section V.C.2 of this document for a discussion of assessing
vulnerabilities to identify actionable process steps.
    We solicit comment on the proposed definitions.

B. Exemptions

    In subpart A of proposed part 121, proposed Sec.  121.5 would
establish exemptions from some or all of the provisions of this
proposed regulation.
1. Proposed Sec.  121.5(a)--Exemption for Qualified Facilities
    Proposed Sec.  121.5(a) would provide that proposed part 121 does
not apply to a qualified facility, except that qualified facilities
must, upon request, provide for official review documentation that was
relied upon to demonstrate that the facility meets this exemption. Such
documentation must be retained for 2 years.
    a. Exemption of qualified facilities. As discussed in section V.A
of this document, proposed Sec.  121.3 would

define a qualified facility to mean (when including the sales by any
subsidiary; affiliate; or subsidiaries or affiliates, collectively, of
any entity of which the facility is a subsidiary or affiliate) a
facility that is: (1) A very small business as defined in this part, or
(2) a facility to which both of the following apply: (i) During the 3-
year period preceding the applicable calendar year, the average annual
monetary value of the food manufactured, processed, packed or held at
such facility that is sold directly to qualified end-users (as defined
in this part) during such period exceeded the average annual monetary
value of the food sold by such facility to all other purchasers; and
(ii) the average annual monetary value of all food sold during the 3-
year period preceding the applicable calendar year was less than
$500,000, adjusted for inflation. In addition, we are proposing to
define very small business to mean a business that has less than
$10,000,000 in total annual sales of food, adjusted for inflation.
    Section 418(l)(2)(A) of the FD&C Act provides that a qualified
facility ``shall not be subject to the requirements under [sections
418(a) through (i) and (n) of the FD&C Act].'' We have tentatively
concluded that we should include the exemption provided in section
418(l)(2)(A) of the FD&C Act in proposed Sec.  121.5(a) to establish by
regulation the reach of the provision.
    Section 418(l)(5) of the FD&C Act requires the Secretary of Health
and Human Services, in consultation with the Secretary of Agriculture,
to conduct a study of the food processing sector regulated by the
Secretary of Health and Human Services and to make determinations in
five areas. These areas include, in part: (1) Distribution of food
production by type and size of operation; (2) the proportion of food
produced by each type and size of operation; (3) the number and types
of food facilities co-located on farms; (4) the incidence of foodborne
illness originating from each size and type of operation; and (5) the
effect on foodborne illness risk associated with certain activities
regarding food.
    Section 418(n)(1)(B) of the FD&C Act requires that the regulations
define the terms ``small business'' and ``very small business,'' taking
into consideration the study of the food processing sector required by
section 418(l)(5) of the FD&C Act. Consistent with section 418(l)(5) of
the FD&C Act, we have consulted with USDA during our study of the food
processing sector. The study is available in the docket established for
this proposed rule (Ref. 53). We request comment on that study. We will
consider comments regarding the study, as well as comments regarding
our proposed definition for very small business, in any final rule
based on this proposed rule.
    We note that section 420 of the FD&C Act does not contain an
explicit size-based exemption, such as the qualified facility provision
in section 418 of the FD&C Act. In section IV.A of this document, we
discuss our assessment that the goal of terrorist organizations is to
maximize public health harm and, to a lesser extent, economic
disruption. We have tentatively concluded that such goals are likely to
drive terrorist organizations to target the product of relatively large
facilities, especially those for which the brand is nationally or
internationally recognizable. The regulations issued under section 420
of the FD&C Act are to apply to food for which there is a high risk of
intentional contamination. We have tentatively concluded that
designating businesses with less than $10,000,000 in total annual sales
of food as very small businesses, resulting in their exemption from
proposed part 121, is consistent with the requirement in section 420 of
the FD&C Act that the regulation be limited to foods at high risk of
intentional adulteration.
    We acknowledge that the amount of food sales in the proposed
definition of very small business (total annual sales of food of less
than $10,000,000) is significantly higher than the threshold in the PC
proposed rule, in which we co-proposed three amounts ($250,000,
$500,000, and $1,000,000 in total annual sales of food). The higher
amount proposed here reflects the difference in the nature of risk
related to intentional adulteration covered by this rule and is
consistent with the requirement in section 418(n)(3)(C) of the FD&C Act
that this regulation ``acknowledge differences in risk and minimize, as
appropriate, the number of separate standards that apply to separate
foods.''
    There are some facilities that are not subject to section 418 of
the FD&C Act but are subject to section 420 of the FD&C Act, and would
be subject to this rulemaking because their activities would likely
involve one of the key activity types (e.g., juice manufacturing and
breaded seafood manufacturing). However, under proposed Sec.  121.5(a),
such facilities would be exempt from proposed part 121 if they are part
of businesses with less than $10,000,000 in total annual sales of food,
adjusted for inflation.
    b. Documentation requirement for qualified facilities. Sections
418(l)(2)(A) and (l)(2)(B) of the FD&C Act provide that a qualified
facility is exempt from the requirements of sections 418(a) through (i)
and (n) (i.e., the requirements for hazard analysis and risk-based
preventive controls), but must instead submit two types of
documentation to the Secretary of Health and Human Services. The first
type of required documentation relates to food safety practices at the
facility, and section 418(l)(2)(B)(i) of the FD&C Act provides two
options for satisfying this documentation requirement. Under section
418(l)(2)(B)(i)(I) of the FD&C Act, the qualified facility may choose
to submit documentation that demonstrates that the owner, operator, or
agent in charge of the facility has identified potential hazards
associated with the food being produced, is implementing preventive
controls to address the hazards, and is monitoring the preventive
controls to ensure that such controls are effective. Alternatively,
under section 418(l)(2)(B)(i)(II) of the FD&C Act, the qualified
facility may choose to submit documentation (which may include
licenses, inspection reports, certificates, permits, credentials,
certification by an appropriate agency (such as a State department of
agriculture), or other evidence of oversight), as specified by the
Secretary of Health and Human Services, that the facility is in
compliance with State, local, county, or other applicable non-Federal
food safety law.
    The second type of required documentation relates to whether the
facility satisfies the definition of a qualified facility. Under
section 418(l)(2)(B)(ii) of the FD&C Act, the facility must submit
documentation, as specified by the Secretary of Health and Human
Services in a guidance document, that the facility is a qualified
facility under section 418(l)(1)(B) or section 418(l)(1)(C).
    Section 418(l)(7)(A) of the FD&C Act requires that a qualified
facility that is exempt from the requirements under sections 418(a)
through (i) and subsection (n), and that does not prepare documentation
under section 418(l)(2)(B)(i)(I), provide notification to consumers by
one of two procedures, depending on whether a food packaging label is
required on the food. With respect to a food for which a food packaging
label is required by the Secretary of Health and Human Services under
any other provision of the FD&C Act, section 418(l)(7)(A)(i) of the
FD&C Act requires that a qualified facility include prominently and
conspicuously on such label the name and business address of the
facility where the food was manufactured or processed. With

respect to a food for which a food packaging label is not required by
the Secretary of Health and Human Services under any other provisions
of the FD&C Act, section 418(l)(7)(A)(ii) of the FD&C Act requires that
a qualified facility prominently and conspicuously display, at the
point of purchase, the name and business address of the facility where
the food was manufactured or processed, on a label, poster, sign,
placard, or documents delivered contemporaneously with the food in the
normal course of business, or, in the case of Internet sales, in an
electronic notice.
    Section XIII.A of the PC proposed rule describes our proposed
requirements pursuant to the above described modified requirements for
qualified facilities in that proposed rule. In summary, in the PC
proposed rule, we proposed codified language to require submission of
the following to FDA: (1) Documentation that the facility is a
qualified facility; and (2) documentation that demonstrates that the
owner, operator, or agent in charge of the facility has identified the
potential hazards associated with the food being produced, is
implementing preventive controls to address the hazards, and is
monitoring the performance of the preventive controls to ensure that
such controls are effective; or documentation (which may include
licenses, inspection reports, certificates, permits, credentials,
certification by an appropriate agency (such as a State department of
agriculture), or other evidence of oversight) that the facility is in
compliance with State, local, county, or other applicable non-Federal
food safety law, including relevant laws and regulations of foreign
countries. In Section XIII.A of the PC proposed rule, we clarified that
the following submission of information would be satisfactory: (1) A
statement from the owner, operator, or agent in charge of a qualified
facility certifying that the facility is a very small business,
otherwise meets the definition of a qualified facility under proposed
Sec.  117.3, or both; and (2) a statement from the owner, operator, or
agent in charge of a qualified facility certifying that the facility
(a) has identified the potential hazards associated with the food being
produced, is implementing preventive controls to address the hazards,
and is monitoring the implementation of the preventive controls to
ensure that such controls are effective; or (b) is in compliance with
State, local, county, or other applicable non-Federal food safety law,
including relevant laws and regulations of foreign countries. We
tentatively concluded that we would not, for example, require that a
facility submit documentation to FDA demonstrating the content of their
hazard identification, preventive controls, or monitoring of the
implementation of preventive controls; or copies of their non-Federal
licenses, inspection reports, certificates, permits, credentials, or
certifications. We proposed to require that the information be
resubmitted to FDA at least every 2 years, or whenever there is a
material change to the information. Finally, we proposed to require
that a qualified facility maintain records relied upon to support their
assertion of meeting the requirements of the qualified exemption. We
tentatively concluded that it is appropriate to require that the
records relied upon to support a self-certified statement be retained
and made available to FDA upon request.
    Proposed Sec.  121.5(a) would require that qualified facilities,
upon request, provide for official review documentation that was relied
upon to demonstrate that the facility meets this exemption. In
addition, proposed Sec.  121.5(a) would provide that such documentation
must be retained for 2 years. We are not proposing to apply all of the
modified requirements described in proposed Sec.  117.201 in the PC
proposed rule to qualified facilities that would be covered under this
rule. We have tentatively concluded that such an approach is
reasonable, considering the context and wording of the statutory
provision as it relates to intentional adulteration caused by acts of
terrorism.
    c. Withdrawal of exemption for qualified facilities. Section
418(l)(3) of the FD&C Act provides that the Secretary of Health and
Human Services may withdraw the exemption provided in section
418(l)(2)(A) under certain circumstances. We discuss the withdrawal
provisions of section 418(l)(3) of the FD&C Act, and the process we
propose to use to withdraw an exemption for a qualified facility
subject to that rule in section XIV.E of the PC proposed rule. We ask
for comment on the appropriateness of those proposed procedures to
withdraw an exemption for a qualified facility subject to this proposed
rule. We also seek input on whether we should include the process for
such withdrawal within proposed part 121 or whether those provisions
might be best placed in a separate part and cross-referenced in
proposed part 121 in order to reduce duplication, given these
provisions also appear in the PC and the Produce Safety proposed rules.
2. Proposed Sec.  121.5(b)--Exemption for Holding of Food
    a. Requirement of section 418 of the FD&C Act. Section 418(m) of
the FD&C Act provides in relevant part that FDA may by regulation
``exempt or modify the requirements for compliance under [section 418
of the FD&C Act] with respect to facilities that are solely engaged in
. . . the storage of raw agricultural commodities (other than fruits
and vegetables) intended for further distribution or processing or the
storage of packaged foods that are not exposed to the environment.'' In
the PC proposed rule, we proposed exemptions and modified requirements
based on this provision (see proposed Sec. Sec.  117.5(j), 117.7, and
117.206).
    b. Petition relevant to section 418(m) of the FD&C Act. In a letter
dated July 22, 2011, an industry coalition of the American Bakers
Association, the American Frozen Food Institute, the Grocery
Manufacturers Association, the International Bottled Water Association,
the International Dairy Foods Association, the International Warehouse
Logistics Association, the Peanut and Tree Nut Processors Association,
and the Snack Food Association (the section 418(m) petitioners)
submitted a citizen petition (Docket No. FDA-2011-P-0561). The petition
requests that FDA issue regulations under section 418(m) of the FD&C
Act ``to exempt from compliance or modify the requirements for
compliance under section 418 [of the FD&C Act] for facilities that are
solely engaged in the storage of packaged foods that are not exposed to
the environment, by allowing such facilities to satisfy the
requirements of that section through compliance with the [CGMPs]
mandated for such facilities by [current] Sec.  110.93.'' The section
418(m) petitioners assert that the food safety issues presented by
facilities used only to store packaged foods that are not exposed to
the environment are essentially the same, regardless of the type of
food. As such, trade associations representing a variety of product
sectors are signatories to the petition and are supportive of the
request to exempt such facilities from the provisions of section 418 of
the FD&C Act.
    The section 418(m) petitioners stated, ``As an initial matter, the
risk of intentional adulteration at facilities solely engaged in the
storage of packaged foods not exposed to the environment is quite
remote. The food in these facilities is stored in unit packaging,
meaning any effort to adulterate the food would be laborious and likely
ineffective.'' They further

