[Federal Register Volume 78, Number 247 (Tuesday, December 24, 2013)]
[Proposed Rules]
[Pages 78013-78061]
From the Federal Register Online via the Government Printing Office [www.gpo.gov]
[FR Doc No: 2013-30373]
[[Page 78013]]
Vol. 78
Tuesday,
No. 247
December 24, 2013
Part III
Department of Health and Human Services
-----------------------------------------------------------------------
Food and Drug Administration
-----------------------------------------------------------------------
21 CFR Parts 16 and 121
Focused Mitigation Strategies To Protect Food Against Intentional
Adulteration; Proposed Rule
Federal Register / Vol. 78 , No. 247 / Tuesday, December 24, 2013 /
Proposed Rules
[[Page 78014]]
-----------------------------------------------------------------------
DEPARTMENT OF HEALTH AND HUMAN SERVICES
Food and Drug Administration
21 CFR Parts 16 and 121
[Docket No. FDA-2013-N-1425]
RIN 0910-AG63
Focused Mitigation Strategies To Protect Food Against Intentional
Adulteration
AGENCY: Food and Drug Administration, HHS.
ACTION: Proposed rule.
-----------------------------------------------------------------------
SUMMARY: The Food and Drug Administration (FDA or we) is proposing to
require domestic and foreign food facilities that are required to
register under the Federal Food, Drug, and Cosmetic Act (the FD&C Act)
to address hazards that may be intentionally introduced by acts of
terrorism. These food facilities would be required to identify and
implement focused mitigation strategies to significantly minimize or
prevent significant vulnerabilities identified at actionable process
steps in a food operation. FDA is proposing these requirements as part
of our implementation of the FDA Food Safety Modernization Act (FSMA).
Further, as part of the proposal, FDA discusses an approach to
addressing economically motivated intentional adulteration. We expect
the proposed rule, if finalized as proposed, would help to protect food
from intentional adulteration caused by acts of terrorism.
DATES: Submit either electronic or written comments on the proposed
rule by March 31, 2014. Submit comments on information collection
issues under the Paperwork Reduction Act of 1995 by January 23, 2014,
(see the ``Paperwork Reduction Act of 1995'' section of this document).
ADDRESSES: You may submit comments, identified by Docket No. FDA-2013-
N-1425 and/or Regulatory Information Number (RIN) 0910-AG63, by any of
the following methods, except that comments on information collection
issues under the Paperwork Reduction Act of 1995 must be submitted to
the Office of Information and Regulatory Affairs, Office of Management
and Budget (OMB) (see the ``Paperwork Reduction Act of 1995'' section
of this document).
Electronic Submissions
Submit electronic comments in the following way:
Federal eRulemaking Portal: http://www.regulations.gov.
Follow the instructions for submitting comments.
Written Submissions
Submit written submissions in the following ways:
Mail/Hand delivery/Courier (for paper or CD-ROM
submissions): Division of Dockets Management (HFA-305), Food and Drug
Administration, 5630 Fishers Lane, rm. 1061, Rockville, MD 20852.
Instructions: All submissions received must include the Agency name
and Docket No. FDA-2013-N-1425 and Regulatory Information Number (RIN)
0910-AG63 for this rulemaking. All comments received may be posted
without change to http://www.regulations.gov, including any personal
information provided. For additional information on submitting
comments, see the ``Comments'' heading of the SUPPLEMENTARY INFORMATION
section of this document.
Docket: For access to the docket to read background documents or
comments received, go to http://www.regulations.gov and insert the
docket number, found in brackets in the heading of this document, into
the ``Search'' box and follow the prompts and/or go to the Division of
Dockets Management, 5630 Fishers Lane, rm. 1061, Rockville, MD 20852.
FOR FURTHER INFORMATION CONTACT: Regarding the provisions with respect
to human food: Ryan Newkirk, Center for Food Safety and Applied
Nutrition (HFS-005), Food and Drug Administration, 5100 Paint Branch
Pkwy., College Park, MD 20740, 240-402-2428. Regarding the provisions
with respect to food for animals: Alfred Montgomery, Center for
Veterinary Medicine (HFV-200), Food and Drug Administration, 7519
Standish Pl., Rockville, MD 20855, 240-453-6836.
SUPPLEMENTARY INFORMATION:
Table of Contents
Executive Summary
Scope of Coverage of the Proposed Rule
Summary of the Major Provisions of the Proposed Rule
Costs and Benefits
I. Introduction
II. Background
A. Incidents of Intentional Adulteration of Food
B. Interagency Approach to Food Defense
C. Resources for the Food Sector
D. Outreach
E. Industry Standards
F. International Food Defense Guidelines
III. Legal Authority
A. Section 103 of FSMA
B. Section 106 of FSMA
C. Intrastate Activities
IV. Regulatory Approach
A. Framework of the Rule
B. Activities That Occur on Produce Farms
C. Transportation Carriers
D. Food for Animals
E. Acts of Disgruntled Employees, Consumers, or Competitors
F. Economically Motivated Adulteration
G. Low-Risk Activities at Farm Mixed-Type Facilities
H. Activities That Occur on Dairy Farms
I. Other Ways To Focus on Foods With a High Risk of Intentional
Adulteration Caused by Terrorism
V. The Proposal
A. Definitions
B. Exemptions
C. Food Defense Measures
D. Requirements Applying to Records That Must Be Established and
Maintained
E. Compliance
VI. Preliminary Regulatory Impact Analysis
VII. Analysis of Environmental Impact
VIII. Federalism
IX. Comments
X. References
Executive Summary
This proposed regulation implements three provisions of the Federal
Food, Drug, and Cosmetic (FD&C) Act, as amended by the FDA Food Safety
Modernization Act (FSMA), that relate to the intentional adulteration
of food. Section 418 of the FD&C Act (21 U.S.C. 350g) addresses
intentional adulteration in the context of facilities that manufacture,
process, pack, or hold food and are required to register under section
415 of the FD&C Act (21 U.S.C. 350d). Section 419 of the FD&C Act (21
U.S.C. 350h) addresses intentional adulteration in the context of
fruits and vegetables that are raw agricultural commodities. Section
420 of the FD&C Act (21 U.S.C. 350i) addresses intentional adulteration
in the context of high risk foods and exempts farms except for farms
that produce milk. FDA is implementing the intentional adulteration
provisions in sections 418, 419, and 420 of the FD&C Act in this
rulemaking.
Scope of Coverage of the Proposed Rule
The subject of this proposed rule is protection of food against
intentional adulteration caused by acts of terrorism. This proposed
rule would apply to both domestic and foreign facilities that are
required to register under section 415 of the FD&C Act. However, as
explained in the remainder of this document and shown in Diagram 1 and
Table 1, the proposed rule contains several exemptions. (The diagrams
and table below are intended to illustrate the proposed scope and
requirements of this rule, and do not include all aspects of the
proposed regulation.) These exemptions are:
The proposed rule would not apply to a qualified facility,
except that the
[[Page 78015]]
facility would be required to provide for official review, upon
request, documentation that was relied upon to demonstrate that the
facility qualifies for this exemption. As proposed, a qualified
facility would be: (1) A very small business (i.e., a business that has
less than $10,000,000 in total annual sales of food, adjusted for
inflation), or (2) a facility that meets two requirements, i.e., (a)
During the 3-year period preceding the applicable calendar year, the
average annual monetary value of the food manufactured, processed,
packed or held at such facility that is sold directly to qualified end-
users (as defined in this part) during such period exceeded the average
annual monetary value of the food sold by such facility to all other
purchasers; and (b) the average annual monetary value of all food sold
during the 3-year period preceding the applicable calendar year was
less than $500,000, adjusted for inflation.
This proposed rule would not apply to the holding of food,
except the holding of food in liquid storage tanks.
This proposed rule would not apply to the packing, re-
packing, labeling, or re-labeling of food where the container that
directly contacts the food remains intact.
This proposed rule would not apply to activities of a
facility that are subject to section 419 of the Federal Food, Drug, and
Cosmetic Act (Standards for Produce Safety).
This proposed rule would not apply with respect to
alcoholic beverages at a facility that meets certain conditions.
This proposed rule would not apply to the manufacturing,
processing, packing, or holding of food for animals other than man.
We seek comment on these exclusions and whether additional
exclusions are warranted.
BILLING CODE 4160-01-P
[[Page 78016]]
[GRAPHIC] [TIFF OMITTED] TP24DE13.026
BILLING CODE 4160-01-C
[[Page 78017]]
Table 1--Scope of Intentional Adulteration and Proposed Exclusions and
Exemptions
------------------------------------------------------------------------
Brief rationale, and
Coverage within relevant
Type of intentional scope of proposed 21 corresponding
adulteration CFR 121 section of the rule
*
------------------------------------------------------------------------
I. Types of Intentional Adulteration Considered in this Proposed
Rulemaking
------------------------------------------------------------------------
1. Acts of disgruntled Not within the scope [ssquf] Not
employees, consumers, or of intentional considered ``high
competitors intended to adulteration risk'' because not
attack the reputation of a covered under intended to cause
company, and not to cause proposed 21 CFR 121. widespread,
public health harm, significant public
although public health harm health harm.
may occur. [ssquf] See section
IV.E of this
document.
2. Economically motivated Not within the scope [ssquf] Considering
adulteration (EMA) intended of intentional addressing as part
to obtain economic gain, adulteration of hazard analysis
and not to cause public covered under in a preventive
health harm, although proposed 21 CFR 121. controls framework
public health harm may where EMA is
occur. ``reasonably likely
to occur.''
[ssquf] See section
IV.F of this
document.
3. Acts intended to cause Covered within [ssquf] Considered
massive public health harm, scope, and is the ``high risk''
including acts of terrorism. focus of proposed because intent of
21 CFR 121. the act is to cause
widespread,
significant public
health harm.
[ssquf] See section
IV.A of this
document.
------------------------------------------------------------------------
II. Facilities or Operations Excluded or Exempted from Proposed 21 CFR
121
------------------------------------------------------------------------
Facility or Operation Exclusion or Brief rationale, and
Exemption (and any relevant
associated modified corresponding
requirements) section of the rule
*
------------------------------------------------------------------------
Activities that fall within Excluded............ [ssquf] Activities
the definition of ``farm'' that occur on
(as defined in 21 CFR Sec. produce farms are
1.227). not considered
``high risk.''
[ssquf] Activities
that occur on dairy
farms are addressed
below.
[ssquf] Activities
that occur on other
farms are outside
the scope of 103,
105, and 106 of
FSMA.
[ssquf] See section
IV.B of this
document.
Transportation carriers..... Excluded............ [ssquf]
Transportation of
bulk liquids is
addressed by
coverage of
shippers and
receivers.
[ssquf] Other
transportation
activities are not
considered ``high
risk.''
[ssquf] See section
IV.C of this
document.
------------------------------------------------------------------------
Activities that occur on [ssquf] Fluid milk storage and loading
dairy farms. appear to pose a significant
vulnerability.
[ssquf] We seek comment on practical and
effective approach to address this
vulnerability.
[ssquf] See section IV.H of this document.
------------------------------------------------------------------------
Qualified facility, as Exempt, except must [ssquf] Very small
defined in proposed Sec. provide for FDA businesses are not
121.3. review, upon considered ``high
request, risk.''
documentation [ssquf] See section
relied on to V.B.1 of this
demonstrate that document.
the facility
qualifies for this
exemption.
Holding of food, except the Exempt.............. [ssquf] Not
holding of food in liquid considered ``high
storage tanks. risk'' because
these activities do
not fit within any
of the FDA-
identified key
activity types.
[ssquf] See section
V.B.2 of this
document.
------------------------------------------------------------------------
Packing, re-packing, Exempt.............. [ssquf] Not
labeling, or re-labeling of considered ``high
food where the container risk'' because
that directly contacts the these activities do
food remains intact. not fit within any
of the FDA-
identified key
activity types.
[ssquf] See section
V.B.3 of this
document.
Activities of a facility Exempt.............. [ssquf] Activities
that are subject to that occur on
Standards for Produce produce farms are
Safety (proposed 21 CFR not considered
112). ``high risk.''
[ssquf] See section
V.B.4 of this
document.
Alcoholic beverages at Exempt.............. [ssquf] Alcoholic
certain alcohol-related beverages at these
facilities, and certain facilities are
prepackaged food sold in outside the scope
limited quantities along of 103, 105, and
with alcoholic beverages at 106 of FSMA.
the same facilities (see [ssquf] See section
proposed Sec. 121.5(e)). V.B.5 of this
document.
Manufacturing, processing, Exempt.............. [ssquf] Not
packing, or holding of food considered ``high
for animals. risk'' because
unlikely to impact
human health.
[ssquf] See section
V.B.6 of this
document.
------------------------------------------------------------------------
* Please see the corresponding sections of the rule identified in the
column for a complete discussion of our analysis, rationale, and
tentative conclusions related to the proposed exclusions or exemption.
[[Page 78018]]
Summary of the Major Provisions of the Proposed Rule
This proposed rule would establish various food defense measures
that an owner, operator, or agent in charge of a facility would be
required to implement to protect against the intentional adulteration
of food, as summarized in Diagram 2. Specifically:
Prepare and implement a written food defense plan that
includes actionable process steps, focused mitigation strategies, and
procedures for monitoring, corrective actions, and verification
(proposed Sec. 121.126).
Identify any actionable process steps, using one of two
procedures. FDA has analyzed vulnerability assessments conducted using
the CARVER+Shock methodology and identified four key activity types:
Bulk liquid receiving and loading; Liquid storage and handling;
Secondary ingredient handling; and Mixing and similar activities. FDA
has determined that the presence of one or more of these key activity
types at a process step (e.g., manufacturing, processing, packing, or
holding of food) indicates a significant vulnerability under section
418 of the FD&C Act and that the food is at high risk of intentional
adulteration caused by acts of terrorism under section 420 of the FD&C
Act. Facilities may identify actionable process steps using the FDA-
identified key activity types as described in proposed Sec. 121.130(a)
or conduct their own facility-specific vulnerability assessments as
provided in proposed Sec. 121.130(b).
Identify and implement focused mitigation strategies at
each actionable process step to provide assurances that the significant
vulnerability at each step will be significantly minimized or prevented
and the food manufactured, processed, packed, or held by the facility
will not be adulterated (proposed Sec. 121.135).
Establish and implement procedures, including the
frequency with which they are to be performed, for monitoring the
focused mitigation strategies (proposed Sec. 121.140).
Establish and implement corrective action procedures that
must be taken if focused mitigation strategies are not properly
implemented (proposed Sec. 121.145).
Verify that monitoring is being conducted and appropriate
decisions about corrective actions are being made; verify that the
focused mitigation strategies are consistently implemented and are
effectively and significantly minimizing or preventing the significant
vulnerabilities; and conduct a reanalysis of the food defense plan
(proposed Sec. 121.150).
Ensure that personnel and supervisors assigned to
actionable process steps receive appropriate training in food defense
awareness and their respective responsibilities in implementing focused
mitigation strategies (proposed Sec. 121.160).
Establish and maintain certain records, including the
written food defense plan; written identification of actionable process
steps and the assessment leading to that identification; written
focused mitigation strategies; written procedures for monitoring,
corrective actions, and verification; and documentation related to
training of personnel (proposed Sec. Sec. 121.301 to 121.325).
As proposed, the effective date is 60 days after a final rule is
published. However, we are providing for a longer timeline for
facilities to come into compliance. Facilities, other than small and
very small businesses, would have one year after the effective date to
comply with proposed part 121. Small businesses (i.e., those employing
fewer than 500 persons) would have 2 years after the effective date to
comply with proposed part 121. Very small businesses (i.e., businesses
that have less than $10,000,000 in total annual sales of food, adjusted
for inflation) would be considered a qualified facility and would have
3 years after the effective date to comply with proposed Sec.
121.5(a).
BILLING CODE 4160-01-P
[[Page 78019]]
[GRAPHIC] [TIFF OMITTED] TP24DE13.027
BILLING CODE 4160-01-C
[[Page 78020]]
In addition, we describe our current thinking and seek comment on
other issues, including activities that occur on dairy farms and
economically motivated adulteration. Finally, elsewhere in this issue
of the Federal Register, FDA is publishing for comment its evaluation
that identifies low-risk activities that occur at farm mixed-type
facilities, with a specific focus on the risk presented by hazards that
may be intentionally introduced by acts of terrorism.
Costs and Benefits
As described in the Preliminary Regulatory Impact Analysis (PRIA),
we estimate the annualized costs of the actions required by this
proposed rule to be about $370 million. The benefits of these actions
are a reduction in the possibility of illness, death, and economic
disruption resulting from intentional adulteration of food. We are
unable to quantify these benefits. However, we monetize the damage that
various intentional adulteration scenarios might cause, and present a
breakeven analysis showing the number of prevented attacks at which the
benefits are larger than the costs.
Annualized Cost and Benefit Overview
------------------------------------------------------------------------
All numbers are USD millions,
annualized over 10 years 3% discount 7% discount
------------------------------------------------------------------------
Costs:
Learning about Rule............. $3 $3
Mitigation Costs................ 59 63
Monitoring and Corrective Action 100 100
Employee Training............... 4 5
Documentation................... 6 6
-----------------------------------
Subtotal (Domestic cost).... 172 177
Cost to Foreign Firms........... 185 190
-----------------------------------
Total....................... 357 367
-----------------------------------
Benefits: Lower Chance of
Intentional Adulteration........... Unquantified.
------------------------------------------------------------------------
I. Introduction
The FDA Food Safety Modernization Act (FSMA) (Pub. L. 111-353),
signed into law on January 4, 2011, enables FDA to better protect
public health by helping to ensure the safety and security of the food
supply. FSMA enables us to focus more on preventing food safety
problems rather than primarily reacting to problems after they occur.
The law also provides us with new enforcement authorities to help us
achieve higher rates of compliance with prevention- and risk-based
safety standards and to better respond to and contain problems when
they do occur. In addition, the law gives us important new tools to
better ensure the safety of imported foods and directs us to build an
integrated national food safety system in partnership with State,
local, tribal, and territorial authorities.
Section 103 of FSMA directs FDA to issue regulations establishing
requirements for facilities that manufacture, process, pack or hold
food and requires facilities to consider hazards that may be
intentionally introduced, including by acts of terrorism. Section 106
of FSMA requires FDA to issue regulations to protect food for which
there is a high risk of intentional contamination and for which such
intentional contamination could cause serious adverse health
consequences or death to humans or animals. In addition, section 105 of
FSMA directs FDA to issue regulations setting forth science-based
minimum standards for the safe production and harvesting of produce,
and requires that the rulemaking consider hazards that may be
intentionally introduced, including by acts of terrorism.
Efforts to protect against intentional adulteration require a shift
in perspective from that applied to traditional food safety. In
proposed rules entitled ``Current Good Manufacturing Practice and
Hazard Analysis and Risk-Based Preventive Controls for Human Food'' (78
FR 3646, January 16, 2013) (Docket No. FDA-2011-N-0920; hereafter
referred to as ``the PC proposed rule''), ``Current Good Manufacturing
Practice and Hazard Analysis and Risk-Based Preventive Controls for
Food for Animals'' (78 FR 64736, October 29, 2013) (Docket No. FDA-
2011-N-0922; hereafter referred to as ``the Animal Food PC proposed
rule''), and ``Standards for the Growing, Harvesting, Packing and
Holding of Produce for Human Consumption'' (78 FR 3504, January 16,
2013) (Docket No. FDA-2011-N-0921; hereafter referred to as ``the
Produce Safety proposed rule''), FDA tentatively decided not to include
requirements to address ``hazards that may be intentionally introduced,
including by acts of terrorism'' (sections 418(b)(2) and 419(a)(3)(C)
of the FD&C Act (21 U.S.C. 350g(b)(2) and 350h(a)(3)(C))) and to
implement sections 103 and 105 of FSMA regarding such hazards in a
separate rulemaking (this proposed rule). As noted in those proposed
rules, FDA tentatively concluded that intentional adulteration, which
is not addressed by traditional Hazard Analysis and Critical Controls
Point (HACCP) or other food safety systems, likely will require
different kinds of controls. FDA is taking the action described in this
proposed rule to implement the intentional adulteration provisions in
sections 103, 105, and 106 of FSMA.
II. Background
Intentional adulteration of the food supply can result in
catastrophic public health consequences, widespread public fear, loss
of public confidence in the safety of food and the ability of
government to ensure food safety, and significant adverse economic
impacts, including disruption of trade (Ref. 1, Ref. 2, Ref. 3, Ref.
4). Acts of intentional adulteration may take several forms, including
acts of terrorism; acts of disgruntled employees, consumers, or
competitors; and economically motivated adulteration. Acts of terrorism
are associated with an intent to cause massive public health harm and,
to a lesser extent, economic disruption (Ref. 5, Ref. 2, Ref. 3, Ref.
6). Acts of disgruntled employees, consumers, or competitors are
generally understood to be directed at attacking the reputation of the
company and not at public health harm. The primary purpose of
economically motivated adulteration is to obtain economic gain, and not
to impact public health (Ref. 7, Ref. 8, Ref. 9), although public
health harm may occur (Ref. 10, Ref. 11).
[[Page 78021]]
``Food defense'' and ``food security'' are terms that are sometimes
used interchangeably. We use the term ``food defense'' to refer to the
effort to protect food from acts of intentional adulteration where
there is an intent to cause public health harm and economic disruption.
``Food security'' is defined by the World Health Organization (WHO) to
mean ``when all people at all times have access to sufficient, safe,
nutritious food to maintain a healthy and active life'' (Ref. 12). To
avoid confusion, we use the term ``food defense'' and not the term
``food security'' in the context of intentional adulteration.
A. Incidents of Intentional Adulteration of Food
Several cases of intentional adulteration with the intent to cause
public health harm and economic disruption in the United States have
been documented. For example, in 1984, in an attempt to prevent the
general public from voting in the local elections, members of a local
religious commune in The Dalles, OR, intentionally contaminated food in
restaurants with Salmonella. A total of 751 people became ill and 45
were hospitalized (Ref. 4). In another incident, in 1996, 12 laboratory
workers at a large medical facility in Texas became ill from consuming
anonymously donated pastries that were intentionally contaminated with
Shigella dysenteriae type 2, which was later discovered to have
originated from the facility's stock culture (Ref. 13). In 2009, two
related incidents resulted in 49 individuals reporting rapid and acute
onset of gastrointestinal and neurological symptoms after eating meals
at a restaurant in Lenexa, KS. Investigations concluded that the
illnesses were caused by methomyl (an insecticide) poisoning associated
with the consumption of salsa at the restaurant. Two former employees
of the restaurant were found guilty of intentionally contaminating the
salsa (Ref. 14).
A widespread incident of economically motivated adulteration
occurred in China in 2008. Some Chinese milk firms added melamine, a
nitrogen-rich industrial by-product, to diluted dairy products to
increase the apparent protein content. This adulteration resulted in
significant public health consequences, with more than 290,000 ill
infants and 6 deaths in China. In addition, this incident caused
significant economic disruption within the Chinese dairy industry, with
estimates approaching $3 billion in loss to industry (Ref. 10, Ref.
11).
B. Interagency Approach to Food Defense
1. Homeland Security Presidential Directives and Presidential Policy
Directives for the Food and Agriculture Sector
Intelligence gathered since the attacks on the United States on
September 11, 2001, indicates that terrorist organizations have
discussed contamination of the food supply as a means to harm U.S.
citizens and disrupt the global economy (Ref. 15). In response, FDA,
along with the Centers for Disease Control and Prevention (CDC), the
United States Department of Agriculture (USDA), the Department of
Homeland Security (DHS), the Federal Bureau of Investigation (FBI), the
Environmental Protection Agency (EPA), the Department of Defense, the
Department of Energy, the Department of Commerce, and the Department of
the Interior, as well as with State, local, tribal, territorial, and
private sector partners have coordinated efforts to prevent, prepare
for, and respond to threats against the food supply. Many of these
efforts were accomplished in accordance with applicable Homeland
Security Presidential Directives (HSPD), specifically HSPD-7, HSPD-8,
and HSPD-9, and Presidential Policy Directives (PPD), specifically PPD-
8 and PPD-21 (Ref. 16, Ref. 17, Ref. 18, Ref. 19, Ref. 20). In
accordance with these directives, FDA, USDA, DHS, State and local
governments and the food industry collaborated to conduct vulnerability
assessments of a variety of products and processes within the food and
agriculture sector.
2. The Evolution of Vulnerability Assessments
Initially, FDA used Operational Risk Management (ORM), which is a
vulnerability assessment methodology that uses a six-step sequence of
identifying hazards and reducing the potential for negative public
health consequences. The ORM process resulted in three main outcomes:
(1) A calculation of risk by combining assessments of severity and
probability of an attack on a specific food; (2) calculations for
specific contaminants and specific food processes or related
activities; and (3) a categorization of specific food/contaminant/food
process or related activity into a high, medium, or low risk scheme.
At first, ORM-based assessments were focused on reducing large
public health consequences of attacks on the food supply. FDA realized
that other significant considerations (i.e., large economic
disruptions, public alarm, loss of confidence in the food supply, and
interruption of the food stream) warranted incorporation into the
vulnerability assessment calculus. To incorporate these considerations,
FDA and USDA's Food Safety and Inspection Service (FSIS) adapted a
military targeting tool known as CARVER to assess vulnerabilities of
the food and agriculture sector. CARVER is an acronym for the following
six attributes used to evaluate the attractiveness of a target for
attack:
Criticality--measure of public health and economic impacts
of an attack;
Accessibility--ability to physically access and egress
from target;
Recuperability--ability of a system to recover from an
attack;
Vulnerability--ease of accomplishing an attack;
Effect--amount of direct loss from an attack as measured
by loss in production; and
Recognizability--ease of identifying a target.
A seventh attribute, ``Shock'', was added to the original six
attributes to assess the combined health, economic, and psychological
impacts of an attack on the food industry. ORM and CARVER+Shock
assessment conclusions were consistent; however, the CARVER+Shock
methodology improved vulnerability assessment efforts because its
process allowed for the identification and estimation of economic and
psychological impacts throughout the food system.
In 2005, the Strategic Partnership Program Agroterrorism (SPPA), a
public-private cooperative effort was established by FDA, USDA, FBI,
and DHS, in partnership with State and industry partners. The intent of
the SPPA Initiative was to collect the necessary data to identify food
and agriculture sector-specific vulnerabilities using the CARVER+Shock
method, develop mitigation strategies, identify research gaps, and
increase coordination between government and industry partners. The
SPPA initiative ran from 2005 to 2008, resulting in vulnerability
assessments of 36 food products and processes (Ref. 21). The SPPA
Initiative was a significant step towards identifying vulnerabilities,
mitigation strategies, and research needs within the food and
agriculture industries. This initiative also provided Federal, State,
and local government agencies with an in-depth look at the
vulnerabilities that may be associated with the food and agriculture
industry, and helped enhance communication among industry, government,
and law enforcement
[[Page 78022]]
stakeholders concerned with the protection of the U.S. food supply.
Since the conclusion of the SPPA Initiative, we have conducted
additional vulnerability assessments, which continue to help inform our
research and policy.
C. Resources for the Food Sector
FDA has issued guidance documents and developed other resources to
assist industry in their efforts to protect the food supply against
intentional adulteration. In 2003, FDA issued five guidance documents
covering food defense preventive measures for various segments of the
food and cosmetic industry: (1) Guidance for Industry: Food Producers,
Processors, and Transporters: Food Security Preventive Measures
Guidance (Ref. 22); (2) Guidance for Industry: Importers and Filers:
Food Security Preventive Measures Guidance (Ref. 23); (3) Guidance for
Industry: Dairy Farms, Bulk Milk Transporters, Bulk Milk Transfer
Stations and Fluid Milk Processors: Food Security Preventive Measures
Guidance (Ref. 24); (4) Retail Food Stores and Food Service
Establishments: Food Security Preventive Measures Guidance (Ref. 25);
and(5) Cosmetics Processors and Transporters of Cosmetics Security
Preventive Measures Guidance (Ref. 26). These guidance documents
provide FDA's recommendations for best practices in food defense, and
describe preventive measures that establishments can take to minimize
the risk of intentional adulteration of food. We updated the guidance
documents in 2007 to include a self-assessment tool that guides the
user through an assessment of recommended preventive measures to
identify those most applicable to the facility.
FDA also has made available other resources to help industry
identify and mitigate potential vulnerabilities for intentional
adulteration. These include:
The ``ALERT'' program,
The ``Employees FIRST'' training tool,
The ``CARVER+Shock Vulnerability Assessment'' software
tool,
The ``Mitigations Strategies Database,''
The ``Food Defense Plan Builder'' software tool,
The Food Related Emergency Exercise Bundle, and
The ``Food Defense 101'' training courses.
We describe each briefly in this section of the document.
The ALERT program, originally released in 2006, is an educational
program intended to raise the awareness of State and local governments
and industry regarding food defense (Ref. 27). ALERT identifies five
key elements that industry can use in food defense planning:
A--How do you ASSURE that the supplies and ingredients you
use are from safe and secure sources?
L--How do you LOOK after the security of the products and
ingredients in your facility?
E--What do you know about your EMPLOYEES and people coming
in and out of your facility?
R--Could you provide REPORTS about the security of your
products while under your control?
T--What do you do and who do you notify if you have a
THREAT or issue at your facility, including suspicious behavior?
Similarly, the Employees FIRST educational tool, originally
released in 2008, is a food defense awareness training program for
front-line food industry workers about the risk of intentional
adulteration and the actions they can take to identify and reduce these
risks (Ref. 28). This tool identifies the following five key elements:
F--Follow company food defense plan and procedures;
I--Inspect your work area and surrounding areas;
R--Recognize anything out of the ordinary;
S--Secure all ingredients, supplies, and finished product;
and
T--Tell management if you notice anything unusual or
suspicious.
The CARVER+Shock Vulnerability Assessment software tool, originally
released in 2007, helps users conduct vulnerability assessments for
their establishments to identify and prioritize the ``critical nodes,''
(also known as critical process steps) the potential targets vulnerable
to intentional adulteration attacks (Ref. 29). It guides users through
a series of questions to determine the vulnerability of each of the
nodes within their facility. After the vulnerabilities are identified,
the software helps users to identify mitigation strategies for reducing
the risk of intentional adulteration. Using the software tool, the user
can focus resources on protecting the most susceptible points in their
system.
The Mitigation Strategies Database (MSD), originally released in
2011, is a database of mitigation strategies that can be applied to
different steps in a food operation to reduce the risk of intentional
adulteration (Ref. 30). The database is searchable by key words and
processing steps common to agriculture and food operations (e.g.,
growing, harvesting, packing, manufacturing, processing, and holding).
See also the discussion in section V.C.3 of this document.
The Food Defense Plan Builder (FDPB) software tool, released in
2013, is a user-friendly computer software program designed to assist
owners and operators of food facilities in developing food defense
plans for their facilities (Ref. 31). In addition to providing new
functionality for food defense planning and implementation, the FDPB
software tool harnesses our food defense guidance documents,
CARVER+Shock Vulnerability Assessment software tool, and the MSD into a
single application.
The Food Related Emergency Exercise Bundle (FREE-B), which FDA
released in 2011 and developed in collaboration with CDC and FSIS and
USDA's Animal and Plant Health Inspection Service (APHIS), is a
compilation of scenarios based on both intentional and unintentional
food contamination events. The FREE-B is designed to assist the food
industry, government regulatory agencies, and public health
organizations in assessing existing food emergency response plans,
protocols, and procedures (Ref. 32). The FREE-B tool is designed to
allow an individual agency or industry entity to test its own plans,
protocols, and procedures independently. Additionally, the tool allows
multiple jurisdictions and organizations (e.g., medical community,
private sector, law enforcement, and first responder communities) to
jointly conduct exercises. The tool is a set of five scenarios, each of
which contains a Facilitator's Guide, a Lead Planner's guide, and a
Situation Manual.
