.D, but in general,
FDA is still in the process of assessing its training needs for
inspection and enforcement of this rule.
    (Comment 105) Some comments state that Alliances have been
successfully used to support implementation of other national
requirements, including other FSMA rules, using a partnership model.
These comments recommend that FDA consider formation of an Alliance
structure for the area of food defense as well. Comments state that
Alliances, made up of State and local public health professionals,
State and local public health associations, and industry can play an
important role in information sharing and outreach and a formal
Alliance for food defense is the best way to accomplish the development
of standardized food defense training content and effective training
tools and resources.
    (Response 105) We agree with these comments and have funded the
establishment of an Intentional Adulteration Subcommittee under the
existing Food Safety Preventive Controls Alliance. We intend to
leverage the expertise of State and local public health professionals,
State and local public health associations, and industry associations
to develop the standardized curriculum needed to meet the training
requirement.
    (Comment 106) Some comments suggest that FDA establish a technical
assistance office based out of the Center for Food Safety and Applied
Nutrition (CFSAN) that can answer queries, provide guidance, and
release information consistently to both regulators and the covered
industry to assist with educating industry and regulators.
    (Response 106) FDA has established a FSMA Technical Assistance
Network (TAN) to provide technical assistance to industry, regulators,
academia, consumers, and others regarding FSMA implementation.
Inquiries are answered by FDA Information Specialists or Subject Matter
Experts, based on the complexity of the question. To find out more
about the FSMA TAN please visit http://www.fda.gov/food/guidanceregulation/fsma/ucm459719.htm.
    (Comment 107) Some comments request funding from FDA for the
training of State, local, tribal, and territorial regulators.
    (Response 107) Funding associated with training State, local,
tribal, and territorial regulators is outside the scope of this rule.
    (Comment 108) One comment asserts that training and compliance
incentives must be available at the same time the final regulation is
released to give facilities time to learn about, build, and deploy an
effective implementation plan.
    (Response 108) It is unclear what is meant by training and
compliance incentives, but we have established extended compliance
dates to allow facilities the time necessary to comply with this
training requirement. See section VIII for information on compliance
dates.
    (Comment 109) One comment suggests that FDA should mandate training
on a ``code of ethics'' to prevent economically motivated adulteration.
    (Response 109) Acts of intentional adulteration for the purpose of
economic gain, i.e., economically motivated adulteration, are outside
the scope of the rule and are addressed in the preventive controls for
human food rule (80 FR 55907 at 56028-56029) and the preventive
controls for animal food final rule (80 FR 56170 at 56244-56246).

VI. Subpart D: Comments on Requirements Applying to Records That Must
Be Established and Maintained

    We proposed to establish in subpart D requirements that would apply
to all records that would be required by the various provisions of
proposed part 121, including general requirements related to the
content and form of records, additional requirements specific to the
food defense plan, requirements for record retention, requirements for
official review of records by FDA, and public disclosure.
    Some comments generally support requiring records to demonstrate
that a food defense plan has been created, is functioning, and is being
monitored. However, many comments disagreed with some of the specific
requirements that we proposed. In the following paragraphs, we discuss
comments that ask us to clarify the proposed requirements, disagree
with, or suggest one or more changes to the proposed requirements.

A. Proposed Sec.  121.301--Records Subject to the Requirements of This
Subpart D

    We proposed that all records required by proposed subpart C (Food
Defense Measures) are subject to all requirements of this subpart
except that the requirements of Sec.  121.310 apply only to the written
food defense plan. We received no comments on this section and are
finalizing as proposed.