asserted that, ``Members of the food industry have implemented a number
of precautions against intentional adulteration. Most importantly,
these facilities are locked and secured against unauthorized entry.
Access is restricted to the employees of the manufacturer dropping off
food, any staff employed at the facility, and the persons who deliver
food to retailers and other customers. Food is often held in such
facilities for a short period of time, which would not be conducive to
attempts at intentional adulteration. Further, we note that the
continual activity in these facilities during pickup and drop-off hours
serves as a deterrent for anyone attempting to gain unauthorized
access.''
    c. Proposed exemption for the holding of food. Proposed Sec.
121.5(b) would exempt from the requirements in proposed part 121 the
holding of food, except the holding of food in liquid storage tanks.
This provision is broader in scope than exemptions in proposed
Sec. Sec.  117.5(j) and 117.7 in the PC proposed rule, and would
exempt, for example, storage of whole grains, shell eggs, fruits and
vegetables, and packaged foods (including packaged milk and orange
juice). It would not exempt, for example, storage in bulk storage tanks
of milk or liquid orange juice.
    As discussed in section V.C.2 of this document, based on an
analysis of the vulnerability assessments that FDA has conducted using
the CARVER+Shock methodology, we identified four key activity types
(Bulk liquid receiving and loading; Liquid storage and handling;
Secondary ingredient handling; and Mixing and similar activities) as
production processes that require focused mitigation strategies. With
the exception of the holding of food in liquid storage tanks, which is
not included in the proposed exemption, we are not aware of activities
performed during the holding of food that fit within any of these four
key activity types.
    We acknowledge that our proposed exemption in Sec.  121.5(b) is not
identical to the exemption in section 418(m) of the FD&C Act. However,
as explained above, the holding of food that would be exempt does not
include any of the four key activity types associated with actionable
process steps under proposed Sec.  121.130(a). Consequently, even
without an exemption, this holding of food would not require the
implementation of focused mitigation strategies under proposed Sec.
121.130(a) to protect food against intentional adulteration. The only
requirement related to holding activities would be for a written
assessment that would conclude that no focused mitigation strategies
are necessary with regard to the holding activities. Under these
circumstances, we have tentatively concluded that an exemption is
appropriate. Accordingly, we propose to exempt the holding of food,
except the holding of food in liquid storage tanks, from the
requirements of this proposed regulation. Although we are not
responding to the merits of the arguments of the section 418(m)
petitioners with regard to precautions against intentional
adulteration, we believe that this proposed exemption meets the request
of the section 418(m) petitioners.
3. Proposed Sec.  121.5(c)--Exemption for Packing, Re-Packing,
Labeling, and Re-labeling of Food
    Proposed Sec.  121.5(c) would exempt from the requirements in
proposed part 121 the packing, re-packing, labeling, or re-labeling of
food where the container that directly contacts the food remains
intact. As discussed in section V.C.2 of this document, based on an
analysis of the vulnerability assessments that FDA has conducted using
the CARVER+Shock methodology, we identified four key activity types
(Bulk liquid receiving and loading; Liquid storage and handling;
Secondary ingredient handling; and Mixing and similar activities) as
production processes that require focused mitigation strategies. We are
not aware of activities performed during the packing, re-packing,
labeling, or re-labeling of food where the immediate package or
container of the food remains intact that fit within any of these four
key activity types.
    As discussed in section V.A of this document, the proposed rule
would not require a facility that chooses to identify its actionable
process steps under proposed Sec.  121.30(a) to implement focused
mitigation strategies for a food process that does not include any of
the four key activity types. Even without the exemption, a facility
that conducts packing, re-packing, labeling, or re-labeling activities
would be able to conclude that it has no key activity types and,
therefore, would not be required to implement focused mitigation
strategies. However, without an exemption, under proposed Sec.
121.130, such a facility would be required to perform a written
assessment to make this determination. We have tentatively concluded
that requiring such an assessment is unnecessary. Consequently, we
propose to exempt the packing, re-packing, labeling, or re-labeling of
food where the container that directly contacts the food remains intact
from the requirements of this proposed regulation.
4. Proposed Sec.  121.5(d)--Exemption for Produce Farms
    Proposed Sec.  121.5(d) would exempt from the requirements in
proposed part 121 the activities of a facility that are subject to
section 419 of the FD&C Act (Standards for Produce Safety). We discuss
our tentative decision not to cover produce farms under section 419 of
the FD&C Act in sections IV.B and IV.F, respectively, of this document.
    Section 418(k) of the FD&C Act provides that section 418 ``shall
not apply to activities of a facility that are subject to section
419''. Section 419 of the FD&C Act, ``Standards for Produce Safety,''
requires FDA to establish by regulation ``science-based minimum
standards for the safe production and harvesting of those types of
fruits and vegetables, including specific mixes or categories of fruits
and vegetables, that are raw agricultural commodities for which [FDA]
has determined that such standards minimize the risk of serious adverse
health consequences or death.'' Section 419(h) of the FD&C Act provides
that section 419 ``shall not apply to activities of a facility that are
subject to section 418.''
    Establishments that are exempt from registration under section 415
of the FD&C Act as ``farms'' would not be subject to section 418 of the
FD&C Act when conducting activities within the farm definition. Farm
mixed-type facilities would be subject to section 418 of the FD&C Act
when conducting those activities that trigger the section 415
registration requirement. We have tentatively concluded that
Congressional intent regarding the reach of section 418(k) of the FD&C
Act is unambiguous in that section 418(k) directly limits the exemption
to activities of the facility that are subject to section 419 of the
FD&C Act. We have also tentatively concluded that we should include a
provision implementing section 418(k) of the FD&C Act in the proposed
regulation to establish by regulation the reach of the exemption.
Therefore, in proposed Sec.  121.5(d), we are proposing that proposed
part 121 would not apply to activities of a facility that are subject
to section 419 of the FD&C Act (Standards for Produce Safety).
    At the time FDA developed the farm definition and its
interpretations of that definition, the practical impact of an
activity's classification as inside or outside that definition was
limited to the potential to trigger the section 415 registration
regulations and the section 414 recordkeeping regulations. With the

advent of FSMA, the scope of the farm definition has taken on more
importance because, for example, activities within the farm definition
are not subject to section 418 of the FD&C Act, but activities outside
the farm definition are subject to section 418. Therefore, FDA proposed
to clarify and adjust the scope of the farm definition, including the
classification of manufacturing, processing, packing, and holding
activities relevant to that definition, in the proposed preventive
controls regulations for human food. In section VIII.D of the PC
proposed rule, we described a set of organizing principles that would
form the basis for our proposal for classifying activities to more
accurately reflect the scope of activities traditionally conducted by
farms and to allow for more certainty among industry with regard to how
their activities will be regulated.
5. Proposed Sec.  121.5(e)--Exemption for Alcoholic Beverages
    Proposed Sec.  121.5(e)(1) would provide that proposed part 121
does not apply with respect to alcoholic beverages at a facility that
meets the following two conditions: (i) Under the Federal Alcohol
Administration Act (27 U.S.C. 201 et seq.) or chapter 51 of subtitle E
of the Internal Revenue Code of 1986 (26 U.S.C. 5001 et seq.) the
facility is required to obtain a permit from, register with, or obtain
approval of a notice or application from the Secretary of the Treasury
as a condition of doing business in the United States, or is a foreign
facility of a type that would require such a permit, registration, or
approval if it were a domestic facility; and (ii) Under section 415 of
the Federal Food, Drug, and Cosmetic Act (21 U.S.C. 350d) the facility
is required to register as a facility because it is engaged in
manufacturing, processing, packing, or holding one or more alcoholic
beverages.
    Proposed Sec.  121.5(e)(2) would provide that proposed part 121
does not apply with respect to food other than alcoholic beverages at a
facility described in paragraph (e)(1) of this section, provided such
food: (i) Is in prepackaged form that prevents any direct human contact
with such food; and (ii) Constitutes not more than 5 percent of the
overall sales of the facility, as determined by the Secretary of the
Treasury.
    In section X.C.7 of the PC proposed rule, we explain in detail our
interpretation of section 116 of FSMA and our consideration of hazards
and preventive controls for the manufacturing, processing, packing, and
holding of alcoholic beverages. Based on that analysis, we proposed, in
proposed Sec.  117.5(i), to exempt certain facilities engaged in the
manufacturing, processing, packing, or holding of alcoholic beverages
and other food. Consistent with that analysis, we are proposing similar
exemptions related to alcoholic beverages in this proposed rule on
focused mitigation strategies for the protection of food against
intentional adulteration caused by acts of terrorism.
    We have tentatively concluded that we should include a provision
implementing section 116 of FSMA in the proposed rule to establish by
regulation the reach of the provision. We request comment on our
interpretation of section 116 of FSMA, described in section X.C.7 of
the PC proposed rule, and its application to the proposed exemption in
Sec.  121.5(e).
6. Proposed Sec.  121.5(f)--Exemption for Food for Animals
    Proposed Sec.  121.5(f) would exempt from the requirements of
proposed part 121 the manufacturing, processing, packing, and holding
of food for animals other than man. In the Animal Food PC proposed
rule, we proposed to require that facilities that manufacture, process,
pack, or hold animal food and that are not otherwise covered by certain
exemptions, design and implement a system of preventive controls to
address food safety issues. In that proposed rulemaking, we tentatively
concluded that hazards associated with intentional adulteration would
likely require different kinds of controls and would be best addressed
in a separate rulemaking.
    We also requested comment in that rulemaking on whether to include
in those regulations potential hazards that may be intentionally
introduced for economic reasons, which we refer to as economically
motivated adulteration, a type of intentional adulteration. Our current
thinking regarding economically motivated adulteration is discussed in
section IV.F of this document.
    Section 418(m) of the FD&C Act authorizes FDA to exempt or modify
the requirements for compliance with section 418 with regard to
facilities that engage solely in the production of animal food.
Further, section 420(c) of the FD&C Act requires that regulations that
FDA issues under that section apply only to food for which there is a
high risk of intentional contamination. In section IV.A of this
document, we discuss how FDA is proposing to implement the provisions
of sections 418 and 420 of the FD&C Act with regard to circumstances
under which a facility subject to either of these sections would be
required to have and implement focused mitigation strategies under a
HACCP-like system to address intentional adulteration related to
terrorism. In summary, this proposed rule would require a facility to
implement focused mitigation strategies if one or more of four key
activity types are applicable to its food operation or if a facility
conducts its own vulnerability assessment and identifies actionable
process steps for significant vulnerabilities in its food operation.
    The identification of a production step for a food as necessitating
focused mitigation strategies is premised upon an analysis, based on
CARVER+Shock methodology, that an attack at these points in the
production of a food would likely result in an outcome that is
consistent with our understanding of the goal of terrorist
organizations (i.e., maximizing adverse public health impacts and, to a
lesser extent, economic disruption) (Ref. 54). For human foods, our
analyses show the potential for significant human morbidity and
mortality should intentional adulteration occur at any one or more of
these points in a food operation. (Significant economic harm is also
likely, related to the human morbidity and mortality as well as
disruption in the food supply as a result of loss of consumer
confidence in its safety.) In contrast, for animal food, our analysis
shows only minimal potential for human morbidity or mortality as a
result of attacks at key activity types or other points in an animal
food operation. Significantly, our CARVER+Shock vulnerability
assessments of animal food have had to focus entirely on economic
consequences because of the lack of potential for human morbidity and
mortality.
    In considering whether to provide an exemption related to animal
food, we evaluated three types of possible attack scenarios: (1)
Incorporation of a contaminant into feed to be used for muscle meat-
producing animals; (2) incorporation of a contaminant into feed to be
used for egg-producing or milk-producing animals; and (3) incorporation
of a contaminant into pet food. With regard to the two former
scenarios, we are not aware of contaminants that could be incorporated
into feed at levels that would not produce noticeable clinical signs
and/or mortality in animals but would result in significant human
morbidity or mortality among consumers that subsequently eat the meat,
eggs or milk (Ref. 55). While contaminants can increase the risk of
chronic disease, such as cancer, among consumers (Ref. 56), such an
outcome is not consistent