Finally, our food defense training courses, entitled ``Food Defense
101'' and released in 2013, reflect FDA's current thinking on how to
minimize the likelihood and impact of incidents of intentional
adulteration (Ref. 27). Four courses integrated into one module
include: (1) Food Defense Awareness for Professionals, (2) Food Defense
Awareness for Frontline Employees, (3) FDA Regulations, and (4) ALERT
for owners and operators of food facilities. The ALERT program is
described previously. The other programs are described in section V.C.7
of this document.
D. Outreach
We have conducted food defense awareness outreach to international
and domestic stakeholders. Beginning in 2008, under the auspices of the
Asia-Pacific Economic Cooperation (APEC), we collaborated with the U.S.
Department of State, USDA's Foreign Agricultural Service, and FSIS to
launch the Food Defense Pilot Program for the
[[Page 78023]]
APEC member countries. The Pilot Program was developed with the intent
to implement the food defense principles endorsed by the APEC Counter
Terrorism Task Force. The goal of the program was to build and foster
global capacity to prevent and protect against deliberate tampering and
intentional contamination of the food supply through information
sharing, outreach, and technical assistance on food defense, thereby
safeguarding food trade and public health across the APEC member
countries. In addition, to support the international capacity building
goals of FSMA, we conducted several workshops in various countries to
discuss topics such as increasing food defense awareness, developing
food defense plans, conducting vulnerability assessments, and
implementing mitigation strategies.
In 2013, we increased our domestic outreach activities with a
series of workshops in the United States. Using a similar format and
agenda as the international workshops, we conducted 1-day food defense
awareness workshops to provide industry, State and local governments,
and academic partners with information on food defense, and share tools
and resources. During these workshops, we shared information on how to
use the new FDPB software tool to develop a comprehensive food defense
plan. These workshops also served as a forum to discuss food defense
concerns, understand industry's current practices, and share ideas for
collaboration to better protect the food supply against intentional
adulteration. We plan to continue to hold additional workshops in 2014.
E. Industry Standards
Guidelines accompanying industry standards in the United States
have addressed intentional adulteration of food. For example, the
Global Food Safety Initiative's (GFSI) Guidance Document Sixth Edition
(Ref. 33) addresses food defense. Some organizations that own and
manage industry standards have worked or are working to incorporate
food defense requirements into their standards to meet this GFSI
guideline. For example, the Safe Quality Foods (SQF) Code, edition 7.1,
issued in 2013, is a process and product certification standard that
specifies various food defense elements, including that the methods,
responsibility, and criteria for preventing food adulteration caused by
a deliberate act of sabotage or terrorist-like incident shall be
documented, implemented and maintained (Ref. 34). Another example of
industry standards that incorporate food defense elements is the
International Featured Standards (IFS) Food Version 6 Standard, which
specifies that areas critical to security be identified, food defense
hazard analysis and assessment of associated risks be conducted
annually or upon changes that affect food integrity, and an appropriate
alert system be defined and periodically tested for effectiveness (Ref.
35).
F. International Food Defense Guidelines
In 2008, WHO issued its ``Terrorist Threats to Food--Guidelines for
Establishing and Strengthening Prevention and Response Systems'' to
provide policy guidance to its Member States for integrating
consideration of deliberate acts of sabotage of food into existing
prevention and response programs (Ref. 6). WHO uses the term ``food
terrorism'' and defines it as ``an act or threat of deliberate
contamination of food for human consumption with biological, chemical
and physical agents or radionuclear materials for the purpose of
causing injury or death to civilian populations and/or disrupting
social, economic or political stability.'' Focusing on the two key
strategies of prevention and response, WHO recommends that all segments
of the food industry consider the development of security and response
plans for their establishments, proportional to the threat and their
resources. The guidelines state that the key to preventing food
terrorism is enhancing existing food safety programs and implementing
reasonable security measures on the basis of vulnerability assessments.
The guidelines further state that the most vulnerable foods, food
ingredients, and food processes should be identified, including: the
most readily accessible food processes; foods that are most vulnerable
to undetected tampering; foods that are the most widely disseminated or
spread; and the least supervised food production areas and processes.
Other national governments, including Australia, China, France,
Germany, and the United Kingdom, also have issued guidelines to assist
their food industry stakeholders in protecting food against intentional
adulteration (Ref. 5, Ref. 36, Ref. 37, Ref. 38, Ref. 39).
III. Legal Authority
FDA is proposing this regulation under the FD&C Act as amended by
FSMA. Under sections 103 and 106 of FSMA, FDA is proposing the
requirements applicable to the owner, operator, or agent in charge of a
facility required to register under section 415 of the FD&C Act. Under
section 106 of FSMA, FDA is proposing the requirements applicable to
activities at some facilities not covered by section 103 of FSMA (i.e.,
activities subject to and in compliance with the juice and seafood
HACCP regulations in parts 120 and 123 (21 CFR parts 120 and 123) and
the manufacturing, processing, packing, or holding of a dietary
supplement in compliance with certain requirements). Under section
701(a) of the FD&C Act (21 U.S.C. 371(a)), FDA is authorized to issue
regulations for the efficient enforcement of the FD&C Act.
A. Section 103 of FSMA
Section 103 of FSMA, Hazard Analysis and Risk-Based Preventive
Controls, amends the FD&C Act to create a new section 418 that mandates
rulemaking. Section 418(n)(1)(A) of the FD&C Act requires that the
Secretary of Health and Human Services issue regulations ``to establish
science-based minimum standards for conducting a hazard analysis,
documenting hazards, implementing preventive controls, and documenting
the implementation of the preventive controls . . ..'' Section
418(n)(1)(B) of the FD&C Act requires that the regulations define the
terms ``small business'' and ``very small business,'' taking into
consideration the study of the food processing sector required by
section 418(l)(5) of the FD&C Act. Further, section 103(e) of FSMA
creates a new section 301(uu) in the FD&C Act (21 U.S.C. 331(uu)) to
prohibit ``[t]he operation of a facility that manufactures, processes,
packs, or holds food for sale in the United States if the owner,
operator, or agent in charge of such facility is not in compliance with
section 418 [of the FD&C Act].''
In addition to rulemaking requirements, section 418 of the FD&C Act
contains requirements applicable to the owner, operator, or agent in
charge of a facility required to register under section 415 of the FD&C
Act. Section 418(a) of the FD&C Act is a general provision that
requires the owner, operator, or agent in charge of a facility to
evaluate the hazards that could affect food manufactured, processed,
packed, or held by the facility, identify and implement preventive
controls, monitor the performance of those controls, and maintain
records of the monitoring. In addition to the general requirements in
section 418(a) of the FD&C Act, sections 418(b) to (i) of the FD&C Act
contain more specific requirements applicable to facilities, including
several provisions explicitly directed at intentional adulteration. For
example, section 418(b)(2) of the FD&C Act specifies that the owner,
operator, or
[[Page 78024]]
agent in charge of a facility shall identify and evaluate hazards that
may be intentionally introduced, including by acts of terrorism.
Section 418(c)(2) of the FD&C Act specifies that the owner, operator,
or agent in charge of a facility shall identify and implement
preventive controls to provide assurances that any hazards that relate
to intentional adulteration will be significantly minimized or
prevented and addressed, consistent with section 420 of the FD&C Act.
In sections IV and V of this document, we discuss proposed requirements
(proposed subparts C and D of part 121) that would implement these
provisions of section 418 of the FD&C Act.
Sections 418(j) to (m) of the FD&C Act and sections 103(c)(1)(D)
and (g) of FSMA provide authority for certain exemptions and
modifications to the requirements of section 418 of the FD&C Act. These
include provisions related to seafood and juice HACCP, and low-acid
canned food (section 418(j) of the FD&C Act); activities of facilities
subject to section 419 of the FD&C Act (Standards for Produce Safety)
(section 418(k)); qualified facilities (section 418(l)); facilities
that are solely engaged in the production of food for animals other
than man, the storage of raw agricultural commodities (other than
fruits and vegetables) intended for further distribution or processing,
or the storage of packaged foods that are not exposed to the
environment (section 418(m)); facilities engaged only in certain low-
risk on-farm activities on certain foods conducted by small or very
small businesses (section 103(c)(1)(D) of FSMA), and dietary
supplements (section 103(g) of FSMA). In sections IV and V of this
document, we discuss the related proposed provisions that would
implement these provisions of section 418 of the FD&C Act and section
103 of FSMA.
B. Section 106 of FSMA
Section 106 of FSMA, Protection Against Intentional Adulteration,
amends the FD&C Act to create a new section 420, which mandates
rulemaking. Section 420 of the FD&C Act requires FDA to issue
regulations to protect against the intentional adulteration of food.
Section 420(b)(1) of the FD&C Act requires that such regulations are to
specify how a person is to assess whether the person is required to
implement mitigation strategies or measures intended to protect against
the intentional adulteration of food. Section 420(b)(2) of the FD&C Act
requires that the regulations specify appropriate science--based
mitigation strategies or measures to prepare and protect the food
supply chain at specific vulnerable points, as appropriate. Section
420(c) of the FD&C Act provides that such regulations are to apply only
to food for which there is a high risk of intentional adulteration and
for which such intentional adulteration could cause serious adverse
health consequences or death to humans or animals. Section 420(c)(1)
provides that such foods are to include those for which FDA has
identified clear vulnerabilities. Section 420(d) of the FD&C Act limits
applicability on farms to farms that produce milk. Further, section
106(d) of FSMA creates a new section 301(ww) in the FD&C Act to
prohibit ``[t]he failure to comply with section 420 [of the FD&C
Act].'' We are proposing all of the provisions under section 420 of the
FD&C Act.
C. Intrastate Activities
FDA tentatively concludes that the provisions in the proposed rule
should be applicable to activities that are intrastate in character.
Facilities are required to register under section 415 of the FD&C Act
regardless of whether the food from the facility enters interstate
commerce (Sec. 1.225(b)). The plain language of section 418 of the
FD&C Act applies to facilities that are required to register under
section 415 of the FD&C Act (section 418(o)(2)) and does not exclude a
facility because food from such a facility is not in interstate
commerce. Similarly, the plain language of section 420 of the FD&C Act
requires FDA to issue regulations to protect against the intentional
adulteration of food and does not include a limitation to interstate
commerce. Further, the prohibited act provisions in sections 301(uu)
and (ww) of the FD&C Act (21 U.S.C. 331(uu) and (ww)) do not require an
interstate commerce nexus. Notably, other subsections in section 301 of
the FD&C Act, and section 304 of the FD&C Act (21 U.S.C. 334)
demonstrate that Congress has included a specific interstate commerce
nexus in the provisions of the FD&C Act when that is its intent.
Accordingly, it is reasonable to interpret sections 418, 420, 301(uu)
and (ww) of the FD&C Act as not limiting the application of the
proposed rule only to those facilities with a direct connection to
interstate commerce. However, we seek comment on this interpretation
and potential alternatives.
IV. Regulatory Approach
A. Framework of the Rule
This proposed regulation implements three provisions of FSMA that
relate to the intentional adulteration of food. Section 103 of FSMA
addresses intentional adulteration in the context of facilities that
manufacture, process, pack, or hold food and are required to register
under section 415 of the FD&C Act. Section 105 of FSMA addresses
intentional adulteration in the context of fruits and vegetables that
are raw agricultural commodities. Section 106 of FSMA addresses
intentional adulteration in the context of high risk foods and exempts
farms except for farms that produce milk.
1. Scope of Intentional Adulteration Covered by this Rule
As noted in section I of this document, acts of intentional
adulteration may take several forms, including: (1) Acts of terrorism;
(2) acts of disgruntled employees, consumers, or competitors; and (3)
economically motivated adulteration. With regard to intentional
adulteration from acts of terrorism, we are proposing to require
certain facilities covered by this rule to address significant
vulnerabilities by implementing focused mitigation strategies at
actionable process steps. While we refer to the protection of the food
supply from ``acts of terrorism'' throughout this rule, we expect our
proposed approach and the proposed implementation of focused mitigation
strategies would generally address acts intended to cause massive
public health harm and, to a lesser extent, economic disruption,
whether committed by terrorists, terrorist organizations, individuals,
or groups of individuals. For the reasons described in section IV.E of
this document, we have tentatively concluded not to propose additional
requirements for the protection of food against intentional
adulteration caused by acts of disgruntled employees, consumers, or
competitors. We describe our approach to address economically motivated
adulteration in section IV.F of this document, and seek comment on our
current thinking on this issue.
2. Identification of Key Activity Types
Terrorist attacks on the U.S. food supply have been exceedingly
rare. However, vulnerability assessments performed by FDA, USDA, DHS,
and FBI, under the SPPA Initiative (Ref. 21), show that an attack could
have devastating public health and economic consequences. Because such
an attack is a low probability but potentially exceedingly high
consequence event, we have tentatively determined that requirements
should focus on those facilities and process steps within those
facilities that pose the greatest risk. To
[[Page 78025]]
assess this risk, FDA and USDA, in collaboration with DHS, FBI, and
State and local government and industry partners, performed
vulnerability assessments using the CARVER+Shock methodology. This
methodology is specifically tailored to assess the risk of a terrorist
attack and is different from an assessment of risk posed by food safety
hazards (i.e., unintentional adulteration).
As discussed in section V.C.2 of this document, based on an
analysis of the vulnerability assessments that FDA has conducted using
the CARVER+Shock methodology, we have identified four key activity
types: Bulk liquid receiving and loading; Liquid storage and handling;
Secondary ingredient handling; and Mixing and similar activities. FDA
has tentatively determined that the presence of one or more of these
key activity types at a process step (e.g., manufacturing, processing,
packing, or holding of food) indicates a significant vulnerability
under section 418 of the FD&C Act and that the food is at high risk of
intentional adulteration caused by acts of terrorism under section 420
of the FD&C Act. We seek comment on the inclusion of these key activity
types.
Designation of these key activity types would serve two purposes.
First, it would provide a facility with a means to assess whether it is
required to implement focused mitigation strategies or measures
intended to protect against intentional adulteration under section
420(b)(1) of the FD&C Act. Second, it would assist a facility subject
to section 418 of the FD&C Act with the performance of a hazard
analysis to identify and evaluate hazards that may be intentionally
introduced by acts of terrorism, in accordance with section 418(b)(2).
Facilities would be able to determine whether their operations
involve one or more of the key activity types or choose to perform a
vulnerability assessment. Our experience is that the most challenging
part of developing a system of controls for intentional adulteration
related to terrorism is identifying the points in the food operation
that are most vulnerable to attack by performing a vulnerability
assessment. By using the FDA-identified key activity types, facilities
would be able to concentrate their efforts on the identification of
appropriate focused mitigation strategies and the development and
implementation of the HACCP-type system for ensuring that those
strategies are consistently and effectively implemented.
3. Requirement for a HACCP-Type System of Controls
We have tentatively concluded that a preventive controls approach
like the one we proposed for the systematic control of food safety
hazards in the PC proposed rule is the most effective means of ensuring
that the focused mitigation strategies are consistently applied once
the significant vulnerabilities are identified and appropriate focused
mitigation strategies are developed. The evolution and advantages of
this system, derived from the HACCP methodology, is discussed in detail
in section II.C of the PC proposed rule. The application of HACCP-type
controls for ensuring the implementation of food defense mitigation
strategies is consistent with the approach taken in Publicly Available
Specification (PAS) 96, developed by the Centre for the Protection of
National Infrastructure in collaboration with the British Standards
Institution, entitled ``The Threat Assessment Critical Control Point
(TACCP) Approach'' (Ref. 5). It is also consistent with WHO
recommendations on protection against intentional adulteration (Ref.
6). We request comment on the appropriateness of a HACCP-type system to
ensure that mitigation strategies designed to significantly minimize or
prevent intentional adulteration related to terrorism and whether there
are approaches that would be more suitable.
Section 418 of the FD&C Act exempts several kinds of activities
(e.g., those related to seafood, juice, dietary supplements, low-acid
canned food [for certain microbiological hazards]). These activities
are subject to preventive control-type regulations that address food
safety, but not food defense, concerns. Section 420 of the FD&C Act
instructs FDA to issue regulations to require that science-based
mitigation strategies or measures be applied to foods that are at high
risk of intentional adulteration. The exemptions set out in section 418
of the FD&C Act are not applicable to the provisions of section 420 of
the FD&C Act. We also have tentatively determined that some activities
that are not subject to section 418 of the FD&C Act that involve
manufacturing, processing, packing, or holding of food are likely to
involve one of the key activity types (e.g., juice manufacturing,
breaded seafood manufacturing, and mixing activity in a low-acid canned
food process). Based on our tentative conclusion that the HACCP-type
system in section 418 of the FD&C Act is generally appropriate for
application to intentional adulteration related to terrorism, this same
system would be required for these activities. Applying the same
regulatory framework under sections 418 and 420 of the FD&C Act would
facilitate a concise and consistent approach to protection against
intentional adulteration of food and the efficient enforcement of the
requirements. Further, this approach would be consistent with the
approach for unintentional adulteration that many of these facilities
(those subject to section 418 of the FD&C Act relative to the control
of food safety hazards) would already be required to take for
unintentional hazards under the PC proposed rule.
We acknowledge that regulation of entities in the food production
system (in this case, facilities) to reduce the risk of intentional
adulteration of food caused by acts of terrorism is, essentially,
without precedent. Such an endeavor is further complicated by the low
probability and potentially high impact nature of such an attack which
makes estimating potential public health benefits and establishing an
appropriate threshold for requiring action difficult. We are further
challenged by the paucity of data on the extent to which facilities
have already implemented programs to mitigate this risk, and the
effectiveness of various strategies to prevent intentional adulteration
of food caused by acts of terrorism.
In developing this proposed rule we have relied on our experience
in both implementing preventive control schemes targeting unintentional
food safety hazards as well as working with the U.S. intelligence
community on the threat of a terrorist attack on the food and
agriculture sector, including performing vulnerability assessments and
developing guidance for industry. While these activities have provided
us with a useful foundation on which to develop this proposed rule, the
challenges described previously remain. We request comment on our
proposed approach, including on the following issues:
From which entities would implementation of measures to
protect against intentional adulteration derive the greatest benefit to
public health protection? How could this proposed regulation be
modified to better target such entities?
Would it be feasible to require measures to protect
against intentional adulteration only in the event of a credible
threat? If so, would such an approach be consistent with the
intentional adulteration provisions of FSMA? How would such
requirements
[[Page 78026]]
be communicated to industry in a timely and actionable manner?
What is an appropriate level of public health protection
with respect to intentional adulteration, considering the intentional
adulteration provisions of FSMA?
Are there other ways to further focus the scope of the
rule (see also section IV.I of this document)?
4. Compliance Dates
Section 103(i)(1) of FSMA, General Rule, provides that ``[t]he
amendments made by this section shall take effect 18 months after the
date of enactment'' (i.e., by July 4, 2012). Section 103(i)(2) of FSMA,
Flexibility for Small Businesses, provides that ``[n]otwithstanding
paragraph (1),'' the amendments made by this section ``shall apply'' to
a small business and very small business beginning on the date that are
6 months and 18 months, respectively, ``after the effective date'' of
FDA's final regulation. Section 106 of FSMA does not contain similar
language. FDA is implementing the amendments made by sections 103 and
106 of FSMA to the FD&C Act, as they relate to intentional
adulteration, through this rulemaking.
We have tentatively concluded that it is appropriate to provide a
sufficient time period following publication of the final regulation
for facilities to come into compliance with proposed part 121. FDA
recognizes that it can take time to develop and implement a food
defense plan that would require, among other things, identification of
actionable process steps, implementation of focused mitigation
strategies, and monitoring of focused mitigation strategies.
FDA is proposing that the final rule would be effective 60 days
after publication in the Federal Register, with staggered compliance
dates, consistent with the proposed effective dates in the PC proposed
rule and Produce Safety proposed rule. Similarly, we recognize that
businesses of all sizes may need more time to comply with the new
requirements established under FSMA. As noted in section VII of the PC
proposed rule, FDA believes that it is reasonable to allow for 1 year
after the date of publication of the final rule for businesses other
than small and very small businesses to come into compliance with the
new requirements established under FSMA. FDA also believes that it is
reasonable to allow for 2 years after the date of publication of the
final rule for small businesses to come into compliance with the new
requirements established under FSMA, and 3 years after the date of
publication of the final rule for very small businesses to come into
compliance with the new requirements established under FSMA.
Therefore, as proposed, facilities, other than small and very small
businesses, that are subject to part 121 would have 1 year after the
effective date to comply with proposed part 121. Small businesses would
have 2 years after the effective date to comply with proposed part 121
(see section V.A of this document for a discussion of the proposed
definition of a ``small business''). With respect to very small
businesses, we are proposing to exempt qualified facilities, which
include very small businesses, from the requirements of proposed part
121, except that such facilities must, upon request, provide for
official review documentation that was relied upon to demonstrate that
the facility meets this exemption. Very small businesses then would
have 3 years after the effective date to comply with proposed Sec.
121.5(a). FDA intends to work closely with the food industry, extension
and education organizations, and State partners to develop any
necessary additional tools and training programs needed to facilitate
implementation of this rule.
B. Activities That Occur on Produce Farms
Section 419 of the FD&C Act requires FDA to issue regulations to
establish science-based minimum standards for the safe production and
harvesting of fruits and vegetables. In developing these regulations,
the Act requires us to consider, among others, those hazards that may
be intentionally introduced, including by acts of terrorism (section
419(a)(3)(C) and (c)(1)(A) of the FD&C Act). Note that neither section
418 of the FD&C Act nor section 420 of the FD&C Act apply to these
activities. Section 420 of the FD&C Act specifically exempts farms,
except those that produce milk, and section 418 of the FD&C Act exempts
activities of facilities subject to section 419 of the FD&C Act.
In implementing section 419 of the FD&C Act, we considered the
risks posed by a terrorist attack on the kinds of activities that occur
on produce farms. We considered those activities that fall within the
definition of ``farm'' (as defined in 21 CFR 1.227) (e.g., planting,
tilling, irrigating, treating with pesticides, harvesting, drying for
purposes of storing or transporting, hydro-cooling, packing,
refrigerating, waxing, shelling, sifting, removing leaves, stems and
husks, culling, shelling, and washing). We utilized data gathered from
vulnerability assessments that we conducted employing the CARVER+Shock
methodology, and evaluated whether activities that occur on produce
farms pose significant vulnerabilities (Ref. 40).
Our evaluation found that activities that are typically performed
on produce farms are at relatively low risk for intentional
adulteration of food from acts of terrorism (Ref. 40). Based on this
evaluation, we have tentatively concluded that requirements for produce
farms are not necessary to minimize the risk of serious adverse health
consequences or death from this type of adulteration. Further, we have
tentatively concluded that requirements relating to this form of
adulteration are not reasonably necessary to prevent the introduction
of known or reasonably foreseeable hazards and to provide reasonable
assurances that the produce is not adulterated under section 402 of the
FD&C Act. For these reasons, we are not proposing requirements for
produce farms to specifically address intentional adulteration related
to terrorism. We seek comment on this tentative conclusion and our
analysis that informed this tentative decision.
We acknowledge that there may be activities that occur on produce
farms for which we are not proposing requirements that are similar to
off-farm activities for which we are proposing to require the
implementation of focused mitigation strategies. However, there are
aspects of the specific on-farm activities that minimize the risk for
intentional adulteration caused by acts of terrorism. For example,
waxing is an on-farm activity that is similar to coating and that fits
within one of the key activity types. However, there are key
differences that make an on-farm waxing operation less vulnerable
compared to a coating operation. With waxing, there is difficulty of
mixing a contaminant into a clear, heated wax in a tank in close
proximity to the busy packing line in an on-farm packing house.
Conversely, a coating operation involves an opaque, ambient or
refrigerated, aqueous coating mix in a tank and occurs in a relatively
isolated part of the manufacturing plant. In addition, the uncertainty
about whether the produce leaving the farm is destined for direct
consumption or for further processing, such as removal of the wax,
which could inactivate or remove any contaminant intentionally added,
makes it a relatively less likely target for intentional adulteration.
C. Transportation Carriers
One of the key activity types that we have tentatively determined
indicates a significant vulnerability to intentional adulteration
caused by acts of terrorism
[[Page 78027]]
is Bulk liquid receiving and loading. As proposed, receiving and
loading of other types of foods (e.g., non-bulk liquids, solid foods,
gaseous foods) are not identified as key activity types because we
determined that they do not present this same level of risk. By
requiring that shippers and receivers of bulk liquids implement focused
mitigation strategies at actionable process steps involving this key
activity, as proposed in Sec. 121.135(a), we expect that shippers and
receivers will institute focused mitigation strategies that will
significantly minimize or prevent the potential for intention
adulteration of these foods during transportation. Such mitigation
strategies may include sealing or locking outbound conveyances of bulk
liquid, or requiring that inbound conveyances be sealed or locked as a
condition of receipt of the bulk liquid. Where such measures are
implemented by the shippers and receivers of bulk liquids, we have
tentatively concluded that the food would be sufficiently protected
from intentional adulteration caused by acts of terrorism, and that no
further actions by a carrier would be needed to ensure the safety of
the food. For this reason, we are not proposing to cover transportation
carriers in this proposed rule. We request comment on our analysis of
this issue, and our tentative conclusion.
Note that FDA will issue a proposed rule in the near future related
to transportation carriers and sanitary transportation practices.
D. Food for Animals
As discussed in section V.B.6 of this document, we are proposing to
exempt the manufacturing, processing, packing, and holding of animal
food from this proposed regulation with respect to intentional
adulteration caused by acts of terrorism.
E. Acts of Disgruntled Employees, Consumers, or Competitors
While the goals and outcomes of acts of disgruntled employees,
consumers or competitors can overlap with acts of terrorism, generally,
the distinction has to do with differences in scale. Disgruntled
employees are generally understood to be interested primarily in
attacking the reputation of the company, and otherwise have little
interest in public health harm. On the other hand, terrorist
organizations are generally understood to be interested in maximizing
public health harm and, to a lesser extent, economic disruption (Ref.
5, Ref. 6).
Section 420(c) of the FD&C Act requires that the regulation
prepared under that section apply to ``food for which there is a high
risk of intentional contamination.'' In the spectrum of risk associated
with intentional adulteration of food, attacks perpetrated by terrorist
organizations intent on causing massive casualties and, to a lesser
extent, economic disruption would be ranked as relatively high risk. On
the other hand, attacks by disgruntled employees, consumers, or
competitors would be consistently ranked as relatively low risk;
although these events occur annually, their public health and economic
impact would be generally quite small. In general, the target food and
the point in its production are those of convenience (i.e., a point to
which the employee, consumer, or competitor has ready access). Should a
disgruntled employee, consumer, or competitor choose to attack at an
actionable process step, where the adverse public health and economic
consequences could be greater, the provisions of this proposed rule
would be effective in minimizing the opportunity for success. Actions
taken to mitigate the potential for a terrorist attack against the food
supply are likely to have collateral benefits in reducing the potential
for an attack by a disgruntled employee, consumer, or competitor (as
well as on other security related issues, such as theft and vandalism).
As a practical matter, hardening the food supply (i.e., reducing the
opportunity for attack) to attacks by disgruntled employees, consumers,
or competitors could require taking steps at many more points in the
food system than would be required to harden the food supply to
minimize the potential for terrorist attack. We have tentatively
concluded that the latter can be accomplished by focusing on those
points in the food system where an attack would be expected to cause
massive adverse public health impact, and, to a lesser extent, economic
disruption.
F. Economically Motivated Adulteration
Efforts to protect against intentional adulteration require a shift
in perspective from that applied to traditional food safety. In the PC,
Animal Food PC, and Produce Safety proposed rules, we tentatively
concluded that hazards associated with intentional adulteration, which
are not addressed in traditional HACCP or other food safety systems,
likely will require different kinds of controls, and would be best
addressed in a separate rulemaking (this proposed rule). However, we
also explained how in some circumstances economically motivated
adulteration could be viewed as reasonably likely to occur. Further, we
requested comment on where to address those hazards that may be
intentionally introduced for economic gain. After additional
consideration, we present our current thinking in this section of the
document.
For facilities subject to section 418 of the FD&C Act, we have
tentatively concluded that economically motivated adulteration would be
best addressed under the regulatory regime described in the PC and
Animal Food PC proposed rules and thus best addressed in those
rulemakings. Before we decide to finalize provisions on economically
motivated adulteration in the PC and Animal Food PC final rules, FDA
plans to provide new language and an analysis of costs associated with
these provisions, and seek comment. Under this approach, the owner,
operator, or agent in charge of a covered facility would be required to
perform a hazard analysis to identify those hazards related to
economically motivated adulteration that are reasonably likely to
occur. Economically motivated adulteration could be reasonably likely
to occur, for example, when obtaining certain ingredients from a
country in which economically motivated adulteration has occurred in
those ingredients in the past. Because of past incidents regarding the
addition of melamine to certain food products apparently to enhance
perceived quality and/or protein content, even if there is no known
history regarding the specific supplier or the specific food product, a
prudent person would implement preventive controls to address the
potential presence of this hazard in a food. The goal of the
perpetrator of economically motivated adulteration is for the
adulterant to be undetected in the product, so that the perpetrator can
continue to obtain the desired economic benefits (Ref. 7, Ref. 9).
Accordingly, unlike with acts of terrorism, such occurrences of
economic adulteration are expected to be long term, and would not be
appropriately viewed as a rare occurrence, but rather as reasonably
likely to occur.
We have tentatively concluded that this hazard-analysis type
approach is better suited to address economically motivated
adulteration than the vulnerability assessment-type approach we are
proposing to address intentional adulteration related to terrorism. In
the latter approach, which we are not proposing, significant
vulnerabilities would be identified based either on the presence of key
activity types (which reflect FDA-conducted vulnerability assessments)
or facility-specific vulnerability assessments. Under a vulnerability
assessment-type approach,
[[Page 78028]]
the assessment would need to consider the degree to which a food is a
likely target for economically motivated adulteration based on the
attributes of the food (such as the nature of the food, its production
system, and its supply chain) and the capabilities of a perpetrator
(such as availability and access to adulterants that can be readily
disguised and undetected by currently accepted testing methods).
Factors to consider could include previous occurrences of economically
motivated adulteration; a highly complex supply chain; sudden changes
in commodity prices; known inadequacies in identification and assay
testing methods for potential adulterants; a highly complex and
variable food ingredient; the widespread availability of a potential
adulterant; the lack of organoleptic properties of a potential
adulterant; the high cost or scarcity of an ingredient; and variation
in the value of a food based on variations in levels of a high value
attribute of that food. The nature of economically motivated
adulteration makes it difficult to identify all relevant factors to be
considered in a vulnerability assessment to predict when novel events
of economic adulteration are expected to occur. Moreover, predictive
tools such as CARVER+Shock are not currently configured to assess the
risk of economically motivated adulteration, nor have extensive
vulnerability assessments for economically motivated adulteration in
food products been conducted by FDA or others. Therefore, we believe
the most appropriate framework to assess the risk of economically
motivated adulteration is to consider whether it is reasonably likely
to occur (such as whether it has occurred under similar circumstances
with some regularity in the past) as part of a hazard analysis.
Under this approach, facilities subject to section 418 of the FD&C
Act would be expected to implement controls against economically
motivated adulteration under circumstances where there has been a
pattern of such adulteration in the past, even though the past
occurrences may not be associated with the specific supplier or the
specific food product but the pattern suggests a potential for
intentional adulteration. Further, a system of monitoring, corrective
action, verification, and recordkeeping that is similar to those in the
PC and Animal Food PC proposed rules would be appropriate for
economically motivated adulteration. In addition, the elements of a
preventive control system, including hazard analysis, preventive
controls, monitoring, corrective actions, verification, and
recordkeeping would be documented in a food safety plan that would
include control of economically motivated adulteration. We believe that
addressing both of these potential sources for contamination within the
same framework is likely to streamline requirements and reduce costs to
industry.
We seek comment on our tentative conclusions presented above.