B. Proposed Sec.  121.305--General Requirements Applying to Records

    We proposed that the records must (1) be kept as original records,
true copies, or electronic records (and that electronic records must be
kept in accordance with

part 11 (21 CFR part 11)); (2) contain the actual values and
observations obtained during monitoring; (3) be accurate, indelible,
and legible; (4) be created concurrently with performance of the
activity documented; (5) be as detailed as necessary to provide history
of work performed; and (6) include the name and location of the plant
or facility, the date and time of the activity documented, the
signature or initials of the person performing the activity, and, where
appropriate, the identity of the product and the production code, if
any. In the following paragraphs, we discuss comments that ask us to
clarify the proposed requirements or that disagree with, or suggest one
or more changes to, the proposed requirements.
    (Comment 110) Several comments express concern over the proposed
requirement that all electronic records be kept in accordance with part
11 and request that FDA exempt electronic records under part 121 from
compliance with part 11. Comments argue that while some of the larger
companies may have the technologies in place to comply with part 11,
many of the covered facilities do not. These comments assert that
compliance with part 11 would create the need to redesign and recreate
existing systems, thus leading to considerable cost, which was not
taken into account in the cost analysis in the preliminary regulatory
analysis for the proposed rule. The comments go on to point out that we
do not impose these requirements for recordkeeping requirements imposed
under section 414 of the FD&C Act, and that this requirement is an
added burden and expense that does not have any added benefit to public
health.
    (Response 110) The final rule does not require compliance with part
11 (Sec.  121.305 (a)). Similar to the PCHF final rule, we are making a
conforming change in part 11 to specify in new Sec.  11.1(o) that part
11 does not apply to records required to be established or maintained
under part 121, and that records that satisfy the requirements of part
121, but that also are required under other applicable statutory
provisions or regulations, remain subject to part 11. Although we are
not specifying that part 11 applies, facilities should take appropriate
measures to ensure that records are trustworthy, reliable, and
generally equivalent to paper records and handwritten signatures
executed on paper.
    (Comment 111) One comment asserts that while it is common for
certain records to be created concurrently with performance of the
activity, some records may require more time for writing, reviewing,
editing, or approving. The comment requests that we provide for the
creation of records ``in a timely manner following performance of the
activity,'' rather than ``concurrently with performance of the
activity.''
    (Response 111) We decline this request. The comment did not provide
any specific examples of activities where concurrent record creation
would prove difficult, and we are not aware of any such circumstance.
For example, we are not aware of any difficulty complying with
longstanding similar requirements associated with our HACCP regulations
for seafood and juice (see Sec. Sec.  123.9(a)(4) and 120.12(b)(4),
respectively).
    (Comment 112) Some comments assert that for certain production and
associated activities documenting the time of activity is not
necessary. Specific examples cited include equipment setup,
verification of equipment setup, charging an ingredient into a blender,
and weighing material for process yield and reconciliation purposes.
These comments ask us to modify the proposed requirements so that the
records would only be required to include the time of the activity