with our understanding of the goals of terrorist organizations, which
include a more immediate impact. We recognize that such an attack could
result in significant economic disruption because of the loss of
consumer confidence in the safety of the food supply. While important,
attacks of that nature fall significantly below those involving human
morbidity and mortality when placed on a scale of risk with regard to
targeting by terrorist organizations.
    Regarding the third attack scenario (incorporation of a contaminant
into pet food), we are aware of contaminants that could be incorporated
into feed or pet food that could result in significant animal
(including pet) morbidity and mortality, including some which could
result in secondary infectious spread of disease (because some
infectious agents can be transmitted orally as well as through
aerosol). Again, such attacks could be significant from an economic and
societal standpoint. However, the risk that they pose with regard to
targeting by terrorist organizations appears to be significantly lower
than those involving human morbidity and mortality. We request comment
on this assessment of risk.
    Therefore, notwithstanding the likely presence of one or more of
the four key activity types in the production of many animal foods, we
have tentatively concluded that animal food (regardless of whether it
is produced at a facility solely engaged in the production of animal
food or at a facility engaged in the production of both animal and
human food) does not involve significant vulnerabilities that require
focused mitigation strategies under section 418 of the FD&C Act and is
not at high risk for intentional adulteration related to terrorism
under section 420 of the FD&C Act. Consequently, we are proposing to
exempt the manufacturing, processing, packing, and holding of food for
animals other than man. We request comment on these tentative
conclusions.

C. Food Defense Measures

    In subpart C of proposed part 121, FDA is proposing various food
defense measures, including requirements for a food defense plan,
identification of actionable process steps, implementation of focused
mitigation strategies and related monitoring, corrective actions, and
verification, and training of certain personnel. We discuss the
provisions of proposed subpart C in this section.
1. Food Defense Plan
    a. Proposed Sec.  121.126(a)--Requirement for a Food Defense Plan.
Proposed Sec.  121.126(a) would require that the owner, operator, or
agent in charge of a facility prepare, or have prepared, and implement
a written food defense plan. To make clear that the written plan is
related to food defense rather than to other plans a facility may have
(such as quality control plans or food safety plans), for purposes of
this rulemaking, we have designated the ``written plan'' to be a ``food
defense plan.'' A written food defense plan is essential for a facility
covered by this rule to implement the plan consistently, train its
employees, and periodically reanalyze and update the plan. It is also
essential to auditors, and to inspectors, in the same way written plans
are essential to ensuring food safety. A written food defense plan
addressing vulnerabilities associated with intentional adulteration is
analogous to a written HACCP or food safety plan for hazards associated
with unintentional contamination.
    Proposed Sec.  121.126(a) would provide flexibility for the owner,
operator, or agent in charge of the facility to either prepare the
written food defense plan or have that plan prepared, in whole or in
part, on its behalf. In addition, proposed Sec.  121.126 would provide
flexibility for facilities in the development of their food defense
plans by allowing facilities to group food types or production method
types if the vulnerabilities, focused mitigation strategies, and other
required procedures, such as monitoring, are essentially identical.
    Proposed Sec.  121.126(a) would require that the owner, operator,
or agent in charge of a facility implement the written food defense
plan. Our proposed requirement to develop and implement a food defense
plan, which includes the identification of actionable process steps and
implementation of focused mitigation strategies, reflects our tentative
conclusion that such actions are measures necessary to prepare and
protect the food supply from intentional adulteration caused by acts of
terrorism. Proposed Sec.  121.126(a) implements sections 418(b), (c),
(d), (e), (f), and (h), and 420(b) of the FD&C Act. We seek comment on
these tentative conclusions.
    b. Proposed Sec.  121.126(b)--Contents of a food defense plan.
Proposed Sec.  121.126(b)(1) through (b)(5) would require that the
contents of a food defense plan include:
     The written identification of actionable process steps as
required by proposed Sec.  121.130;
     The written focused mitigation strategies as required by
proposed Sec.  121.135(b);
     The written procedures for monitoring as required by
proposed Sec.  121.140(a);
     The written corrective action procedures as required by
proposed Sec.  121.145(a)(1); and
     The written verification procedures as required by
proposed Sec.  121.150(e).
    Although we are proposing to require that the contents of food
defense plan include only the specific elements described above, the
food defense plan can be used as a resource for facilities to capture
additional food defense-related information. For example, facilities
may also wish to include information, such as process flow diagrams, an
evaluation of broad mitigation strategies, emergency contact
information, crisis management plans, action plans for implementation
of broad mitigation strategies, results of supplier audits, and other
documents, analysis, reviews, or information the facility finds
relevant to its food defense program. FDA has developed and publicly
released the user-friendly FDPB software tool that can be used to
assist a facility to develop a robust food defense plan. This free tool
is available on the FDA Web site at http://www.fda.gov/Food/FoodDefense/ToolsEducationalMaterials/ucm349888.htm.
    Proposed Sec.  121.126, if finalized, would establish a requirement
for every facility covered by this rule to have its own written food
defense plan. Like the food safety plan, this facility-based nature of
the written food defense plan is consistent with the overall framework
of section 418 of the FD&C Act, which is directed to a facility rather
than, for example, a corporate entity that may have multiple
facilities.
    Proposed Sec.  117.126(c) of the PC proposed rule would require
that the food safety plan be prepared by (or its preparation overseen
by) a qualified individual (See the discussion in section XII.A.4 of
the PC proposed rule). We are proposing to require that the
vulnerability assessment be performed by an individual qualified by
experience and/or training only when facilities choose to identify
actionable process steps in their food defense plans using the
provisions of proposed Sec.  121.130(b), whereby they would perform
their own vulnerability assessment. Our proposal is based on two
considerations. First, we anticipate that most facilities will develop
their food defense plan using the procedure in proposed Sec.
121.130(a) for identification of actionable process steps. Here, FDA
has performed much of the scientific analysis required and identified
the key activity types (see section V.C.2 of this document for

further discussion). Second, we believe that the identification of
focused mitigation strategies, and the monitoring, corrective action
and verification activities to implement them requires less technical
expertise than required for preventive controls and implementation
procedures for those controls. The former usually involve focused
mitigation strategies to limit access to specific steps in the
production process with simple visual checks to monitor them, while the
latter often involve scientific studies to establish critical limits
with process control instruments to monitor them.
    Proposed Sec.  121.126(b) implements sections 418(h) and 420(b)(2)
of the FD&C Act.
    We seek comment on our proposed provisions related to the written
food defense plan and its contents.
2. Identification of Actionable Process Steps
    a. FDA's vulnerability assessments and FDA-identified key activity
types. As noted in section II.B of this document, under the SPPA
Initiative, FDA, along with USDA, FBI, and DHS, conducted vulnerability
assessments on products and processes in the food and agriculture
sector. After conclusion of the initiative, FDA continued conducting
assessments for products and processes not previously assessed. To
implement section 420(a)(1)(A), FDA combined and analyzed data from a
subset of these assessments (i.e., those relevant to the food
manufacturing and distribution segments of the food system) and
identified activities which consistently ranked high for vulnerability
to intentional adulteration. FDA published the results of this analysis
in April, 2013 (April 2013 Report) (Ref. 54).
    CARVER+Shock methodology is a tool for assessing the
vulnerabilities within a food system and determining the most
vulnerable points, and focusing resources on protecting the most
susceptible points. Using the CARVER+Shock methodology, FDA, in
collaboration with other U.S. government partners conducted over 50
vulnerability assessments on a wide range of food products and
processes. Based on these assessments, we identified the processing
steps with the greatest vulnerability to intentional adulteration
caused by acts of terrorism. Through this review, we determined that
the processing steps we identified fit into one of four groups of
activities occurring at those processing steps. We refer to these as
``key activity types.'' The key activity types that we have identified
are: (1) Bulk liquid receiving and loading, (2) Liquid storage and
handling, (3) Secondary ingredient handling, and (4) Mixing and similar
activities. In this proposed rule we have modified the activity type
names and descriptions from those in the April 2013 Report for clarity.
    Providing these key activity types to facilities for their use in
identifying actionable process steps and developing focused mitigation
strategies provides some advantages over other approaches that we might
have taken, such as identifying points in the production of specific
foods at increased risk for intentional adulteration caused by an acts
of terrorism, or requiring each facility to perform its own
vulnerability assessment. First, publicly providing a list of key
activity types does not disclose sensitive information, as might be the
case if we provided CARVER+Shock scores derived from our vulnerability
assessments for process steps for specific foods.
    Second, providing a list of key activity types rather than
requiring facilities to perform their own facility-specific
vulnerability assessments relieves the burden upon the facility to
assemble a team of individuals with the diverse expertise needed to
properly self-score the steps in their process (using the CARVER+Shock
Vulnerability Assessment software tool or another suitable tool). When
we performed vulnerability assessments during the SPPA initiative our
teams included individuals with expertise in the production of the food
under study, law enforcement, food science, food regulatory systems,
and public health. We expect that such an effort is likely beyond the
capacity of many facilities. Further, by providing a list of key
activity types, we eliminate the need to identify a CARVER+Shock score,
for example, as the threshold for the implementation of focused
mitigation strategies. This is important because CARVER+Shock scores
are somewhat subjective and difficult to correlate across food types,
making identification of a universal threshold score challenging.
    b. Proposed Sec.  121.130--Requirement for written identification
of actionable process steps. Proposed Sec.  121.130 would require that
the owner, operator, or agent in charge of a facility identify any
actionable process steps, using the procedures in either proposed Sec.
121.130(a) or proposed Sec.  121.130(b). A facility would be required
to follow either one of the two specified procedures, but not both.
    Proposed Sec.  121.130 would also require that the identification
of actionable process steps and the assessment leading to that
identification be written. A written assessment of whether the facility
has one or more of the key activity types (under proposed Sec.
121.130(a)) or a written vulnerability assessment (under proposed Sec.
121.130(b)) would help the facility organize its assessment, and fully
understand the nature of the vulnerabilities. In addition, it is
essential for auditors and inspectors to assess the adequacy of the
facility's assessment. This written identification of actionable
process steps would also be essential during reanalysis of the food
defense plan, as would be required by proposed Sec.  121.150(d). Such a
written document would also be useful for training purposes as a tool
to make employees aware of the elements of the facility's food defense
plan.
    The written identification of actionable process steps must include
the justification for whatever conclusion the owner, operator, or agent
in charge of a facility reaches. Proposed Sec.  121.130 would not limit
the requirement for a written identification of actionable process
steps to only those circumstances where the owner, operator, or agent
in charge of a facility identifies one or more actionable process
steps. Rather, under proposed Sec.  121.130, a written analysis would
be required even if the conclusion of the analysis is that there are no
actionable process step.
    If a facility chooses to identify actionable process steps using
the procedure in proposed Sec.  121.130(a), the written documentation
would not need to include the procedures for assessing the
vulnerabilities associated with identified actionable process steps. If
a facility chooses to identify actionable process steps using the
procedure in proposed Sec.  121.130(b), the written identification of
actionable process steps must include information about the appropriate
methods used to conduct the vulnerability assessment and identify
actionable process steps, and the experience and training of the
person(s) who conducted that assessment (see also discussion in section
V.C.2.d of this document).
    Proposed Sec.  121.130 implements sections 418(b)(2), 418(b)(3),
420(a)(1), and 420(b)(1) of the FD&C Act.
    c. Proposed Sec.  121.130(a)--Identification of actionable process
steps using FDA-identified key activity types. Proposed Sec.
121.130(a) would specify the first of two procedures by which the
proposed requirement for identification of actionable process steps in
proposed Sec.  121.130 can be met, i.e., using the FDA-identified key
activity types.