Specifically, we are interested in information on the specific factors
that are most relevant for determining whether economically motivated
adulteration is reasonably likely to occur, particularly in instances
where the specific product or supplier has not been previously
associated with such adulteration. In addition, we seek comment on
whether and how these relevant factors may be used to develop
appropriate predictive tools or establish a standard for when
preventive controls are necessary.
Section 418 of the FD&C Act contains certain exemptions related to
compliance with FDA's seafood and juice HACCP regulations and with
regard to manufacturing, processing, packing or holding dietary
supplements that are in compliance with the requirements of sections
402(g)(2) and 761 of the FD&C Act. Section 420 of the FD&C Act does not
contain these exemptions and requires FDA to issue regulations to
protect against the intentional adulteration of food. Seafood and juice
are currently subject to HACCP-type regulations in Sec. Sec. 123 and
120, respectively, and our current thinking is that under section 420
economically motivated adulteration could be addressed through the
existing frameworks for these foods. Under this option, FDA would amend
the seafood and juice HACCP regulations to specify that economically
motivated adulteration is a hazard that must be considered in a hazard
analysis of these foods, and addressed in a HACCP plan. For example,
for seafood, we could propose to add ``economically motivated
adulteration that could result in serious adverse health consequences
or death'' to the list of hazards to be considered in a hazard analysis
in accordance with Sec. 123.6(c)(1). Similarly, for juice we could
propose to add ``economically motivated adulteration that could result
in serious adverse health consequences or death'' to the list of
hazards to be considered in a hazard analysis in accordance with Sec.
120.7(c). Also under this option, FDA would consider proposing to amend
part 111 (21 CFR part 111), the Dietary Supplements current good
manufacturing practice (CGMP) rule, to include economically motivated
adulteration that could result in serious adverse health consequences
or death. Current Sec. 111.70(b) and (c) require establishing
component specifications and in-process specifications to ensure the
identity, purity, strength, and composition of the dietary supplement,
and we could amend these provisions to cover economically motivated
adulteration that could result in serious adverse health consequences
or death.
We have also tentatively concluded not to require produce farms
subject to section 419 of the FD&C Act and farms that produce milk
(also referred to in this document as ``dairy farms'') subject to
section 420 of the FD&C Act to take measures to address economically
motivated adulteration. With regard to produce farms subject to section
419 of the FD&C Act, we have tentatively concluded that there are not
procedures, processes, or practices that are reasonably necessary to be
implemented by these entities to prevent the introduction of known or
reasonably foreseeable biological, chemical, or physical hazards that
can cause serious adverse health consequences or death as a result of
economically motivated adulteration. With regard to farms that produce
milk subject to section 420 of the FD&C Act, we have tentatively
concluded that there are not appropriate science-based strategies or
measures intended to protect against economically motivated
adulteration that can be applied at the farm. These tentative
conclusions are based on our assessment that preventive controls for
economically motivated adulteration are suitable to address such
adulteration when it is perpetrated by the entity's supplier, but not
when it is perpetrated by the entity itself, as would be the case for
economically motivated adulteration at a produce farm or a farm that
produces milk. Actions such as auditing of suppliers or reliance upon
supplier-supplied test results or production control records are
generally considered unsuitable to address economically motivated
adulteration where the supplier, if intentionally adulterating the
food, would already be violating the law and would be able to subvert
these controls. For both types of farms, we are not aware of inputs
into the growing, harvesting, packing, or holding of produce or milk
(i.e., within our farm definition) that could be subject to
economically motivated adulteration that could cause serious adverse
health consequences or death under sections 419 and 420 of the FD&C
Act. We seek comment on this tentative conclusion.
[[Page 78029]]
G. Low-Risk Activities at Farm Mixed-Type Facilities
Section 103(c)(1)(C) of FSMA directs the Secretary of Health and
Human Services to conduct a science-based risk analysis as part of the
section 103(c) rulemaking. The science-based risk analysis is to cover
``(i) specific types of on-farm packing or holding of food that is not
grown, raised, or consumed on such farm or another farm under the same
ownership, as such packing and holding relates to specific foods; and
(ii) specific on-farm manufacturing and processing activities as such
activities relate to specific foods that are not consumed on that farm
or on another farm under common ownership.'' In section VIII.G of the
PC proposed rule, we describe a draft Qualitative Risk Assessment (the
draft RA) we performed to satisfy this requirement. Section
103(c)(1)(D)(i) of FSMA requires FDA to use the results of this
analysis to establish exemptions and inspection frequencies, or modify
requirements, for facilities engaged only in specific types of on-farm
activities that FDA determines to be low risk.
Elsewhere in this issue of the Federal Register, FDA is publishing
a notice announcing the availability for public comment Appendix 4 to
the draft RA (the draft RA Appendix). The purpose of the draft RA
Appendix is to provide a science-based risk analysis of those foods
whose production processes would be considered low risk with respect to
the risk of intentional adulteration caused by acts of terrorism. FDA
conducted this evaluation to satisfy the requirement in Section
103(c)(1)(C) of FSMA to conduct a science-based risk analysis with
respect to the risk of intentional adulteration caused by acts of
terrorism. We evaluated the production processes for the types of
finished foods we expect are produced at farm mixed-type facilities to
determine whether or not they are low-risk with respect to hazards that
may be intentionally introduced by acts of terrorism. For the purposes
of this analysis, we evaluated whether a production process involved
any of the four FDA-identified key activity types, and identified a
production process that did not involve any of the four key activity
types as a ``low risk production process.'' Based on this evaluation,
we concluded that the production processes for the following finished
foods are ``low-risk'':
Eggs (In-Shell)
Fruits & Vegetables Other Than Pods, Seeds for Direct
Consumption, and Hesperidia (Fresh, Intact)
Game Meats (Whole or Cut, Not Ground or Shredded, Without
Secondary Ingredients)
Peanuts & Tree Nuts (Raw, In-Shell)
Sugarcane & Sugar Beets (Fresh, Intact)
We are considering the results of this analysis in determining any
specific exemptions or modified requirements. We request comment on
whether we should exempt on-farm manufacturing, processing, packing, or
holding of the foods identified as having low-risk production practices
when conducted by a small or very small business if such activities are
the only activities conducted by the business that are subject to
section 418 of the FD&C Act. If we were to take this approach, only
facilities meeting all of the specified criteria would be exempt as a
result of being engaged in low-risk activities. Thus, a facility
located on-farm, that is a small or very small business, and only
produces fresh, intact apples as a finished product (e.g., by packing
apples grown on a different farm that is under different ownership)
would be exempt from this proposed rule. On the other hand, an apple-
packing facility that is off-farm would not be exempt, an apple packing
facility that is on-farm but that is not a small or very small business
would not be exempt, and an apple packing facility that also packs
green beans would not be exempt. We request comment on whether we
should broaden this potential exemption in any way, such as by removing
certain of the restrictions mentioned immediately above. We also seek
comment on whether we should instead establish modified requirements
for facilities that produce foods identified as having low-risk
production processes, and if so, what those modified requirements
should be and the scope of application of the modified requirements. In
addition, we seek comment on whether and how we should consider the
results of this analysis in determining whether to exempt or modify the
inspections frequency requirements under Section 421 of the FD&C Act,
Targeting of Inspection Resources for Domestic Facilities.
H. Activities That Occur on Dairy Farms
1. Assessment of Vulnerabilities
Under section 420 of the FD&C Act, we considered whether activities
that occur on farms that produce milk pose a high risk for intentional
adulteration of food caused by acts of terrorism that could cause
significant adverse health consequences or death. A preliminary
evaluation indicates that fluid milk storage appears to fit within the
key activity type, Liquid storage and handling, and fluid milk loading
appears to fit within the key activity type, Bulk liquid receiving and
holding. The fluid milk storage tank is one of the actionable process
steps that would be applicable to both of these activities on a dairy
farm.
As discussed in section V.C.2 of this document, FDA is proposing to
require that the owner, operator, or agent in charge of a facility that
has one or more of the FDA-identified key activity types identify
actionable process steps for those key activity types and implement
focused mitigation strategies at any actionable process steps. Because
dairy farms generally are not facilities as defined in this rule, they
would not be subject to this requirement. However, section 420 is
applicable to dairy farms (see Sec. 420(d)) and fluid milk storage and
loading in a dairy farm operation appear to pose a significant
vulnerability.
The risk posed by intentional adulteration of milk on-farm results
from a number of factors: (1) The system of milk collection from farms
and subsequent holding and processing serves to distribute contaminants
added to the milk on the farm into much larger quantities of fluid
milk, increasing the potential magnitude of an intentional adulteration
event; (2) in its fluid form milk has a short shelf life, increasing
the potential for significant adverse public health impacts before
detection and, once detected, before a public health intervention can
be implemented; (3) fluid milk is widely consumed across different sub-
populations, including infants and children, increasing the potential
for significant adverse public health impacts and, because of public
reaction to child and infant morbidity and mortality, decreasing public
confidence in the food supply; (4) fluid milk is consumed in a variety
of food forms, including as a beverage (finished food) and as an
ingredient in other finished foods, complicating public health
intervention; and (5) milk storage tanks are commonly left unlocked
(Ref. 41, Ref. 42, Ref. 43, Ref. 44, Ref. 45, Ref. 46, Ref. 47).
2. Mitigation Strategies
Farms are not subject to the HACCP-type system of preventive
controls prescribed in section 418 of the FD&C Act, and our current
thinking is that, should we include requirements relative to dairy
farms in the final rule, we would not require HACCP-type controls for
dairy farms under section 420 of the FD&C Act. Similarly, under section
419 of the FD&C Act we did not propose to apply such an approach to
unintentional adulteration on produce
[[Page 78030]]
farms in the Produce Safety proposed rule (see section IV.D of the
Produce Safety proposed rule). Rather, as with produce farms, a more
appropriate approach might be a CGMP-type provision that relates
directly to the significant vulnerability. Generally, CGMPs set out
mandatory, broad, generally applicable practices and conditions that
are required to be met, and the criteria and definitions that are
applicable in determining whether the food is adulterated. For example,
a CGMP approach would identify the broad, generally applicable
mitigation strategies that dairy farm operators must implement (e.g.,
limiting access to fluid milk storage tanks), without specifying how
that strategy must be accomplished and without a further requirement
for monitoring, recordkeeping or the development of a plan. We seek
comment on this approach.
FDA previously provided guidance for the dairy industry, including
dairy farms, on the potential for intentional contamination and
identified the types of food defense measures that dairy farms may take
to minimize the risk that fluid milk under their control will be
subject to tampering or other malicious, criminal, or terrorist actions
(Ref. 24). Among other recommendations, FDA's guidance recommends
``limiting access'' to raw and pasteurized milk storage as a food
defense preventive measure. We acknowledge the difficulties involved in
limiting access to many dairy farms, including multiple entries to the
milk house, multiple visitors with customary access to the milk house
(e.g., State food safety inspectors, vendors delivering veterinary
medications, and drivers collecting bulk milk for transport to
processing and storage facilities); continuous milk piping from the
milking parlor to the bulk milk tank, providing for access points to
the bulk milk tank from outside the milk house; open access to the
milking parlor for workers and cows; and automated milking operations
where employees are not necessarily present to escort cows into the
milking parlor.
In light of these circumstances, we request comment on whether and
how access to the bulk milk storage tank and associated systems can be
limited, and the costs and other implications of doing so. In addition,
we are interested in comment on whether and what types of focused
mitigation strategies or other measures are currently employed by dairy
farms. Specifically for fluid milk storage tanks, we seek comment on
whether and what focused mitigation strategies would be appropriate and
feasible given current dairy farming practices.
We also seek comment on whether it would be more appropriate for
FDA to require that dairy farm operators receive food defense awareness
training rather than requiring that they implement focused mitigation
strategies to limit access to certain steps of their operation. If you
support an approach based on training rather than mandated focused
mitigation strategies, we are further interested in how such an
approach would work at those farms where an agent of the farm may not
be present at all times, given that a system based on awareness
training is premised on the assumption that such training would provide
the operator with the tools to report and respond to suspicious
activity that they observe.
3. Scope of Dairy Farms Subject to any Requirement
Finally, we seek comment on the scope of farms that produce milk
that should be subject to any requirements that we may establish in a
final rule. For example, the scope of dairy farms covered could be
determined based on the potential for adverse public health outcome
resulting from consumption of milk produced at a farm, if a contaminant
were intentionally introduced into the milk from that farm. Farms with
less than 50 milk-producing cows contribute a relatively small
proportion to the total volume of milk produced in the United States
(i.e., approximately 4.2 percent of total milk produced in the United
States), and the current trend in the dairy farm industry toward
consolidation (Ref. 48) likely further reduces the percentage of
production that such farms will contribute in the future. However, milk
from even very small dairy farms may be pooled with milk from other
farms in raw milk storage tanks at milk processing and storage
facilities, potentially resulting in a public health impact from
intentional adulteration that is disproportionate to the size of the
farm or its contribution to the milk supply. We request comment on the
appropriateness of determining the scope of dairy farms covered based
on the number of cows on a farm. Alternatively, should we consider
excluding farms based on how the milk from a farm is distributed (e.g.,
direct sale to consumers or other end users; pooling with milk from
other farms; supplied to the Grade A Milk system for the production of
fluid milk; or used in the production of cheese and other products that
have a different risk associated with intentional adulteration caused
by acts of terrorism)?
I. Other Ways to Focus on Foods With a High Risk of Intentional
Adulteration Caused by Terrorism
We are requesting comment on whether, under section 420 of the FD&C
Act, there are other ways in which the coverage of this proposed
regulation can be further focused on foods that present a high risk of
intentional adulteration caused by acts of terrorism. For example, are
there ways in which a food's shelf life, turnover in the marketplace,
batch size, serving size and servings per batch, distribution and
consumption patterns, and intended consumer could be considered in
providing for an exemption or in setting modified requirements for that
food. Ordinarily, these considerations are part of a vulnerability
assessment, and in such assessments the risk reduction aspects of one
attribute may be offset or exacerbated by those of another attribute,
and may be very facility-specific. Such attributes specific to the
food(s) manufactured, processed, packed, or held at the facility can be
taken into account, should a facility choose to perform its own
vulnerability assessment and assign actionable process steps, as
provided for in proposed Sec. 121.130(b). However, as discussed in
section V.C.2 of this document, facilities would not be required to
perform a facility-specific vulnerability assessment and, instead,
would have the option of identifying actionable process steps using the
procedure in proposed Sec. 121.130(a). We are particularly interested
in how food-specific attributes can be taken into account in the
absence of a general requirement for a facility-specific vulnerability
assessment.
V. The Proposal
A. Definitions
In subpart A of proposed part 121, under Sec. 121.3, FDA is
proposing the following definitions and interpretations of terms
relevant to proposed part 121. The definitions and interpretations of
terms in section 201 of the FD&C Act (21 U.S.C. 321) are applicable to
such terms when used in this part. As proposed, several terms in part
121 have the same definitions as in proposed part 117 and, therefore,
we have not included an extensive discussion of those terms in this
proposed rule. See section X.B of the PC proposed rule for a discussion
of the following terms: facility, farm, holding, manufacturing/
processing, mixed-type facility, packing, qualified end-user, qualified
facility, and small business.
FDA is proposing to define the term ``actionable process step'' to
mean a
[[Page 78031]]
point, step, or procedure in a food process at which food defense
measures can be applied and are essential to prevent or eliminate a
significant vulnerability or reduce such vulnerability to an acceptable
level. The term ``actionable process step'' used in the food defense
context is analogous to the term ``critical control point'' (CCP),
which is defined as ``a point, step, or procedure in a food process at
which control can be applied and is essential to prevent or eliminate a
food safety hazard or reduce such hazard to an acceptable level.''
Similar to a CCP, in proposed part 121, an ``actionable process step''
is identified during a vulnerability assessment (analogous to a hazard
analysis) in relation to a significant vulnerability (analogous to a
hazard that is reasonably likely to occur), and is facility-specific.
As discussed in section V.C.2 of this document, based on
vulnerability assessments, FDA has identified four key activity types
that we have tentatively concluded pose significant vulnerabilities in
a food operation. FDA identified and described these key activity types
(which are not facility-specific) with the expectation that an owner,
operator, or agent in charge would objectively determine whether the
processing steps in a facility fit within one or more of these key
activity types. The processing steps identified by facilities in their
food operation that fit within the FDA-identified key activity types
are ``actionable process steps,'' and are steps at which a focused
mitigation strategy would be employed to prevent or eliminate a
significant vulnerability or reduce it to an acceptable level.
Actionable process steps might also be identified in a vulnerability
assessment (proposed Sec. 121.130(b)). Though we use the term
``actionable process step'' in FDA's FDPB software tool (Ref. 31), we
recognize it is a relatively new term and, therefore, we solicit
comment on its appropriateness and any other more appropriate
alternative terms.
FDA is proposing to define the term ``contaminant'' as any
biological, chemical, physical or radiological agent that may be
intentionally added to food and that may cause illness, injury or
death. We based the proposed definition, in part, on the definition of
``contaminant'' used in Codex Alimentarius guidelines (Ref. 49) that
refers to any biological or chemical agent, foreign matter or other
substances not intentionally added to feed or food that may compromise
feed and food safety or suitability. In this proposal, the term
``contaminant'' is used in the context of key activity types, which are
related to intentional acts of adulteration caused by acts of terrorism
with intent to cause public health harm and, to a lesser extent,
economic disruption. Therefore, for the purposes of proposed part 121,
we focused the definition of ``contaminant'' on agents that may be
intentionally added to food and that may cause illness, injury, or
death, which is consistent with our determination that the primary goal
of such an attack would be public health harm (i.e., illness, injury,
or death). Our proposed definition of ``contaminant'' in proposed 121.3
would be applicable to proposed part 121 only. We acknowledge that this
term has a broader meaning in other settings, as evidenced by its use
in the Codex Alimentarius guidelines.
FDA is proposing to define the term ``facility'' to mean a domestic
facility or a foreign facility that is required to register under
section 415 of the FD&C Act in accordance with the requirements of part
1, subpart H (21 CFR part 1, subpart H). The proposed definition would
incorporate the definition in section 418(o)(2) of the FD&C Act.
FDA is proposing to define the term ``farm'' by reference to the
definition of that term in proposed Sec. 1.227. We are proposing to
cross-reference the definition of ``farm'' rather than to define it in
proposed part 121 because the definition of ``farm,'' under both
current Sec. 1.227(b)(3) and proposed Sec. 1.227, includes the word
``facility'' with a meaning that is broader than the meaning of
``facility'' in section 418(o)(2) of the FD&C Act. Under part 1,
subpart H, the term ``facility'' is not limited to entities that are
required to register under section 415 of the FD&C Act. We are
proposing to cross-reference the definition to reduce the potential
confusion that could result if we used the term ``facility'' to have
two different meanings within proposed part 121. See sections X.B and
VIII of the PC proposed rule for additional information.
FDA is proposing to define the term ``focused mitigation
strategies'' to mean those risk-based, reasonably appropriate measures
that a person knowledgeable about food defense would employ to
significantly minimize or prevent significant vulnerabilities
identified at actionable process steps, and that are consistent with
the current scientific understanding of food defense at the time of the
analysis. The term ``focused mitigation strategies'' used in the food
defense context is analogous to the term ``preventive controls'' in a
HACCP-type framework for food safety.
As discussed in section V.C.3 of this document, a mitigation
strategy is a measure taken by a facility to reduce the potential for
intentional adulteration of food. A ``focused mitigation strategy'' is
such a strategy applied in response to the identification of a
significant vulnerability and at an actionable process step. Focused
mitigation strategies are customized to the processing step at which
they are applied, tailored to existing facility practices and
procedures, and depend on an evaluation of the vulnerabilities
identified in a facility. Because they are applied in response to a
significant vulnerability, we have determined that focused mitigation
strategies are essential to ensure that appropriate action is taken to
protect the food from intentional adulteration caused by acts of
terrorism.
While an option to perform a vulnerability assessment is provided
under proposed Sec. 121.130(b), facilities may choose instead to rely
on the analysis performed by FDA that resulted in the identification of
the key activity types listed in proposed Sec. 121.130(a) when
identifying actionable process steps and, subsequently, focused
mitigation strategies, eliminating the need for a full vulnerability
assessment. See section V.C.3 of this document for examples of focused
mitigation strategies.
FDA is proposing to define the term ``food defense'' as the effort
to protect food from intentional acts of adulteration where there is an
intent to cause public health harm and economic disruption. As
discussed in section IV.A of this document, acts of intentional
adulteration may take several forms, including acts of terrorism; acts
of disgruntled employees, consumers, or competitors; and economically
motivated adulteration. We are proposing to define the term ``food
defense'' to refer to the sum of actions and activities (including
identification of actionable process steps; implementation of focused
mitigation strategies; monitoring, corrective actions, verification,
and training activities) taken to protect food from intentional acts of
adulteration related to terrorism.
FDA is proposing to define the term ``holding'' to mean the storage
of food. The proposed definition would also state that holding
facilities include warehouses, cold storage facilities, storage silos,
grain elevators, and liquid storage tanks; and that, for farms and farm
mixed-type facilities, holding also includes activities traditionally
performed by farms for the safe or effective storage of raw
agricultural commodities grown or raised on the same farm or another
farm under the
[[Page 78032]]
same ownership, but does not include activities that transform a raw
agricultural commodity, as defined in section 201(r) of the FD&C Act,
into a processed food as defined in section 201(gg) of the FD&C Act.
For consistency of terminology, we are proposing the same definition of
``holding'' as in the PC proposed rule (see proposed Sec. Sec. 1.227
and 117.3). For a detailed discussion of ``holding,'' see sections
VIII.E and X.B of the PC proposed rule.
FDA is proposing to define the term ``manufacturing/processing'' to
mean making food from one or more ingredients, or synthesizing,
preparing, treating, modifying or manipulating food, including food
crops or ingredients. The proposed definition would also state that
examples of manufacturing/processing activities are cutting, peeling,
trimming, washing, waxing, eviscerating, rendering, cooking, baking,
freezing, cooling, pasteurizing, homogenizing, mixing, formulating,
bottling, milling, grinding, extracting juice, distilling, labeling, or
packaging. The proposed definition would also specify that, for farms
and farm mixed-type facilities, manufacturing/processing does not
include activities that are part of harvesting, packing, or holding.
For consistency of terminology, we are proposing the same definition of
``manufacturing/processing'' as in the PC proposed rule (see proposed
Sec. Sec. 1.227 and 117.3). For a detailed discussion of
``manufacturing/processing,'' see sections VIII.E and X.B of the PC
proposed rule.
FDA is proposing to define the term ``mixed-type facility'' to mean
an establishment that engages in both activities that are exempt from
registration under section 415 of the FD&C Act and activities that
require the establishment to be registered. The proposed definition
would also state that an example of such a facility is a ``farm mixed-
type facility,'' which is an establishment that grows and harvests
crops or raises animals and may conduct other activities within the
farm definition, but also conducts activities that require the
establishment to be registered. For consistency of terminology, we are
proposing the same definition of ``mixed-type facility'' as in the PC
proposed rule (see proposed Sec. Sec. 1.227 and 117.3). For a detailed
discussion of ``mixed-type facilities,'' see sections VIII.E and X.B of
the PC proposed rule.
FDA is proposing to define the term ``monitor'' to mean to conduct
a planned sequence of observations or measurements to assess whether
focused mitigation strategies are consistently applied and to produce
an accurate record for use in verification. In the intentional
adulteration framework, monitoring would be performed to ensure that
focused mitigation strategies are consistently applied and to provide a
record for use in verifying consistent application.
FDA is proposing to define the term ``packing'' to mean placing
food into a container other than packaging the food. The proposed
definition would also specify that, for farms and farm mixed-type
facilities, packing also includes activities traditionally performed by
farms to prepare raw agricultural commodities grown or raised on the
same farm or another farm under the same ownership for storage and
transport, but does not include activities that transform a raw
agricultural commodity, as defined in section 201(r) of the FD&C Act,
into a processed food as defined in section 201(gg). We are proposing
to use the same definition of ``packing'' as in the PC proposed rule
(see proposed Sec. Sec. 1.227 and 117.3). For a detailed discussion of
``packing,'' see sections VIII.E and X.B of the PC proposed rule.
FDA is proposing to define the term ``qualified end-user'' to mean,
with respect to a food, the consumer of the food (where the term
consumer does not include a business); or a restaurant or retail food
establishment (as those terms are defined in Sec. 1.227) that: (1) Is
located: (i) in the same State as the qualified facility that sold the
food to such restaurant or establishment; or (ii) not more than 275
miles from such facility; and (2) is purchasing the food for sale
directly to consumers at such restaurant or retail food establishment.
The proposed definition would incorporate the definition in section
418(l)(4)(B) of the FD&C Act.
FDA is proposing to define the term ``qualified facility'' to mean
(when including the sales by any subsidiary; affiliate; or subsidiaries
or affiliates, collectively, of any entity of which the facility is a
subsidiary or affiliate) a facility that is: (1) A very small business
as defined in this part; or (2) a facility to which both of the
following apply: (i) During the 3-year period preceding the applicable
calendar year, the average annual monetary value of the food
manufactured, processed, packed or held at such facility that is sold
directly to qualified end-users (as defined in this part) during such
period exceeded the average annual monetary value of the food sold by
such facility to all other purchasers; and (ii) the average annual
monetary value of all food sold during the 3-year period preceding the
applicable calendar year was less than $500,000, adjusted for
inflation.
We acknowledge that facilities would not need to consider the
applicability of previous paragraph (2) because facilities that meet
this second prong of the definition would be included in our proposed
definition of a very small business, which is broader.
The proposed definition would incorporate the description of
``qualified facility'' in section 418(l)(1) of the FD&C Act with
editorial changes to improve clarity.
FDA is proposing to define the term ``significant vulnerability''
to mean a vulnerability for which a prudent person knowledgeable about
food defense would employ food defense measures because of the
potential for serious adverse health consequences or death and the
degree of accessibility to that point in the food process. The term
``significant vulnerability'' is analogous to the term ``hazard that is
reasonably likely to occur'' in a HACCP-type framework for food safety.
As proposed, a ``significant vulnerability'' is a type of vulnerability
for which there is both: (1) The potential for serious adverse health
consequences or death from the intentional introduction of a
contaminant at the particular point in the process at which the
significant vulnerability exists; and (2) a significant degree of
accessibility at the particular point in the process. Unlike a ``hazard
that is reasonably likely to occur'' in a HACCP system, a ``significant
vulnerability'' exists at a particular point in a process (e.g., during
storage in a bulk tank or during mixing). As discussed in section V.C.2
of this document, we have determined that significant vulnerabilities
exist in a food operation at those actionable process steps that fit in
the FDA-identified key activity types or that are identified as part of
a vulnerability assessment.
We have retained in this proposed definition the concept of a
``prudent person'' used in the definition of a ``hazard that is
reasonably likely to occur'' in the PC proposed rule. However, because
intentional adulteration is a potentially high consequence but low
probability occurrence, the portion of the proposed definition in the
PC proposed rule that reads, ``experience, illness data, scientific
reports, or other information provides a basis to conclude that there
is a reasonable possibility that the hazard will occur in the type of
food being manufactured, processed, packed, or held in the absence of
those controls,'' does not appear to be appropriate. Successful
intentional adulteration caused by an act of
[[Page 78033]]
terrorism requires not only the absence of focused mitigation
strategies designed to address a significant vulnerability, but also
simultaneous intent by an attacker to adulterate the food. As such, the
absence of focused mitigation strategies to address a significant
vulnerability alone may not present a reasonable possibility of
intentional adulteration. Instead, as described above, we have
tentatively concluded that the prudent person would consider the
potential for public health consequences should intentional
adulteration occur, and the degree of access by the attacker to commit
the intentional adulteration, in determining which vulnerabilities are
significant.
FDA is proposing to define the term ``significantly minimize'' to
mean to reduce to an acceptable level, including to eliminate. As noted
in section X.B of the PC proposed rule, the term ``significantly
minimize'' is used in FSMA and is consistent with the outcome of a
``control measure'' as described in the HACCP regulations for seafood
(part 123), juice (part 120), and meat and poultry (9 CFR part 417).
Generally, a ``control measure'' is implemented so that hazards are
prevented, reduced to an acceptable level, or eliminated.
FDA is proposing to define the term ``small business'' to mean, for
the purposes of proposed part 121, a business employing fewer than 500
persons. The proposed limit of 500 employees would include all
employees of the business rather than be limited to the employees of a
particular facility. We are proposing to establish the same definition
for small business as that which has been established by the U.S. Small
Business Administration under 13 CFR part 121 for most food
manufacturers.
FDA is proposing to define the term ``verification'' to mean those
activities, other than monitoring, that establish that the system is
operating according to the food defense plan. As discussed in section
V.C.6 of this document, we are not proposing to require validation of
the focused mitigation strategies and, therefore, we are not proposing
to include a determination of the validity of the food defense plan
within the definition of verification in proposed Sec. 121.3.
FDA is proposing to define the term ``very small business'' to
mean, for the purposes of proposed part 121, a business that has less
than $10,000,000 in total annual sales of food, adjusted for inflation.
In the discussion on the regulatory framework in section IV.A of this
document, we discuss our assessment that the goal of terrorist
organizations is to maximize public health harm and, to a lesser
extent, economic disruption. It is our assessment that such goals are
likely to drive terrorist organizations to target the product of
relatively large facilities, especially those for which the brand is
nationally or internationally recognizable. An attack on such a target
would potentially provide the wide-scale consequences desired by a
terrorist organization and the significant public attention that would
accompany an attack on a recognizable brand. Such facilities are likely
to have larger batch sizes, potentially resulting in greater human
morbidity and mortality. Further, an attack on a well-recognized,
trusted brand is likely to result in greater loss of consumer
confidence in the food supply and in the government's ability to ensure
its safety and, consequently, cause greater economic disruption than a
relatively unknown brand that is distributed regionally (Ref. 2, Ref.
50, Ref. 3, Ref. 51, Ref. 6). Therefore, we have set a threshold of
$10,000,000 in total food sales, adjusted for inflation, as the level
defining a very small business. Data from the Dun & Bradstreet Global
Business Database show that businesses with less than $10,000,000 in
total food sales represent about 3 percent of the market share of food
commodities, but include the majority of food facilities. Of a total of
65,900 domestic food facilities that are estimated to have actionable
process steps, about 51,700 are owned by businesses with less than
$10,000,000 in total annual sales. We request comment on our proposed
definition, and whether a dollar amount of sales more than or less than
$10,000,000 would be more appropriate. We also seek comment on whether
this threshold should be based on total food sold, as we proposed, or
on some appropriate proportion of food sales. For example, in the case
of foreign facilities, would it be more appropriate to consider the
proportion of food sold for marketing in the United States?
FDA is proposing to define the term ``vulnerability'' to mean the
susceptibility of a point, step, or procedure in a facility's food
process to intentional adulteration. ``Vulnerability'' is used in the
term ``vulnerability assessment'' in section 420 of the FD&C Act and
may best be described in the food defense context as analogous to the
term ``hazard'' in a HACCP-type framework for food safety. While
hazards in the unintentional adulteration context may also be thought
of as analogous to agents or contaminants in the intentional
adulteration context, we have tentatively concluded that focusing on
individual agents or contaminants is generally not effective or
efficient in minimizing the risk of intentional adulteration caused by
acts of terrorism. There are a significant number of potential agents
or contaminants that could be used in a terrorist attack on food, with
one or more being suitable for essentially any point in the production
of any specific food. It would be extremely difficult, if not
impossible, to consider the multiple combinations of potential
contaminants, points in a food operation, and food categories, and to
determine a strategy that would effectively address all possible
agents. For this reason, determining whether there is an agent that
could be intentionally introduced to a specific food that would then
cause serious adverse health consequences or death would not be a
useful exercise. Further, many agents or contaminants that could be
used in such an attack are different from those that are associated
with foodborne illnesses caused by unintentional adulteration and, as
such, are not expected to be well understood by operators of food
facilities. Therefore, we have tentatively concluded that in the
intentional adulteration framework related to acts of terrorism, it is
appropriate to refer to ``vulnerabilities'' rather than ``hazards''.