where appropriate for food defense.
    (Response 112) The recordkeeping requirements in the rule only
apply to records required by subpart C (Food defense measures). It is
not clear that all of the activities specified by the comments relate
to food defense measures and therefore are subject to the recordkeeping
requirements in the rule. For records that are required, we agree that
documenting the time of the activity is not always necessary. The rule
requires that records must contain ``when appropriate, the time of the
activity documented'' (Sec.  121.305(f)(2)). Monitoring records are an
example of when documenting the time of the activity is appropriate
because monitoring records are used to determine if a particular
mitigation strategy is properly implemented. Without documenting the
time the monitoring was conducted, a facility cannot identify patterns
over time as to the mitigation strategy's implementation and whether
appropriate corrective actions were being made. For mitigations
strategies that are not time-dependent (e.g., permanent equipment
changes to reduce access to the product, such as permanently affixing a
shield to the rotating air drying to prevent access to the food at the
point where product is introduced into the dryer from the pneumatic
conveyance), facilities are not required to document the time the
activity was performed.
    (Comment 113) Some comments express concern that we will require
records to be kept in English. These comments ask us to limit the
documents that must be written in English to reduce translation and
records duplication. These comments ask that records related to
verification and monitoring should be allowed to be written in
languages other than English.
    (Response 113) The rule does not require that any records be kept
in English.
    (Comment 114) One comment seeks clarification on whether the use of
checklist-type forms to document monitoring observations would satisfy
the requirement in Sec.  121.305(b) that records contain actual values
and observations obtained during monitoring. The comment argues that
properly developed checklists will allow monitoring records to be
accurate, indelible, and legible as required in Sec.  121.305(c) and
will lessen the recordkeeping burden. For example, monitoring a
mitigation strategy such as adequate lighting at the truck unloading
bay could be recorded as a ``yes'' or ``no'' by checking the
appropriate box on a checklist.
    (Response 114) Although monitoring records must contain the actual
values and observations obtained during monitoring, facilities have
flexibility to tailor the amount of detail to the nature of the record
(Sec.  121.305(e)). Monitoring for adequate lighting at the truck
unloading bay could be recorded as ``yes'' or ``no'' in either a
narrative or checklist format. However, in the case of an improperly
implemented mitigation strategy, we would recommend that the facility
also document the extent to which the strategy was incorrectly applied,
because this information would support the identification of previously
written corrective actions that could be used to remedy the situation,
as well as provide context as to why the mitigation strategy failed in
this instance, which would be beneficial information for verification
activities. For example, if lighting in the bulk unloading bay was
insufficient, the monitoring document may record this instance as
``no'' in a checklist and also may note that half of the lights were
inoperative due to a circuit-breaker that failed. This information
would be helpful to facility management to determine whether the
mitigation strategy is consistently applied and appropriate to the
actionable process step in question. In this case, a faulty circuit
breaker would be replaced, thereby correcting the deviation in the
mitigation strategy. The mitigation strategy could still be determined
to be achieving its aim with