    Proposed Sec.  121.130(a) would state that the owner, operator, or
agent in charge of a facility must assess, for each type of food
manufactured, processed, packed or held at the facility, whether the
facility has one or more of the following key activity types and
identify the actionable process steps associated with any key activity
types present:
    1. Bulk liquid receiving and loading--a step in which a bulk liquid
is received and unloaded from an inbound conveyance or loaded into an
outbound conveyance where a contaminant can be intentionally introduced
and, if it is, it is likely that the contaminant will be distributed
throughout the liquid due to sloshing, movement, or turbulence caused
by the receiving and unloading or loading activity;
    2. Liquid storage and handling--a step in which a liquid is
contained in bulk storage tanks or in holding, surge, or metering tanks
where a contaminant can be intentionally introduced and, if it is, it
is likely that the contaminant will be distributed into the food;
    3. Secondary ingredient handling--a staging, preparation, addition,
or rework step where a contaminant can be intentionally introduced into
a relatively small amount of ingredient or rework and, if it is, it is
likely that the contaminant will be distributed into a larger volume of
food; and
    4. Mixing and similar activities--a step, such as mixing, blending,
homogenizing, or grinding where a contaminant can be intentionally
introduced and, if it is, it is likely that the contaminant will be
distributed into the food.
    The owner, operator, or agent in charge would be required to assess
whether the facility has a food process that involves any one or more
of the specified four key activity types. If the food process is found
to involve any key activity types, the owner, operator, or agent would
be required to identify actionable process step(s) that are associated
with each key activity type that is present.
    For example, based on proposed Sec.  121.130(a), a facility may
identify a mixing tank as involving the key activity type, Mixing and
similar activities, in its operation because the mixing tank has an
unsecured lid and several sample ports which provide direct access to
the food product and because a contaminant can be introduced into the
tank through the lid or one of the sampling ports and, if it is, the
contaminant would be distributed into the food. The owner would
conclude that the mixing tank is an actionable process step. We would
expect that this conclusion would be reached for virtually all steps
that involve mixing, blending, homogenizing, or grinding because these
kinds of process steps generally: (1) Present an opportunity for access
to the product at or just prior to the equipment (e.g., in-feed
conveyor); and (2) would cause a contaminant, if intentionally added,
to be distributed into the food. We expect this conclusion to be
reached regardless of whether the facility may already have mitigation
strategies in place to impede access to the mixing tank (e.g., a
``buddy system'' that ensures that at least two employees were present
at the mixing tank at all times or a lock on the mixing tank access
ports). The presence of mitigation strategies should not be considered
when assessing whether a facility has a process step that involves one
of the key activity types. Any existing mitigation strategies and their
adequacy to significantly minimize or prevent the significant
vulnerability should be considered at a later step when identifying
appropriate focused mitigation strategies, in accordance with proposed
Sec.  121.135.
    We acknowledge the possibility, although not likely, that
circumstances may exist where access at or just prior to the equipment
is not possible (i.e., because the equipment is fully enclosed, with no
access ports), and that in such a situation this process step would not
be identified as fitting within the key activity type. For example, the
owner of the same facility may assess a second mixing tank that is part
of an entirely closed system, with no direct access points into the
system, such that an individual attempting to access this mixing tank
would likely cause a major disruption to the line, foiling any
attempted intentional adulteration. Based on this assessment, the owner
may conclude that the enclosed nature of this second mixing tank
renders the product inaccessible at this step and, therefore, it does
not fit within the key activity type. In this circumstance, there would
be no requirement to identify an actionable process step associated
with this mixing tank (in which case, there also would be no
requirement to implement a focused mitigation strategy at this step).
Under proposed Sec.  121.130, the owner would be required to document
the basis for the determination that the second mixing tank does not
fit within the key activity type. The second mixing tank would continue
to be subject to the requirement for reanalysis of a food defense plan,
as proposed in Sec.  121.150(d) and the facility would consider the
applicability of the four key activity types during reanalysis. We
request comment on whether there are specific process steps for
specific products that otherwise fit within one of the four key
activity types but for which access to the equipment is not possible
(i.e., because the equipment is fully enclosed, with no access ports).
    If the owner, operator, or agent in charge determines that the food
operation does not involve any of the key activity types, there would
be no need to identify actionable process steps. Such a facility,
however, would still be required to document its finding that none of
the key activity types apply to its food processes, under proposed
Sec.  121.130. The documentation would be a part of the written food
defense plan required under proposed Sec.  121.126. Such a facility
would continue to be subject to the requirement for reanalysis of a
food defense plan, as proposed in Sec.  121.150(d).
    Proposed Sec.  121.130(a) would require that the process of
identification of actionable process steps be done ``for each type of
food manufactured, processed, packed, or held at the facility.'' The
vulnerability of a food to intentional contamination may differ based
on the type of food and associated process, practices, and conditions
at the facility. Therefore, we are proposing that the facility assess
whether it has any of the key activity types for each type of food that
is manufactured, processed, packed, or held at that facility. A
facility may find that its operation related to one type of food
manufactured at that facility involves one or more of the key activity
types, but all other types of food manufactured at that facility do not
involve any of the key activity types. In such an instance, actionable
process steps would need to be identified and focused mitigation
strategies implemented only for the food type that involved the key
activity types.
    Description of key activity types--As discussed in section V.C.2.a
of this document, our vulnerability assessments revealed four key
activity types that most commonly rank high: Bulk liquid receiving and
loading; Liquid storage and handling; Secondary ingredient handling;
and Mixing and similar activities. We have tentatively concluded that
the presence of any of these four key activity types in a food
operation indicates a significant vulnerability for intentional
contamination caused by acts of terrorism. Based on our assessments, we
believe that these four key activity types capture the significant
vulnerabilities in a food operation. However, although generally
unlikely, a vulnerability

assessment of a specific food at a specific facility conducted under
proposed Sec.  121.130(b) may identify significant vulnerabilities at
actionable process steps that are not associated with one of these four
key activity types. We seek comment on our tentative conclusion.
    Proposed Sec.  121.130(a)(1) would identify ``Bulk liquid receiving
and loading'' as a key activity type, based on our finding that this
activity type commonly ranked high in our vulnerability assessments.
Proposed Sec.  121.130(a) would describe this key activity type as a
step in which a bulk liquid is received and unloaded from an inbound
conveyance or loaded into an outbound conveyance where a contaminant
can be intentionally introduced and, if it is, it is likely that the
contaminant will be distributed throughout the liquid due to sloshing,
movement, or turbulence caused by the receiving and unloading or
loading activity. Bulk liquid receiving refers to the inbound movement
of liquid product into a facility for its use in the food production
process, whereas bulk liquid loading refers to the outbound movement of
liquid product from a facility for further processing or use by an end
customer/consumer. Examples of products that may be received or loaded
in bulk include juices, high fructose corn syrup and other sweeteners,
milk, animal fats, syrups, and vegetable oils.
    Bulk liquid receiving and loading refers to any processing step
where a liquid ingredient is being received and unloaded at a facility
or a liquid intermediate or finished product is being loaded into an
outbound shipping transport vehicle and for which there is an
opportunity for a contaminant to be intentionally introduced into the
food. This key activity type incorporates the actions of opening the
transport vehicle, attaching any pumping equipment or hoses, and
opening any venting hatches. The characteristics associated with these
activities are such that there is a high probability of a contaminant,
if intentionally added, mixing within the liquid, due to significant
sloshing, movement, and turbulence associated with the receiving or
loading activity. In addition, the need for worker activity associated
with these processing steps provides access to hoses, the transport
vessel, and potentially the product as it is being received or loaded.
    Proposed Sec.  121.130(a)(2) would identify ``Liquid storage and
handling'' as a key activity type, based on our finding that this
activity type ranked high in our vulnerability assessments. Proposed
Sec.  121.130(a) would describe this key activity type as a step in
which a liquid is contained in bulk storage tanks or in holding, surge,
or metering tanks where a contaminant can be intentionally introduced
and, if it is, it is likely that the contaminant will be distributed
into the food. This key activity type refers to any processing step
where a liquid ingredient or intermediate or finished liquid product is
stored in either bulk storage tanks or smaller secondary, non-bulk
holding tanks or surge tanks and for which there is an opportunity for
a contaminant to be intentionally introduced into the food. Bulk liquid
storage refers to any storage silo or tank where liquid product may be
stored prior to introduction into the product stream or prior to
loading for outbound shipping. Non-bulk tanks can be used to store non-
bulk liquid ingredients (e.g., fats, oils, vitamin mixes, and
sweeteners), hold liquid product for sample testing and other quality
control activity, or to control flow rates of liquid ingredients or
product through the production system. Non-bulk storage tanks also
include tanks or totes where the tamper evident seals are opened and
the container itself is used for holding. Both categories of liquid
storage can be considered key processing steps because if a contaminant
were successfully introduced, there is a high probability of a
contaminant mixing within the liquid due to the agitation commonly used
to prevent separation within the liquid medium. Access necessary for
the introduction of a contaminant is generally available through
hatches, sample ports, and the container lid (in the case of a tanker
or tote for which the tamper evident seal has been broken).
    Proposed Sec.  121.130(a)(3) would identify ``Secondary ingredient
handling'' as a key activity type, based on our finding that this
activity type commonly ranked high in our vulnerability assessments.
Proposed Sec.  121.130(a) would describe this key activity type as the
staging, preparation, addition, or rework step where a contaminant can
be intentionally introduced into a relatively small amount of
ingredient or rework and, if it is, it is likely that the contaminant
will be distributed into a larger volume of food. This key activity
type refers to any processing step where ingredients (either dry or
liquid) are manipulated prior to or during addition to the product
stream by human contact and for which there is an opportunity for a
contaminant to be intentionally introduced into the food. ``Staging''
refers to the process of opening the tamper evident packaging of a
secondary ingredient and moving the ingredient to the production area
in advance of being added into the primary product stream.
``Preparation'' refers to any act of measuring, weighing, premixing, or
otherwise manipulating the ingredient prior to addition to the product
stream. ``Addition'' refers to any act of physically adding ingredient
directly into the product stream or into surge or meter hoppers in
order to deliver the ingredient into the product stream. ``Rework''
refers to clean, unadulterated food that has been removed from
processing for reasons other than insanitary conditions or that has
been successfully reconditioned by reprocessing and that is suitable
for use as food. Staging, preparation, addition, and rework involving
secondary ingredients are key activities because a contaminant added to
a relatively small volume of product would be distributed into the
large product flow as the ingredient or rework is combined with the
other components of the food. Secondary ingredient staging,
preparation, addition, and rework are generally open and accessible and
that accessibility is an inherent component of the activity. Thus,
these key activities provide a potential point of access where a
contaminant could be introduced into the product stream.
    Proposed Sec.  121.130(a)(4) would identify ``Mixing and similar
activities'' as a key activity type, based on our finding that the
activities commonly ranked high in our vulnerability assessments.
Proposed Sec.  121.130(a) would describe this key activity type as a
step, such as mixing, blending, homogenizing, coating, glazing, or
grinding where a contaminant can be intentionally introduced and, if it
is, it is likely that the contaminant will be distributed into the
food. This key activity type refers to any processing step where there
is an opportunity for a contaminant to be intentionally introduced into
the food, and the primary purpose or result of the processing step is:
(1) Coating, i.e., to layer a powder or liquid onto the surface of a
product, such as a batter, breading, glazing or flavoring; (2) mixing,
i.e., to blend a powder, dough, or liquid ingredient together; (3)
grinding, i.e., to reduce the particle size of a solid ingredient or
mass to a smaller granularity; or (4) homogenizing, i.e., to reduce the
particle size of an ingredient and disperse it throughout a liquid.
    These are key activities because a potential contaminant
successfully added at one of these steps would generally be readily
dispersed throughout the product. Further, access is generally
available through access ports, lids, and in-feed conveyors or