According to the Merriam-Webster dictionary (Ref. 52), vulnerability is
a ``susceptibility,'' and we believe this concept best captures the
idea of a point, step, or procedure where someone intent on intentional
adulteration would focus an attack in a facility's food process. See
section V.C.2 of this document for a discussion of assessing
vulnerabilities to identify actionable process steps.
We solicit comment on the proposed definitions.
B. Exemptions
In subpart A of proposed part 121, proposed Sec. 121.5 would
establish exemptions from some or all of the provisions of this
proposed regulation.
1. Proposed Sec. 121.5(a)--Exemption for Qualified Facilities
Proposed Sec. 121.5(a) would provide that proposed part 121 does
not apply to a qualified facility, except that qualified facilities
must, upon request, provide for official review documentation that was
relied upon to demonstrate that the facility meets this exemption. Such
documentation must be retained for 2 years.
a. Exemption of qualified facilities. As discussed in section V.A
of this document, proposed Sec. 121.3 would
[[Page 78034]]
define a qualified facility to mean (when including the sales by any
subsidiary; affiliate; or subsidiaries or affiliates, collectively, of
any entity of which the facility is a subsidiary or affiliate) a
facility that is: (1) A very small business as defined in this part, or
(2) a facility to which both of the following apply: (i) During the 3-
year period preceding the applicable calendar year, the average annual
monetary value of the food manufactured, processed, packed or held at
such facility that is sold directly to qualified end-users (as defined
in this part) during such period exceeded the average annual monetary
value of the food sold by such facility to all other purchasers; and
(ii) the average annual monetary value of all food sold during the 3-
year period preceding the applicable calendar year was less than
$500,000, adjusted for inflation. In addition, we are proposing to
define very small business to mean a business that has less than
$10,000,000 in total annual sales of food, adjusted for inflation.
Section 418(l)(2)(A) of the FD&C Act provides that a qualified
facility ``shall not be subject to the requirements under [sections
418(a) through (i) and (n) of the FD&C Act].'' We have tentatively
concluded that we should include the exemption provided in section
418(l)(2)(A) of the FD&C Act in proposed Sec. 121.5(a) to establish by
regulation the reach of the provision.
Section 418(l)(5) of the FD&C Act requires the Secretary of Health
and Human Services, in consultation with the Secretary of Agriculture,
to conduct a study of the food processing sector regulated by the
Secretary of Health and Human Services and to make determinations in
five areas. These areas include, in part: (1) Distribution of food
production by type and size of operation; (2) the proportion of food
produced by each type and size of operation; (3) the number and types
of food facilities co-located on farms; (4) the incidence of foodborne
illness originating from each size and type of operation; and (5) the
effect on foodborne illness risk associated with certain activities
regarding food.
Section 418(n)(1)(B) of the FD&C Act requires that the regulations
define the terms ``small business'' and ``very small business,'' taking
into consideration the study of the food processing sector required by
section 418(l)(5) of the FD&C Act. Consistent with section 418(l)(5) of
the FD&C Act, we have consulted with USDA during our study of the food
processing sector. The study is available in the docket established for
this proposed rule (Ref. 53). We request comment on that study. We will
consider comments regarding the study, as well as comments regarding
our proposed definition for very small business, in any final rule
based on this proposed rule.
We note that section 420 of the FD&C Act does not contain an
explicit size-based exemption, such as the qualified facility provision
in section 418 of the FD&C Act. In section IV.A of this document, we
discuss our assessment that the goal of terrorist organizations is to
maximize public health harm and, to a lesser extent, economic
disruption. We have tentatively concluded that such goals are likely to
drive terrorist organizations to target the product of relatively large
facilities, especially those for which the brand is nationally or
internationally recognizable. The regulations issued under section 420
of the FD&C Act are to apply to food for which there is a high risk of
intentional contamination. We have tentatively concluded that
designating businesses with less than $10,000,000 in total annual sales
of food as very small businesses, resulting in their exemption from
proposed part 121, is consistent with the requirement in section 420 of
the FD&C Act that the regulation be limited to foods at high risk of
intentional adulteration.
We acknowledge that the amount of food sales in the proposed
definition of very small business (total annual sales of food of less
than $10,000,000) is significantly higher than the threshold in the PC
proposed rule, in which we co-proposed three amounts ($250,000,
$500,000, and $1,000,000 in total annual sales of food). The higher
amount proposed here reflects the difference in the nature of risk
related to intentional adulteration covered by this rule and is
consistent with the requirement in section 418(n)(3)(C) of the FD&C Act
that this regulation ``acknowledge differences in risk and minimize, as
appropriate, the number of separate standards that apply to separate
foods.''
There are some facilities that are not subject to section 418 of
the FD&C Act but are subject to section 420 of the FD&C Act, and would
be subject to this rulemaking because their activities would likely
involve one of the key activity types (e.g., juice manufacturing and
breaded seafood manufacturing). However, under proposed Sec. 121.5(a),
such facilities would be exempt from proposed part 121 if they are part
of businesses with less than $10,000,000 in total annual sales of food,
adjusted for inflation.
b. Documentation requirement for qualified facilities. Sections
418(l)(2)(A) and (l)(2)(B) of the FD&C Act provide that a qualified
facility is exempt from the requirements of sections 418(a) through (i)
and (n) (i.e., the requirements for hazard analysis and risk-based
preventive controls), but must instead submit two types of
documentation to the Secretary of Health and Human Services. The first
type of required documentation relates to food safety practices at the
facility, and section 418(l)(2)(B)(i) of the FD&C Act provides two
options for satisfying this documentation requirement. Under section
418(l)(2)(B)(i)(I) of the FD&C Act, the qualified facility may choose
to submit documentation that demonstrates that the owner, operator, or
agent in charge of the facility has identified potential hazards
associated with the food being produced, is implementing preventive
controls to address the hazards, and is monitoring the preventive
controls to ensure that such controls are effective. Alternatively,
under section 418(l)(2)(B)(i)(II) of the FD&C Act, the qualified
facility may choose to submit documentation (which may include
licenses, inspection reports, certificates, permits, credentials,
certification by an appropriate agency (such as a State department of
agriculture), or other evidence of oversight), as specified by the
Secretary of Health and Human Services, that the facility is in
compliance with State, local, county, or other applicable non-Federal
food safety law.
The second type of required documentation relates to whether the
facility satisfies the definition of a qualified facility. Under
section 418(l)(2)(B)(ii) of the FD&C Act, the facility must submit
documentation, as specified by the Secretary of Health and Human
Services in a guidance document, that the facility is a qualified
facility under section 418(l)(1)(B) or section 418(l)(1)(C).
Section 418(l)(7)(A) of the FD&C Act requires that a qualified
facility that is exempt from the requirements under sections 418(a)
through (i) and subsection (n), and that does not prepare documentation
under section 418(l)(2)(B)(i)(I), provide notification to consumers by
one of two procedures, depending on whether a food packaging label is
required on the food. With respect to a food for which a food packaging
label is required by the Secretary of Health and Human Services under
any other provision of the FD&C Act, section 418(l)(7)(A)(i) of the
FD&C Act requires that a qualified facility include prominently and
conspicuously on such label the name and business address of the
facility where the food was manufactured or processed. With
[[Page 78035]]
respect to a food for which a food packaging label is not required by
the Secretary of Health and Human Services under any other provisions
of the FD&C Act, section 418(l)(7)(A)(ii) of the FD&C Act requires that
a qualified facility prominently and conspicuously display, at the
point of purchase, the name and business address of the facility where
the food was manufactured or processed, on a label, poster, sign,
placard, or documents delivered contemporaneously with the food in the
normal course of business, or, in the case of Internet sales, in an
electronic notice.
Section XIII.A of the PC proposed rule describes our proposed
requirements pursuant to the above described modified requirements for
qualified facilities in that proposed rule. In summary, in the PC
proposed rule, we proposed codified language to require submission of
the following to FDA: (1) Documentation that the facility is a
qualified facility; and (2) documentation that demonstrates that the
owner, operator, or agent in charge of the facility has identified the
potential hazards associated with the food being produced, is
implementing preventive controls to address the hazards, and is
monitoring the performance of the preventive controls to ensure that
such controls are effective; or documentation (which may include
licenses, inspection reports, certificates, permits, credentials,
certification by an appropriate agency (such as a State department of
agriculture), or other evidence of oversight) that the facility is in
compliance with State, local, county, or other applicable non-Federal
food safety law, including relevant laws and regulations of foreign
countries. In Section XIII.A of the PC proposed rule, we clarified that
the following submission of information would be satisfactory: (1) A
statement from the owner, operator, or agent in charge of a qualified
facility certifying that the facility is a very small business,
otherwise meets the definition of a qualified facility under proposed
Sec. 117.3, or both; and (2) a statement from the owner, operator, or
agent in charge of a qualified facility certifying that the facility
(a) has identified the potential hazards associated with the food being
produced, is implementing preventive controls to address the hazards,
and is monitoring the implementation of the preventive controls to
ensure that such controls are effective; or (b) is in compliance with
State, local, county, or other applicable non-Federal food safety law,
including relevant laws and regulations of foreign countries. We
tentatively concluded that we would not, for example, require that a
facility submit documentation to FDA demonstrating the content of their
hazard identification, preventive controls, or monitoring of the
implementation of preventive controls; or copies of their non-Federal
licenses, inspection reports, certificates, permits, credentials, or
certifications. We proposed to require that the information be
resubmitted to FDA at least every 2 years, or whenever there is a
material change to the information. Finally, we proposed to require
that a qualified facility maintain records relied upon to support their
assertion of meeting the requirements of the qualified exemption. We
tentatively concluded that it is appropriate to require that the
records relied upon to support a self-certified statement be retained
and made available to FDA upon request.
Proposed Sec. 121.5(a) would require that qualified facilities,
upon request, provide for official review documentation that was relied
upon to demonstrate that the facility meets this exemption. In
addition, proposed Sec. 121.5(a) would provide that such documentation
must be retained for 2 years. We are not proposing to apply all of the
modified requirements described in proposed Sec. 117.201 in the PC
proposed rule to qualified facilities that would be covered under this
rule. We have tentatively concluded that such an approach is
reasonable, considering the context and wording of the statutory
provision as it relates to intentional adulteration caused by acts of
terrorism.
c. Withdrawal of exemption for qualified facilities. Section
418(l)(3) of the FD&C Act provides that the Secretary of Health and
Human Services may withdraw the exemption provided in section
418(l)(2)(A) under certain circumstances. We discuss the withdrawal
provisions of section 418(l)(3) of the FD&C Act, and the process we
propose to use to withdraw an exemption for a qualified facility
subject to that rule in section XIV.E of the PC proposed rule. We ask
for comment on the appropriateness of those proposed procedures to
withdraw an exemption for a qualified facility subject to this proposed
rule. We also seek input on whether we should include the process for
such withdrawal within proposed part 121 or whether those provisions
might be best placed in a separate part and cross-referenced in
proposed part 121 in order to reduce duplication, given these
provisions also appear in the PC and the Produce Safety proposed rules.
2. Proposed Sec. 121.5(b)--Exemption for Holding of Food
a. Requirement of section 418 of the FD&C Act. Section 418(m) of
the FD&C Act provides in relevant part that FDA may by regulation
``exempt or modify the requirements for compliance under [section 418
of the FD&C Act] with respect to facilities that are solely engaged in
. . . the storage of raw agricultural commodities (other than fruits
and vegetables) intended for further distribution or processing or the
storage of packaged foods that are not exposed to the environment.'' In
the PC proposed rule, we proposed exemptions and modified requirements
based on this provision (see proposed Sec. Sec. 117.5(j), 117.7, and
117.206).
b. Petition relevant to section 418(m) of the FD&C Act. In a letter
dated July 22, 2011, an industry coalition of the American Bakers
Association, the American Frozen Food Institute, the Grocery
Manufacturers Association, the International Bottled Water Association,
the International Dairy Foods Association, the International Warehouse
Logistics Association, the Peanut and Tree Nut Processors Association,
and the Snack Food Association (the section 418(m) petitioners)
submitted a citizen petition (Docket No. FDA-2011-P-0561). The petition
requests that FDA issue regulations under section 418(m) of the FD&C
Act ``to exempt from compliance or modify the requirements for
compliance under section 418 [of the FD&C Act] for facilities that are
solely engaged in the storage of packaged foods that are not exposed to
the environment, by allowing such facilities to satisfy the
requirements of that section through compliance with the [CGMPs]
mandated for such facilities by [current] Sec. 110.93.'' The section
418(m) petitioners assert that the food safety issues presented by
facilities used only to store packaged foods that are not exposed to
the environment are essentially the same, regardless of the type of
food. As such, trade associations representing a variety of product
sectors are signatories to the petition and are supportive of the
request to exempt such facilities from the provisions of section 418 of
the FD&C Act.
The section 418(m) petitioners stated, ``As an initial matter, the
risk of intentional adulteration at facilities solely engaged in the
storage of packaged foods not exposed to the environment is quite
remote. The food in these facilities is stored in unit packaging,
meaning any effort to adulterate the food would be laborious and likely
ineffective.'' They further
[[Page 78036]]
asserted that, ``Members of the food industry have implemented a number
of precautions against intentional adulteration. Most importantly,
these facilities are locked and secured against unauthorized entry.
Access is restricted to the employees of the manufacturer dropping off
food, any staff employed at the facility, and the persons who deliver
food to retailers and other customers. Food is often held in such
facilities for a short period of time, which would not be conducive to
attempts at intentional adulteration. Further, we note that the
continual activity in these facilities during pickup and drop-off hours
serves as a deterrent for anyone attempting to gain unauthorized
access.''
c. Proposed exemption for the holding of food. Proposed Sec.
121.5(b) would exempt from the requirements in proposed part 121 the
holding of food, except the holding of food in liquid storage tanks.
This provision is broader in scope than exemptions in proposed
Sec. Sec. 117.5(j) and 117.7 in the PC proposed rule, and would
exempt, for example, storage of whole grains, shell eggs, fruits and
vegetables, and packaged foods (including packaged milk and orange
juice). It would not exempt, for example, storage in bulk storage tanks
of milk or liquid orange juice.
As discussed in section V.C.2 of this document, based on an
analysis of the vulnerability assessments that FDA has conducted using
the CARVER+Shock methodology, we identified four key activity types
(Bulk liquid receiving and loading; Liquid storage and handling;
Secondary ingredient handling; and Mixing and similar activities) as
production processes that require focused mitigation strategies. With
the exception of the holding of food in liquid storage tanks, which is
not included in the proposed exemption, we are not aware of activities
performed during the holding of food that fit within any of these four
key activity types.
We acknowledge that our proposed exemption in Sec. 121.5(b) is not
identical to the exemption in section 418(m) of the FD&C Act. However,
as explained above, the holding of food that would be exempt does not
include any of the four key activity types associated with actionable
process steps under proposed Sec. 121.130(a). Consequently, even
without an exemption, this holding of food would not require the
implementation of focused mitigation strategies under proposed Sec.
121.130(a) to protect food against intentional adulteration. The only
requirement related to holding activities would be for a written
assessment that would conclude that no focused mitigation strategies
are necessary with regard to the holding activities. Under these
circumstances, we have tentatively concluded that an exemption is
appropriate. Accordingly, we propose to exempt the holding of food,
except the holding of food in liquid storage tanks, from the
requirements of this proposed regulation. Although we are not
responding to the merits of the arguments of the section 418(m)
petitioners with regard to precautions against intentional
adulteration, we believe that this proposed exemption meets the request
of the section 418(m) petitioners.
3. Proposed Sec. 121.5(c)--Exemption for Packing, Re-Packing,
Labeling, and Re-labeling of Food
Proposed Sec. 121.5(c) would exempt from the requirements in
proposed part 121 the packing, re-packing, labeling, or re-labeling of
food where the container that directly contacts the food remains
intact. As discussed in section V.C.2 of this document, based on an
analysis of the vulnerability assessments that FDA has conducted using
the CARVER+Shock methodology, we identified four key activity types
(Bulk liquid receiving and loading; Liquid storage and handling;
Secondary ingredient handling; and Mixing and similar activities) as
production processes that require focused mitigation strategies. We are
not aware of activities performed during the packing, re-packing,
labeling, or re-labeling of food where the immediate package or
container of the food remains intact that fit within any of these four
key activity types.
As discussed in section V.A of this document, the proposed rule
would not require a facility that chooses to identify its actionable
process steps under proposed Sec. 121.30(a) to implement focused
mitigation strategies for a food process that does not include any of
the four key activity types. Even without the exemption, a facility
that conducts packing, re-packing, labeling, or re-labeling activities
would be able to conclude that it has no key activity types and,
therefore, would not be required to implement focused mitigation
strategies. However, without an exemption, under proposed Sec.
121.130, such a facility would be required to perform a written
assessment to make this determination. We have tentatively concluded
that requiring such an assessment is unnecessary. Consequently, we
propose to exempt the packing, re-packing, labeling, or re-labeling of
food where the container that directly contacts the food remains intact
from the requirements of this proposed regulation.
4. Proposed Sec. 121.5(d)--Exemption for Produce Farms
Proposed Sec. 121.5(d) would exempt from the requirements in
proposed part 121 the activities of a facility that are subject to
section 419 of the FD&C Act (Standards for Produce Safety). We discuss
our tentative decision not to cover produce farms under section 419 of
the FD&C Act in sections IV.B and IV.F, respectively, of this document.
Section 418(k) of the FD&C Act provides that section 418 ``shall
not apply to activities of a facility that are subject to section
419''. Section 419 of the FD&C Act, ``Standards for Produce Safety,''
requires FDA to establish by regulation ``science-based minimum
standards for the safe production and harvesting of those types of
fruits and vegetables, including specific mixes or categories of fruits
and vegetables, that are raw agricultural commodities for which [FDA]
has determined that such standards minimize the risk of serious adverse
health consequences or death.'' Section 419(h) of the FD&C Act provides
that section 419 ``shall not apply to activities of a facility that are
subject to section 418.''
Establishments that are exempt from registration under section 415
of the FD&C Act as ``farms'' would not be subject to section 418 of the
FD&C Act when conducting activities within the farm definition. Farm
mixed-type facilities would be subject to section 418 of the FD&C Act
when conducting those activities that trigger the section 415
registration requirement. We have tentatively concluded that
Congressional intent regarding the reach of section 418(k) of the FD&C
Act is unambiguous in that section 418(k) directly limits the exemption
to activities of the facility that are subject to section 419 of the
FD&C Act. We have also tentatively concluded that we should include a
provision implementing section 418(k) of the FD&C Act in the proposed
regulation to establish by regulation the reach of the exemption.
Therefore, in proposed Sec. 121.5(d), we are proposing that proposed
part 121 would not apply to activities of a facility that are subject
to section 419 of the FD&C Act (Standards for Produce Safety).
At the time FDA developed the farm definition and its
interpretations of that definition, the practical impact of an
activity's classification as inside or outside that definition was
limited to the potential to trigger the section 415 registration
regulations and the section 414 recordkeeping regulations. With the
[[Page 78037]]
advent of FSMA, the scope of the farm definition has taken on more
importance because, for example, activities within the farm definition
are not subject to section 418 of the FD&C Act, but activities outside
the farm definition are subject to section 418. Therefore, FDA proposed
to clarify and adjust the scope of the farm definition, including the
classification of manufacturing, processing, packing, and holding
activities relevant to that definition, in the proposed preventive
controls regulations for human food. In section VIII.D of the PC
proposed rule, we described a set of organizing principles that would
form the basis for our proposal for classifying activities to more
accurately reflect the scope of activities traditionally conducted by
farms and to allow for more certainty among industry with regard to how
their activities will be regulated.
5. Proposed Sec. 121.5(e)--Exemption for Alcoholic Beverages
Proposed Sec. 121.5(e)(1) would provide that proposed part 121
does not apply with respect to alcoholic beverages at a facility that
meets the following two conditions: (i) Under the Federal Alcohol
Administration Act (27 U.S.C. 201 et seq.) or chapter 51 of subtitle E
of the Internal Revenue Code of 1986 (26 U.S.C. 5001 et seq.) the
facility is required to obtain a permit from, register with, or obtain
approval of a notice or application from the Secretary of the Treasury
as a condition of doing business in the United States, or is a foreign
facility of a type that would require such a permit, registration, or
approval if it were a domestic facility; and (ii) Under section 415 of
the Federal Food, Drug, and Cosmetic Act (21 U.S.C. 350d) the facility
is required to register as a facility because it is engaged in
manufacturing, processing, packing, or holding one or more alcoholic
beverages.
Proposed Sec. 121.5(e)(2) would provide that proposed part 121
does not apply with respect to food other than alcoholic beverages at a
facility described in paragraph (e)(1) of this section, provided such
food: (i) Is in prepackaged form that prevents any direct human contact
with such food; and (ii) Constitutes not more than 5 percent of the
overall sales of the facility, as determined by the Secretary of the
Treasury.
In section X.C.7 of the PC proposed rule, we explain in detail our
interpretation of section 116 of FSMA and our consideration of hazards
and preventive controls for the manufacturing, processing, packing, and
holding of alcoholic beverages. Based on that analysis, we proposed, in
proposed Sec. 117.5(i), to exempt certain facilities engaged in the
manufacturing, processing, packing, or holding of alcoholic beverages
and other food. Consistent with that analysis, we are proposing similar
exemptions related to alcoholic beverages in this proposed rule on
focused mitigation strategies for the protection of food against
intentional adulteration caused by acts of terrorism.
We have tentatively concluded that we should include a provision
implementing section 116 of FSMA in the proposed rule to establish by
regulation the reach of the provision. We request comment on our
interpretation of section 116 of FSMA, described in section X.C.7 of
the PC proposed rule, and its application to the proposed exemption in
Sec. 121.5(e).
6. Proposed Sec. 121.5(f)--Exemption for Food for Animals
Proposed Sec. 121.5(f) would exempt from the requirements of
proposed part 121 the manufacturing, processing, packing, and holding
of food for animals other than man. In the Animal Food PC proposed
rule, we proposed to require that facilities that manufacture, process,
pack, or hold animal food and that are not otherwise covered by certain
exemptions, design and implement a system of preventive controls to
address food safety issues. In that proposed rulemaking, we tentatively
concluded that hazards associated with intentional adulteration would
likely require different kinds of controls and would be best addressed
in a separate rulemaking.
We also requested comment in that rulemaking on whether to include
in those regulations potential hazards that may be intentionally
introduced for economic reasons, which we refer to as economically
motivated adulteration, a type of intentional adulteration. Our current
thinking regarding economically motivated adulteration is discussed in
section IV.F of this document.
Section 418(m) of the FD&C Act authorizes FDA to exempt or modify
the requirements for compliance with section 418 with regard to
facilities that engage solely in the production of animal food.
Further, section 420(c) of the FD&C Act requires that regulations that
FDA issues under that section apply only to food for which there is a
high risk of intentional contamination. In section IV.A of this
document, we discuss how FDA is proposing to implement the provisions
of sections 418 and 420 of the FD&C Act with regard to circumstances
under which a facility subject to either of these sections would be
required to have and implement focused mitigation strategies under a
HACCP-like system to address intentional adulteration related to
terrorism. In summary, this proposed rule would require a facility to
implement focused mitigation strategies if one or more of four key
activity types are applicable to its food operation or if a facility
conducts its own vulnerability assessment and identifies actionable
process steps for significant vulnerabilities in its food operation.
The identification of a production step for a food as necessitating
focused mitigation strategies is premised upon an analysis, based on
CARVER+Shock methodology, that an attack at these points in the
production of a food would likely result in an outcome that is
consistent with our understanding of the goal of terrorist
organizations (i.e., maximizing adverse public health impacts and, to a
lesser extent, economic disruption) (Ref. 54). For human foods, our
analyses show the potential for significant human morbidity and
mortality should intentional adulteration occur at any one or more of
these points in a food operation. (Significant economic harm is also
likely, related to the human morbidity and mortality as well as
disruption in the food supply as a result of loss of consumer
confidence in its safety.) In contrast, for animal food, our analysis
shows only minimal potential for human morbidity or mortality as a
result of attacks at key activity types or other points in an animal
food operation. Significantly, our CARVER+Shock vulnerability
assessments of animal food have had to focus entirely on economic
consequences because of the lack of potential for human morbidity and
mortality.
In considering whether to provide an exemption related to animal
food, we evaluated three types of possible attack scenarios: (1)
Incorporation of a contaminant into feed to be used for muscle meat-
producing animals; (2) incorporation of a contaminant into feed to be
used for egg-producing or milk-producing animals; and (3) incorporation
of a contaminant into pet food. With regard to the two former
scenarios, we are not aware of contaminants that could be incorporated
into feed at levels that would not produce noticeable clinical signs
and/or mortality in animals but would result in significant human
morbidity or mortality among consumers that subsequently eat the meat,
eggs or milk (Ref. 55). While contaminants can increase the risk of
chronic disease, such as cancer, among consumers (Ref. 56), such an
outcome is not consistent
[[Page 78038]]
with our understanding of the goals of terrorist organizations, which
include a more immediate impact. We recognize that such an attack could
result in significant economic disruption because of the loss of
consumer confidence in the safety of the food supply. While important,
attacks of that nature fall significantly below those involving human
morbidity and mortality when placed on a scale of risk with regard to
targeting by terrorist organizations.
Regarding the third attack scenario (incorporation of a contaminant
into pet food), we are aware of contaminants that could be incorporated
into feed or pet food that could result in significant animal
(including pet) morbidity and mortality, including some which could
result in secondary infectious spread of disease (because some
infectious agents can be transmitted orally as well as through
aerosol). Again, such attacks could be significant from an economic and
societal standpoint. However, the risk that they pose with regard to
targeting by terrorist organizations appears to be significantly lower
than those involving human morbidity and mortality. We request comment
on this assessment of risk.
Therefore, notwithstanding the likely presence of one or more of
the four key activity types in the production of many animal foods, we
have tentatively concluded that animal food (regardless of whether it
is produced at a facility solely engaged in the production of animal
food or at a facility engaged in the production of both animal and
human food) does not involve significant vulnerabilities that require
focused mitigation strategies under section 418 of the FD&C Act and is
not at high risk for intentional adulteration related to terrorism
under section 420 of the FD&C Act. Consequently, we are proposing to
exempt the manufacturing, processing, packing, and holding of food for
animals other than man. We request comment on these tentative
conclusions.
C. Food Defense Measures
In subpart C of proposed part 121, FDA is proposing various food
defense measures, including requirements for a food defense plan,
identification of actionable process steps, implementation of focused
mitigation strategies and related monitoring, corrective actions, and
verification, and training of certain personnel. We discuss the
provisions of proposed subpart C in this section.
1. Food Defense Plan
a. Proposed Sec. 121.126(a)--Requirement for a Food Defense Plan.
Proposed Sec. 121.126(a) would require that the owner, operator, or
agent in charge of a facility prepare, or have prepared, and implement
a written food defense plan. To make clear that the written plan is
related to food defense rather than to other plans a facility may have
(such as quality control plans or food safety plans), for purposes of
this rulemaking, we have designated the ``written plan'' to be a ``food
defense plan.'' A written food defense plan is essential for a facility
covered by this rule to implement the plan consistently, train its
employees, and periodically reanalyze and update the plan. It is also
essential to auditors, and to inspectors, in the same way written plans
are essential to ensuring food safety. A written food defense plan
addressing vulnerabilities associated with intentional adulteration is
analogous to a written HACCP or food safety plan for hazards associated
with unintentional contamination.
Proposed Sec. 121.126(a) would provide flexibility for the owner,
operator, or agent in charge of the facility to either prepare the
written food defense plan or have that plan prepared, in whole or in
part, on its behalf. In addition, proposed Sec. 121.126 would provide
flexibility for facilities in the development of their food defense
plans by allowing facilities to group food types or production method
types if the vulnerabilities, focused mitigation strategies, and other
required procedures, such as monitoring, are essentially identical.
Proposed Sec. 121.126(a) would require that the owner, operator,
or agent in charge of a facility implement the written food defense
plan. Our proposed requirement to develop and implement a food defense
plan, which includes the identification of actionable process steps and
implementation of focused mitigation strategies, reflects our tentative
conclusion that such actions are measures necessary to prepare and
protect the food supply from intentional adulteration caused by acts of
terrorism. Proposed Sec. 121.126(a) implements sections 418(b), (c),
(d), (e), (f), and (h), and 420(b) of the FD&C Act. We seek comment on
these tentative conclusions.
b. Proposed Sec. 121.126(b)--Contents of a food defense plan.
Proposed Sec. 121.126(b)(1) through (b)(5) would require that the
contents of a food defense plan include:
The written identification of actionable process steps as
required by proposed Sec. 121.130;
The written focused mitigation strategies as required by
proposed Sec. 121.135(b);
The written procedures for monitoring as required by
proposed Sec. 121.140(a);
The written corrective action procedures as required by
proposed Sec. 121.145(a)(1); and
The written verification procedures as required by
proposed Sec. 121.150(e).
Although we are proposing to require that the contents of food
defense plan include only the specific elements described above, the
food defense plan can be used as a resource for facilities to capture
additional food defense-related information. For example, facilities
may also wish to include information, such as process flow diagrams, an
evaluation of broad mitigation strategies, emergency contact
information, crisis management plans, action plans for implementation
of broad mitigation strategies, results of supplier audits, and other
documents, analysis, reviews, or information the facility finds
relevant to its food defense program. FDA has developed and publicly
released the user-friendly FDPB software tool that can be used to
assist a facility to develop a robust food defense plan. This free tool
is available on the FDA Web site at http://www.fda.gov/Food/FoodDefense/ToolsEducationalMaterials/ucm349888.htm.
Proposed Sec. 121.126, if finalized, would establish a requirement
for every facility covered by this rule to have its own written food
defense plan. Like the food safety plan, this facility-based nature of
the written food defense plan is consistent with the overall framework
of section 418 of the FD&C Act, which is directed to a facility rather
than, for example, a corporate entity that may have multiple
facilities.
Proposed Sec. 117.126(c) of the PC proposed rule would require
that the food safety plan be prepared by (or its preparation overseen
by) a qualified individual (See the discussion in section XII.A.4 of
the PC proposed rule). We are proposing to require that the
vulnerability assessment be performed by an individual qualified by
experience and/or training only when facilities choose to identify
actionable process steps in their food defense plans using the
provisions of proposed Sec. 121.130(b), whereby they would perform
their own vulnerability assessment. Our proposal is based on two
considerations. First, we anticipate that most facilities will develop
their food defense plan using the procedure in proposed Sec.
121.130(a) for identification of actionable process steps. Here, FDA
has performed much of the scientific analysis required and identified
the key activity types (see section V.C.2 of this document for
[[Page 78039]]
further discussion). Second, we believe that the identification of
focused mitigation strategies, and the monitoring, corrective action
and verification activities to implement them requires less technical
expertise than required for preventive controls and implementation
procedures for those controls. The former usually involve focused
mitigation strategies to limit access to specific steps in the
production process with simple visual checks to monitor them, while the
latter often involve scientific studies to establish critical limits
with process control instruments to monitor them.
Proposed Sec. 121.126(b) implements sections 418(h) and 420(b)(2)
of the FD&C Act.
We seek comment on our proposed provisions related to the written
food defense plan and its contents.
2. Identification of Actionable Process Steps
a. FDA's vulnerability assessments and FDA-identified key activity
types. As noted in section II.B of this document, under the SPPA
Initiative, FDA, along with USDA, FBI, and DHS, conducted vulnerability
assessments on products and processes in the food and agriculture
sector. After conclusion of the initiative, FDA continued conducting
assessments for products and processes not previously assessed. To
implement section 420(a)(1)(A), FDA combined and analyzed data from a
subset of these assessments (i.e., those relevant to the food
manufacturing and distribution segments of the food system) and
identified activities which consistently ranked high for vulnerability
to intentional adulteration. FDA published the results of this analysis
in April, 2013 (April 2013 Report) (Ref. 54).