this corrective action. Alternatively, if monitoring records document
that the lighting was turned off by an employee, a different corrective
action may be required, such as retraining of the employee on the
importance of maintaining adequate lighting in the area. We note in
Response 83 that ensuring adequate lighting around an actionable
process step would generally be a mitigation strategy that must be used
in concert with other strategies to significantly reduce the likelihood
of, or prevent, successful acts of intentional adulteration at an
actionable process step.

C. Proposed Sec.  121.310--Additional Requirements Applying to the Food
Defense Plan

    We proposed that the food defense plan must be signed and dated by
the owner, operator, or agent in charge of the facility upon initial
completion and upon any modification. We did not receive any comments
related to this section, and we are finalizing as proposed.

D. Proposed Sec.  121.315--Requirements for Record Retention

    We proposed that (1) All required records must be retained at the
facility for at least 2 years after the date they were prepared; (2)
The food defense plan must be retained at the facility for at least 2
years after its use is discontinued; (3) Except for the food defense
plan, offsite storage of records is permitted after 6 months following
the date that the records were made if such records can be retrieved
and provided onsite within 24 hours of request for official review; and
(4) If the facility is closed for a prolonged period, the records may
be transferred to some other reasonably accessible location but must be
returned to the plant or facility within 24 hours for official review
upon request.
    (Comment 115) One comment asserts that a 2-year retention period
for monitoring, corrective actions, and verification records for a
product with a short shelf life is unnecessary. The comment argues that
industry has been following record retention requirements in the
Seafood HACCP regulation which requires 1 year records retention for
refrigerated products and 2 years records retention for frozen,
preserved, or shelf-stable products and requests that we use the same
requirements in this rule.
    (Response 115) We decline this request. The 2-year record retention
period is explicitly provided for by section 418(g) of the FD&C Act.
Further, shelf life is more relevant to record retention requirements
for the purpose of tracking potentially contaminated food than to
record retention requirements for the purpose of evaluating compliance
with this rule. Finally, 2 years is the same retention period as
required by the PCHF final rule.
    (Comment 116) Some comments ask us to exercise flexibility
regarding the 2-year record retention requirement because the unique
nature of food defense activities and the technologies used in
protecting the food supply against intentional adulteration do not
typically allow for record retention for such a long period of time.
For example, several comments explain that records related to video
surveillance cannot be kept for 2 years because it is impractical;
industry practice is typically to keep video records for 30 days or
less. Comments argue that requiring 2-year retention of video records
would be very difficult and costly, and that FDA likely did not include
calculations for those added costs in our preliminary regulatory impact
analysis for the proposed rule.
    (Response 116) The assertion that it is impractical for food
defense records cannot be kept for 2 years seems to reflect a
misunderstanding of the rule. The rule does not require maintaining
video surveillance footage for 2 years. Video surveillance used as part
of a mitigation strategy is not a monitoring record. If the video is
being sent to a security office for observation, the monitoring record
could be a log affirming that a security officer reviewed the video and
detected no abnormal activities. If the video is being watched by a
security officer in real time, the monitoring record could be the
timesheets of the security officer showing he was in the security
office performing his duties in observing the video feed.
    (Comment 117) Some comments ask us to specify our expectations for
record availability and allow companies the flexibility in using
technology to meet those expectations. The comments explain that many
companies keep important records such as food defense plans at their
corporate headquarters or other central locations and not at individual
facilities but that the facilities can easily access those records
electronically if needed. The comments also assert that 6-month onsite
record retention requirement is arbitrary and that FDA should establish
a workable requirement that provides for the efficient storage and
retrieval of records in a timely manner. Some comments ask us to revise
the requirement so that records that can be retrieved and provided
onsite within 24 hours would be sufficient.
    (Response 117) We have revised the provisions to provide for
offsite storage of all records (except the food defense plan), provided
that the records can be retrieved and made available to us within 24
hours of a request for official review. We expect that many records
will be electronic records that are accessible from an onsite location
and, thus, would be classified as being onsite (see Sec.  121.315(c)).
As a companion change, we have revised the proposed provision directed
to the special circumstance of storing records when a facility is
closed for prolonged periods of time so that it only relates to the
offsite storage of the food defense plan in such circumstances (see
Sec.  121.315(d)). Further, we require records that a facility relies
on during the 3-year period preceding the applicable calendar year to
support its status as exempt as a very small business must be retained
at the facility as long as necessary to support the status of a
facility as a very small business during the applicable calendar year
(see Sec.  121.315(a)(2)).
    (Comment 118) One comment states that records and documentation
should not increase costs for farm-based operations, most of whom
operate as small businesses. They argue that these businesses already
maintain a variety of records but some do not have the technical or
financial resources available to maintain an electronic system for
records. The comment requests that FDA accept records in formats that
are not electronic.
    (Response 118) To clarify, we did not propose to require that any
records must be kept in electronic format. In addition, this rule does
not apply to farms.

E. Proposed Sec.  121.320--Requirements for Official Review

    We proposed that all records required by this part must be made
promptly available to a duly authorized representative of the Secretary
of Health and Human Services upon oral or written request. In the
following paragraphs, we discuss comments that ask us to clarify the
proposed requirements or that disagree with, or suggest one or more
changes to, the proposed requirements.
    (Comment 119) Some comments assert that FDA investigators should
only review food defense plans on site and that we should not copy,
photograph, transmit, or take possession of food defense plans. These
comments assert that onsite review of records allows facility staff
that is familiar with the documents and recordkeeping