flumes. Examples of equipment associated with these activities include:
Mixers, blenders, homogenizers, cascade breaders, mills, grinders, and
pulverizers.
    We seek comment on these key activity types, and whether they are
each appropriate to include and whether there are additional activities
that present significant vulnerability to intentional adulteration
caused by acts of terrorism.
    Proposed Sec.  121.130(a) implements sections 418(a) through (c)
and 420(a)(1)(A) of the FD&C Act.
    d. Proposed Sec.  121.130(b)--Identification of actionable process
steps by conducting a vulnerability assessment. Proposed Sec.
121.130(b) would provide the second of two options for identification
of actionable process steps. Proposed Sec.  121.130(b) would specify
that the owner, operator, or agent in charge of a facility must conduct
or have conducted, for each food type manufactured, processed, packed
or held at the facility, an evaluation to identify and prioritize the
points, steps, and procedures in a food operation based on their
vulnerability to intentional adulteration and to identify actionable
process steps.
    Proposed Sec.  121.130(b) would provide flexibility to the owner,
operator, or agent in charge of a facility covered by this rule to
conduct, or have conducted, their own vulnerability assessment of the
food operations at a facility, rather than assessing their food
operation against the FDA-identified key activity types. We are
proposing that a vulnerability assessment conducted under proposed
Sec.  121.130(b) must be performed by an individual(s) qualified by
experience and/or training using appropriate methods. Training or job
experience is essential to the effective evaluation of vulnerabilities
and identification of actionable process steps. Only a trained
individual or individual qualified by job experience using appropriate
methods would be capable of effectively conducting a vulnerability
assessment, including assessing the various points, steps, or
procedures in a food process; identifying and prioritizing those
points, steps, or procedures in a food process that are susceptible to
intentional contamination; and identifying actionable process steps
where food defense measures are essential to address significant
vulnerabilities. Our proposed definition of significant vulnerability
(in proposed Sec.  121.3), too, reflects the need for a qualified
individual to make such assessments where focused mitigation strategies
would be necessary to protect the food from intentional adulteration
caused by acts of terrorism. As noted above, when we performed
vulnerability assessments during the SPPA initiative our teams included
individuals with expertise in the production of the food under study,
law enforcement, food science, food regulatory systems, and public
health. While we are not proposing to specify the particular training
or experience requirements of the individual(s) qualified to conduct
such vulnerability assessments, or the particular methods that must be
used to conduct these assessments, facilities choosing this procedure
in proposed Sec.  121.130(b) would be required to employ appropriate
methods and use a qualified individual(s) to conduct a robust and
scientifically sound vulnerability assessment of the facility's food
operation. FDA's resources available online, such as the CARVER+Shock
Vulnerability Assessment software tool and the FDPB software tool may
be helpful.
    Finally, as in the case of proposed Sec.  121.130(a), proposed
Sec.  121.130(b) would require that the process of identification of
actionable process steps be done ``for each type of food manufactured,
processed, packed, or held at the facility.'' See discussion in section
V.C.2 of this document.
    Elements of a Facility-Specific Vulnerability Assessment--The
elements of an approach to conducting a facility-specific vulnerability
assessment are:
     Planning to conduct a vulnerability assessment--collect
and evaluate appropriate background information on biological,
chemical, physical, and radiological agents of concern, such as those
found in the CDC's Select Agents and Toxins List (Ref. 57);
     Assembling the vulnerability assessment team--identify
appropriate individuals within the organization to assist in the
vulnerability assessment process. This may include personnel working in
the areas of security, food safety/quality assurance or control, human
resources, operations, maintenance, and other individuals deemed
necessary to facilitate the formation of a vulnerability assessment;
     Developing a process flow diagram--list out each of the
steps in the food process to be evaluated;
     Identifying significant vulnerabilities--evaluate each
process step to prioritize vulnerabilities and identify significant
vulnerabilities. For each process step, the evaluation should consider,
at a minimum: (1) The potential public health impact if a contaminant
were added; (2) whether downstream processing steps would eliminate or
remove agents of concern; (3) the degree of physical access to product;
(4) the ability of an aggressor to successfully contaminate the
product; and (5) the volume of product impacted. This evaluation should
also include the rationale or justification for which process steps
were and were not identified as significant vulnerabilities; and
     Identifying actionable process steps--for identified
significant vulnerabilities, indicate where actionable process steps
exist in the food process and where associated focused mitigation
strategies would be required to be implemented, under proposed Sec.
121.135.
    Facilities that choose this alternative may need assistance from
outside experts who are knowledgeable in food defense and vulnerability
assessments. Some facilities may not have the resources or the
necessary expertise on site and expert advice may be obtained when
necessary from other sources, such as trade and industry associations,
independent experts, and regulatory authorities.
    We seek comment on the need for, and appropriateness of, proposed
Sec.  121.130(b), including whether, in a final rule, we should specify
the particular qualifications of individual(s) performing the
vulnerability assessment or the methods that must be used under this
alternative procedure, and whether the vulnerability assessment
elements, we described previously, provide sufficient direction
regarding appropriate methodology.
    Proposed Sec.  121.130(b) implements sections 418(a) to (c) and
420(a)(1)(A) of the FD&C Act.
3. Focused Mitigation Strategies
    a. Requirements of sections 418 and 420 of the FD&C Act. Section
418(c)(2) of the FD&C Act, in relevant part, specifies that the owner,
operator, or agent in charge of a facility shall identify and implement
preventive controls to provide assurances that hazards identified in
the hazard analysis conducted under section 418(b)(2) of the FD&C Act
will be significantly minimized or prevented and addressed, consistent
with section 420 of the FD&C Act, as applicable. Section 418(c)(1)(3)
of the FD&C Act, in relevant part, specifies that the preventive
controls must also provide assurances that the food manufactured,
processed, packed, or held by such facility will not be adulterated
under section 402 of the FD&C Act. Section 418(h) of the FD&C Act
requires that the owner, operator, or agent in charge of a facility
prepare a written food safety plan that, among

other things, identifies the preventive controls within the plan.
Section 420(b) of the FD&C Act requires FDA to issue regulations to
protect against the intentional adulteration of food. Such regulations
are to specify appropriate science-based mitigation strategies or
measures to prepare and protect the food supply chain at specific
vulnerable points, as appropriate (section 420(b)(2) of the FD&C Act).
    Section 418(o)(3) of the FD&C Act defines preventive controls as
``those risk-based, reasonably appropriate procedures, practices, and
processes that a person knowledgeable about the safe manufacturing,
processing, packing, or holding of food would employ to significantly
minimize or prevent the hazards identified under the hazard analysis
conducted under [section 418(b) of the FD&C Act] and that are
consistent with the current scientific understanding of safe food
manufacturing, processing, packing or holding at the time of the
analysis.'' The definition provides that ``those procedures, practices,
and processes may include the following: (A) Sanitation procedures for
food-contact surfaces and utensils and food-contact surfaces of
equipment; (B) Supervisor, manager, and employee hygiene training; (C)
An environmental monitoring program to verify the effectiveness of
pathogen controls in processes where a food is exposed to a potential
contaminant in the environment; (D) A food allergen control program;
(E) A recall plan; (F) Current Good Manufacturing Practices (cGMPs)
under part 110 of title 21, Code of Federal Regulations (or any
successor regulations); (G) Supplier verification activities that
relate to the safety of food.'' (emphasis added)
    In section V.A.2 of this document, we discuss our proposed
definition of focused mitigation strategy and its relationship to the
definition of preventive controls in section 418(o)(3) of the FD&C Act.
We are not proposing requirements for sanitation procedures, hygiene
training, environmental monitoring, food allergen control, and CGMPs
because these examples are relevant to food safety, but not to food
defense. We considered proposing to require a recall plan (as we did in
the PC proposed rule in proposed Sec.  117.135(d)(4); see sections
XII.C.8 and XII.D of that document). However, we tentatively conclude
that the usefulness of a recall plan is greatly reduced in the context
of preventive controls for intentional adulteration. The relationship
between an implementation failure and the status of the food is
different in intentional adulteration and food safety contexts. An act
of intentional adulteration caused by terrorism, historically, has been
a rare event. In the vast majority of cases, the failure to properly
implement a focused mitigation strategy would not be expected to result
in intentional adulteration. With intentional adulteration,
adulteration of food requires not just the opportunity for a
contamination event (i.e., failure of a mitigation strategy to limit
access to an actionable process step), but also someone with intent to
cause harm at that same moment. As such, it is unlikely that a
deviation from the provisions of this proposed rule would necessitate a
recall. In contrast, the failure to properly implement a preventive
control for a food safety hazard (for example, where proper cook
temperatures are not reached in a process) would be expected to more
likely result in a situation where the food becomes adulterated (e.g.,
because the pathogen reasonably likely to be present in the raw food
would not be eliminated from the food by the inadequate cooking
process), potentially necessitating a recall.
    b. General description of mitigation strategies. Mitigation
strategies are measures taken by a facility to reduce the potential for
intentional adulteration of food. Based on these vulnerability
assessments, FDA previously developed recommendations for mitigation
strategies that can be implemented, as appropriate, to minimize or
prevent intentional contamination of food. These mitigation strategies
are presented in our guidance documents (Ref. 22, Ref. 23, Ref. 24,
Ref. 25, Ref. 26), the CARVER+Shock Vulnerability Assessment software
tool (Ref. 29), the MSD (Ref. 30), and the FDPB software tool (Ref.
31). FDA divides mitigation strategies into two types: Broad Mitigation
Strategies and Focused Mitigation Strategies. We explain each of these
types in this section of the document.
    i. Broad mitigation strategies. Broad mitigation strategies are
general facility-level measures that are intended to minimize a
facility's vulnerability, as a whole, to potential acts of intentional
contamination. Examples of broad mitigation strategies are: (1)
Physical security, such as perimeter security fencing, locking exterior
doors, penetration alarms; (2) personnel security, such as pre-hire
background, reference checks, identification badges, and controlled
visitor access; (3) securing hazardous materials, such as cleaning
products, laboratory materials, and pesticides; (4) management
practices, such as ingredient storage inventory procedures; key
security procedures, PINs or passwords; procedures to restrict personal
items from all food production areas; procedures requiring IDs and
uniforms to be returned when a person's employment ends; and supplier
verification or certification procedures; and (5) crisis management
planning, such as maintenance of updated emergency contact information,
procedures for responding to reported threats, and establishment of a
designated food defense leadership team.
    Broad mitigation strategies, by nature, are generally applicable to
a facility, regardless of the type of food being processed, and, as
such, are not targeted to a specific processing step in a food
operation. Broad mitigation strategies address facility-wide
vulnerabilities that may present an opportunity for an attacker to
access the facility and intentionally adulterate food. Broad mitigation
strategies serve as foundational actions or procedures that improve a
facility's overall defense against intentional contamination caused by
acts of terrorism.
    We are proposing to require the implementation of focused
mitigation strategies only. However, as set out in our guidance
documents (Ref. 22, Ref. 23, Ref. 24, Ref. 25, Ref. 26), we think it is
prudent for facilities to review our guidance and implement those broad
mitigation strategies that are appropriate to minimize the risk for
intentional adulteration of food.
    ii. Focused mitigation strategies. As discussed in section V.A of
this document, we are proposing to define focused mitigation strategies
as those risk-based, reasonably appropriate measures that a person
knowledgeable about food defense would employ to significantly minimize
or prevent significant vulnerabilities identified at actionable process
steps, and that are consistent with the current scientific
understanding of food defense at the time of the analysis.
    Focused mitigation strategies are specific to an actionable process
step in a food operation where a significant vulnerability is
identified. They represent reasonably appropriate measures that are
necessary to reduce the likelihood of intentional contamination caused
by an act of terrorism at that process step. Focused mitigation
strategies are customized to the processing step at which they are
applied, tailored to existing facility practices and procedures, and
depend on an evaluation of the vulnerabilities identified in a
vulnerability assessment. When properly implemented, focused