CARVER+Shock methodology is a tool for assessing the
vulnerabilities within a food system and determining the most
vulnerable points, and focusing resources on protecting the most
susceptible points. Using the CARVER+Shock methodology, FDA, in
collaboration with other U.S. government partners conducted over 50
vulnerability assessments on a wide range of food products and
processes. Based on these assessments, we identified the processing
steps with the greatest vulnerability to intentional adulteration
caused by acts of terrorism. Through this review, we determined that
the processing steps we identified fit into one of four groups of
activities occurring at those processing steps. We refer to these as
``key activity types.'' The key activity types that we have identified
are: (1) Bulk liquid receiving and loading, (2) Liquid storage and
handling, (3) Secondary ingredient handling, and (4) Mixing and similar
activities. In this proposed rule we have modified the activity type
names and descriptions from those in the April 2013 Report for clarity.
Providing these key activity types to facilities for their use in
identifying actionable process steps and developing focused mitigation
strategies provides some advantages over other approaches that we might
have taken, such as identifying points in the production of specific
foods at increased risk for intentional adulteration caused by an acts
of terrorism, or requiring each facility to perform its own
vulnerability assessment. First, publicly providing a list of key
activity types does not disclose sensitive information, as might be the
case if we provided CARVER+Shock scores derived from our vulnerability
assessments for process steps for specific foods.
Second, providing a list of key activity types rather than
requiring facilities to perform their own facility-specific
vulnerability assessments relieves the burden upon the facility to
assemble a team of individuals with the diverse expertise needed to
properly self-score the steps in their process (using the CARVER+Shock
Vulnerability Assessment software tool or another suitable tool). When
we performed vulnerability assessments during the SPPA initiative our
teams included individuals with expertise in the production of the food
under study, law enforcement, food science, food regulatory systems,
and public health. We expect that such an effort is likely beyond the
capacity of many facilities. Further, by providing a list of key
activity types, we eliminate the need to identify a CARVER+Shock score,
for example, as the threshold for the implementation of focused
mitigation strategies. This is important because CARVER+Shock scores
are somewhat subjective and difficult to correlate across food types,
making identification of a universal threshold score challenging.
b. Proposed Sec. 121.130--Requirement for written identification
of actionable process steps. Proposed Sec. 121.130 would require that
the owner, operator, or agent in charge of a facility identify any
actionable process steps, using the procedures in either proposed Sec.
121.130(a) or proposed Sec. 121.130(b). A facility would be required
to follow either one of the two specified procedures, but not both.
Proposed Sec. 121.130 would also require that the identification
of actionable process steps and the assessment leading to that
identification be written. A written assessment of whether the facility
has one or more of the key activity types (under proposed Sec.
121.130(a)) or a written vulnerability assessment (under proposed Sec.
121.130(b)) would help the facility organize its assessment, and fully
understand the nature of the vulnerabilities. In addition, it is
essential for auditors and inspectors to assess the adequacy of the
facility's assessment. This written identification of actionable
process steps would also be essential during reanalysis of the food
defense plan, as would be required by proposed Sec. 121.150(d). Such a
written document would also be useful for training purposes as a tool
to make employees aware of the elements of the facility's food defense
plan.
The written identification of actionable process steps must include
the justification for whatever conclusion the owner, operator, or agent
in charge of a facility reaches. Proposed Sec. 121.130 would not limit
the requirement for a written identification of actionable process
steps to only those circumstances where the owner, operator, or agent
in charge of a facility identifies one or more actionable process
steps. Rather, under proposed Sec. 121.130, a written analysis would
be required even if the conclusion of the analysis is that there are no
actionable process step.
If a facility chooses to identify actionable process steps using
the procedure in proposed Sec. 121.130(a), the written documentation
would not need to include the procedures for assessing the
vulnerabilities associated with identified actionable process steps. If
a facility chooses to identify actionable process steps using the
procedure in proposed Sec. 121.130(b), the written identification of
actionable process steps must include information about the appropriate
methods used to conduct the vulnerability assessment and identify
actionable process steps, and the experience and training of the
person(s) who conducted that assessment (see also discussion in section
V.C.2.d of this document).
Proposed Sec. 121.130 implements sections 418(b)(2), 418(b)(3),
420(a)(1), and 420(b)(1) of the FD&C Act.
c. Proposed Sec. 121.130(a)--Identification of actionable process
steps using FDA-identified key activity types. Proposed Sec.
121.130(a) would specify the first of two procedures by which the
proposed requirement for identification of actionable process steps in
proposed Sec. 121.130 can be met, i.e., using the FDA-identified key
activity types.
[[Page 78040]]
Proposed Sec. 121.130(a) would state that the owner, operator, or
agent in charge of a facility must assess, for each type of food
manufactured, processed, packed or held at the facility, whether the
facility has one or more of the following key activity types and
identify the actionable process steps associated with any key activity
types present:
1. Bulk liquid receiving and loading--a step in which a bulk liquid
is received and unloaded from an inbound conveyance or loaded into an
outbound conveyance where a contaminant can be intentionally introduced
and, if it is, it is likely that the contaminant will be distributed
throughout the liquid due to sloshing, movement, or turbulence caused
by the receiving and unloading or loading activity;
2. Liquid storage and handling--a step in which a liquid is
contained in bulk storage tanks or in holding, surge, or metering tanks
where a contaminant can be intentionally introduced and, if it is, it
is likely that the contaminant will be distributed into the food;
3. Secondary ingredient handling--a staging, preparation, addition,
or rework step where a contaminant can be intentionally introduced into
a relatively small amount of ingredient or rework and, if it is, it is
likely that the contaminant will be distributed into a larger volume of
food; and
4. Mixing and similar activities--a step, such as mixing, blending,
homogenizing, or grinding where a contaminant can be intentionally
introduced and, if it is, it is likely that the contaminant will be
distributed into the food.
The owner, operator, or agent in charge would be required to assess
whether the facility has a food process that involves any one or more
of the specified four key activity types. If the food process is found
to involve any key activity types, the owner, operator, or agent would
be required to identify actionable process step(s) that are associated
with each key activity type that is present.
For example, based on proposed Sec. 121.130(a), a facility may
identify a mixing tank as involving the key activity type, Mixing and
similar activities, in its operation because the mixing tank has an
unsecured lid and several sample ports which provide direct access to
the food product and because a contaminant can be introduced into the
tank through the lid or one of the sampling ports and, if it is, the
contaminant would be distributed into the food. The owner would
conclude that the mixing tank is an actionable process step. We would
expect that this conclusion would be reached for virtually all steps
that involve mixing, blending, homogenizing, or grinding because these
kinds of process steps generally: (1) Present an opportunity for access
to the product at or just prior to the equipment (e.g., in-feed
conveyor); and (2) would cause a contaminant, if intentionally added,
to be distributed into the food. We expect this conclusion to be
reached regardless of whether the facility may already have mitigation
strategies in place to impede access to the mixing tank (e.g., a
``buddy system'' that ensures that at least two employees were present
at the mixing tank at all times or a lock on the mixing tank access
ports). The presence of mitigation strategies should not be considered
when assessing whether a facility has a process step that involves one
of the key activity types. Any existing mitigation strategies and their
adequacy to significantly minimize or prevent the significant
vulnerability should be considered at a later step when identifying
appropriate focused mitigation strategies, in accordance with proposed
Sec. 121.135.
We acknowledge the possibility, although not likely, that
circumstances may exist where access at or just prior to the equipment
is not possible (i.e., because the equipment is fully enclosed, with no
access ports), and that in such a situation this process step would not
be identified as fitting within the key activity type. For example, the
owner of the same facility may assess a second mixing tank that is part
of an entirely closed system, with no direct access points into the
system, such that an individual attempting to access this mixing tank
would likely cause a major disruption to the line, foiling any
attempted intentional adulteration. Based on this assessment, the owner
may conclude that the enclosed nature of this second mixing tank
renders the product inaccessible at this step and, therefore, it does
not fit within the key activity type. In this circumstance, there would
be no requirement to identify an actionable process step associated
with this mixing tank (in which case, there also would be no
requirement to implement a focused mitigation strategy at this step).
Under proposed Sec. 121.130, the owner would be required to document
the basis for the determination that the second mixing tank does not
fit within the key activity type. The second mixing tank would continue
to be subject to the requirement for reanalysis of a food defense plan,
as proposed in Sec. 121.150(d) and the facility would consider the
applicability of the four key activity types during reanalysis. We
request comment on whether there are specific process steps for
specific products that otherwise fit within one of the four key
activity types but for which access to the equipment is not possible
(i.e., because the equipment is fully enclosed, with no access ports).
If the owner, operator, or agent in charge determines that the food
operation does not involve any of the key activity types, there would
be no need to identify actionable process steps. Such a facility,
however, would still be required to document its finding that none of
the key activity types apply to its food processes, under proposed
Sec. 121.130. The documentation would be a part of the written food
defense plan required under proposed Sec. 121.126. Such a facility
would continue to be subject to the requirement for reanalysis of a
food defense plan, as proposed in Sec. 121.150(d).
Proposed Sec. 121.130(a) would require that the process of
identification of actionable process steps be done ``for each type of
food manufactured, processed, packed, or held at the facility.'' The
vulnerability of a food to intentional contamination may differ based
on the type of food and associated process, practices, and conditions
at the facility. Therefore, we are proposing that the facility assess
whether it has any of the key activity types for each type of food that
is manufactured, processed, packed, or held at that facility. A
facility may find that its operation related to one type of food
manufactured at that facility involves one or more of the key activity
types, but all other types of food manufactured at that facility do not
involve any of the key activity types. In such an instance, actionable
process steps would need to be identified and focused mitigation
strategies implemented only for the food type that involved the key
activity types.
Description of key activity types--As discussed in section V.C.2.a
of this document, our vulnerability assessments revealed four key
activity types that most commonly rank high: Bulk liquid receiving and
loading; Liquid storage and handling; Secondary ingredient handling;
and Mixing and similar activities. We have tentatively concluded that
the presence of any of these four key activity types in a food
operation indicates a significant vulnerability for intentional
contamination caused by acts of terrorism. Based on our assessments, we
believe that these four key activity types capture the significant
vulnerabilities in a food operation. However, although generally
unlikely, a vulnerability
[[Page 78041]]
assessment of a specific food at a specific facility conducted under
proposed Sec. 121.130(b) may identify significant vulnerabilities at
actionable process steps that are not associated with one of these four
key activity types. We seek comment on our tentative conclusion.
Proposed Sec. 121.130(a)(1) would identify ``Bulk liquid receiving
and loading'' as a key activity type, based on our finding that this
activity type commonly ranked high in our vulnerability assessments.
Proposed Sec. 121.130(a) would describe this key activity type as a
step in which a bulk liquid is received and unloaded from an inbound
conveyance or loaded into an outbound conveyance where a contaminant
can be intentionally introduced and, if it is, it is likely that the
contaminant will be distributed throughout the liquid due to sloshing,
movement, or turbulence caused by the receiving and unloading or
loading activity. Bulk liquid receiving refers to the inbound movement
of liquid product into a facility for its use in the food production
process, whereas bulk liquid loading refers to the outbound movement of
liquid product from a facility for further processing or use by an end
customer/consumer. Examples of products that may be received or loaded
in bulk include juices, high fructose corn syrup and other sweeteners,
milk, animal fats, syrups, and vegetable oils.
Bulk liquid receiving and loading refers to any processing step
where a liquid ingredient is being received and unloaded at a facility
or a liquid intermediate or finished product is being loaded into an
outbound shipping transport vehicle and for which there is an
opportunity for a contaminant to be intentionally introduced into the
food. This key activity type incorporates the actions of opening the
transport vehicle, attaching any pumping equipment or hoses, and
opening any venting hatches. The characteristics associated with these
activities are such that there is a high probability of a contaminant,
if intentionally added, mixing within the liquid, due to significant
sloshing, movement, and turbulence associated with the receiving or
loading activity. In addition, the need for worker activity associated
with these processing steps provides access to hoses, the transport
vessel, and potentially the product as it is being received or loaded.
Proposed Sec. 121.130(a)(2) would identify ``Liquid storage and
handling'' as a key activity type, based on our finding that this
activity type ranked high in our vulnerability assessments. Proposed
Sec. 121.130(a) would describe this key activity type as a step in
which a liquid is contained in bulk storage tanks or in holding, surge,
or metering tanks where a contaminant can be intentionally introduced
and, if it is, it is likely that the contaminant will be distributed
into the food. This key activity type refers to any processing step
where a liquid ingredient or intermediate or finished liquid product is
stored in either bulk storage tanks or smaller secondary, non-bulk
holding tanks or surge tanks and for which there is an opportunity for
a contaminant to be intentionally introduced into the food. Bulk liquid
storage refers to any storage silo or tank where liquid product may be
stored prior to introduction into the product stream or prior to
loading for outbound shipping. Non-bulk tanks can be used to store non-
bulk liquid ingredients (e.g., fats, oils, vitamin mixes, and
sweeteners), hold liquid product for sample testing and other quality
control activity, or to control flow rates of liquid ingredients or
product through the production system. Non-bulk storage tanks also
include tanks or totes where the tamper evident seals are opened and
the container itself is used for holding. Both categories of liquid
storage can be considered key processing steps because if a contaminant
were successfully introduced, there is a high probability of a
contaminant mixing within the liquid due to the agitation commonly used
to prevent separation within the liquid medium. Access necessary for
the introduction of a contaminant is generally available through
hatches, sample ports, and the container lid (in the case of a tanker
or tote for which the tamper evident seal has been broken).
Proposed Sec. 121.130(a)(3) would identify ``Secondary ingredient
handling'' as a key activity type, based on our finding that this
activity type commonly ranked high in our vulnerability assessments.
Proposed Sec. 121.130(a) would describe this key activity type as the
staging, preparation, addition, or rework step where a contaminant can
be intentionally introduced into a relatively small amount of
ingredient or rework and, if it is, it is likely that the contaminant
will be distributed into a larger volume of food. This key activity
type refers to any processing step where ingredients (either dry or
liquid) are manipulated prior to or during addition to the product
stream by human contact and for which there is an opportunity for a
contaminant to be intentionally introduced into the food. ``Staging''
refers to the process of opening the tamper evident packaging of a
secondary ingredient and moving the ingredient to the production area
in advance of being added into the primary product stream.
``Preparation'' refers to any act of measuring, weighing, premixing, or
otherwise manipulating the ingredient prior to addition to the product
stream. ``Addition'' refers to any act of physically adding ingredient
directly into the product stream or into surge or meter hoppers in
order to deliver the ingredient into the product stream. ``Rework''
refers to clean, unadulterated food that has been removed from
processing for reasons other than insanitary conditions or that has
been successfully reconditioned by reprocessing and that is suitable
for use as food. Staging, preparation, addition, and rework involving
secondary ingredients are key activities because a contaminant added to
a relatively small volume of product would be distributed into the
large product flow as the ingredient or rework is combined with the
other components of the food. Secondary ingredient staging,
preparation, addition, and rework are generally open and accessible and
that accessibility is an inherent component of the activity. Thus,
these key activities provide a potential point of access where a
contaminant could be introduced into the product stream.
Proposed Sec. 121.130(a)(4) would identify ``Mixing and similar
activities'' as a key activity type, based on our finding that the
activities commonly ranked high in our vulnerability assessments.
Proposed Sec. 121.130(a) would describe this key activity type as a
step, such as mixing, blending, homogenizing, coating, glazing, or
grinding where a contaminant can be intentionally introduced and, if it
is, it is likely that the contaminant will be distributed into the
food. This key activity type refers to any processing step where there
is an opportunity for a contaminant to be intentionally introduced into
the food, and the primary purpose or result of the processing step is:
(1) Coating, i.e., to layer a powder or liquid onto the surface of a
product, such as a batter, breading, glazing or flavoring; (2) mixing,
i.e., to blend a powder, dough, or liquid ingredient together; (3)
grinding, i.e., to reduce the particle size of a solid ingredient or
mass to a smaller granularity; or (4) homogenizing, i.e., to reduce the
particle size of an ingredient and disperse it throughout a liquid.
These are key activities because a potential contaminant
successfully added at one of these steps would generally be readily
dispersed throughout the product. Further, access is generally
available through access ports, lids, and in-feed conveyors or
[[Page 78042]]
flumes. Examples of equipment associated with these activities include:
Mixers, blenders, homogenizers, cascade breaders, mills, grinders, and
pulverizers.
We seek comment on these key activity types, and whether they are
each appropriate to include and whether there are additional activities
that present significant vulnerability to intentional adulteration
caused by acts of terrorism.
Proposed Sec. 121.130(a) implements sections 418(a) through (c)
and 420(a)(1)(A) of the FD&C Act.
d. Proposed Sec. 121.130(b)--Identification of actionable process
steps by conducting a vulnerability assessment. Proposed Sec.
121.130(b) would provide the second of two options for identification
of actionable process steps. Proposed Sec. 121.130(b) would specify
that the owner, operator, or agent in charge of a facility must conduct
or have conducted, for each food type manufactured, processed, packed
or held at the facility, an evaluation to identify and prioritize the
points, steps, and procedures in a food operation based on their
vulnerability to intentional adulteration and to identify actionable
process steps.
Proposed Sec. 121.130(b) would provide flexibility to the owner,
operator, or agent in charge of a facility covered by this rule to
conduct, or have conducted, their own vulnerability assessment of the
food operations at a facility, rather than assessing their food
operation against the FDA-identified key activity types. We are
proposing that a vulnerability assessment conducted under proposed
Sec. 121.130(b) must be performed by an individual(s) qualified by
experience and/or training using appropriate methods. Training or job
experience is essential to the effective evaluation of vulnerabilities
and identification of actionable process steps. Only a trained
individual or individual qualified by job experience using appropriate
methods would be capable of effectively conducting a vulnerability
assessment, including assessing the various points, steps, or
procedures in a food process; identifying and prioritizing those
points, steps, or procedures in a food process that are susceptible to
intentional contamination; and identifying actionable process steps
where food defense measures are essential to address significant
vulnerabilities. Our proposed definition of significant vulnerability
(in proposed Sec. 121.3), too, reflects the need for a qualified
individual to make such assessments where focused mitigation strategies
would be necessary to protect the food from intentional adulteration
caused by acts of terrorism. As noted above, when we performed
vulnerability assessments during the SPPA initiative our teams included
individuals with expertise in the production of the food under study,
law enforcement, food science, food regulatory systems, and public
health. While we are not proposing to specify the particular training
or experience requirements of the individual(s) qualified to conduct
such vulnerability assessments, or the particular methods that must be
used to conduct these assessments, facilities choosing this procedure
in proposed Sec. 121.130(b) would be required to employ appropriate
methods and use a qualified individual(s) to conduct a robust and
scientifically sound vulnerability assessment of the facility's food
operation. FDA's resources available online, such as the CARVER+Shock
Vulnerability Assessment software tool and the FDPB software tool may
be helpful.
Finally, as in the case of proposed Sec. 121.130(a), proposed
Sec. 121.130(b) would require that the process of identification of
actionable process steps be done ``for each type of food manufactured,
processed, packed, or held at the facility.'' See discussion in section
V.C.2 of this document.
Elements of a Facility-Specific Vulnerability Assessment--The
elements of an approach to conducting a facility-specific vulnerability
assessment are:
Planning to conduct a vulnerability assessment--collect
and evaluate appropriate background information on biological,
chemical, physical, and radiological agents of concern, such as those
found in the CDC's Select Agents and Toxins List (Ref. 57);
Assembling the vulnerability assessment team--identify
appropriate individuals within the organization to assist in the
vulnerability assessment process. This may include personnel working in
the areas of security, food safety/quality assurance or control, human
resources, operations, maintenance, and other individuals deemed
necessary to facilitate the formation of a vulnerability assessment;
Developing a process flow diagram--list out each of the
steps in the food process to be evaluated;
Identifying significant vulnerabilities--evaluate each
process step to prioritize vulnerabilities and identify significant
vulnerabilities. For each process step, the evaluation should consider,
at a minimum: (1) The potential public health impact if a contaminant
were added; (2) whether downstream processing steps would eliminate or
remove agents of concern; (3) the degree of physical access to product;
(4) the ability of an aggressor to successfully contaminate the
product; and (5) the volume of product impacted. This evaluation should
also include the rationale or justification for which process steps
were and were not identified as significant vulnerabilities; and
Identifying actionable process steps--for identified
significant vulnerabilities, indicate where actionable process steps
exist in the food process and where associated focused mitigation
strategies would be required to be implemented, under proposed Sec.
121.135.
Facilities that choose this alternative may need assistance from
outside experts who are knowledgeable in food defense and vulnerability
assessments. Some facilities may not have the resources or the
necessary expertise on site and expert advice may be obtained when
necessary from other sources, such as trade and industry associations,
independent experts, and regulatory authorities.
We seek comment on the need for, and appropriateness of, proposed
Sec. 121.130(b), including whether, in a final rule, we should specify
the particular qualifications of individual(s) performing the
vulnerability assessment or the methods that must be used under this
alternative procedure, and whether the vulnerability assessment
elements, we described previously, provide sufficient direction
regarding appropriate methodology.
Proposed Sec. 121.130(b) implements sections 418(a) to (c) and
420(a)(1)(A) of the FD&C Act.
3. Focused Mitigation Strategies
a. Requirements of sections 418 and 420 of the FD&C Act. Section
418(c)(2) of the FD&C Act, in relevant part, specifies that the owner,
operator, or agent in charge of a facility shall identify and implement
preventive controls to provide assurances that hazards identified in
the hazard analysis conducted under section 418(b)(2) of the FD&C Act
will be significantly minimized or prevented and addressed, consistent
with section 420 of the FD&C Act, as applicable. Section 418(c)(1)(3)
of the FD&C Act, in relevant part, specifies that the preventive
controls must also provide assurances that the food manufactured,
processed, packed, or held by such facility will not be adulterated
under section 402 of the FD&C Act. Section 418(h) of the FD&C Act
requires that the owner, operator, or agent in charge of a facility
prepare a written food safety plan that, among
[[Page 78043]]
other things, identifies the preventive controls within the plan.
Section 420(b) of the FD&C Act requires FDA to issue regulations to
protect against the intentional adulteration of food. Such regulations
are to specify appropriate science-based mitigation strategies or
measures to prepare and protect the food supply chain at specific
vulnerable points, as appropriate (section 420(b)(2) of the FD&C Act).
Section 418(o)(3) of the FD&C Act defines preventive controls as
``those risk-based, reasonably appropriate procedures, practices, and
processes that a person knowledgeable about the safe manufacturing,
processing, packing, or holding of food would employ to significantly
minimize or prevent the hazards identified under the hazard analysis
conducted under [section 418(b) of the FD&C Act] and that are
consistent with the current scientific understanding of safe food
manufacturing, processing, packing or holding at the time of the
analysis.'' The definition provides that ``those procedures, practices,
and processes may include the following: (A) Sanitation procedures for
food-contact surfaces and utensils and food-contact surfaces of
equipment; (B) Supervisor, manager, and employee hygiene training; (C)
An environmental monitoring program to verify the effectiveness of
pathogen controls in processes where a food is exposed to a potential
contaminant in the environment; (D) A food allergen control program;
(E) A recall plan; (F) Current Good Manufacturing Practices (cGMPs)
under part 110 of title 21, Code of Federal Regulations (or any
successor regulations); (G) Supplier verification activities that
relate to the safety of food.'' (emphasis added)
In section V.A.2 of this document, we discuss our proposed
definition of focused mitigation strategy and its relationship to the
definition of preventive controls in section 418(o)(3) of the FD&C Act.
We are not proposing requirements for sanitation procedures, hygiene
training, environmental monitoring, food allergen control, and CGMPs
because these examples are relevant to food safety, but not to food
defense. We considered proposing to require a recall plan (as we did in
the PC proposed rule in proposed Sec. 117.135(d)(4); see sections
XII.C.8 and XII.D of that document). However, we tentatively conclude
that the usefulness of a recall plan is greatly reduced in the context
of preventive controls for intentional adulteration. The relationship
between an implementation failure and the status of the food is
different in intentional adulteration and food safety contexts. An act
of intentional adulteration caused by terrorism, historically, has been
a rare event. In the vast majority of cases, the failure to properly
implement a focused mitigation strategy would not be expected to result
in intentional adulteration. With intentional adulteration,
adulteration of food requires not just the opportunity for a
contamination event (i.e., failure of a mitigation strategy to limit
access to an actionable process step), but also someone with intent to
cause harm at that same moment. As such, it is unlikely that a
deviation from the provisions of this proposed rule would necessitate a
recall. In contrast, the failure to properly implement a preventive
control for a food safety hazard (for example, where proper cook
temperatures are not reached in a process) would be expected to more
likely result in a situation where the food becomes adulterated (e.g.,
because the pathogen reasonably likely to be present in the raw food
would not be eliminated from the food by the inadequate cooking
process), potentially necessitating a recall.
b. General description of mitigation strategies. Mitigation
strategies are measures taken by a facility to reduce the potential for
intentional adulteration of food. Based on these vulnerability
assessments, FDA previously developed recommendations for mitigation
strategies that can be implemented, as appropriate, to minimize or
prevent intentional contamination of food. These mitigation strategies
are presented in our guidance documents (Ref. 22, Ref. 23, Ref. 24,
Ref. 25, Ref. 26), the CARVER+Shock Vulnerability Assessment software
tool (Ref. 29), the MSD (Ref. 30), and the FDPB software tool (Ref.
31). FDA divides mitigation strategies into two types: Broad Mitigation
Strategies and Focused Mitigation Strategies. We explain each of these
types in this section of the document.
i. Broad mitigation strategies. Broad mitigation strategies are
general facility-level measures that are intended to minimize a
facility's vulnerability, as a whole, to potential acts of intentional
contamination. Examples of broad mitigation strategies are: (1)
Physical security, such as perimeter security fencing, locking exterior
doors, penetration alarms; (2) personnel security, such as pre-hire
background, reference checks, identification badges, and controlled
visitor access; (3) securing hazardous materials, such as cleaning
products, laboratory materials, and pesticides; (4) management
practices, such as ingredient storage inventory procedures; key
security procedures, PINs or passwords; procedures to restrict personal
items from all food production areas; procedures requiring IDs and
uniforms to be returned when a person's employment ends; and supplier
verification or certification procedures; and (5) crisis management
planning, such as maintenance of updated emergency contact information,
procedures for responding to reported threats, and establishment of a
designated food defense leadership team.
Broad mitigation strategies, by nature, are generally applicable to
a facility, regardless of the type of food being processed, and, as
such, are not targeted to a specific processing step in a food
operation. Broad mitigation strategies address facility-wide
vulnerabilities that may present an opportunity for an attacker to
access the facility and intentionally adulterate food. Broad mitigation
strategies serve as foundational actions or procedures that improve a
facility's overall defense against intentional contamination caused by
acts of terrorism.
We are proposing to require the implementation of focused
mitigation strategies only. However, as set out in our guidance
documents (Ref. 22, Ref. 23, Ref. 24, Ref. 25, Ref. 26), we think it is
prudent for facilities to review our guidance and implement those broad
mitigation strategies that are appropriate to minimize the risk for
intentional adulteration of food.
ii. Focused mitigation strategies. As discussed in section V.A of
this document, we are proposing to define focused mitigation strategies
as those risk-based, reasonably appropriate measures that a person
knowledgeable about food defense would employ to significantly minimize
or prevent significant vulnerabilities identified at actionable process
steps, and that are consistent with the current scientific
understanding of food defense at the time of the analysis.
Focused mitigation strategies are specific to an actionable process
step in a food operation where a significant vulnerability is
identified. They represent reasonably appropriate measures that are
necessary to reduce the likelihood of intentional contamination caused
by an act of terrorism at that process step. Focused mitigation
strategies are customized to the processing step at which they are
applied, tailored to existing facility practices and procedures, and
depend on an evaluation of the vulnerabilities identified in a
vulnerability assessment. When properly implemented, focused
[[Page 78044]]
mitigation strategies by themselves are sufficient to significantly
minimize or eliminate the chances that an attacker would be successful
if an act of intentional adulteration were attempted at the specific
process step. Focused mitigation strategies focus on minimizing either
the accessibility of an attacker to the product at a particular process
step or the opportunity for the attacker to successfully contaminate
the product at that process step, or both.
Based on our vulnerability assessments, we tentatively conclude
that the implementation of focused mitigation strategies at actionable
process steps in a food operation is necessary to minimize or prevent
the significant vulnerabilities that are identified in a vulnerability
assessment (Ref. 21, Ref. 54, Ref. 58), regardless of the existence of
broad mitigation strategies. Although broad mitigation strategies are
important to further reduce the vulnerability for intentional
contamination, they are not sufficient to significantly minimize the
risk of intentional contamination caused by an act of terrorism because
broad mitigation strategies are not specific enough, for example, to
counter the actions of an attacker who has legitimate access to the
facility (i.e., insider attack) or an attacker who circumvents
perimeter protections (e.g., scaling a fence), with the goal of
intentionally contaminating the food. Focused mitigation strategies, on
the other hand, are targeted to actionable process steps identified in
a food operation to reduce the likelihood of intentional contamination
at those process steps and, therefore, are essential to ensure that
appropriate food defense measures are taken to protect the food from
intentional contamination caused by acts of terrorism. In contrast to
broad mitigation strategies, focused mitigation strategies are targeted
to actionable process steps and, therefore, are more effective at
countering an attacker who has legitimate access to the facility. We
have tentatively concluded that we will continue to encourage the
implementation of broad mitigation strategies on a voluntary basis, but
we will require the implementation of focused mitigation strategies at
actionable process steps. We request comment on this tentative
conclusion, and on whether we should include, in a final rule, a
requirement for the implementation of any broad mitigation strategies.
iii. Examples of focused mitigation strategies for FDA-identified
key activity types. For the FDA-identified key activity types, a
variety of focused mitigation strategies may be applicable, dependent
both on the food manufactured, processed, packed, or held at the
facility and on the practices and processes employed at that facility.
We list in this section some examples of focused mitigation strategies
that may be appropriate to implement at actionable process steps for
each of these four key activity types. While the decision of which and
how many focused mitigation strategies would be appropriate to employ
at an actionable process step is dependent upon the physical layout and
operation at a specific facility, the examples presented in the section
immediately below illustrate the decision-making process to identify
and determine appropriate focused mitigation strategies at an
actionable process step.
Bulk liquid receiving and loading--Examples of focused mitigation
strategies that may be appropriate include the following:
1. Controlling access to the receiving or loading area,
conveyances, and equipment, including hoses and pumping machinery, to
prevent an unauthorized person from gaining access to the food during
receiving or loading. Access controls may include: strategies to easily
identify authorized persons, such as color-coded uniforms or badges;
restricting conveyance drivers to areas away from the receiving or
loading area (e.g., restricting them to a lounge or break room);
securing hoses with locking caps or in cabinets; and ensuring that
conveyance access hatches, vents, and inspection ports are secured;
2. Ensuring adequate lighting in the receiving or loading area,
which reduces the ability of an attacker to disguise his or her
actions. Adequate lighting in and around vulnerable areas of a food
operation increases the likelihood that other staff will witness the
actions of an attacker and enable them to take steps to prevent or
react to contamination;
3. Increasing observation of the receiving or loading area, which
reduces the ability of an attacker to disguise his or her actions. For
example, maximizing the line of sight by removing boxes, crates, or
other obstructions from the area; positioning quality control personnel
in the receiving or loading area to supervise operations; or utilizing
closed-circuit TV systems or other monitoring devices;
4. Verifying that seals on a shipping conveyance are intact prior
to receiving or after loading a bulk liquid to reduce the likelihood
that the shipping conveyance was or is accessed during transport to
introduce a contaminant into the product;
5. Establishing and implementing a policy for driver check-in and
identification to help confirm driver identity and verify the
individual is authorized, through verification of shipping
documentation or other means, to deliver or pick-up the shipment and
reduce the likelihood that an attacker could fraudulently pose as a
driver as a means of gaining access to the facility; and
6. Inspecting the shipping conveyance prior to loading bulk liquids
to help ensure that no contaminant has been introduced to the
conveyance chamber that could then contaminate the product once the
product is loaded.