practices to answer any questions or provide clarification to the
investigator. Some comments state that we should make it clear that any
State investigators must follow the same policy and not copy,
photograph, transmit, or take possession of food defense plans. Other
comments assert that we should only take possession of food defense
plans for compliance reasons or in the event of an emergency or a
credible threat.
    (Response 119) Some of the issues raised by these comments are
similar to issues raised by comments on the PCHF rule (see the
discussion at 80 FR 55908 at 56091) and seafood HACCP rule (see the
discussion at 60 FR 65096 at 65137-65140, December 18, 1995). During an
inspection, we expect that FDA investigators will determine whether to
copy records on a case-by-case basis as necessary and appropriate. It
may be necessary to copy records when, for example, our investigators
need assistance in reviewing a certain record from relevant experts in
headquarters. If we are unable to copy records, we would have to rely
solely on our investigators' notes and reports when drawing
conclusions. In addition, copying records will facilitate follow-up
regulatory actions. The public availability of any records that FDA
would possess as a result of copying during an inspection would be
governed by section 301(j) of the FD&C Act and by the Freedom of
Information Act (FOIA) and regulations issued pursuant to it by the
Department of Health and Human Services (DHHS) and FDA. Section 301(j)
of the FD&C Act expressly prohibits FDA from disclosing trade secret
information obtained during the course of an inspection. FDA's
disclosure regulations also provide that FDA will not divulge either
trade secret or confidential commercial information. See section VI.F.
for a further discussion of protecting food defense records from
disclosure.
    (Comment 120) Some comments assert that FDA investigators should
not include details of food defense plans in the Establishment
Inspection Reports (EIR) Form 483 and that food defense information
should be kept separate from food safety information on FDA reports.
The comments argue that if investigators include food defense-related
noncompliance on an official report, that report could become public
and could increase the risk to public health by disclosing weak points
in a facility's food defense plan.
    (Response 120) As we do now, FDA would redact any protected
information in an EIR or other document before publically releasing the
document. See section VI.F for further discussion of protecting food
defense records from disclosure.
    (Comment 121) One comment asserts that section 106 of FSMA does not
give FDA express access to review food defense plans and that FSMA
indicates a Congressional intent to limit the distribution of certain
materials related to food defense.
    (Response 121) The provisions in section 106 of FSMA concerning
limited distribution relate to the ability of the Secretary of HHS (and
by delegation, FDA) to limit the distribution of certain information
already in the Agency's possession. Specifically, section 420(a)(2) of
the FD&C Act authorizes FDA to determine the time, manner, and form in
which a vulnerability assessment is made publically available. Further,
section 420(b)(3) provides for FDA to determine the time, manner, and
form in which certain guidance documents are made public. The
provisions do not limit FDA's authority to access information in a
facility's possession, such as a food defense plan.
    Further, the ability of FDA to review food defense plans is
necessary for the efficient enforcement of the FD&C Act. The rule
requires a food defense plan consisting of a written vulnerability
assessment, mitigation strategies, and procedures for food defense
monitoring, corrective actions, and verification. Access to food
defense plans is necessary for FDA to assess the adequacy of each of
these documents and determine compliance with the rule. For example, to
assess compliance with Sec.  121.130(a), FDA must review a facility's
vulnerability assessment to determine whether it includes an evaluation
of the potential public health impact if a contaminant were added, the
degree of physical access to the product, and the ability of an
attacker to successfully contaminated the product.
    In addition to section 420 (added to the FD&C Act by section 106 of
FSMA), FDA is issuing this rule under the authority of section 418 of
the FD&C Act. Section 418 explicitly provides authority for FDA access
to certain documents. Under section 418, the required ``written plan,
together with the documentation of [monitoring, instances of
nonconformance, the results of testing and other appropriate means of
verification, instances where corrective actions were implemented, and
the efficacy of preventive controls and corrective actions] shall be
made promptly available to [FDA] upon oral or written request.''
    (Comment 122) One comment asserts that neither section 103 nor 106
of FSMA expressly provide FDA with the authority to copy food defense
plans or records.
    (Response 122) As we described in the seafood HACCP rule (60 FR
65096 at 65101, December 18, 1995), to effectuate the broad purposes of
the FD&C Act, there may be some circumstances in which access to the
records would be meaningless without the opportunity to copy them, and
therefore copying records is necessary for the efficient enforcement of
the FD&C Act. For further discussion of copying records, see response
to Comment 121.

F. Proposed Sec.  121.325--Public Disclosure

    We proposed that records required by this part will be protected
from public disclosure to the extent allowable under part 20 of this
chapter. We received numerous comments expressing concern with
protecting food defense plans and records from public disclosure,
especially due to the sensitive nature of the content within a food
defense plan. One comment fully supports our proposal and believes
there is sufficient precedent and need to protect the sensitive
documents from public disclosure. In the following paragraphs, we
discuss comments that ask us to clarify the proposed requirements or
that disagree with, or suggest one or more changes to, the proposed
requirements.
    (Comment 123) Some comments assert that food defense plans include
information that is commercial confidential or trade secret and,
therefore, should be exempt from disclosure under FOIA. The comments
argue that food defense plans may include information on a facility's
food defense-related measures and that disclosure of one facility's
food defense plan may adversely affect other facilities and companies
that may process similar foods or have similar processing procedures.
    (Response 123) FDA protects records from disclosure under Exemption
4 of FOIA to the extent they contain ``trade secrets'' or ``commercial
or financial information obtained from a person and privileged or
confidential.'' The questions raised in these comments are similar to
some of the questions raised during the rulemaking to establish our
HACCP regulation for seafood (see the discussion at 60 FR 65096 at
65137-65140). Our experience in conducting CGMP inspections in
processing plants, our experience with enforcing our HACCP regulations
for seafood and juice, and our understanding from the Regulatory Impact
Analysis for this rule make it clear that food defense plans