mitigation strategies by themselves are sufficient to significantly
minimize or eliminate the chances that an attacker would be successful
if an act of intentional adulteration were attempted at the specific
process step. Focused mitigation strategies focus on minimizing either
the accessibility of an attacker to the product at a particular process
step or the opportunity for the attacker to successfully contaminate
the product at that process step, or both.
    Based on our vulnerability assessments, we tentatively conclude
that the implementation of focused mitigation strategies at actionable
process steps in a food operation is necessary to minimize or prevent
the significant vulnerabilities that are identified in a vulnerability
assessment (Ref. 21, Ref. 54, Ref. 58), regardless of the existence of
broad mitigation strategies. Although broad mitigation strategies are
important to further reduce the vulnerability for intentional
contamination, they are not sufficient to significantly minimize the
risk of intentional contamination caused by an act of terrorism because
broad mitigation strategies are not specific enough, for example, to
counter the actions of an attacker who has legitimate access to the
facility (i.e., insider attack) or an attacker who circumvents
perimeter protections (e.g., scaling a fence), with the goal of
intentionally contaminating the food. Focused mitigation strategies, on
the other hand, are targeted to actionable process steps identified in
a food operation to reduce the likelihood of intentional contamination
at those process steps and, therefore, are essential to ensure that
appropriate food defense measures are taken to protect the food from
intentional contamination caused by acts of terrorism. In contrast to
broad mitigation strategies, focused mitigation strategies are targeted
to actionable process steps and, therefore, are more effective at
countering an attacker who has legitimate access to the facility. We
have tentatively concluded that we will continue to encourage the
implementation of broad mitigation strategies on a voluntary basis, but
we will require the implementation of focused mitigation strategies at
actionable process steps. We request comment on this tentative
conclusion, and on whether we should include, in a final rule, a
requirement for the implementation of any broad mitigation strategies.
    iii. Examples of focused mitigation strategies for FDA-identified
key activity types. For the FDA-identified key activity types, a
variety of focused mitigation strategies may be applicable, dependent
both on the food manufactured, processed, packed, or held at the
facility and on the practices and processes employed at that facility.
We list in this section some examples of focused mitigation strategies
that may be appropriate to implement at actionable process steps for
each of these four key activity types. While the decision of which and
how many focused mitigation strategies would be appropriate to employ
at an actionable process step is dependent upon the physical layout and
operation at a specific facility, the examples presented in the section
immediately below illustrate the decision-making process to identify
and determine appropriate focused mitigation strategies at an
actionable process step.
    Bulk liquid receiving and loading--Examples of focused mitigation
strategies that may be appropriate include the following:
    1. Controlling access to the receiving or loading area,
conveyances, and equipment, including hoses and pumping machinery, to
prevent an unauthorized person from gaining access to the food during
receiving or loading. Access controls may include: strategies to easily
identify authorized persons, such as color-coded uniforms or badges;
restricting conveyance drivers to areas away from the receiving or
loading area (e.g., restricting them to a lounge or break room);
securing hoses with locking caps or in cabinets; and ensuring that
conveyance access hatches, vents, and inspection ports are secured;
    2. Ensuring adequate lighting in the receiving or loading area,
which reduces the ability of an attacker to disguise his or her
actions. Adequate lighting in and around vulnerable areas of a food
operation increases the likelihood that other staff will witness the
actions of an attacker and enable them to take steps to prevent or
react to contamination;
    3. Increasing observation of the receiving or loading area, which
reduces the ability of an attacker to disguise his or her actions. For
example, maximizing the line of sight by removing boxes, crates, or
other obstructions from the area; positioning quality control personnel
in the receiving or loading area to supervise operations; or utilizing
closed-circuit TV systems or other monitoring devices;
    4. Verifying that seals on a shipping conveyance are intact prior
to receiving or after loading a bulk liquid to reduce the likelihood
that the shipping conveyance was or is accessed during transport to
introduce a contaminant into the product;
    5. Establishing and implementing a policy for driver check-in and
identification to help confirm driver identity and verify the
individual is authorized, through verification of shipping
documentation or other means, to deliver or pick-up the shipment and
reduce the likelihood that an attacker could fraudulently pose as a
driver as a means of gaining access to the facility; and
    6. Inspecting the shipping conveyance prior to loading bulk liquids
to help ensure that no contaminant has been introduced to the
conveyance chamber that could then contaminate the product once the
product is loaded.
    Liquid storage and handling--Examples of focused mitigation
strategies that may be appropriate include the following:
    1. Controlling access to liquid storage, holding, surge, or
metering tanks, similar to the strategies that may be applied for
controlling access to bulk liquid receiving and holding;
    2. Ensuring that the area around liquid storage, holding, surge, or
metering tanks is free of unrelated materials, such as personal items
(backpacks, purses, or packages), and other items that are not directly
related to the food operation, to reduce the likelihood of a
contaminant being brought into the area for introduction into the tank;
    3. Ensuring adequate lighting in and around liquid storage,
holding, surge or metering tanks, similar to the strategies that may be
applied for ensuring adequate lighting at bulk liquid receiving and
loading;
    4. Installing one-way sample ports in liquid storage, holding,
surge, or metering tanks , so that food product can be drawn out of the
equipment but a contaminant cannot be inserted into the tank;
    5. Inspecting tanks prior to filling to help ensure that no
contaminant has been introduced into the empty tank that could then
contaminate the product once loaded;
    6. Inspecting pumping or metering equipment prior to use to help
ensure that no contaminant has been introduced into the equipment that
could contaminate the product;
    7. Using enclosed tanks and transfer systems to move materials to
reduce the potential for an attacker to access the product and
introduce a contaminant; and
    8. Positioning holding, surge, or metering tanks to increase
visibility, such that frequent observation is facilitated and
visibility of activity around the tank is improved. This

focused mitigation strategy may be less practical for longer term
storage tanks.
    Secondary ingredient handling--Examples of focused mitigation
strategies that may be appropriate include the following:
    1. Controlling access to ingredient handling areas, including where
secondary ingredients or rework are staged, prepared, or added to the
product stream, to prevent an unauthorized person from gaining access
to the ingredients or rework during these processes. As with other key
activity types, access controls may include strategies to easily
identify authorized persons, such as with color coded uniforms or
badges, or conducting ingredient handling activities in areas behind
locking gates, doors, or other barriers;
    2. Ensuring the secondary ingredient handling area is free of
unrelated materials, such as personal items or other items not directly
related to the activity, to help ensure that a contaminant is not
brought into the area for introduction into the ingredient during
staging, preparation, or addition;
    3. Ensuring adequate lighting and increasing visibility in and
around ingredient staging and handling areas, similar to the strategies
that may be employed to ensure adequate lighting at bulk liquid
receiving and holding;
    4. Reducing staging time to reduce the opportunity for intentional
adulteration. Any time sealed or tamper-evident containers are breached
provides a potential opportunity for an attacker to introduce a
contaminant into the ingredient or rework. Reducing the time
ingredients and rework are staged in unsecured containers reduces the
opportunity for an attacker to adulterate the ingredient or rework;
    5. Restricting secondary ingredient handling to senior staff to
reduce the accessibility and opportunity for intentional adulteration;
    6. Using peer monitoring in the ingredient handling area, because
requiring at least two staff members to be in the area at any given
time during operations can reduce the opportunity for a contaminant to
be discreetly introduced into the food;
    7. Using automated and enclosed ingredient handling equipment, such
as automated computer weighing, measuring, and addition equipment, to
reduce human contact with secondary ingredients or rework and thereby
reduce the opportunity for introduction of a contaminant; and
    8. Inspecting secondary ingredients held in staging and
investigating any irregularities in the amount, condition, or
organization of items in secondary ingredient handling areas to
identify circumstances that suggest product contamination before a
contaminated ingredient is added to the product stream.
    Mixing and similar activities--Examples of focused mitigation
strategies that may be appropriate include the following:
    1. Controlling access to processing areas where mixing and similar
activities are conducted to prevent an unauthorized person from gaining
access to the product and equipment. Access controls may include:
strategies to easily identify authorized persons, such as with color
coded uniforms or badges; conducting these activities in areas behind
locking gates, doors, or other barriers; securing access to overhead
gangways and sampling platforms; and securing hatches, ports, and lids
with locks or access alarm devices;
    2. Ensuring that the area is free of unrelated materials, such as
personal items and other items that are not directly related to the
activity, to reduce the likelihood of a contaminant being brought into
the area for introduction into the ingredient during mixing and similar
activities;
    3. Ensuring adequate lighting and increasing visibility in and
around mixing and similar activities areas, similar to the strategies
that may be employed to ensure adequate lighting at bulk receiving and
loading;
    4. Positioning mixing and similar equipment in a manner that
maximizes visibility, similar to the strategies that may be employed to
maximize visibility for liquid storage and handling;
    5. Using one-way sample ports that prohibit introduction of a
contaminant into the mixing or similar equipment, similar to the
strategies that may be employed for liquid storage and handling;
    6. Conducting inspections of mixing and similar equipment prior to
use to help ensure no contaminant has been introduced that could
contaminate the product once loaded;
    7. Restricting mixing and similar activities to senior staff,
similar to the strategies that may be employed for secondary ingredient
handling;
    8. Using peer monitoring in this area to ensure that at least two
staff members are in this area at any given time during operations,
reducing the opportunity for a contaminant to be discreetly introduced
into the food; and
    9. Using automated, self-contained, enclosed equipment to reduce
human contact with the product and reduce the opportunity for
introduction of a contaminant.
    These examples of focused mitigation strategies are consistent with
measures included in the MSD. The examples are not intended to be an
exhaustive list of appropriate focused mitigation strategies. For
additional guidance on identifying appropriate focused mitigation
strategies, see our guidance documents, the MSD, and other resources
(see section II.D of this document).
    iv. Specific examples of determining appropriate focused mitigation
strategies. In this section, we discuss specific examples of the
decision-making process to identify and determine appropriate focused
mitigation strategies at an actionable process step for each of the
FDA-identified key activity types.
    Bulk liquid receiving and loading--Unloading at Facility A's bulk
tanker truck unloading bay is an actionable process step for this key
activity type. Facility A has a significant vulnerability related to
access to the food during the unloading of the bulk liquid. At Facility
A, the tanker truck drives into the unloading bay without passing
through any security check-in procedures. A single facility employee is
assigned to this area and takes a facility-owned hose from an open
shelving unit in the unloading bay and attaches it to the tanker
truck's unloading port. The driver of the tanker truck assists in
unloading by opening the venting hatch at the top of the tanker truck
while the facility employee is attaching the hose. The driver then
waits in the unloading bay area while the truck is being unloaded. Upon
completion of unloading activities, the driver gets back in the truck
and exits the facility.
    Facility A is not implementing focused mitigation strategies at
this actionable process step such that access to the food during
unloading of the bulk liquid is significantly minimized or eliminated.
The food is significantly vulnerable to an attacker (in this case,
potentially the driver, the facility employee, or a third party) who
could intentionally add a contaminant to the product to adulterate the
food. One approach for Facility A to significantly minimize or
eliminate the significant vulnerability at this actionable process step
is to implement the following focused mitigation strategies:
     Establish a receiving check-in and verification procedure
to ensure that the shipment is being delivered by the proper firm and
that the driver is properly identified. The procedure would be
documented and maintained in a shipping log that records the key
identifying information about the driver, tanker truck, and shipping