Liquid storage and handling--Examples of focused mitigation
strategies that may be appropriate include the following:
1. Controlling access to liquid storage, holding, surge, or
metering tanks, similar to the strategies that may be applied for
controlling access to bulk liquid receiving and holding;
2. Ensuring that the area around liquid storage, holding, surge, or
metering tanks is free of unrelated materials, such as personal items
(backpacks, purses, or packages), and other items that are not directly
related to the food operation, to reduce the likelihood of a
contaminant being brought into the area for introduction into the tank;
3. Ensuring adequate lighting in and around liquid storage,
holding, surge or metering tanks, similar to the strategies that may be
applied for ensuring adequate lighting at bulk liquid receiving and
loading;
4. Installing one-way sample ports in liquid storage, holding,
surge, or metering tanks , so that food product can be drawn out of the
equipment but a contaminant cannot be inserted into the tank;
5. Inspecting tanks prior to filling to help ensure that no
contaminant has been introduced into the empty tank that could then
contaminate the product once loaded;
6. Inspecting pumping or metering equipment prior to use to help
ensure that no contaminant has been introduced into the equipment that
could contaminate the product;
7. Using enclosed tanks and transfer systems to move materials to
reduce the potential for an attacker to access the product and
introduce a contaminant; and
8. Positioning holding, surge, or metering tanks to increase
visibility, such that frequent observation is facilitated and
visibility of activity around the tank is improved. This
[[Page 78045]]
focused mitigation strategy may be less practical for longer term
storage tanks.
Secondary ingredient handling--Examples of focused mitigation
strategies that may be appropriate include the following:
1. Controlling access to ingredient handling areas, including where
secondary ingredients or rework are staged, prepared, or added to the
product stream, to prevent an unauthorized person from gaining access
to the ingredients or rework during these processes. As with other key
activity types, access controls may include strategies to easily
identify authorized persons, such as with color coded uniforms or
badges, or conducting ingredient handling activities in areas behind
locking gates, doors, or other barriers;
2. Ensuring the secondary ingredient handling area is free of
unrelated materials, such as personal items or other items not directly
related to the activity, to help ensure that a contaminant is not
brought into the area for introduction into the ingredient during
staging, preparation, or addition;
3. Ensuring adequate lighting and increasing visibility in and
around ingredient staging and handling areas, similar to the strategies
that may be employed to ensure adequate lighting at bulk liquid
receiving and holding;
4. Reducing staging time to reduce the opportunity for intentional
adulteration. Any time sealed or tamper-evident containers are breached
provides a potential opportunity for an attacker to introduce a
contaminant into the ingredient or rework. Reducing the time
ingredients and rework are staged in unsecured containers reduces the
opportunity for an attacker to adulterate the ingredient or rework;
5. Restricting secondary ingredient handling to senior staff to
reduce the accessibility and opportunity for intentional adulteration;
6. Using peer monitoring in the ingredient handling area, because
requiring at least two staff members to be in the area at any given
time during operations can reduce the opportunity for a contaminant to
be discreetly introduced into the food;
7. Using automated and enclosed ingredient handling equipment, such
as automated computer weighing, measuring, and addition equipment, to
reduce human contact with secondary ingredients or rework and thereby
reduce the opportunity for introduction of a contaminant; and
8. Inspecting secondary ingredients held in staging and
investigating any irregularities in the amount, condition, or
organization of items in secondary ingredient handling areas to
identify circumstances that suggest product contamination before a
contaminated ingredient is added to the product stream.
Mixing and similar activities--Examples of focused mitigation
strategies that may be appropriate include the following:
1. Controlling access to processing areas where mixing and similar
activities are conducted to prevent an unauthorized person from gaining
access to the product and equipment. Access controls may include:
strategies to easily identify authorized persons, such as with color
coded uniforms or badges; conducting these activities in areas behind
locking gates, doors, or other barriers; securing access to overhead
gangways and sampling platforms; and securing hatches, ports, and lids
with locks or access alarm devices;
2. Ensuring that the area is free of unrelated materials, such as
personal items and other items that are not directly related to the
activity, to reduce the likelihood of a contaminant being brought into
the area for introduction into the ingredient during mixing and similar
activities;
3. Ensuring adequate lighting and increasing visibility in and
around mixing and similar activities areas, similar to the strategies
that may be employed to ensure adequate lighting at bulk receiving and
loading;
4. Positioning mixing and similar equipment in a manner that
maximizes visibility, similar to the strategies that may be employed to
maximize visibility for liquid storage and handling;
5. Using one-way sample ports that prohibit introduction of a
contaminant into the mixing or similar equipment, similar to the
strategies that may be employed for liquid storage and handling;
6. Conducting inspections of mixing and similar equipment prior to
use to help ensure no contaminant has been introduced that could
contaminate the product once loaded;
7. Restricting mixing and similar activities to senior staff,
similar to the strategies that may be employed for secondary ingredient
handling;
8. Using peer monitoring in this area to ensure that at least two
staff members are in this area at any given time during operations,
reducing the opportunity for a contaminant to be discreetly introduced
into the food; and
9. Using automated, self-contained, enclosed equipment to reduce
human contact with the product and reduce the opportunity for
introduction of a contaminant.
These examples of focused mitigation strategies are consistent with
measures included in the MSD. The examples are not intended to be an
exhaustive list of appropriate focused mitigation strategies. For
additional guidance on identifying appropriate focused mitigation
strategies, see our guidance documents, the MSD, and other resources
(see section II.D of this document).
iv. Specific examples of determining appropriate focused mitigation
strategies. In this section, we discuss specific examples of the
decision-making process to identify and determine appropriate focused
mitigation strategies at an actionable process step for each of the
FDA-identified key activity types.
Bulk liquid receiving and loading--Unloading at Facility A's bulk
tanker truck unloading bay is an actionable process step for this key
activity type. Facility A has a significant vulnerability related to
access to the food during the unloading of the bulk liquid. At Facility
A, the tanker truck drives into the unloading bay without passing
through any security check-in procedures. A single facility employee is
assigned to this area and takes a facility-owned hose from an open
shelving unit in the unloading bay and attaches it to the tanker
truck's unloading port. The driver of the tanker truck assists in
unloading by opening the venting hatch at the top of the tanker truck
while the facility employee is attaching the hose. The driver then
waits in the unloading bay area while the truck is being unloaded. Upon
completion of unloading activities, the driver gets back in the truck
and exits the facility.
Facility A is not implementing focused mitigation strategies at
this actionable process step such that access to the food during
unloading of the bulk liquid is significantly minimized or eliminated.
The food is significantly vulnerable to an attacker (in this case,
potentially the driver, the facility employee, or a third party) who
could intentionally add a contaminant to the product to adulterate the
food. One approach for Facility A to significantly minimize or
eliminate the significant vulnerability at this actionable process step
is to implement the following focused mitigation strategies:
Establish a receiving check-in and verification procedure
to ensure that the shipment is being delivered by the proper firm and
that the driver is properly identified. The procedure would be
documented and maintained in a shipping log that records the key
identifying information about the driver, tanker truck, and shipping
[[Page 78046]]
documentation for the delivered product. The facility would also
institute a policy requiring that the shipping documentation include
the ID numbers of the seals on the unloading ports so that the facility
employee can verify that seal numbers match the shipping documentation
and that the seals were not broken, tampered with or replaced during
transport.
Implement a procedure to store hoses securely to reduce
the likelihood an attacker could add a contaminant to the hoses when
not in use. This would include storing hoses in locking cabinets and
placing end caps on the hoses. The facility also would issue keys only
to staff working in the tanker truck receiving bay and use a key
numbering and tracking system to verify that all keys are accounted
for.
Increase active observation of the unloading process to
reduce the likelihood of an attacker successfully introducing a
contaminant by requiring two or more production staff members to be
present during unloading activities (i.e., peer monitoring), or
requiring the bulk liquid unloading operations be overseen by a
supervisor or a member of the quality control staff. Alternatively, the
facility could employ video surveillance of the area. If the truck
driver is permitted to remain in the area of the receiving bay, the
introduction of active observation practices ensures that no
contaminant could be intentionally introduced to the product during
unloading activities. Alternatively, the facility could limit the
driver's access to the product by restricting the location of the
driver to designated areas outside the loading area while the truck is
being unloaded.
In this example, the focused mitigation strategies were selected to
achieve the following goals: Establishing the identity of personnel
with access to the food; ensuring that equipment that may be used to
introduce a contaminant is secured when not in use; and providing
active observation of activities at actionable process steps. By
implementing these focused mitigation strategies, the facility could
significantly minimize the significant vulnerability identified at the
actionable process step.
Liquid storage and handling--The storage of liquid in Facility B's
bulk liquid storage tank is an actionable process step for this key
activity type. Facility B's bulk storage tank holding a primary
ingredient is located within its building, and a significant
vulnerability relates to access to the food during such storage. In
Facility B, a network of gangways, ladders, and platforms surround the
bulk liquid storage tank so that personnel can gain access to a hatch
at the top of the tank. Facility B has a procedure for securing this
hatch with a lock, and the facility stores the key to the hatch in the
operations manager's office. To access a key, a worker must request the
key from the operations manager and justify the need to open the lock.
When an employee checks out the key, the manager's assistant records
the employee's name, time the key is checked out, and the reason.
Facility B's bulk liquid storage tank also has a second hatch along the
side which is used for cleaning the tank when empty and is not locked.
This secondary hatch is not accessible while product is in the tank
because it opens inward, and pressure from product in the tank prevents
the hatch from being opened when product is present.
In considering the requirement for focused mitigation strategies at
this actionable process step, Facility B would determine that it has
sufficient safeguards in place to significantly minimize the likelihood
of intentional adulteration from an attacker accessing the hatch on the
top of the bulk storage tank. However, the facility would identify the
secondary hatch as presenting a significant vulnerability for which
insufficient focused mitigation strategies are being implemented. While
food is in the tank, the secondary hatch is secure. However, when the
tank is empty after cleaning, there is an opportunity for an attacker
to introduce a contaminant into the tank via the secondary hatch which
would then contaminate the food when it is added to the tank. To
significantly minimize or eliminate the significant vulnerability
presented by the secondary hatch, the facility would implement focused
mitigation strategies to restrict and document access to the secondary
hatch as is done for the hatch on the top of the tank. To do this, the
facility would install a lock on the secondary hatch and incorporate
the key for the secondary hatch into its existing key management
system. Alternatively, the facility could implement a procedure of
monitoring the condition of the tank interior immediately prior to
reintroducing product to the tank. This monitoring check would be
recorded in a monitoring log.
Facility B already has in place some practices that we would
consider appropriate focused mitigation strategies. The procedures in
place to control access to the top access hatch on the bulk liquid
storage tank are sufficient to minimize the significant vulnerability
presented by this hatch. However, Facility B still has a significant
vulnerability associated with the secondary access hatch, which
required additional focused mitigation strategies to significantly
reduce or eliminate the risk of intentional contamination.
Another example of an actionable process step for the key activity
type ``Liquid Storage and Handling'' is liquid storage in a liquid
surge tank located above an in-line bottling operation at Facility C.
The surge tank is used to control the flow rate of liquid product into
the bottling equipment and is enclosed by an unlocked lid. A ladder and
walkway enable workers to access the surge tank as needed to monitor
product flow and take quality control samples. Facility C has an
operations control room, which is equipped with windows to view the
production floor. However, the view of the bottling operation from the
operations control room is commonly blocked by pallets of empty bottles
awaiting introduction into the bottling equipment.
It is not practical for Facility C to lock the surge tank lid
because workers need to frequently check the status of product flow and
take quality control samples. Also, it is not practical to physically
limit access to the ladder or walkway used to access the surge tank,
for the same reasons. One approach for Facility C to significantly
minimize or eliminate the significant vulnerability at this actionable
process step is to implement the following focused mitigation
strategies:
Implement a policy to prohibit all personnel not
associated with the bottling operation from entering the area and issue
uniforms of a particular color to the bottling personnel only. The
staff working in the bottling area would enforce this policy by
instructing any staff not associated with the bottling operation to
leave the area.
Prohibit staff working in the bottling area from bringing
any items not associated with the bottling operation into the work
area.
Train the staff working in the bottling area in a peer
monitoring program to be attentive to the activity of other staff in
the area.
Stage pallets of empty bottles awaiting introduction into
the bottling equipment in another location to improve line of sight
from the operations control room.
By implementing these focused mitigation strategies, the facility
could significantly minimize or eliminate the significant vulnerability
associated with the actionable process step at the liquid surge tank.
Secondary ingredient handling--Ingredient staging at Facility D is
an actionable process step for this key activity type. Facility D opens
a
[[Page 78047]]
containerized secondary ingredient's tamper evident package, measures
out the required amount into a secondary container, and pre-positions
the ingredient in the production area so that it is readily added to
the product line. Access to the food during each of these activities at
this actionable process step presents a significant vulnerability.
Facility D stages a dry, powdered ingredient near the mixer the night
before it is intended to be used so that it is ready when the
production run begins the next morning. Additionally, the staging area
in Facility D is accessible to all staff and is an open area on the
production floor.
One approach for Facility D to significantly minimize or eliminate
the significant vulnerability at this actionable process step is to
implement the following focused mitigation strategies:
Reduce staging time, by revising its procedures so that
ingredients are staged immediately before they are added into the
product stream. This strategy would reduce the time ingredients are
accessible.
Change its staffing procedures to ensure that only senior
or long-term employees are assigned to measuring and staging secondary
ingredients. Assigning the most trusted employees to work in sensitive
areas reduces the risk of intentional contamination.
Increase its observation of this area by installing
closed-circuit TV cameras to monitor the actions of staff in the
secondary ingredient staging area.
By its nature, the action of ingredient staging is an open and
accessible process step. Focused mitigation strategies must address
personnel access so that the likelihood of an intentional contamination
at this step is significantly reduced or eliminated. By implementing
these focused mitigation strategies, the facility could significantly
minimize the significant vulnerability identified at the actionable
process step.
Mixing and similar activities--Blending in Facility E's dough mixer
is an actionable process step for this key activity type. Facility E
operates a dough mixer to combine several dry and liquid ingredients.
This mixer is not enclosed and is located in an open area of the
facility where it is under regular--though not dedicated--human
observation. While a batch of product is being mixed, the staff member
assigned to the mixer may leave the area to retrieve and prepare
ingredients for the next production batch. The line of sight in this
area is clear, and management in the operations control room located
above the production floor has a clear view of the mixer through an
observation window.
The mixer is vulnerable to an attacker who could intentionally
introduce a contaminant into the food because of the open nature of the
mixer, the lack of constant and dedicated observation, and the lack of
physical access control to the area where it is located. One approach
for Facility E to significantly minimize or eliminate the significant
vulnerability at this actionable process step is to implement the
following focused mitigation strategies:
Install a lid on the mixer that must be opened to add
anything to the mixer. If Facility E determines that it would be
disruptive to the production schedule to install a lock on the lid, the
facility could install an access alarm that would indicate that the lid
has been opened. This alarm would sound in the operation control room
where a manager supervises production operations.
Assign another member of staff the responsibility of
preparing and securely staging ingredients for later production
batches. This would alleviate the need for the mixer operator to leave
the area, leaving the mixer unattended.
With the introduction of these two focused mitigation strategies,
the facility would have taken steps to enclose the mixer, making it
more difficult for an attacker to introduce a contaminant without
alerting management (by the sounding of the alarm), and increased the
dedicated observation of this otherwise vulnerable process step by
ensuring that the mixer operator is not required to leave the area
unattended.
Mixing at Facility F's rotating air dryer is another example of an
actionable process step for the key activity type ``Mixing and similar
activities.'' In Facility F, product, such as crackers or breakfast
cereals, are fed through drum-like equipment, where warm air is blown
across it while the drum rotates. Although the goal of this process is
to dry the product, it also could distribute any contaminant introduced
into the dryer evenly across the product. Facility F's rotating air
dryer is located alongside a commonly used walkway, but is behind a
guard rail to prevent employees from coming in contact with the hot
exterior of the dryer. Product is fed into the top of the dryer via a
pneumatic conveyor. There is sufficient space between the dryer opening
and the pneumatic conveyor discharge to enable an attacker to introduce
a contaminant to the dryer at this point. That opening is about six
feet above the ground, accessible from the floor of the facility.
Product leaves the dryer through a gravity fed line. The connection
between the dryer and the discharge line is sealed.
To goal of focused mitigation strategies at this actionable process
step would be to reduce access to this equipment to significantly
reduce the likelihood an attacker could introduce a contaminant into
the rotating air dryer. One way Facility F could do this would be to
install a clear plastic shield that would be affixed to and extend from
the discharge of the pneumatic conveyor to the opening of the dryer
where it would also be tightly affixed to the housing of the dryer. A
clear plastic shield would enable workers to supervise the product flow
into the dryer while posing as an effective barrier to an attacker
wishing to introduce a contaminant into the product at the dryer. This
engineering improvement would significantly minimize or eliminate
access to the food in the dryer and thereby significantly reduce or
eliminate the likelihood of a successful act of intentional
adulteration at this process step. The installation of physical
barriers to access of equipment at actionable process steps can be one
of the most effective focused mitigation strategies because it does not
require restricting personnel or maintaining active observation of an
area. The implementation of this engineering improvement would be
detailed in the facility's food defense plan.
c. Proposed Sec. 121.135(a)--Requirement to identify and implement
focused mitigation strategies for actionable process steps. Proposed
Sec. 121.135(a) would require that the owner, operator, or agent in
charge of a facility identify and implement focused mitigation
strategies at each actionable process step to provide assurances that
the significant vulnerability at each step will be significantly
minimized or prevented and the food manufactured, processed, packed or
held by such facility will not be adulterated under section 402 of the
FD&C Act. Under Sec. 121.135, we are proposing that, for each of the
identified actionable process steps, the owner, operator, or agent in
charge of a facility covered by this rule identify and implement
focused mitigation strategies. Focused mitigation strategies would be
required only for actionable process steps.
Because a focused mitigation strategy that would be necessary at an
actionable process step must be tailored to address the significant
vulnerability applicable to the specific actionable process step, we
are not proposing to specify the particular focused mitigation
strategies that would be appropriate. Rather, we expect the owner,
operator, or agent in charge of the facility covered by this
[[Page 78048]]
rule to identify the specific focused mitigation strategy(s) that would
be appropriate, considering the facility and food it produces, and to
ensure the proper implementation of those strategies to provide
assurances that the significant vulnerability at each identified
actionable process step is significantly minimized or prevented and the
food is not adulterated. In section V.C.3.b of this document, we list
examples of focused mitigation strategies and describe scenarios for
determining appropriate focused mitigation strategies at actionable
process steps for each of the FDA-identified key activity types.
A facility would have the flexibility to identify and implement
focused mitigation strategies from among all procedures, practices, and
processes available to the facility that would provide the assurances
that would be required by proposed Sec. 121.135. The flexibility
provided under this proposed provision acknowledges the existing
expertise within the food industry in this regard, and recognizes the
complex and varied nature of operations in food facilities.
Additionally, to the extent facilities may already be engaging in
practices that constitute focused mitigation strategies, facilities
should consider whether those measures satisfy the requirements of
proposed Sec. 121.135, such that the implementation of additional
focused mitigation strategies may not be necessary. (Note that
associated requirements, such as monitoring and verification, would
apply).
FDA's existing guidance documents and other resources (discussed in
section II.D of this document) include guidance for industry on a range
of focused mitigation strategies. In particular, the MSD includes a
list of mitigation strategies that can be applied to different steps in
a food operation to reduce the risk of intentional adulteration. The
database is searchable by key words and processing steps common to food
operations (e.g., packing, manufacturing, processing and holding).
Proposed Sec. 121.135(a) implements the provisions in sections
418(c)(2) and 420(b)(2) of the FD&C Act. FDA requests comments on our
analysis and proposed provisions related to mitigation strategies
necessary to protect against intentional adulteration of food caused by
acts of terrorism. We also seek input on whether and, to what extent,
facilities currently employ broad mitigation strategies and focused
mitigation strategies.
d. Proposed Sec. 121.135(b)--Requirement for written focused
mitigation strategies. Proposed Sec. 121.135(b) would require that
focused mitigation strategies for actionable process steps be written.
The focused mitigation strategy(ies) selected for each actionable
process step identified in accordance with proposed Sec. 121.130, and
a justification for how the strategy significantly reduces or
eliminates the risk of intentional adulteration at that actionable
process step(s) must be documented. Similar to preventive controls in a
food safety plan, written focused mitigation strategies in a food
defense plan are essential for the facility to implement the focused
mitigation strategies consistently, and essential for the facility and
inspectors. Written focused mitigation strategies also would be
essential for training purposes and during reanalysis and updates of
the focused mitigation strategies.
Proposed Sec. 121.135(b) implements the provisions in sections
418(h) and 420(b)(2) of the FD&C Act.
e. Proposed Sec. 121.135(c)--Applicability of monitoring,
corrective actions, and verification. Proposed Sec. 121.135(c) would
specify that the focused mitigation strategies required under this
section would be subject to monitoring as would be required by proposed
Sec. 121.140; corrective actions as would be required by proposed
Sec. 121.145; and verification as would be required by proposed Sec.
121.150. Proposed Sec. 121.135(c)(1) through (c)(3) would restate the
requirements of proposed Sec. Sec. 121.140, 121.145, and 121.150 to
clearly communicate the applicability of proposed Sec. Sec. 121.140,
121.145, and 121.150 to the focused mitigation strategies that would be
required under proposed Sec. 121.135 and would establish no new
requirements.
4. Monitoring
a. General description of monitoring. Proposed Sec. 121.3 would
define ``monitor'' to mean ``to conduct a planned sequence of
observations or measurements to assess whether focused mitigation
strategies are consistently applied and to produce an accurate record
for use in verification.'' In developing the proposed monitoring
requirements related to food defense, we considered our proposed
monitoring requirements related to food safety, which are described in
section XII.E of the PC proposed rule. For the same reasons outlined in
the PC proposed rule, we have tentatively concluded that monitoring is
necessary to establish the performance of the implementation of the
focused mitigation strategies. The proposed provisions in Sec. 121.140
implement section 418(h) of the FD&C Act.
b. Proposed Sec. 121.140(a)--Requirement for written procedures
for monitoring. Proposed Sec. 121.140(a) would require that the owner,
operator, or agent in charge of a facility establish and implement
written procedures, including the frequency with which they are to be
performed, for monitoring the focused mitigation strategies. Monitoring
the performance of focused mitigation strategies at specified
frequencies would facilitate tracking the implementation of the focused
mitigation strategies to provide assurance that they are consistently
applied in a facility covered by this rule. If monitoring shows that a
focused mitigation strategy is frequently not implemented, a facility
can consider whether another focused mitigation strategy would be more
appropriate. For example, if an ingredient storeroom door is to be kept
locked when not in use, but the door is frequently left unlocked
because access to the room is needed for other purposes, the facility
may replace the previous focused mitigation strategy with video
monitoring. Further, if monitoring is conducted with sufficient
frequency, it will detect if a focused mitigation strategy is not
properly implemented (e.g., if access to a particular area of a
facility is not being appropriately restricted or a bulk liquid tank is
not being visually inspected prior to filling), indicating a problem
and signaling the need for an appropriate corrective action. In
addition, the proposed monitoring requirement would result in written
documentation for use in verification.
c. Proposed Sec. 121.140(b)--Frequency of monitoring. Proposed
Sec. 121.140(b) would require that the owner, operator, or agent in
charge of a facility monitor the focused mitigation strategies with
sufficient frequency to provide assurances that they are consistently
applied. Proposed Sec. 121.140(b) does not specify a single monitoring
frequency applicable to all facilities and processes. Rather, it
requires monitoring with ``sufficient frequency'' to ensure that the
focused mitigation strategies are consistently applied in a facility
covered by this rule. We note that for food defense that many focused
mitigation strategies may be monitored over longer timeframes (non-
continuous monitoring) than preventive controls for food safety, which
are often monitored continuously. In large part preventive controls for
food safety are monitored continuously because they relate to physical
or chemical parameters of the process, such as the temperature of a
pasteurizer, which both lend themselves
[[Page 78049]]
to continuous monitoring and necessitate that level of monitoring to
ensure that the process is under control. As discussed in greater
detail in section V.C.3 of this document, most focused mitigation
strategies for food defense are not related to physical or chemical
parameters of the process. They tend to have more in common with
sanitation preventive controls for food safety in that they relate to
conditions around the food process, such as access to the equipment. A
focused mitigation strategy such as ``adequate lighting at an
actionable process step'' or ``secure air vents on a cooling tank with
one-way valves'' would not require continuous monitoring. Management
may choose to monitor lighting on a weekly basis to ensure that
everything is working properly and monitoring of the security of air
vents with one-way valves on a cooling tank might be done monthly.
Frequency is not prescribed in this proposed rule. More frequent (e.g.,
daily) monitoring would be appropriate for mitigation strategies that
relate to conditions or practices that are more likely to change more
rapidly, such as keeping the access door to an actionable process step
closed when not in use or ensuring that employees with color coded
uniforms are staying in the areas designated by the color code.
d. Proposed Sec. 121.140(c)--Requirement for records. To implement
section 418(g) of the FD&C Act, proposed Sec. 121.140(c) would require
that all monitoring of focused mitigation strategies in accordance with
this section must be documented in records that are subject to
verification in accordance with Sec. 121.150(a) and records review in
accordance with proposed Sec. 121.150(c).
The monitoring records would be used to verify that the focused
mitigation strategies are being monitored, as would be required by
proposed Sec. 121.150(a), and to verify that the focused mitigations
strategies are consistently implemented and are effective at
significantly minimizing or preventing the significant vulnerabilities,
as would be required by proposed Sec. 121.150(c). Further, they are
necessary to facilitate regulatory review of the system of controls.
Together, proposed Sec. Sec. 121.140(a), (b), and (c) and 121.150(a),
(c), and (e) would establish a system that would provide assurances
that the significant vulnerabilities identified for a food operation
are being significantly minimized or prevented.
5. Corrective Actions
a. General description of corrective actions. When a HACCP-type
system is applied to ensure food safety, the term ``corrective
actions'' is used to describe procedures that are in place to correct
the cause of a deviation to ensure that a critical control point is
under control and to ensure that the product produced under that
deviation is safe, since total adherence to a planned process may not
always occur. This concept is discussed in detail in section XII.F of
the PC proposed rule.
This same concept can be applied to the control of intentional
adulteration related to acts of terrorism. Monitoring may detect a
deviation from implementation of a focused mitigation strategy;
corrective actions are implemented to re-establish control. In
developing the proposed corrective actions requirements related to food
defense, we considered our proposed relevant requirements related to
food safety. The proposed provisions in Sec. 121.145 implement
sections 418(e), 418(h), and 420(b)(2) of the FD&C Act.
b. Proposed Sec. 127.145(a)--Corrective action procedures.
Proposed Sec. 121.145(a)(1) would require that the owner, operator, or
agent in charge of a facility establish and implement written
corrective action procedures that must be taken if focused mitigation
strategies are not properly implemented. Having written procedures in
place would enable facilities covered by this rule to act quickly and
appropriately when focused mitigation strategies are not properly
implemented--e.g., a situation where a work station at an actionable
process step requires two staff at all times in a ``buddy system'' but
is only staffed by one person for a period of time.
The benefits of identifying corrective action procedures before
corrective action is needed largely derive from having written
procedures. Written corrective action procedures would be essential to
the facility's management, to auditors, and to inspectors. The
facility's management will be responsible for ensuring that appropriate
corrective actions are taken if focused mitigation strategies are not
properly implemented. Having access to appropriate, written corrective
action procedures determined in advance of the need for such action can
ensure that correct and complete actions are taken in a timely fashion.
Having written corrective action procedures available for auditors and
for inspectors is essential for them to assess the adequacy of the food
defense plan; the procedures a facility will use to address
implementation failures are essential to proper, consistent
implementation, and without them a complete assessment cannot be made.
Written corrective action procedures also will be useful for training
purposes, so that employees who would need to implement the corrective
action procedures will be prepared for what they would need to do.
Proposed Sec. 121.145(a)(2) would require that corrective action
procedures describe the steps to be taken to ensure that appropriate
action is taken to identify and correct a problem with implementation
of a focused mitigation strategy to reduce the likelihood that the
problem will recur. In the previous example in which two staff are
required to be at a work station at all times, the corrective action
could be speaking with the employees to ensure they understand the
importance of remaining at the work station together, sending staff to
a refresher course on food defense awareness, and ensuring that the
supervisor knows that there must be adequate staff present on a shift
so two people can be at the work station at all times. If the problem
recurs, management may need to consider other measures for preventing
access at that process step.
c. Proposed Sec. 121.145(b)--Documentation. Proposed Sec.
121.145(b) would require that all corrective actions taken in
accordance with this section be documented in records that are subject
to verification in accordance with proposed Sec. 121.150(b) and
records review in accordance with proposed Sec. 121.150(c). The
records that document corrective actions would be used to verify that
appropriate decisions about corrective actions are being made and
appropriate corrective actions are being taken in facilities covered by
this rule.
d. Corrective actions proposed to be required by part 117 but not
part 121. Unlike in proposed part 117, in proposed part 121, we have
not proposed a requirement to ensure that all affected food is
evaluated for food safety if focused mitigation strategies are not
properly implemented or are found to be ineffective. An act of
intentional adulteration or attempted intentional adulteration has
historically been a rare event and, as a result, in the vast majority
of cases, the failure to properly implement a focused mitigation
strategy would not be expected to result in contaminated food. This is
because intentional adulteration requires not just the opportunity for
contamination (i.e., failure of a mitigation strategy to limit access
to an actionable process step), but also someone with intent to cause
harm at that same moment. In contrast, the failure to properly
implement a preventive control for a food safety hazard, such as proper
cook temperatures, is more likely to result in adulterated food (e.g.,
because the
[[Page 78050]]
pathogen reasonably likely to be present in the raw food would not be
eliminated from the food by the inadequate cooking process). However,
our decision not to propose these requirements does not absolve an
owner, operator, or agent in charge of a facility from their
responsibility to ensure that food is not adulterated. In addition,
food firms would continue to be subject to the reporting requirements
under section 417 of the FD&C Act. Moreover, the introduction or
delivery for introduction into interstate commerce of any food that is
adulterated is a prohibited act under section 301(a) of the FD&C Act.
The PC proposed rule also contains requirements for corrective
actions that must be taken in the event of an unanticipated problem.
Unlike in proposed part 117, in proposed part 121, we are not proposing
a requirement related to unanticipated problems because we are not
aware of circumstances where this would be relevant. Because of the
nature of the focused mitigation strategies, we expect that the
outcomes of monitoring will be binary, either the focused mitigation
strategy will be in place or it will not be in place. For this reason,
we expect that corrective action plans will be straightforward, with no
provision needed for unanticipated corrective actions. This contrasts
with the circumstances of food safety preventive measures, where
controls are often more complex, presenting opportunities for a more
nuanced corrective action, which may not be possible to fully
anticipate in advance.
We ask for comment on our rationale and tentative conclusion not to
propose these requirements.
6. Verification
a. General description of verification. In the preventive controls
framework, ``verification'' involves activities that help determine
whether the focused mitigation strategies are valid and are implemented
according to the food defense plan. Verification includes confirming
that monitoring and corrective actions are being implemented as
planned, through review of records and periodic reanalysis of the food
defense plan. This concept as applied to food safety is discussed in
detail in section XII.G of the PC proposed rule.
We have tentatively concluded that this same concept applies to the
control of intentional adulteration related to acts of terrorism.
Efforts must be made to ensure that the system of mitigation strategies
is in place and functioning as designed. The proposed provisions in
Sec. 121.150 implement sections 418(f) and 420(b)(2) of the FD&C Act.
b. Proposed Sec. 121.150(a)--Verification of monitoring. Proposed
Sec. 121.150(a) would require that the owner, operator, or agent in
charge of a facility verify that monitoring is being conducted.