will take each facility time and money to develop.
    There is value in a plan to a company that produces it for no other
reason than that it took work to write. The equity in such a product is
not readily given away to competitors. We expect that plant
configurations will be unique to individual processors, or at least
have unique features, as was the case in the seafood industry (Ref.
16). While generic plans will have great utility in many circumstances,
they will serve primarily as starting points for facilities to develop
their own plans. Facilities will still need to expend time and money to
tailor a generic food defense plan to their individual circumstances.
Thus, we conclude that food defense plans generally will meet the
definition of trade secret, including the court's definition in Public
Citizen Health Research Group v. FDA, 704 F.2d 1280 (D.C. Cir. 1983).
    (Comment 124) Some comments ask us to provide assurances that food
defense plans and related records will not be made public and assert
that protecting these documents from disclosure to the extent allowable
under part 20 may not be sufficient. They argue that food defense plans
are more sensitive than food safety plans because food defense plans
contain specifics on a facility's vulnerabilities and how they protect
those vulnerabilities, and as such, could provide a ``road map'' for
individuals intending to cause harm. These comments state that FDA
should be more protective of food defense plans and argue that due to
the sensitivity of information contained in food defense plans, it is
too risky to rely on FOIA exemptions alone.
    (Response 124) We agree that food defense plans contains
information that presents sensitivities not likely to be present in
food safety plans. Exemption 7(F) of FOIA allows Agencies to withhold
``records or information compiled for law enforcement purposes . . . to
the extent that production of such law enforcement records or
information . . . could reasonably be expected to endanger the life or
physical safety of any individual.'' Food defense plans are likely to
meet the criteria to withhold them from disclosure under exemption
7(F). Food defense plans in FDA's possession would be compiled for law
enforcement purposes because they would be collected as part of
compliance efforts. Further, production of such records could
reasonably be expected to endanger life or physical safety.
Specifically, a food defense plan is likely to contain information that
could be used to identify weaknesses in a facility's security, to
choose targets, and to help plan and execute an attack involving
intentional adulteration.
    (Comment 125) Some comments state that food defense plans could be
classified under Executive Order 13526 because their unauthorized
disclosure could reasonably be expected to cause identifiable or
describable damage to national security and because food defense plans
pertain to ``vulnerabilities or capabilities of systems, installations,
infrastructures, projects, plans, or protection services relating to
national security.'' These comments acknowledge that classifying food
defense plans would be cumbersome and access to the classified
documents would be extremely restricted and therefore, they recommend
that FDA implement a policy that FDA investigators not copy,
photograph, or transmit any food defense plan records or make detailed
notes about the food defense plans in the Establishment Inspection
Reports that could reveal sensitive information.
    (Response 125) See response to Comment 124 for a discussion of FDA
handling of food defense plans. We note that FDA cannot classify food
defense plans under Executive Order 13526. That executive order
provides that information may be originally classified only if several
conditions are met, including that the information is owned by,
produced by or for, or is under the control of the U.S. Government. A
food defense plan that is developed by industry for use by industry is
not owned by, produced by or for, or under the control of, the U.S.
Government.
    (Comment 126) One comment suggests that FDA only allow
investigators who have the appropriate national security credentials
(e.g., background checks, security clearances) to review the content of
a food defense plan. The comment asserts that this will help prevent
the risk of a sophisticated insider attack by a potential wrongdoer who
has infiltrated the Agency.
    (Response 126) All FDA investigators and contracted State
investigators are required to undergo background checks by the Federal
government prior to employment and periodically thereafter. Food
defense plans are not classified, and therefore FDA investigators would
not need national security clearances.
    (Comment 127) Some comments state that FDA should, at a minimum, be
aligned with and apply the same protection for food defense plans and
records required under this part as HACCP seafood and juice regulations
(see Sec. Sec.  123.9(d) and 120.12(f), respectively).
    (Response 127) We disagree that the proposed provisions governing
public disclosure are not aligned with the public disclosure provisions
of our HACCP regulations for seafood and juice. Our regulations in part
20 regarding public information apply to all Agency records, regardless
of whether a particular recordkeeping requirement says so. In the
public disclosure provisions for our HACCP regulations for seafood and
juice, we provided specific details about how particular provisions in
part 20 (i.e., Sec.  20.61 (Trade secrets and commercial or financial
information which is privileged or confidential) and Sec.  20.81 (Data
and information previously disclosed to the public)) would apply to the
applicable records, because we recognized that such details were of
particular interest to the regulated industries and such recordkeeping
requirements were relatively new. In this rule, we framed the
provisions regarding public disclosure more broadly by referring to all
the requirements of part 20, consistent with our more recent approach
to public disclosure provisions in regulations (see e.g., 21 CFR
112.167, 117.325).
    (Comment 128) Some comments assert that FDA should develop guidance
and training for industry on how to protect food defense-related
documents because industry is developing these documents to meet an FDA
requirement and has a potential to increase the risk to public health.
    (Response 128) Our implementation of this rule will involve a
broad, collaborative effort to foster awareness and compliance through
guidance, education, and technical assistance. We agree that protection
of food defense plans--by FDA and by industry--is important; we plan on
including information within guidance for industry on best practices
for how to protect food defense plans.