documentation for the delivered product. The facility would also
institute a policy requiring that the shipping documentation include
the ID numbers of the seals on the unloading ports so that the facility
employee can verify that seal numbers match the shipping documentation
and that the seals were not broken, tampered with or replaced during
transport.
     Implement a procedure to store hoses securely to reduce
the likelihood an attacker could add a contaminant to the hoses when
not in use. This would include storing hoses in locking cabinets and
placing end caps on the hoses. The facility also would issue keys only
to staff working in the tanker truck receiving bay and use a key
numbering and tracking system to verify that all keys are accounted
for.
     Increase active observation of the unloading process to
reduce the likelihood of an attacker successfully introducing a
contaminant by requiring two or more production staff members to be
present during unloading activities (i.e., peer monitoring), or
requiring the bulk liquid unloading operations be overseen by a
supervisor or a member of the quality control staff. Alternatively, the
facility could employ video surveillance of the area. If the truck
driver is permitted to remain in the area of the receiving bay, the
introduction of active observation practices ensures that no
contaminant could be intentionally introduced to the product during
unloading activities. Alternatively, the facility could limit the
driver's access to the product by restricting the location of the
driver to designated areas outside the loading area while the truck is
being unloaded.
    In this example, the focused mitigation strategies were selected to
achieve the following goals: Establishing the identity of personnel
with access to the food; ensuring that equipment that may be used to
introduce a contaminant is secured when not in use; and providing
active observation of activities at actionable process steps. By
implementing these focused mitigation strategies, the facility could
significantly minimize the significant vulnerability identified at the
actionable process step.
    Liquid storage and handling--The storage of liquid in Facility B's
bulk liquid storage tank is an actionable process step for this key
activity type. Facility B's bulk storage tank holding a primary
ingredient is located within its building, and a significant
vulnerability relates to access to the food during such storage. In
Facility B, a network of gangways, ladders, and platforms surround the
bulk liquid storage tank so that personnel can gain access to a hatch
at the top of the tank. Facility B has a procedure for securing this
hatch with a lock, and the facility stores the key to the hatch in the
operations manager's office. To access a key, a worker must request the
key from the operations manager and justify the need to open the lock.
When an employee checks out the key, the manager's assistant records
the employee's name, time the key is checked out, and the reason.
Facility B's bulk liquid storage tank also has a second hatch along the
side which is used for cleaning the tank when empty and is not locked.
This secondary hatch is not accessible while product is in the tank
because it opens inward, and pressure from product in the tank prevents
the hatch from being opened when product is present.
    In considering the requirement for focused mitigation strategies at
this actionable process step, Facility B would determine that it has
sufficient safeguards in place to significantly minimize the likelihood
of intentional adulteration from an attacker accessing the hatch on the
top of the bulk storage tank. However, the facility would identify the
secondary hatch as presenting a significant vulnerability for which
insufficient focused mitigation strategies are being implemented. While
food is in the tank, the secondary hatch is secure. However, when the
tank is empty after cleaning, there is an opportunity for an attacker
to introduce a contaminant into the tank via the secondary hatch which
would then contaminate the food when it is added to the tank. To
significantly minimize or eliminate the significant vulnerability
presented by the secondary hatch, the facility would implement focused
mitigation strategies to restrict and document access to the secondary
hatch as is done for the hatch on the top of the tank. To do this, the
facility would install a lock on the secondary hatch and incorporate
the key for the secondary hatch into its existing key management
system. Alternatively, the facility could implement a procedure of
monitoring the condition of the tank interior immediately prior to
reintroducing product to the tank. This monitoring check would be
recorded in a monitoring log.
    Facility B already has in place some practices that we would
consider appropriate focused mitigation strategies. The procedures in
place to control access to the top access hatch on the bulk liquid
storage tank are sufficient to minimize the significant vulnerability
presented by this hatch. However, Facility B still has a significant
vulnerability associated with the secondary access hatch, which
required additional focused mitigation strategies to significantly
reduce or eliminate the risk of intentional contamination.
    Another example of an actionable process step for the key activity
type ``Liquid Storage and Handling'' is liquid storage in a liquid
surge tank located above an in-line bottling operation at Facility C.
The surge tank is used to control the flow rate of liquid product into
the bottling equipment and is enclosed by an unlocked lid. A ladder and
walkway enable workers to access the surge tank as needed to monitor
product flow and take quality control samples. Facility C has an
operations control room, which is equipped with windows to view the
production floor. However, the view of the bottling operation from the
operations control room is commonly blocked by pallets of empty bottles
awaiting introduction into the bottling equipment.
    It is not practical for Facility C to lock the surge tank lid
because workers need to frequently check the status of product flow and
take quality control samples. Also, it is not practical to physically
limit access to the ladder or walkway used to access the surge tank,
for the same reasons. One approach for Facility C to significantly
minimize or eliminate the significant vulnerability at this actionable
process step is to implement the following focused mitigation
strategies:
     Implement a policy to prohibit all personnel not
associated with the bottling operation from entering the area and issue
uniforms of a particular color to the bottling personnel only. The
staff working in the bottling area would enforce this policy by
instructing any staff not associated with the bottling operation to
leave the area.
     Prohibit staff working in the bottling area from bringing
any items not associated with the bottling operation into the work
area.
     Train the staff working in the bottling area in a peer
monitoring program to be attentive to the activity of other staff in
the area.
     Stage pallets of empty bottles awaiting introduction into
the bottling equipment in another location to improve line of sight
from the operations control room.
    By implementing these focused mitigation strategies, the facility
could significantly minimize or eliminate the significant vulnerability
associated with the actionable process step at the liquid surge tank.
    Secondary ingredient handling--Ingredient staging at Facility D is
an actionable process step for this key activity type. Facility D opens
a

containerized secondary ingredient's tamper evident package, measures
out the required amount into a secondary container, and pre-positions
the ingredient in the production area so that it is readily added to
the product line. Access to the food during each of these activities at
this actionable process step presents a significant vulnerability.
Facility D stages a dry, powdered ingredient near the mixer the night
before it is intended to be used so that it is ready when the
production run begins the next morning. Additionally, the staging area
in Facility D is accessible to all staff and is an open area on the
production floor.
    One approach for Facility D to significantly minimize or eliminate
the significant vulnerability at this actionable process step is to
implement the following focused mitigation strategies:
     Reduce staging time, by revising its procedures so that
ingredients are staged immediately before they are added into the
product stream. This strategy would reduce the time ingredients are
accessible.
     Change its staffing procedures to ensure that only senior
or long-term employees are assigned to measuring and staging secondary
ingredients. Assigning the most trusted employees to work in sensitive
areas reduces the risk of intentional contamination.
     Increase its observation of this area by installing
closed-circuit TV cameras to monitor the actions of staff in the
secondary ingredient staging area.
    By its nature, the action of ingredient staging is an open and
accessible process step. Focused mitigation strategies must address
personnel access so that the likelihood of an intentional contamination
at this step is significantly reduced or eliminated. By implementing
these focused mitigation strategies, the facility could significantly
minimize the significant vulnerability identified at the actionable
process step.
    Mixing and similar activities--Blending in Facility E's dough mixer
is an actionable process step for this key activity type. Facility E
operates a dough mixer to combine several dry and liquid ingredients.
This mixer is not enclosed and is located in an open area of the
facility where it is under regular--though not dedicated--human
observation. While a batch of product is being mixed, the staff member
assigned to the mixer may leave the area to retrieve and prepare
ingredients for the next production batch. The line of sight in this
area is clear, and management in the operations control room located
above the production floor has a clear view of the mixer through an
observation window.
    The mixer is vulnerable to an attacker who could intentionally
introduce a contaminant into the food because of the open nature of the
mixer, the lack of constant and dedicated observation, and the lack of
physical access control to the area where it is located. One approach
for Facility E to significantly minimize or eliminate the significant
vulnerability at this actionable process step is to implement the
following focused mitigation strategies:
     Install a lid on the mixer that must be opened to add
anything to the mixer. If Facility E determines that it would be
disruptive to the production schedule to install a lock on the lid, the
facility could install an access alarm that would indicate that the lid
has been opened. This alarm would sound in the operation control room
where a manager supervises production operations.
     Assign another member of staff the responsibility of
preparing and securely staging ingredients for later production
batches. This would alleviate the need for the mixer operator to leave
the area, leaving the mixer unattended.
    With the introduction of these two focused mitigation strategies,
the facility would have taken steps to enclose the mixer, making it
more difficult for an attacker to introduce a contaminant without
alerting management (by the sounding of the alarm), and increased the
dedicated observation of this otherwise vulnerable process step by
ensuring that the mixer operator is not required to leave the area
unattended.
    Mixing at Facility F's rotating air dryer is another example of an
actionable process step for the key activity type ``Mixing and similar
activities.'' In Facility F, product, such as crackers or breakfast
cereals, are fed through drum-like equipment, where warm air is blown
across it while the drum rotates. Although the goal of this process is
to dry the product, it also could distribute any contaminant introduced
into the dryer evenly across the product. Facility F's rotating air
dryer is located alongside a commonly used walkway, but is behind a
guard rail to prevent employees from coming in contact with the hot
exterior of the dryer. Product is fed into the top of the dryer via a
pneumatic conveyor. There is sufficient space between the dryer opening
and the pneumatic conveyor discharge to enable an attacker to introduce
a contaminant to the dryer at this point. That opening is about six
feet above the ground, accessible from the floor of the facility.
Product leaves the dryer through a gravity fed line. The connection
between the dryer and the discharge line is sealed.
    To goal of focused mitigation strategies at this actionable process
step would be to reduce access to this equipment to significantly
reduce the likelihood an attacker could introduce a contaminant into
the rotating air dryer. One way Facility F could do this would be to
install a clear plastic shield that would be affixed to and extend from
the discharge of the pneumatic conveyor to the opening of the dryer
where it would also be tightly affixed to the housing of the dryer. A
clear plastic shield would enable workers to supervise the product flow
into the dryer while posing as an effective barrier to an attacker
wishing to introduce a contaminant into the product at the dryer. This
engineering improvement would significantly minimize or eliminate
access to the food in the dryer and thereby significantly reduce or
eliminate the likelihood of a successful act of intentional
adulteration at this process step. The installation of physical
barriers to access of equipment at actionable process steps can be one
of the most effective focused mitigation strategies because it does not
require restricting personnel or maintaining active observation of an
area. The implementation of this engineering improvement would be
detailed in the facility's food defense plan.
    c. Proposed Sec.  121.135(a)--Requirement to identify and implement
focused mitigation strategies for actionable process steps. Proposed
Sec.  121.135(a) would require that the owner, operator, or agent in
charge of a facility identify and implement focused mitigation
strategies at each actionable process step to provide assurances that
the significant vulnerability at each step will be significantly
minimized or prevented and the food manufactured, processed, packed or
held by such facility will not be adulterated under section 402 of the
FD&C Act. Under Sec.  121.135, we are proposing that, for each of the
identified actionable process steps, the owner, operator, or agent in
charge of a facility covered by this rule identify and implement
focused mitigation strategies. Focused mitigation strategies would be
required only for actionable process steps.
    Because a focused mitigation strategy that would be necessary at an
actionable process step must be tailored to address the significant
vulnerability applicable to the specific actionable process step, we
are not proposing to specify the particular focused mitigation
strategies that would be appropriate. Rather, we expect the owner,
operator, or agent in charge of the facility covered by this