Verification of monitoring can be conducted in a number of ways. One
example of verification of monitoring is a periodic observation of the
monitoring activity, e.g., by a supervisor. Another example is an
independent test made by a person other than the person doing the
monitoring. For example, if a shift supervisor is assigned to check at
the end of each shift that chemicals are properly stored and secured,
another supervisor may be responsible for checking periodically (e.g.,
once a week) that this is occurring. In another example, if an alarm is
supposed to sound if a mixing tank is accessed without authorization
and the monitoring procedures provide for weekly testing of the alarm,
a supervisor may be responsible for performing the same test monthly to
ensure that the alarm and the monitoring procedure are both working
properly. Proposed Sec. 121.150(a) would not specify the verification
activities that must be conducted for monitoring. We request comment on
whether proposed Sec. 121.150(a) should do so, and if so, what
verification activities should be required.
c. Proposed Sec. 121.150(b)--Verification of corrective actions.
Proposed Sec. 121.150(b) would require that the owner, operator, or
agent in charge of a facility verify that appropriate decisions about
corrective actions are being made. An example of verification that
appropriate decisions about corrective actions are being made is
observation of the corrective actions being taken, e.g., by a
supervisor. Proposed Sec. 121.150(b) would not specify the
verification activities that must be conducted for corrective actions.
We request comment on whether proposed Sec. 121.150(b) should do so,
and if so, what verification activities should be required.
d. Proposed Sec. 121.150(c)--Implementation and effectiveness.
Proposed Sec. 121.150(c) would require that the owner, operator, or
agent in charge of a facility verify that the focused mitigation
strategies are consistently implemented and are effectively and
significantly minimizing or preventing the significant vulnerabilities.
As appropriate to the facility and the food, this must include review
of the monitoring and corrective action records within appropriate
timeframes to ensure that the records are complete, the activities
reflected in the records occurred in accordance with the food defense
plan, the focused mitigation strategies are effective, and appropriate
decisions were made about corrective actions.
Proposed Sec. 121.150(c) would establish that the purpose of the
review of records is to ensure that the records are complete, the
activities reflected in the records occurred in accordance with the
food defense plan, the focused mitigation strategies are effective, and
appropriate decisions are made about corrective actions. We tentatively
conclude that review of the records required by proposed Sec.
121.150(c) would accomplish these purposes. Reviewing monitoring
records can reveal whether they contain information on all of the
activities or measures that were to be monitored to determine whether a
focused mitigation strategy is being consistently implemented in
accordance with the food defense plan. For example, a review of
monitoring records can show if the shift supervisor is consistently
storing and securing chemicals at the end of each shift as may be
required by a food defense plan. Review of monitoring records also can
reveal whether any information is missing--e.g., a date or time--so
that the missing information can be quickly identified and added to the
record if necessary.
Review of records also can reveal whether appropriate decisions
were made about corrective actions. The review would determine whether
all the corrective action procedures required by proposed Sec. 121.145
have been followed to prevent recurrence of the problem. For example,
in the previous example on corrective actions, a review of records
could reveal that the supervisor spoke to the staff about always having
two staff present at the work station as required in the food defense
plan and, as appropriate, enrolled the staff in a refresher course on
food defense awareness.
Proposed Sec. 121.150(c) would require review of the monitoring
and corrective action records within an appropriate time after the
records are made. We are not proposing to require review of records
within a specified timeframe. While the PC proposed rule contains a
requirement that monitoring and corrective action records be reviewed
within a week after the records are made, in the case of food defense,
we do not believe specifying a timeframe for records review is
necessary. As discussed previously, some focused mitigation strategies
may be monitored less frequently than are preventive controls for food
safety. In a HACCP-
[[Page 78051]]
type system for food safety, monitoring and corrective action records
are often reviewed a short time after their creation to enable action
to be taken relative to food that may be adulterated (e.g., recall). It
is unlikely that an improperly implemented focused mitigation strategy
would result in adulterated food (i.e., because adulteration of food
would require not only opportunity but also a simultaneous intent to
cause adulteration). A focused mitigation strategy such as ``adequate
lighting at the bulk truck unloading bay'' or ``secure air vents on a
cooling tank with one-way valves'' may be monitored on a weekly or
monthly basis. Because the focused mitigation strategies may be
monitored less frequently and because these frequencies may vary
significantly from one focused mitigation strategy to another, we
believe it is appropriate for owners, operators, or agents in charge of
a facility to determine when review of the monitoring and corrective
action records is best performed.
e. Proposed Sec. 121.150(d)--Reanalysis. To implement section
418(i) of the FD&C Act, proposed Sec. 121.150(d)(1) would require that
the owner, operator, or agent in charge of a facility conduct a
reanalysis of the food defense plan as follows:
1. At least once every 3 years (proposed Sec. 121.150(d)(1)(i)).
2. Whenever a significant change is made in the activities
conducted at a facility operated by such owner, operator, or agent in
charge if the change creates a reasonable potential for a new
vulnerability or a significant increase in a previously identified
vulnerability (proposed Sec. 121.150(d)(1)(ii)). For example, if a
facility adds a new product line, then the food defense plan must be
reanalyzed to consider whether it includes one of the key activity
types, and, if so to implement appropriate focused mitigation
strategies.
3. Whenever such owner, operator or agent in charge becomes aware
of new information about potential vulnerabilities associated with the
food operation or facility (proposed Sec. 121.150(d)(1)(iii)). For
example, an owner, operator, or agent in charge of a facility may
become aware that access to a particular piece of equipment is greater
than was thought to be the case when they initially considered whether
a key activity type is applicable to their food process.
4. Whenever a focused mitigation strategy is found to be
ineffective (proposed Sec. 121.150(d)(1)(iv)). Proposed Sec.
121.150(d)(1)(iv) would require that the owner, operator, or agent in
charge of a facility reanalyze the food defense plan to determine
whether modification of the plan is required if a focused mitigation
strategy is found to be ineffective. For example, if the owner,
operator, or agent in charge of a facility finds that color coding of
employee hard hats according to their assigned work stations or areas
is not effective in preventing employees from crossing into areas where
they are not assigned because employees have found that adhering to the
system adversely affects product, the owner, operator, or agent in
charge may need to consider other focused mitigation strategies to
ensure that staff access at actionable process steps is controlled.
5. Whenever FDA requires reanalysis to respond to new
vulnerabilities and developments in scientific understanding including,
as appropriate, results from a DHS biological, chemical, radiological,
or other terrorism risk assessment (proposed Sec. 121.150(d)(1)(v)).
Risk assessments or vulnerability assessments conducted by DHS or
others may reveal a significant vulnerability in process steps in
addition to the significant vulnerabilities associated with the key
activity types that FDA has identified. FDA would require reanalysis of
food defense plans, as necessary, to respond to any new knowledge about
threats or vulnerabilities to food operations based on information
available to the agency. This requirement for reanalysis could involve
a requirement to consider whether a new key activity type is relevant
to a facility's food processes. It could also involve a requirement to
reconsider existing key activity types in light of a credible threat of
terrorist attack on a specific food type, product, brand, or company.
Proposed Sec. 121.150(d)(2) would require that the owner,
operator, or agent in charge of a facility complete the required
reanalysis and implement any additional focused mitigation strategies
needed to address the significant vulnerabilities identified, if any,
before the change in activities at the facility is operative or, when
necessary, during the first six weeks of production. The purpose of the
reanalysis is to identify the need for, and implement, focused
mitigation strategies in light of a reasonable potential for a new
significant vulnerability, or a significant increase in a previously
identified significant vulnerability.
Proposed Sec. 121.150(d)(3) would require that the owner,
operator, or agent in charge of a facility revise the written plan if a
significant change is made or document the basis for the conclusion
that no additional or revised focused mitigation strategies are needed.
It is important to document that a reanalysis has been conducted and
the plan has been revised accordingly or that no change has been made.
Such documentation demonstrates that a facility has considered all
relevant information on the defense of the operation, including new
information that has become available since the last analysis. The
documentation further demonstrates that appropriate changes have been
made or that current procedures for implementing focused mitigation
strategies are adequate to significantly minimize or prevent
significant vulnerabilities.
f. Proposed Sec. 121.150(e)--Requirement for records for
verification. To implement sections 418(g) and 420(b)(2) of the FD&C
Act, proposed Sec. 121.150(e) would require that all verification
activities taken in accordance with this section be documented in
records.
g. Verification proposed to be required by part 117 but not part
121. In the PC proposed rule, we proposed to require, as part of
verification, the validation of the adequacy of the preventive controls
implemented to control the hazards identified in the hazard analysis as
reasonably likely to occur. In this proposed rule, we are not including
a similar proposed requirement. Unlike preventive controls, which often
involve processing parameters that can be scientifically validated,
focused mitigations strategies for food defense (which correspond to
preventive controls for food safety) often are not of a nature that
they can be scientifically validated. For example, it would not be
practical for a facility to attempt to validate the effectiveness of a
lock on a tank or the use of a `buddy system' at a particular process
step to prevent or significantly minimize intentional adulteration of
food caused by a terrorist attack. Most of the recommended mitigation
strategies in the MSD (Ref. 30) are similar in nature to the two
mentioned in the example above in that validation would be impractical.
Therefore, we have tentatively concluded not to propose a requirement
for validation of focused mitigation strategies.
However, if a facility chooses to use a processing parameter (e.g.,
thermal kill step) as a focused mitigation strategy, the facility
should employ such a processing parameter if it has been demonstrated
to be effective in significantly minimizing or preventing the
associated significant vulnerability. In many circumstances it is not
appropriate to use such strategies
[[Page 78052]]
because they are usually effective against one or several, but not all,
potential contaminants. See section XII.G of the PC proposed rule for
additional discussion of validation.
The PC proposed rule also includes proposed requirements for
calibration of process monitoring instruments and verification
instruments and also records associated with these activities. As
discussed previously, it is our expectation that most of the focused
mitigation strategies will not be continuously monitored and will not
require process monitoring instruments or instruments to verification
purposes. Therefore, we do not believe it would be necessary to include
those requirements in this part.
We ask for comment on our tentative decision not to include
validation of the focused mitigation strategies and calibration of
monitoring and verification instruments in codified requirements in
proposed Sec. 121.150.
7. Training of Personnel
Proposed Sec. 121.160 would establish requirements related to
training of certain personnel working in a food operation. Proposed
Sec. 121.160(a) would require that personnel and supervisors assigned
to actionable process steps receive appropriate training in food
defense awareness and their respective responsibilities in implementing
focused mitigation strategies. Because the effectiveness of a
mitigation strategy, which is applied at an actionable process step, is
dependent on the proper implementation by personnel and supervisors of
the strategy, we are proposing to require that personnel and
supervisors assigned to actionable process steps be appropriately
trained in food defense. The purpose of training a supervisor, in
addition to personnel at actionable process steps, is so that the
supervisor can help train employees, recognize conditions that could
lead to intentional contamination, and take necessary actions to
correct those conditions.
We are proposing that training required under this provision must
cover food defense awareness and the respective responsibilities of
personnel and supervisors assigned to actionable steps in implementing
focused mitigation strategies. At a minimum, such training must include
the general principles of food defense, including simple procedures for
employees to follow to adhere to those principles in their jobs. We
have tentatively concluded that completion of FDA's training course on
Food Defense Awareness for the Front-line Employee (described in this
section of the document), which takes about 20 minutes to complete,
would be sufficient to satisfy this element of the proposed training
requirement. Additionally, training must contain specifics about the
actionable process steps where employees are working and their roles in
the proper implementation of the focused mitigation strategy(ies)
applied at those actionable process steps. Training on the application
of focused mitigation strategies, which is likely to be specific to
each facility or actionable process step, may be added to existing on-
the-job training programs or provided separately.
FDA has developed training tools that are available for use by the
industry. FDA revamped its online food defense courses in 2013, and the
revamped courses, entitled ``Food Defense 101'' (Ref. 27), address the
types of intentional contamination that have occurred in the United
States in recent years and reflect FDA's current thinking on how to
minimize the likelihood and impact of such incidents. The courses
included in Food Defense 101 are: (1) Food Defense Awareness for the
Food Professional; (2) Food Defense Awareness for the Front-line
Employee; (3) Food Defense Regulations; and (4) ALERT, for owners and
operators of food facilities. The course on Food Defense Awareness for
the Food Professional provides an understanding of food defense and
information for professionals in the food industry. The course modules
progress through food defense planning including broad mitigation
strategies, vulnerability assessments, focused mitigation strategies,
and food defense plans. The course on Food Defense Awareness for Front-
line Employees provides information specific to front-line workers and
simple procedures for these employees to follow in food defense. The
course on Food Defense Regulations presents an overview of the Public
Health Security and Bioterrorism Preparedness and Response Act of 2002
(the Bioterrorism Act), FSMA, and FDA's Reportable Food Registry.
Finally, the course on ALERT, which was developed by FDA to help
stakeholders better understand food defense and how food defense
applies to the food industry, provides specific examples of ways to
protect a firm from the threat of intentional contamination. FDA's Food
Defense 101 online courses are available free-of-charge on our Web site
at http://www.fda.gov/Food/FoodDefense/default.htm.
We expect these existing courses will assist industry to comply
with this training requirement, if finalized as proposed. We are also
aware of training seminars and programs offered by private sector
entities (Ref. 59, Ref. 60, Ref. 61, Ref. 62) that may also assist
industry to comply with this training requirement. We seek comment on
the adequacy of FDA's Food Defense 101 training materials, and whether
there is a need for revisions to these existing FDA courses or the
development of additional FDA training materials.
FDA also previously issued guidance documents for industry on food
defense (Ref. 22, Ref. 23, Ref. 24, Ref. 25, Ref. 26), which include
recommendations related to personnel training. In these guidance
documents, we recommended that all employees have training in food
defense awareness, including information on how to prevent, detect, and
respond to an intentional contamination incident at their facility. As
noted in these guidance documents, we recommended incorporating
periodic reminders of the importance of food defense procedures into
routine facility communications, such as brochures, staff meetings or
payroll stuffers. We further recommended that facilities encourage all
employees to report unusual or suspicious individuals or activities to
management. We reiterate these recommendations described in our
guidance documents. However, in this proposed rule, we are not
proposing to include additional specific training requirements to
reflect all of those recommendations. For example, although we are not
requiring that all employees at a facility receive training in food
defense, we recognize the importance of training as a measure to
protect against intentional adulteration of food and, therefore,
reiterate our recommendation that all personnel working in a food
operation receive training in food defense awareness. We request
comment on this issue, including on whether we should require, in a
final rule, that basic food defense awareness training be completed by
all employees at a facility. We also request comment on whether we
should require training to be repeated periodically, including when
significant changes are made to food defense plans.
Proposed Sec. 121.160(b) would require that all training received
in accordance with section Sec. 121.160 be documented in records.
Under proposed Sec. 121.305, records would include such information as
the date of the training, the topics covered, and the person(s)
trained. An example of records that would comply with proposed Sec.
121.160(b) is an attendance sheet with the date, list of those in
attendance, and the particular topics covered (such as an overview of
food defense principles or food defense
[[Page 78053]]
planning). The records required by proposed Sec. 121.160(b) would
enable a facility to track the training that personnel received,
thereby enabling identification of personnel that have the prerequisite
awareness training for an assignment at an actionable process step.
Such records could be used to document that a person has, as would be
required under proposed Sec. 121.160(a), successfully completed
training appropriate to the person's duties at an actionable process
step.
We recognize that industry has already begun to implement food
defense measures to meet certain industry standards, which include
guidelines for food defense training (Ref. 63, Ref. 33, Ref. 35). Our
proposed minimum requirements for training are consistent with these
standards, as well as with WHO recommendations for personnel training
in its guidance on food defense (Ref. 6). We seek comment on the
feasibility of our proposed training requirements, in light of the
current state of food defense awareness in the industry and available
training resources.
D. Requirements Applying to Records That Must Be Established and
Maintained
When a HACCP-type system is implemented for food safety, records
are a critical part of the system because they aid facilities in
compliance with the requirements, including all the elements of a food
safety plan as proposed in Part 117, and allow facilities to show, and
FDA to determine, compliance with the requirements. This concept is
discussed in detail in section XV of the PC proposed rule. We have
tentatively concluded that records are critical to protect food from
intentional adulteration caused by acts of terrorism.
In subpart D of proposed part 121, FDA is proposing to establish
requirements applying to records that must be established and
maintained according to the requirements of this proposed rule. This
subpart implements numerous provisions in section 418 of the FD&C Act,
including sections 418(a), (b)(3), (g), (h), and (n)(1)(A), as well as
section 420(b) of the FD&C Act.
1. Proposed Sec. 121.301--Records Subject to the Requirements of this
Subpart D
Proposed Sec. 121.301(a) would establish that, except as provided
by proposed Sec. 121.301(b), all records required by proposed subpart
C of part 121 would be subject to all requirements of proposed subpart
D. We have tentatively concluded that the requirements in subpart D
describing how records must be established and maintained, including
the general requirements, record retention requirements, and
requirements for official review and public disclosure, are applicable
to all records that would be required under subpart C. Such records
would aid facilities in compliance with the requirements of proposed
part 121, and allow facilities to show, and FDA to determine,
compliance with the requirements of part 121. The proposed requirements
of subpart D are discussed in this document.
Proposed Sec. 121.301(b) would establish that the requirements of
proposed Sec. 121.310 apply only to the written food defense plan and
is discussed in more detail in section V.D.3 of this document.
2. Proposed Sec. 121.305--General Requirements Applying to Records
Proposed Sec. 121.305 contains general requirements that would
apply to records that would be required under proposed part 121,
including the format for required records, the recording of actual
values and observations obtained during monitoring, when records must
be created, and information that must be included in each record.
a. Proposed Sec. 121.305(a). Proposed Sec. 121.305(a) would
require that the records be kept as original records, true copies (such
as photocopies, pictures, scanned copies, microfilm, microfiche, or
other accurate reproductions of the original records), or electronic
records. True copies of records should be of sufficient quality to
detect whether the original record was changed or corrected in a manner
that obscured the original entry (e.g., through the use of white-out).
Proposed Sec. 121.305(a) would provide flexibility for mechanisms for
keeping records while maintaining the integrity of the recordkeeping
system. The proposed requirement allowing true copies provides options
that may be compatible with the way records are currently being kept in
facilities.
Proposed Sec. 121.305(a) also would require that electronic
records be kept in accordance with part 11 (21 CFR part 11). Part 11
provides criteria for acceptance by FDA, under certain circumstances,
of electronic records, electronic signatures, and handwritten
signatures executed to electronic records as equivalent to paper
records and handwritten signatures executed on paper. The proposed
requirement clarifies and acknowledges that records required by
proposed part 121 may be retained electronically, provided that they
comply with part 11.
In the PC proposed rule, FDA tentatively concluded that it would be
appropriate to apply the requirements of part 11 to the records that
would be required to be kept under proposed part 117. However, we
requested comment on whether there are any circumstances that would
warrant not applying part 11 to records that would be kept under
proposed part 117. In section XV.C of that document, we provided
examples of circumstances in which we exempted records from the
requirements of part 11 (21 CFR 1.329(b)) to avoid the necessity of
establishing new recordkeeping systems as long as current practices
would satisfy the requirements of the Act. In the PC proposed rule, we
also asked for comment on whether we should allow additional time for
electronic records to be kept in accordance with part 11. We seek
similar comment with regard to circumstances that would warrant not
applying part 11 to records that would be kept under proposed part 121
and whether we should allow additional time for electronic records to
be kept in accordance with part 11. Comments should provide the basis
for any view that the requirements of part 11 are not warranted.
b. Proposed Sec. 121.305(b). Proposed Sec. 121.305(b) would
require that records contain the actual values and observations
obtained during monitoring. For example, monitoring of the locking of
an access door to an actionable process step could be recorded as
``locked'' or ``unlocked'' (or ``yes'' or ``no'') and the monitoring of
the presence of staff with only appropriate color uniforms in a
designated area could be recorded as ``100% staff (or 10 of 10 staff)
with blue uniforms'' or conversely ``80% staff (or 8 of 10 staff) with
blue uniforms'' in the case of an improperly implemented focused
mitigation strategy. In the case of an improperly implemented focused
mitigation strategy, it is important to document the extent to which
the strategy was incorrectly applied, as monitoring data can show a
trend toward loss of control at an actionable process step. So, in the
example in which 8 of 10 staff have blue uniforms, a facility may also
consider documenting what color the remaining two staff were wearing if
such information would be valuable in establishing a trend. If the
recording of numerical values is possible in the monitoring of a
focused mitigation strategy (e.g., if a facility is using a processing
parameter such as heat treatment), then the actual times and
temperatures or other appropriate processing data should be recorded.
c. Proposed Sec. 121.305(c), (d) and (e). Proposed Sec.
121.305(c), (d) and (e) would require that records be accurate,
indelible, and legible (proposed
[[Page 78054]]
Sec. 121.305(c)); be created concurrently with performance of the
activity documented (proposed Sec. 121.305(d)); and be as detailed as
necessary to provide a history of work performed (proposed Sec.
121.305(e)). Proposed Sec. 121.305(c) and (d) would ensure that the
records are useful to the owner, operator, or agent in charge of a
facility in complying with the requirements of proposed part 121, for
example, in documenting compliance with monitoring requirements and
verifying compliance with the food defense plan. These proposed
requirements would also ensure that the records would be useful to FDA
in determining compliance with the requirements of proposed part 121.
Proposed Sec. 121.305(e) would provide flexibility to facilities to
tailor the amount of detail to the nature of the record.
d. Proposed Sec. 121.305(f). Proposed Sec. 121.305(f) would
require that the records include the following: (1) The name and
location of the facility; (2) the date and time of the activity
documented; (3) the signature or initials of the person performing the
activity; and (4) where appropriate, the identity of the product and
the production code, if any. The name and location of the facility and
the date and time would allow the owner, operator, or agent in charge
of a facility (and, during inspection, an FDA investigator) to assess
whether the record is current, to identify when and where any deviation
occurred, and to track corrective actions. The signature of the
individual who made the observation would ensure responsibility and
accountability. In addition, if there is a question about the record, a
signature would ensure that the source of the record will be known.
Linking a record to a specific product (and, when applicable, the
production code) would enable the owner, operator, or agent in charge
of a facility covered by this rule to isolate product if there is a
question that food has been adulterated. We seek comment on the scope
and potential burden associated with these proposed requirements.
The proposed requirement (proposed Sec. 121.305(f)(4)) for the
identity of the product and production code, if any, is important in
the context of food safety, where the production of potentially
adulterated product may result from loss of control during processing,
such as an improper cook temperature, and a recall may be necessary. It
is also especially applicable for food safety in cases of continuous
monitoring, when the loss of control can be associated with a
particular product or production code. Consistent with the PC proposed
rule, we have qualified the proposed requirement to indicate that the
identity of the product and the production code should be included as
part of the record ``where appropriate.'' We note that, in many cases,
it will likely be more difficult to include this information for a
focused mitigation strategy. As noted in the discussion on monitoring
in section V.C.5 of this proposed rule, some focused mitigation
strategies may be monitored weekly or monthly. In that case, it may not
be appropriate to include all of the products and production codes that
may have been affected by an improperly implemented focused mitigation
strategy. Further, in many cases the identity of the product and the
production code will not be relevant because the monitoring will be
performed in the area surrounding one or more production lines, used
for one or more products, rather than of processing parameters on a
production line for a specific lot of product. On the other hand, if
control of processing parameters, such as pasteurization time and
temperature, are used as a focused mitigation strategy, it would be
appropriate to document the product and production code, if any, that
was being processed at the time of monitoring. The nature of the
focused mitigation strategy should drive the decision by an owner,
operator, or agent in charge of a facility regarding whether or not to
include the identity of the product and the production code, if any, in
records.
3. Proposed Sec. 121.310--Additional Requirements Applying to the Food
Defense Plan
Proposed Sec. 121.310 would require that the owner, operator, or
agent in charge of a facility sign and date the food defense plan upon
initial completion (proposed Sec. 121.310(a)) and upon any
modification (proposed Sec. 121.310(b)). Such a signature would
provide direct evidence of the owner, operator, or agent's acceptance
of the plan and commitment to implementation of the plan. Additionally,
the signature, along with the date of signing, would serve to minimize
potential confusion over the authenticity of any differing versions or
editions of the document that might exist.
4. Proposed Sec. 121.315--Requirements for Record Retention
Proposed Sec. 121.315 contains requirements on the length of time
records that would be required under proposed part 121 must be retained
and allowances for offsite storage of records under certain
circumstances.
a. Proposed Sec. 121.315(a) and (b). Proposed Sec. 121.315(a)
would require that all records that would be required by proposed part
121 be retained at the facility for at least 2 years after the date
they were prepared. Proposed Sec. 121.315(b) would require that the
food defense plan be retained at the facility for at least 2 years
after its use is discontinued (e.g., because the facility has updated
the written food defense plan. The 2-year timeframe for all records
required by proposed part 121 is consistent with the length of time
that nonperishable food products, on average, can be expected to be in
commercial distribution plus a reasonable time thereafter to ensure
that the records are available for verification activities. This
proposed requirement is similar to the proposed records retention
requirement in the PC proposed rule, which contains a discussion of
similar requirements found in other FDA regulations and in particular
the proposed and final rules implementing the recordkeeping
requirements of the Bioterrorism Act. This 2-year retention period
would run from either the date the record is prepared, for day-to-day
operational records, or the date at which use of the record is
discontinued, for the food defense plan. We seek comment on this
proposal.
b. Proposed Sec. 121.315(c). Proposed Sec. 121.315(c) would
provide that, except for the food defense plan, use of offsite storage
for records is permitted after 6 months following the date that the
record was made if such records can be retrieved and provided onsite
within 24 hours of request for official review. The food defense plan
would be required to remain onsite. FDA realizes that the proposed
requirements for recordkeeping could require some facilities to store a
significant quantity of records, and that there may not be adequate
storage space in the facility for all of these records. Providing for
offsite storage of most records after 6 months would enable a facility
to comply with the proposed requirements for record retention while
reducing the amount of space needed for onsite storage of the records
without interfering with the purpose of record retention, because the
records will be readily available.
Proposed Sec. 121.315(c) also would provide that electronic
records are considered to be onsite if they are accessible from an
onsite location. Computerized systems within corporations can be
networked, allowing for the sending and receiving of information in a
secure fashion to all of the different food processing facilities of
that corporation worldwide. This
[[Page 78055]]
type of system can be used to provide access at multiple locations to
records from multiple facilities.
c. Proposed Sec. 121.315(d). Proposed Sec. 121.315(d) would
provide that if the facility is closed for a prolonged period, the
records may be transferred to some other reasonably accessible location
but must be returned to the facility within 24 hours for official
review upon request. Allowing for transfer of records will give
practical storage relief to seasonal operations or those closed for
other reasons for prolonged periods.
5. Proposed Sec. 121.320--Requirements for Official Review
Proposed Sec. 121.320 would require that all records required by
proposed part 121 be made promptly available to a duly authorized
representative of the Secretary of Health and Human Services upon oral
or written request.
6. Proposed Sec. 121.325--Public Disclosure
Proposed Sec. 121.325 would establish that all records required by
proposed part 121 will be protected from public disclosure to the
extent allowable under part 20 of this chapter. Our general policies,
procedures, and practices relating to the protection of confidential or
otherwise protected information received from third parties would apply
to information received under this rule.
E. Compliance
Section 103(e) of FSMA amends section 301 of the FD&C Act (21
U.S.C. 331) by adding a new section--(uu)--to the list of acts and the
causing thereof that are prohibited. Under section 301(uu) of the FD&C
Act, the following act, and the causing thereof, are prohibited:
``[t]he operation of a facility that manufactures, processes, packs, or
holds food for sale in the United States if the owner, operator, or
agent in charge of such facility is not in compliance with section 418
[of the FD&C Act].'' To clearly communicate that failure to comply with
the regulations established under section 418 of the FD&C Act is a
prohibited act, proposed Sec. 121.401(a) in subpart E would establish
that the operation of a facility that manufactures, processes, packs,
or holds food for sale in the United States if the owner, operator, or
agent in charge of such facility is required to comply with, and is not
in compliance with, section 418 or subparts C or D of part 121 is a
prohibited act under section 301(uu) of the FD&C Act.
Section 106(d) of FSMA amends section 301 of the FD&C Act by adding
a new section--(ww)--to the list of acts and the causing thereof that
are prohibited. Under section 301(ww) of the FD&C Act, the following
act, and the causing thereof, are prohibited: ``[t]he failure to comply
with section 420 [of the FD&C Act].'' To clearly communicate that
failure to comply with the regulations established under section 420 of
the FD&C Act is a prohibited act, proposed Sec. 121.401(b) would
establish that the failure to comply with section 420 of the FD&C Act
or subparts C or D of part 121 is a prohibited act under section
301(ww) of the FD&C Act.
VI. Preliminary Regulatory Impact Analysis
A. Overview
FDA has examined the impacts of the proposed rule under Executive
Order 12866, Executive Order 13563, the Regulatory Flexibility Act (5
U.S.C. 601-612), and the Unfunded Mandates Reform Act of 1995 (Pub. L.
104-4). Executive Orders 12866 and 13563 direct Agencies to assess all
costs and benefits of available regulatory alternatives and, when
regulation is necessary, to select regulatory approaches that maximize
net benefits (including potential economic, environmental, public
health and safety, and other advantages; distributive impacts; and
equity). We believe that this proposed rule is a significant regulatory
action under Executive Order 12866.
B. Regulatory Flexibility Act
The Regulatory Flexibility Act requires Agencies to analyze
regulatory options that would minimize any significant impact of a rule
on small entities. The annualized costs per entity due to this proposed
rule are about $13,000 for a one-facility firm with 100 employees, and
there are about 4,100 small businesses that would be affected by the
proposed rule, so we tentatively conclude that the proposed rule could
have a significant economic impact on a substantial number of small
entities.
C. Small Business Regulatory Enforcement Fairness Act of 1996
The Small Business Regulatory Enforcement Fairness Act of 1996
(Pub. L. 104-121) defines a major rule for the purpose of congressional
review as having caused or being likely to cause one or more of the
following: An annual effect on the economy of $100 million or more; a
major increase in costs or prices; significant adverse effects on
competition, employment, productivity, or innovation; or significant
adverse effects on the ability of U.S.-based enterprises to compete
with foreign-based enterprises in domestic or export markets. In
accordance with the Small Business Regulatory Enforcement Fairness Act,
the Office of Management and Budget (OMB) has determined that this
proposed rule is a major rule for the purpose of congressional review.
D. Unfunded Mandates Reform Act of 1995
Section 202(a) of the Unfunded Mandates Reform Act of 1995 requires
that Agencies prepare a written statement, which includes an assessment
of anticipated costs and benefits, before proposing ``any rule that
includes any Federal mandate that may result in the expenditure by
State, local, and tribal governments, in the aggregate, or by the
private sector, of $100,000,000 or more (adjusted annually for
inflation) in any one year.'' The current threshold after adjustment
for inflation is $141 million, using the most current (2012) Implicit
Price Deflator for the Gross Domestic Product. We expect this proposed
rule may result in a 1-year expenditure that would meet or exceed this
amount.
E. Paperwork Reduction Act of 1995
This proposed rule contains information collection requirements
that are subject to review by the Office of Management and Budget (OMB)
under the Paperwork Reduction Act of 1995 (PRA) (44 U.S.C. 3501-3520).
A description of these provisions is given in the Description section
of this document with an estimate of the annual reporting,
recordkeeping, and third-party disclosure burden. Included in the
estimate is the time for reviewing instructions, searching existing
data sources, gathering and maintaining the data needed, and completing
and reviewing each collection of information.