G. Proposed Sec.  121.330--Use of Existing Records

    We are adding new section Sec.  121.330 (Use of Existing Records)
to the final rule to increase recordkeeping flexibility. Section
121.330 specifies that existing records (e.g., records that are kept to
comply with other Federal, State, or local regulations) do not need to
be duplicated if they contain all of the required information and
satisfy the requirements of subpart D. Section 121.330 also provides
that existing records may be supplemented as necessary to include all
of the required information. Further, Sec.  121.330 clarifies that the
information required does not need to be kept in one set of records; if
existing records contain some of the required information, any new

information required may be kept either separately or combined with the
existing records.

VII. Subpart E: Comments on Compliance--Proposed Sec.  121.401

1. Proposed Sec.  121.401(a)--Failure To Comply With Section 418 of the
FD&C Act
    We proposed that the operation of a facility that manufactures,
processes, packs, or holds food for sale in the United States if the
owner, operator, or agent in charge of such facility is required to
comply with, and is not in compliance with, section 418 of the FD&C Act
or subparts C or D of this part is a prohibited act under section
301(uu) of the FD&C Act.
    We did not receive any comments on this provision, and we are
finalizing as proposed.
2. Proposed Sec.  121.401(b)--Failure To Comply With Section 420 of the
FD&C Act
    We proposed that the failure to comply with section 420 of the FD&C
Act or subparts C or D of this part is a prohibited act under section
301(ww) of the FD&C Act.
    We did not receive any comments on this provision, and we are
finalizing as proposed.

VIII. Effective and Compliance Dates

    We proposed the effective date would be 60 days after this final
rule is published. However, we proposed for a longer timeline for
facilities to come into compliance. As proposed, facilities, other than
small and very small businesses, would have 1 year after the effective
date to comply with part 121. Small businesses (i.e., those employing
fewer than 500 persons) would have 2 years after the effective date to
comply with part 121. Very small businesses (i.e., businesses that have
less than $10,000,000 in total annual sales of food, adjusted for
inflation) would have 3 years after the effective date to comply with
Sec.  121.5(a).
    Some comments express concern that facilities will not have the
time or resources to implement requirements for the intentional
adulteration rule at the same time they must comply with other FSMA
rules. Some comments also state that more time is necessary to comply
with this rule because food defense is different from current
requirements for food safety. These comments request additional time
for compliance.
    We agree with the comments and are providing more time for
facilities to come into compliance. Facilities, other than small and
very small businesses, have 3 years after the effective date to comply
with part 121. Small businesses (i.e., those employing fewer than 500
full-time equivalent employees) have 4 years after the effective date
to comply with part 121. Very small businesses (i.e., businesses that
have less than $10,000,000, adjusted for inflation, per year, during
the 3-year period preceding the applicable calendar year in both sales
of human food plus the market value of human food manufactured,
processed, packed, or held without sale) have 5 years after the
effective date to comply with Sec.  121.5(a).