rule to identify the specific focused mitigation strategy(s) that would
be appropriate, considering the facility and food it produces, and to
ensure the proper implementation of those strategies to provide
assurances that the significant vulnerability at each identified
actionable process step is significantly minimized or prevented and the
food is not adulterated. In section V.C.3.b of this document, we list
examples of focused mitigation strategies and describe scenarios for
determining appropriate focused mitigation strategies at actionable
process steps for each of the FDA-identified key activity types.
    A facility would have the flexibility to identify and implement
focused mitigation strategies from among all procedures, practices, and
processes available to the facility that would provide the assurances
that would be required by proposed Sec.  121.135. The flexibility
provided under this proposed provision acknowledges the existing
expertise within the food industry in this regard, and recognizes the
complex and varied nature of operations in food facilities.
Additionally, to the extent facilities may already be engaging in
practices that constitute focused mitigation strategies, facilities
should consider whether those measures satisfy the requirements of
proposed Sec.  121.135, such that the implementation of additional
focused mitigation strategies may not be necessary. (Note that
associated requirements, such as monitoring and verification, would
apply).
    FDA's existing guidance documents and other resources (discussed in
section II.D of this document) include guidance for industry on a range
of focused mitigation strategies. In particular, the MSD includes a
list of mitigation strategies that can be applied to different steps in
a food operation to reduce the risk of intentional adulteration. The
database is searchable by key words and processing steps common to food
operations (e.g., packing, manufacturing, processing and holding).
    Proposed Sec.  121.135(a) implements the provisions in sections
418(c)(2) and 420(b)(2) of the FD&C Act. FDA requests comments on our
analysis and proposed provisions related to mitigation strategies
necessary to protect against intentional adulteration of food caused by
acts of terrorism. We also seek input on whether and, to what extent,
facilities currently employ broad mitigation strategies and focused
mitigation strategies.
    d. Proposed Sec.  121.135(b)--Requirement for written focused
mitigation strategies. Proposed Sec.  121.135(b) would require that
focused mitigation strategies for actionable process steps be written.
The focused mitigation strategy(ies) selected for each actionable
process step identified in accordance with proposed Sec.  121.130, and
a justification for how the strategy significantly reduces or
eliminates the risk of intentional adulteration at that actionable
process step(s) must be documented. Similar to preventive controls in a
food safety plan, written focused mitigation strategies in a food
defense plan are essential for the facility to implement the focused
mitigation strategies consistently, and essential for the facility and
inspectors. Written focused mitigation strategies also would be
essential for training purposes and during reanalysis and updates of
the focused mitigation strategies.
    Proposed Sec.  121.135(b) implements the provisions in sections
418(h) and 420(b)(2) of the FD&C Act.
    e. Proposed Sec.  121.135(c)--Applicability of monitoring,
corrective actions, and verification. Proposed Sec.  121.135(c) would
specify that the focused mitigation strategies required under this
section would be subject to monitoring as would be required by proposed
Sec.  121.140; corrective actions as would be required by proposed
Sec.  121.145; and verification as would be required by proposed Sec.
121.150. Proposed Sec.  121.135(c)(1) through (c)(3) would restate the
requirements of proposed Sec. Sec.  121.140, 121.145, and 121.150 to
clearly communicate the applicability of proposed Sec. Sec.  121.140,
121.145, and 121.150 to the focused mitigation strategies that would be
required under proposed Sec.  121.135 and would establish no new
requirements.
4. Monitoring
    a. General description of monitoring. Proposed Sec.  121.3 would
define ``monitor'' to mean ``to conduct a planned sequence of
observations or measurements to assess whether focused mitigation
strategies are consistently applied and to produce an accurate record
for use in verification.'' In developing the proposed monitoring
requirements related to food defense, we considered our proposed
monitoring requirements related to food safety, which are described in
section XII.E of the PC proposed rule. For the same reasons outlined in
the PC proposed rule, we have tentatively concluded that monitoring is
necessary to establish the performance of the implementation of the
focused mitigation strategies. The proposed provisions in Sec.  121.140
implement section 418(h) of the FD&C Act.
    b. Proposed Sec.  121.140(a)--Requirement for written procedures
for monitoring. Proposed Sec.  121.140(a) would require that the owner,
operator, or agent in charge of a facility establish and implement
written procedures, including the frequency with which they are to be
performed, for monitoring the focused mitigation strategies. Monitoring
the performance of focused mitigation strategies at specified
frequencies would facilitate tracking the implementation of the focused
mitigation strategies to provide assurance that they are consistently
applied in a facility covered by this rule. If monitoring shows that a
focused mitigation strategy is frequently not implemented, a facility
can consider whether another focused mitigation strategy would be more
appropriate. For example, if an ingredient storeroom door is to be kept
locked when not in use, but the door is frequently left unlocked
because access to the room is needed for other purposes, the facility
may replace the previous focused mitigation strategy with video
monitoring. Further, if monitoring is conducted with sufficient
frequency, it will detect if a focused mitigation strategy is not
properly implemented (e.g., if access to a particular area of a
facility is not being appropriately restricted or a bulk liquid tank is
not being visually inspected prior to filling), indicating a problem
and signaling the need for an appropriate corrective action. In
addition, the proposed monitoring requirement would result in written
documentation for use in verification.
    c. Proposed Sec.  121.140(b)--Frequency of monitoring. Proposed
Sec.  121.140(b) would require that the owner, operator, or agent in
charge of a facility monitor the focused mitigation strategies with
sufficient frequency to provide assurances that they are consistently
applied. Proposed Sec.  121.140(b) does not specify a single monitoring
frequency applicable to all facilities and processes. Rather, it
requires monitoring with ``sufficient frequency'' to ensure that the
focused mitigation strategies are consistently applied in a facility
covered by this rule. We note that for food defense that many focused
mitigation strategies may be monitored over longer timeframes (non-
continuous monitoring) than preventive controls for food safety, which
are often monitored continuously. In large part preventive controls for
food safety are monitored continuously because they relate to physical
or chemical parameters of the process, such as the temperature of a
pasteurizer, which both lend themselves

to continuous monitoring and necessitate that level of monitoring to
ensure that the process is under control. As discussed in greater
detail in section V.C.3 of this document, most focused mitigation
strategies for food defense are not related to physical or chemical
parameters of the process. They tend to have more in common with
sanitation preventive controls for food safety in that they relate to
conditions around the food process, such as access to the equipment. A
focused mitigation strategy such as ``adequate lighting at an
actionable process step'' or ``secure air vents on a cooling tank with
one-way valves'' would not require continuous monitoring. Management
may choose to monitor lighting on a weekly basis to ensure that
everything is working properly and monitoring of the security of air
vents with one-way valves on a cooling tank might be done monthly.
Frequency is not prescribed in this proposed rule. More frequent (e.g.,
daily) monitoring would be appropriate for mitigation strategies that
relate to conditions or practices that are more likely to change more
rapidly, such as keeping the access door to an actionable process step
closed when not in use or ensuring that employees with color coded
uniforms are staying in the areas designated by the color code.
    d. Proposed Sec.  121.140(c)--Requirement for records. To implement
section 418(g) of the FD&C Act, proposed Sec.  121.140(c) would require
that all monitoring of focused mitigation strategies in accordance with
this section must be documented in records that are subject to
verification in accordance with Sec.  121.150(a) and records review in
accordance with proposed Sec.  121.150(c).
    The monitoring records would be used to verify that the focused
mitigation strategies are being monitored, as would be required by
proposed Sec.  121.150(a), and to verify that the focused mitigations
strategies are consistently implemented and are effective at
significantly minimizing or preventing the significant vulnerabilities,
as would be required by proposed Sec.  121.150(c). Further, they are
necessary to facilitate regulatory review of the system of controls.
Together, proposed Sec. Sec.  121.140(a), (b), and (c) and 121.150(a),
(c), and (e) would establish a system that would provide assurances
that the significant vulnerabilities identified for a food operation
are being significantly minimized or prevented.
5. Corrective Actions
    a. General description of corrective actions. When a HACCP-type
system is applied to ensure food safety, the term ``corrective
actions'' is used to describe procedures that are in place to correct
the cause of a deviation to ensure that a critical control point is
under control and to ensure that the product produced under that
deviation is safe, since total adherence to a planned process may not
always occur. This concept is discussed in detail in section XII.F of
the PC proposed rule.
    This same concept can be applied to the control of intentional
adulteration related to acts of terrorism. Monitoring may detect a
deviation from implementation of a focused mitigation strategy;
corrective actions are implemented to re-establish control. In
developing the proposed corrective actions requirements related to food
defense, we considered our proposed relevant requirements related to
food safety. The proposed provisions in Sec.  121.145 implement
sections 418(e), 418(h), and 420(b)(2) of the FD&C Act.
    b. Proposed Sec.  127.145(a)--Corrective action procedures.
Proposed Sec.  121.145(a)(1) would require that the owner, operator, or
agent in charge of a facility establish and implement written
corrective action procedures that must be taken if focused mitigation
strategies are not properly implemented. Having written procedures in
place would enable facilities covered by this rule to act quickly and
appropriately when focused mitigation strategies are not properly
implemented--e.g., a situation where a work station at an actionable
process step requires two staff at all times in a ``buddy system'' but
is only staffed by one person for a period of time.
    The benefits of identifying corrective action procedures before
corrective action is needed largely derive from having written
procedures. Written corrective action procedures would be essential to
the facility's management, to auditors, and to inspectors. The
facility's management will be responsible for ensuring that appropriate
corrective actions are taken if focused mitigation strategies are not
properly implemented. Having access to appropriate, written corrective
action procedures determined in advance of the need for such action can
ensure that correct and complete actions are taken in a timely fashion.
Having written corrective action procedures available for auditors and
for inspectors is essential for them to assess the adequacy of the food
defense plan; the procedures a facility will use to address
implementation failures are essential to proper, consistent
implementation, and without them a complete assessment cannot be made.
Written corrective action procedures also will be useful for training
purposes, so that employees who would need to implement the corrective
action procedures will be prepared for what they would need to do.
    Proposed Sec.  121.145(a)(2) would require that corrective action
procedures describe the steps to be taken to ensure that appropriate
action is taken to identify and correct a problem with implementation
of a focused mitigation strategy to reduce the likelihood that the
problem will recur. In the previous example in which two staff are
required to be at a work station at all times, the corrective action
could be speaking with the employees to ensure they understand the
importance of remaining at the work station together, sending staff to
a refresher course on food defense awareness, and ensuring that the
supervisor knows that there must be adequate staff present on a shift
so two people can be at the work station at all times. If the problem
recurs, management may need to consider other measures for preventing
access at that process step.
    c. Proposed Sec.  121.145(b)--Documentation. Proposed Sec.
121.145(b) would require that all corrective actions taken in
accordance with this section be documented in records that are subject
to verification in accordance with proposed Sec.  121.150(b) and
records review in accordance with proposed Sec.  121.150(c). The
records that document corrective actions would be used to verify that
appropriate decisions about corrective actions are being made and
appropriate corrective actions are being taken in facilities covered by
this rule.
    d. Corrective actions proposed to be required by part 117 but not
part 121. Unlike in proposed part 117, in proposed part 121, we have
not proposed a requirement to ensure that all affected food is
evaluated for food safety if focused mitigation strategies are not
properly implemented or are found to be ineffective. An act of
intentional adulteration or attempted intentional adulteration has
historically been a rare event and, as a result, in the vast majority
of cases, the failure to properly implement a focused mitigation
strategy would not be expected to result in contaminated food. This is
because intentional adulteration requires not just the opportunity for
contamination (i.e., failure of a mitigation strategy to limit access
to an actionable process step), but also someone with intent to cause
harm at that same moment. In contrast, the failure to properly
implement a preventive control for a food safety hazard, such as proper
cook temperatures, is more likely to result in adulterated food (e.g.,
because the

pathogen reasonably likely to be present in the raw food would not be
eliminated from the food by the inadequate cooking process). However,
our decision not to propose these requirements does not absolve an
owner, operator, or agent in charge of a facility from their
responsibility to ensure that food is not adulterated. In addition,
food firms would continue to be subject to the reporting requirements
under section 417 of the FD&C Act. Moreover, the introduction or
delivery for introduction into interstate commerce of any food that is
adulterated is a prohibited act under section 301(a) of the FD&C Act.
    The PC proposed rule also contains requirements for corrective
actions that must be taken in the event of an unanticipated problem.
Unlike in proposed part 117, in proposed part 121, we are not proposing
a requirement related to unanticipated problems because we are not
aware of circumstances where this would be relevant. Because of the
nature of the focused mitigation strategies, we expect that the
outcomes of monitoring will be binary, either the focused mitigation
strategy will be in place or it will not be in place. For this reason,
we expect that corrective action plans will be straightforward, with no
provision needed for unanticipated corrective actions. This contrasts
with the circumstances of food safety preventive measures, where
controls are often more complex, presenting opportunities for a more
nuanced corrective action, which may not be possible to fully
anticipate in advance.
    We ask for comment on our rationale and tentative conclusion not to
propose these requirements.
6. Verification
    a. General description of verification. In the preventive controls
framework, ``verification'' involves activities that help determine
whether the focused mitigation strategies are valid and are implemented
according to the food defense plan. Verification includes confirming
that monitoring and corrective actions are being implemented as
planned, through review of records and periodic reanalysis of the food
defense plan. This concept as applied to food safety is discussed in
detail in section XII.G of the PC proposed rule.
    We have tentatively concluded that this same concept applies to the
control of intentional adulteration related to acts of terrorism.
Efforts must be made to ensure that the system of mitigation strategies
is in place and functioning as designed. The proposed provisions in
Sec.  121.150 implement sections 418(f) and 420(b)(2) of the FD&C Act.
    b. Proposed Sec.  121.150(a)--Verification of monitoring. Proposed
Sec.  121.150(a) would require that the owner, operator, or agent in
charge of a facility verify that monitoring is being conducted.
Verification of monitoring can be conducted in a number of ways. One
example of verification of monitoring is a periodic observation of the
monitoring activity, e.g., by a supervisor. Another example is an
independent test made by a person other than the person doing the
monitoring. For example, if a shift supervisor is assigned to check at
the end of each shift that chemicals are properly stored and secured,
another supervisor may be responsible for checking periodically (e.g.,
once a week) that this is occurring. In another example, if an alarm is
supposed to sound if a mixing tank is accessed without authorization
and the monitoring procedures provide for weekly testing of the alarm,
a supervisor may be responsible for performing the same test monthly to
ensure that the alarm and the monitoring procedure are both working
properly. Proposed Sec.  121.150(a) would not specify the verification
activities that must be conducted for monitoring. We request comment on
whether proposed Sec.  121.150(a) should do so, and if so, what
verification activities should be required.
    c. Proposed Sec.  121.150(b)--Verification of corrective actions.