IX. Executive Order 13175

    In accordance with Executive Order 13175, FDA has consulted with
tribal government officials. A Tribal Summary Impact Statement has been
prepared that includes a summary of Tribal officials' concerns and how
FDA has addressed them (Ref. 17). Persons with access to the Internet
may obtain the Tribal Summary Impact Statement at http://www.fda.gov/Food/GuidanceRegulation/FSMA/ucm378628 or at http://www.regulations.gov. Copies of the Tribal Summary Impact Statement also
may be obtained by contacting the person listed under FOR FURTHER
INFORMATION CONTACT.

X. Final Regulatory Impact Analysis

    We have examined the impacts of the final rule under Executive
Order 12866, Executive Order 13563, the Regulatory Flexibility Act (5
U.S.C. 601-612), and the Unfunded Mandates Reform Act of 1995 (Pub. L.
104-4). Executive Orders 12866 and 13563 direct Agencies to assess all
costs and benefits of available regulatory alternatives and, when
regulation is necessary, to select regulatory approaches that maximize
net benefits (including potential economic, environmental, public
health and safety, and other advantages; distributive impacts; and
equity). We have developed a comprehensive Economic Analysis of Impacts
that assesses the impacts of the final rule. We believe that this final
rule is a significant regulatory action under Executive Order 12866.
    The Regulatory Flexibility Act requires us to analyze regulatory
options that would minimize any significant impact of a rule on small
entities. The annualized costs per entity due to this rule are about
$13,000 for a one-facility firm with 100 employees, and there are about
4,100 small businesses that would be affected by the rule, so we
tentatively conclude that the final rule could have a significant
economic impact on a substantial number of small entities.
    The Small Business Regulatory Enforcement Fairness Act of 1996
(Pub. L. 104-121) defines a major rule for the purpose of congressional
review as having caused or being likely to cause one or more of the
following: An annual effect on the economy of $100 million or more; a
major increase in costs or prices; significant adverse effects on
competition, employment, productivity, or innovation; or significant
adverse effects on the ability of U.S.-based enterprises to compete
with foreign-based enterprises in domestic or export markets. In
accordance with the Small Business Regulatory Enforcement Fairness Act,
the Office of Management and Budget (OMB) has determined that this rule
is a major rule for the purpose of Congressional review.
    The Unfunded Mandates Reform Act of 1995 (section 202(a)) requires
us to prepare a written statement, which includes an assessment of
anticipated costs and benefits, before proposing ``any rule that
includes any Federal mandate that may result in the expenditure by
State, local, and tribal governments, in the aggregate, or by the
private sector, of $100,000,000 or more (adjusted annually for
inflation) in any one year.'' The current threshold after adjustment
for inflation is $144 million, using the most current (2014) Implicit
Price Deflator for the Gross Domestic Product. This final rule may
result in a 1-year expenditure that would meet or exceed this amount.

XI. Paperwork Reduction Act of 1995

    This rule contains information collection requirements that are
subject to review by the OMB under the Paperwork Reduction Act of 1995
(PRA) (44 U.S.C. 3501-3521). A description of these provisions is given
in this section with an estimate of the annual reporting and
recordkeeping burden; there is no third-party disclosure burden
associated with the information collection. Included in the estimate is
the time for reviewing instructions, searching existing data sources,
gathering and maintaining the data needed, and completing and reviewing
each collection of information.
    Title: Mitigation Strategies to Protect Food Against Intentional
Adulteration