FDA invites comments on: (1) Whether the proposed collection of
information is necessary for the proper performance of FDA's functions,
including whether the information will have practical utility; (2) the
accuracy of FDA's estimate of the burden of the proposed collection of
information, including the validity of the methodology and assumptions
used; (3) ways to enhance the quality, utility, and clarity of the
information to be collected; and (4) ways to minimize the burden of the
collection of information on respondents, including through the use of
automated collection techniques, when appropriate, and other forms of
information technology.
To ensure that comments on information collection are received, OMB
recommends that written
[[Page 78056]]
comments be faxed to the Office of Information and Regulatory Affairs,
OMB, Attn: FDA Desk Officer, FAX: 202-395-7285, or emailed to oira_submission@omb.eop.gov. All comments should be identified with the
title ``Focused Mitigation Strategies to Protect Food Against
Intentional Adulteration.''
In compliance with the Paperwork Reduction Act of 1995 (44. U.S.C.
3407(d)), the agency has submitted the information collection
provisions of this proposed rule to OMB for review. Interested persons
are requested to send comments regarding information collection by
January 23, 2014 to the Office of Information and Regulatory Affairs,
OMB. To ensure that comments on information collection are received,
OMB recommends that written comments be faxed to the Office of
Information and Regulatory Affairs, OMB, Attn: FDA Desk Officer, FAX:
202-395-6974, or emailed to oira_submission@omb.eop.gov. All comments
should be identified with the title, ``Focused Mitigation Strategies to
Protect Food Against Intentional Adulteration.''
F. Public Access to the Analyses
The analyses that we have performed to examine the impacts of this
proposed rule under Executive Order 12866, Executive Order 13563, the
Regulatory Flexibility Act (5 U.S.C. 601-612), the Unfunded Mandates
Reform Act of 1995 (Pub. L. 104-4), and the Paperwork Reduction Act of
1995 (44 U.S.C. 3501-3520) are available to the public in the docket
for this final rule (Ref. 64).
VII. Analysis of Environmental Impact
The Agency has determined under 21 CFR 25.30(h) that this action is
of a type that does not individually or cumulatively have a significant
effect on the human environment (Ref. 65). Therefore, neither an
environmental assessment nor an environmental impact statement is
required.
VIII. Federalism
FDA has analyzed this proposed rule in accordance with the
principles set forth in Executive Order 13132. FDA has determined that
the proposed rule, if finalized, would not contain policies that would
have substantial direct effects on the States, on the relationship
between the National Government and the States, or on the distribution
of power and responsibilities among the various levels of government.
Accordingly, the Agency tentatively concludes that the proposed rule
does not contain policies that have federalism implications as defined
in the Executive order and, consequently, a federalism summary impact
statement is not required.
IX. Comments
We invite public comment on the matters specified in this document
as well as any other matters concerning this proposed rule that are of
interest. Interested persons may submit either electronic comments
regarding this document to http://www.regulations.gov or written
comments to the Division of Dockets Management (see ADDRESSES). It is
only necessary to send one set of comments. Identify comments with the
docket number found in brackets in the heading of this document.
Received comments may be seen in the Division of Dockets Management
between 9 a.m. and 4 p.m., Monday through Friday, and will be posted to
the docket at http://www.regulations.gov.
X. References
The following references have been placed on display in the
Division of Dockets Management (see ADDRESSES) and may be seen by
interested persons between 9 a.m. and 4 p.m., Monday through Friday.
(FDA has verified the Web site addresses, but FDA is not responsible
for any subsequent changes to the Web sites after this document
publishes in the Federal Register.)
1. Kennedy, S.K. and F.F. Busta, ``Chapter 5 Biosecurity: Food
Protection and Defense,'' Food Microbiology: Fundamentals and
Frontiers, Edited by M.P. Doyle and L.R. Beuchat, American Society
for Microbiology Press: Washington, DC, pp. 87-102, 2007. Accessed
October 30, 2013.
2. Khan A.S., D.L. Swerdlow, and D.D. Juranek, ``Precautions
Against Biological and Chemical Terrorism Directed at Food and Water
Supplies,'' Public Health Reports, 116(1):3-14, 2001.
3. Sobel, J., A.S. Khan, and D.L. Swerdlow, ``Threat of a
Biological Terrorist Attack on the US Food Supply: The CDC
Perspective,'' The Lancet, 359(9309):874-880, March 9, 2002.
4. T[ouml]r[ouml]k, T.J., R.V. Tauxe, R.P. Wise, et al., ``A
Large Community Outbreak of Salmonellosis Caused by Intentional
Contamination of Restaurant Salad Bars,'' Journal of American
Medical Association, 278(5):389-395, August 1997.
5. British Standards Institute and Centre for the Protection of
National Infrastructure. ``Publicly Available Specification 96:2010
Defending Food and Drink,'' March 2010. http://www.cpni.gov.uk/documents/publications/non-cpni_pubs/pas96_vis14.pdf. Accessed
September 25, 2013.
6. World Health Organization. ``Terrorist Threats to Food:
Guidance for Establishing and Strengthening Prevention and Response
Systems,'' Food Safety Issues, Revision May 2008. http://www.who.int/foodsafety/publications/general/en/terrorist.pdf.
Accessed September 23, 2013.
7. Everstine, K., S. Kennedy, and J. Spink, ``Economically
Motivated Adulteration (EMA) of Food: Common Characteristics of EMA
Incidents,'' Journal of Food Protection, 76(4):723-735, 2013.
8. U.S. Food and Drug Administration. ``Economically Motivated
Adulteration; Public Meeting; Request for Comment,'' Federal
Register, 74(64):15497-15499, 2009. http://www.gpo.gov/fdsys/pkg/FR-2009-04-06/pdf/E9-7843.pdf. Accessed September 23, 2013.
9. Spink, J. and DC Moyer, ``Defining the Public Health Threat
of Food Fraud,'' Journal of Food Science, 75(9):R157-R163, 2011.
10. Ingelfinger, J.R., ``Melamine and the Global Implications of
Food Contamination,'' New England Journal of Medicine, 359(26):2745-
2748, 2008.
11. Xiu, C. and K.K. Klein, ``Melamine in Milk Products in
China: Examining the Factors That Led to Deliberate Use of the
Contaminant,'' Food Policy, 35(5):463-470, 2010.
12. World Health Organization. Food Security Page. http://www.who.int/trade/glossary/story028/en. Accessed September 23, 2013
13. Kolavic, S., A. Kimura, S. Simons, L. Slutsker, S. Barth,
and C. Haley, ``An Outbreak of Shigella dysenteriae Type 2 Among
Laboratory Workers Due to Intentional Food Contamination,'' Journal
of American Medical Association, 278(5):396-398, August 1997.
14. Anderson, S., J. DeMent, C.B. Ocfemia, and D.C. Hunt,
Outbreaks of Methomyl Poisoning Caused by the Intentional
Contamination of Salsa at the Mi Ranchito Restaurant in Lenexa, KS--
August 2009, Kansas Department of Health and Environment, April 12,
2011. http://www.kdheks.gov/epi/download/Final_Mi_Ranchito_Report.pdf. Accessed October 22, 2013.
15. U.S. Government Printing Office. Senate Hearing 108-491,
``Agroterrorism: The Threat to America's Breadbasket,'' p. 1,
November 19, 2003. http://www.gpo.gov/fdsys/pkg/CHRG-108shrg91045/html/CHRG-108shrg91045.htm. Accessed September 23, 2013.
16. The White House, Office of the Press Secretary. Homeland
Security Presidential Directive/HSPD-8, December, 17, 2003. https://www.fas.org/irp/offdocs/nspd/hspd-8.html. Accessed October 17, 2013.
17. The White House, Office of the Press Secretary. Homeland
Security Presidential Directive 7: Critical Infrastructure
Identification, Prioritization, and Protection, December, 17, 2003.
https://www.dhs.gov/homeland-security-presidential-directive-7.
Accessed October 17, 2013.
18. The White House, Office of the Press Secretary. Homeland
Security Presidential Directive/HSPD-9, January, 30, 2004. https://www.fas.org/irp/offdocs/nspd/hspd-9.html. Accessed October 17, 2013.
19. The White House, Office of the Press Secretary. Presidential
Policy Directive/PPD-8: National Preparedness, March 30, 2011.
http://www.dhs.gov/presidential-policy-directive-8-national-preparedness. Accessed October 17, 2013.
20. The White House, Office of the Press Secretary. Presidential
Policy Directive 21:
[[Page 78057]]
Critical Infrastructure Security and Resilience, February 12, 2013.
http://www.whitehouse.gov/the-press-office/2013/02/12/presidential-policy-directive-critical-infrastructure-security-and-resil.
Accessed October 7, 2013.
21. U.S. Food and Drug Administration. Strategic Partnership
Program Agroterrorism (SPPA) Initiative: Final Summary Report
September 2005--September 2008, December 2008. http://www.fda.gov/Food/FoodDefense/FoodDefensePrograms/ucm170509.htm. Accessed
September 23, 2013.
22. U.S. Food and Drug Administration, Center for Food Safety
and Applied Nutrition. ``Guidance for Industry: Food Producers,
Processors, and Transporters: Food Security Preventive Measures
Guidance,'' March 2003, Revision October 2007. http://www.fda.gov/Food/GuidanceRegulation/GuidanceDocumentsRegulatoryInformation/FoodDefense/ucm083075.htm. Accessed September 23, 2013.
23. U.S. Food and Drug Administration, Center for Food Safety
and Applied Nutrition. ``Guidance for Industry: Importers and
Filers: Food Security Preventive Measures Guidance,'' March 2003,
Revision October 2007. http://www.fda.gov/Food/GuidanceRegulation/GuidanceDocumentsRegulatoryInformation/FoodDefense/ucm078978.htm.
Accessed September 23, 2013.
24. U.S. Food and Drug Administration, Center for Food Safety
and Applied Nutrition. ``Guidance for Industry: Dairy Farms, Bulk
Milk Transporters, Bulk Milk Transfer Stations and Fluid Milk
Processors: Food Security Preventive Measures Guidance,'' July 2003,
Revision October 2007. http://www.fda.gov/Food/GuidanceRegulation/GuidanceDocumentsRegulatoryInformation/FoodDefense/ucm078978.htm.
Accessed September 23, 2013.
25. U.S. Food and Drug Administration, Center for Food Safety
and Applied Nutrition. ``Guidance for Industry: Retail Food Stores
and Food Service Establishments: Food Security Preventive Measures
Guidance,'' December 2003, Revision October 2007. http://www.fda.gov/Food/GuidanceRegulation/GuidanceDocumentsRegulatoryInformation/FoodDefense/ucm082751.htm.
Accessed September 23, 2013.
26. U.S. Food and Drug Administration, Center for Food Safety
and Applied Nutrition. ``Guidance for Industry: Cosmetics Processors
and Transporters of Cosmetics Security Preventive Measures
Guidance,'' November 2003, Revision October 2007. http://www.fda.gov/Food/GuidanceRegulation/GuidanceDocumentsRegulatoryInformation/FoodDefense/ucm082716.htm.
Accessed September 23, 2013.
27. U.S. Food and Drug Administration. Food Defense 101 Page.
http://www.fda.gov/Food/FoodDefense/ToolsEducationalMaterials/ucm353774.htm. Accessed October 17, 2013.
28. U.S. Food and Drug Administration. Employees FIRST Page.
http://www.fda.gov/Food/FoodDefense/ToolsEducationalMaterials/ucm295997.htm. Accessed and printed on October 17, 2013.
29. U.S. Food and Drug Administration. Vulnerability Assessment
Software Page, Version 2.4, November 2011. http://www.fda.gov/Food/FoodDefense/ToolsEducationalMaterials/ucm295900.htm. Accessed
September 25, 2013.
30. U.S. Food and Drug Administration. Mitigation Strategies
Database Page. http://www.fda.gov/Food/FoodDefense/ToolsEducationalMaterials/ucm295898.htm. Accessed September 25,
2013.
31. U.S. Food and Drug Administration. Food Defense Plan Builder
Software Page. http://www.fda.gov/Food/FoodDefense/ToolsEducationalMaterials/ucm349888.htm. Accessed September 25,
2013.
32. U.S. Food and Drug Administration. Food Related Emergency
Exercise Bundle (FREE-B) Page. http://www.fda.gov/Food/FoodDefense/ToolsEducationalMaterials/ucm295902.htm. Accessed October 17, 2013.
33. Global Food Safety Initiative. GFSI Guidance Document,
Version 6.1, 6(2), August 2011. http://www.mygfsi.com/gfsifiles/Guidance_Document_Sixth_Edition_Version_6.1.pdf. Accessed
September 23, 2013.
34. Safe Quality Food Institute. SQF Code: A HACCP-Based
Supplier Assurance Code for the Food Industry, Edition 7.1, April
2013. http://www.sqfi.com/wp-content/uploads/SQF-Code-Ed-7.1-4-3-13.pdf. Accessed October 17, 2013.
35. International Featured Standards. Events and Academy Page.
http://www.ifs-certification.us/events. Accessed November 5, 2013.
36. China Inspection and Quarantine Service, Administrative
Provisions on Filing of Export Food Production Enterprises Page.
http://en.ciqcid.com/Zjl/Comprehensives/51829.htm. Accessed
September 25, 2013.
37. German Federal Office of Consumer Protection and Food
Safety. ``General Recommendations for Protection of Animal Feed and
Food Supply Chain From the Intentional Release of Agents,'' February
2011. Accessed October 22, 2013.
38. French Republic. Guide Containing Recommendations for the
Protection of the Food Chain From Threats of Malevolent, Criminal,
or Terrorist Acts, May 2007. http://www.frenchfoodintheus.org/IMG/pdf/I07008308-imtnea-Guide_des_recommandations-ENG_3_.pdf.
Accessed and printed on September 23, 2013.
39. Trusted Information Sharing Network for Critical
Infrastructure Protection. A National Strategy for Enhancing the
Safety and Security of our Food Supply, March 2006. http://www.daff.gov.au/__data/assets/pdf_file/0004/183325/enhancing_safety_security_strategy.pdf. Accessed September 23, 2013.
40. U.S. Food and Drug Administration. Memorandum to the File:
Evaluation of the potential for intentional adulteration of produce
during activities that occur on produce farms, September 2013.
41. Buttars, N.K., A.J. Young, D. Bailey, ``Adoption of Security
Systems by Dairy Farms To Address Bioterrorist Threats in the
Intermountain United States,'' Journal of Dairy Science, 89:1822-
1829, 2006. Accessed October 22, 2013.
42. International Dairy Foods Association. Global Markets Page.
http://www.idfa.org/key-issues/category/global-markets/map/#us.
Accessed October 23, 2013.
43. Newkirk, R., C. Hedberg, and J. Bender, ``Establishing a
Milkborne Disease Outbreak Profile: Potential Food Defense
Implications,'' Foodborne Pathogens and Disease, 8(3):433-437, 2011.
44. Popkin, B., ``Patterns of Beverage Use Across the
Lifecycle,'' Physiology and Behavior, 100(1):4-9, 2010.
45. Sebastian, R.S., J.D. Goldman, C.W. Enns, and R.P. LaComb,
``Fluid Milk Consumption in the United States: What We Eat In
America, NHANES 2005-2006,'' Food Surveys Research Group Dietary
Data Brief No. 3, September 2010. http://ars.usda.gov/SP2UserFiles/Place/12355000/pdf/DBrief/3_milk_consumption_0506.pdf. Accessed
October 23, 2013.
46. U.S. Department of Agriculture and Economic Research
Service. Dairy Products: Per capita consumption, United States
(Annual), 2013. http://www.ers.usda.gov/data-products/dairy-data.aspx. Accessed October 23, 2013.
47. Wein, L.M. and Y. Lui, ``Analyzing a Bioterror Attack on the
Food Supply: The Case of Botulinum Toxin in Milk,'' Proceedings of
the National Academy of Sciences of the United States of America,
102(28):9984-9989, 2005.
48. Blayney, D.P., ``The Changing Landscape of U.S. Milk
Production,'' Statistical Bulletin No. 978, U.S. Department of
Agriculture, June 2002. http://usda.mannlib.cornell.edu/usda/nass/sb/sb978.pdf. Accessed October 23, 2013.
49. Codex Alimentarius Commission. General Principles of Food
Hygiene, CAC/RCP 1-1969, 2003.
50. Sobel J. and J. Watson, ``Chapter 10: Intentional Terrorism
Contamination of Food and Water,'' Beyond Anthrax, Springer Link,
2009.
51. Stinson, T.F., J. Kinsey, D. Degeneffe, and K. Ghosh, How
Should America's Anti-Terrorism Budget Be Allocated? Findings From a
National Survey of Attitudes of U.S. Residents About Terrorism, The
Food Industry Center, March 2006. http://ageconsearch.umn.edu/bitstream/14351/1/tr06-01.pdf. Accessed October 21, 2013.
52. Merriam-Webster. Vulnerability Page. http://www.merriam-webster.com/dictionary/vulnerability. Accessed October 21, 2013.
53. U.S. Food and Drug Administration, Study and Report on the
Food Processing Sector, 2011.
54. U.S. Food and Drug Administration. Analysis of Results for
FDA Food Defense Vulnerability Assessments and Identification of
Activity Types, April 2013. http://www.fda.gov/food/guidanceregulation/fsma/ucm347023.htm. Accessed September 25, 2013.
55. U.S. Food and Drug Administration. Memorandum to the File:
Evaluation of the potential for intentional adulteration of animal
feed from acts of terrorism, December 2013.
56. U.S. Department of Health and Human Services, Public Health
Service, and National
[[Page 78058]]
Toxicology Program. Report on Carcinogens, 12th Edition, 2011.
57. U.S. Department of Health and Human Services, Centers for
Disease Control and Prevention, and U.S. Department of Agriculture.
HHS and USDA Select Agents and Toxins 7 CFR Part 331, 9 CFR Part
121, and 42 CFR Part 73, September 10, 2013. http://www.selectagents.gov/resources/List_of_Select_Agents_and_Toxins_2013-09-10.pdf. Accessed October 21, 2013.
58. U.S. Food and Drug Administration. Vulnerability Assessments
of Food Systems: Final Summary Report, June 2009-February 2012.
http://www.fda.gov/downloads/Food/FoodDefense/UCM317547.pdf.
Accessed September 23, 2013.
59. AIB International. Food Safety and Food Defense Education
Page. https://www.aibonline.org/foodsafetyeducation/index.html.
Accessed October 17, 2013.
60. Center for Agriculture and Food Security and Preparedness
and University of Tennessee Knoxville. Instructor-Led Courses Page:
Agriculture and Food Vulnerability Assessment Training. http://www.vet.utk.edu/cafsp/courses.php. Accessed October 17, 2013.
61. International Featured Standards. IFS Food: Standard for
Auditing Quality and Food Safety of Food Products, Version 6,
January 2012. http://www.ifs-certification.com/images/ifs_standards/ifs6/IFS_Food_V6_en.pdf. Accessed September 23, 2013.
62. National Center for Food Protection and Defense. Food
Defense Online Modules Page. http://www.ncfpd.umn.edu/index.cfm/education/food-defense-online-modules/. Accessed October 17, 2013.
63. AIB International. The AIB International Consolidated
Standards for Inspection: Prerequisite and Food Safety Programs,
January 2013. https://www.aibonline.org/Standards/2013FoodSafety_web_ENG.pdf. Accessed October 17, 2013.
64. U.S. Food and Drug Administration. FDA's Preliminary
Regulatory Impact Analysis, Preliminary Regulatory Flexibility
Analysis, Preliminary Unfunded Mandates Reform Act Analysis,
Preliminary Paperwork Reduction Act Analysis, December 2013.
65. U.S. Food and Drug Administration. Memorandum to the File:
Environmental analysis related to the proposed rule on focused
mitigation strategies to protect food against intentional
adulteration, November 2013.
List of Subjects in 21 CFR Part 121
Food packaging, Foods.
Therefore, under the Federal Food, Drug, and Cosmetic Act and under
authority delegated to the Commissioner of Food and Drugs, it is
proposed that 21 CFR chapter I be amended by adding part 121 to read as
follows:
PART 121--FOCUSED MITIGATION STRATEGIES TO PROTECT FOOD AGAINST
INTENTIONAL ADULTERATION
Subpart A--General Provisions
Sec.
121.3 Definitions.
121.5 Exemptions.
Subpart B--[Reserved]
Subpart C--Food Defense Measures
121.126 Requirement for a food defense plan.
121.130 Identification of actionable process steps.
121.135 Focused mitigation strategies for actionable process steps.
121.140 Monitoring.
121.145 Corrective actions.
121.150 Verification.
121.160 Training.
Subpart D--Requirements Applying to Records That Must Be Established
and Maintained
121.301 Records subject to the requirements of this subpart.
121.305 General requirements applying to records.
121.310 Additional requirements applying to the food defense plan.
121.315 Requirements for record retention.
121.320 Requirements for official review.
121.325 Public disclosure.
Subpart E--Compliance
121.401 Compliance.
Authority: 21 U.S.C. 331, 342, 350g, 350(i), 371, 374.
Subpart A--General Provisions
Sec. 121.3 Definitions.
The definitions and interpretations of terms in section 201 of the
Federal Food, Drug, and Cosmetic Act are applicable to such terms when
used in this part. The following definitions also apply:
Actionable process step means a point, step, or procedure in a food
process at which food defense measures can be applied and are essential
to prevent or eliminate a significant vulnerability or reduce such
vulnerability to an acceptable level.
Contaminant means any biological, chemical, physical or
radiological agent that may be intentionally added to food and that may
cause illness, injury or death.
Facility means a domestic facility or a foreign facility that is
required to register under section 415 of the Federal Food, Drug, and
Cosmetic Act (21 U.S.C. 350d), in accordance with the requirements of
21 CFR part 1, subpart H.
Farm means farm as defined in Sec. 1.227 of this chapter.
FDA means the Food and Drug Administration.
Focused mitigation strategies mean those risk-based, reasonably
appropriate measures that a person knowledgeable about food defense
would employ to significantly minimize or prevent significant
vulnerabilities identified at actionable process steps, and that are
consistent with the current scientific understanding of food defense at
the time of the analysis.
Food means food as defined in section 201(f) of the Federal Food,
Drug, and Cosmetic Act (21 U.S.C. 321(f)) and includes raw materials
and ingredients.
Food defense means the effort to protect food from intentional acts
of adulteration where there is an intent to cause public health harm
and economic disruption.
Holding means storage of food. Holding facilities include
warehouses, cold storage facilities, storage silos, grain elevators,
and liquid storage tanks. For farms and farm mixed-type facilities,
holding also includes activities traditionally performed by farms for
the safe or effective storage of raw agricultural commodities grown or
raised on the same farm or another farm under the same ownership, but
does not include activities that transform a raw agricultural
commodity, as defined in section 201(r) of the Federal Food, Drug, and
Cosmetic Act, into a processed food as defined in section 201(gg).
Manufacturing/processing means making food from one or more
ingredients, or synthesizing, preparing, treating, modifying or
manipulating food, including food crops or ingredients. Examples of
manufacturing/processing activities are cutting, peeling, trimming,
washing, waxing, eviscerating, rendering, cooking, baking, freezing,
cooling, pasteurizing, homogenizing, mixing, formulating, bottling,
milling, grinding, extracting juice, distilling, labeling, or
packaging. For farms and farm mixed-type facilities, manufacturing/
processing does not include activities that are part of harvesting,
packing, or holding.
Mixed-type facility means an establishment that engages in both
activities that are exempt from registration under section 415 of the
Federal Food, Drug, and Cosmetic Act and activities that require the
establishment to be registered. An example of such a facility is a
``farm mixed-type facility,'' which is an establishment that grows and
harvests crops or raises animals and may conduct other activities
within the farm definition, but also conducts activities that require
the establishment to be registered.
Monitor means to conduct a planned sequence of observations or
measurements to assess whether focused mitigation strategies are
consistently applied and to produce an accurate record for use in
verification.
[[Page 78059]]
Packing means placing food into a container other than packaging
the food. For farms and farm mixed-type facilities, packing also
includes activities traditionally performed by farms to prepare raw
agricultural commodities grown or raised on the same farm or another
farm under the same ownership for storage and transport, but does not
include activities that transform a raw agricultural commodity, as
defined in section 201(r) of the Federal Food, Drug, and Cosmetic Act,
into a processed food as defined in section 201(gg).
Qualified end-user, with respect to a food, means the consumer of
the food (where the term consumer does not include a business); or a
restaurant or retail food establishment (as those terms are defined in
Sec. 1.227 of this chapter) that:
(1) Is located:
(i) In the same State as the qualified facility that sold the food
to such restaurant or establishment; or
(ii) Not more than 275 miles from such facility; and
(2) Is purchasing the food for sale directly to consumers at such
restaurant or retail food establishment.
Qualified facility means (when including the sales by any
subsidiary; affiliate; or subsidiaries or affiliates, collectively, of
any entity of which the facility is a subsidiary or affiliate) a
facility that is:
(1) A very small business as defined in this part; or
(2) A facility to which both of the following apply:
(i) During the 3-year period preceding the applicable calendar
year, the average annual monetary value of the food manufactured,
processed, packed or held at such facility that is sold directly to
qualified end-users (as defined in this part) during such period
exceeded the average annual monetary value of the food sold by such
facility to all other purchasers; and
(ii) The average annual monetary value of all food sold during the
3-year period preceding the applicable calendar year was less than
$500,000, adjusted for inflation.
Significant vulnerability means a vulnerability for which a prudent
person knowledgeable about food defense would employ food defense
measures because of the potential for serious adverse health
consequences or death and the degree of accessibility to that point in
the food process.
Significantly minimize means to reduce to an acceptable level,
including to eliminate.
Small business means a business employing fewer than 500 persons.
Verification means those activities, other than monitoring, that
establish that the system is operating according to the food defense
plan.
Very small business means a business that has less than $10,000,000
in total annual sales of food, adjusted for inflation.
Vulnerability means the susceptibility of a point, step, or
procedure in a facility's food process to intentional adulteration.
Sec. 121.5 Exemptions.
(a) This part does not apply to a qualified facility, except that
qualified facilities must, upon request, provide for official review
documentation that was relied upon to demonstrate that the facility
meets this exemption. Such documentation must be retained for 2 years.
(b) This part does not apply to the holding of food, except the
holding of food in liquid storage tanks.
(c) This part does not apply to the packing, re-packing, labeling,
or re-labeling of food where the container that directly contacts the
food remains intact.
(d) This part does not apply to activities of a facility that are
subject to section 419 of the Federal Food, Drug, and Cosmetic Act (21
U.S.C. 350h) (Standards for Produce Safety).
(e)(1) This part does not apply with respect to alcoholic beverages
at a facility that meets the following two conditions:
(i) Under the Federal Alcohol Administration Act (27 U.S.C. 201 et
seq.) or chapter 51 of subtitle E of the Internal Revenue Code of 1986
(26 U.S.C. 5001 et seq.) the facility is required to obtain a permit
from, register with, or obtain approval of a notice or application from
the Secretary of the Treasury as a condition of doing business in the
United States, or is a foreign facility of a type that would require
such a permit, registration, or approval if it were a domestic
facility; and
(ii) Under section 415 of the Federal Food, Drug, and Cosmetic Act
(21 U.S.C. 350d) the facility is required to register as a facility
because it is engaged in manufacturing, processing, packing, or holding
one or more alcoholic beverages.
(2) This part does not apply with respect to food other than
alcoholic beverages at a facility described in paragraph (e)(1) of this
section, provided such food:
(i) Is in prepackaged form that prevents any direct human contact
with such food; and
(ii) Constitutes not more than 5 percent of the overall sales of
the facility, as determined by the Secretary of the Treasury.
(f) This part does not apply to the manufacturing, processing,
packing, or holding of food for animals other than man.
Subpart B--[Reserved]
Subpart C--Food Defense Measures
Sec. 121.126 Requirement for a food defense plan.
(a) Food defense plan. The owner, operator, or agent in charge of a
facility must prepare, or have prepared, and implement a written food
defense plan.
(b) Contents of a food defense plan. The food defense plan must
include:
(1) The written identification of actionable process steps as
required by Sec. 121.130;
(2) The written focused mitigation strategies as required by Sec.
121.135(b);
(3) The written procedures for monitoring as required by Sec.
121.140(a);
(4) The written corrective action procedures as required by Sec.
121.145(a)(1); and
(5) The written verification procedures as required by Sec.
121.150(e).
Sec. 121.130 Identification of actionable process steps.
The owner, operator, or agent in charge of a facility must identify
any actionable process steps, using the procedures described in either
paragraph (a) or paragraph (b) of this section. The identification of
actionable process steps and the assessment leading to that
identification must be written.
(a) Key activity types. The owner, operator, or agent in charge of
a facility must assess, for each type of food manufactured, processed,
packed or held at the facility, whether the facility has one or more of
the following key activity types and identify the actionable process
steps associated with any key activity types present:
(1) Bulk liquid receiving and loading--a step in which a bulk
liquid is received and unloaded from an inbound conveyance or loaded
into an outbound conveyance where a contaminant can be intentionally
introduced and, if it is, it is likely that the contaminant will be
distributed throughout the liquid due to sloshing, movement, or
turbulence caused by the receiving and unloading or loading activity.
(2) Liquid storage and handling--a step in which a liquid is
contained in bulk storage tanks or in holding, surge,
[[Page 78060]]
or metering tanks where a contaminant can be intentionally introduced
and, if it is, it is likely that the contaminant will be distributed
into the food.
(3) Secondary ingredient handling--a staging, preparation,
addition, or rework step where a contaminant can be intentionally
introduced into a relatively small amount of ingredient or rework and,
if it is, it is likely that the contaminant will be distributed into a
larger volume of food.
(4) Mixing and similar activities--a step, such as mixing,
blending, homogenizing, or grinding where a contaminant can be
intentionally introduced and, if it is, it is likely that the
contaminant will be distributed into the food.
(b) Vulnerability assessment. The owner, operator, or agent in
charge of a facility must conduct or have conducted, for each type of
food manufactured, processed, packed or held at the facility, an
evaluation to identify and prioritize the points, steps, and procedures
in a food operation based on their vulnerability to intentional
adulteration and to identify actionable process steps. Such
vulnerability assessments must be performed by an individual(s)
qualified by experience and/or training using appropriate methods.
Sec. 121.135 Focused mitigation strategies for actionable process
steps.
(a) The owner, operator, or agent in charge of a facility must
identify and implement focused mitigation strategies at each actionable
process step to provide assurances that the significant vulnerability
at each step will be significantly minimized or prevented and the food
manufactured, processed, packed, or held by such facility will not be
adulterated under section 402 of the Federal Food, Drug, and Cosmetic
Act (21 U.S.C. 342).
(b) Focused mitigation strategies must be written.
(c) Focused mitigation strategies required under this section are
subject to:
(1) Monitoring as required by Sec. 121.140;
(2) Corrective actions as required by Sec. 121.145; and
(3) Verification as required by Sec. 121.150.
Sec. 121.140 Monitoring.
(a) The owner, operator, or agent in charge of a facility must
establish and implement written procedures, including the frequency
with which they are to be performed, for monitoring the focused
mitigation strategies.
(b) The owner, operator, or agent in charge of a facility must
monitor the focused mitigation strategies with sufficient frequency to
provide assurances that they are consistently applied.
(c) All monitoring of focused mitigation strategies in accordance
with this section must be documented in records that are subject to
verification in accordance with Sec. 121.150(a) and records review in
accordance with Sec. 121.150(c).
Sec. 121.145 Corrective actions.
(a) Corrective action procedures. (1) The owner, operator, or agent
in charge of a facility must establish and implement written corrective
action procedures that must be taken if focused mitigation strategies
are not properly implemented.
(2) The corrective action procedures must describe the steps to be
taken to ensure that appropriate action is taken to identify and
correct a problem with implementation of a focused mitigation strategy
to reduce the likelihood that the problem will recur.
(b) Documentation. All corrective actions taken in accordance with
this section must be documented in records that are subject to
verification in accordance with Sec. 121.150(b) and records review in
accordance with Sec. 121.150(c).
Sec. 121.150 Verification.
(a) Monitoring. The owner, operator, or agent in charge of a
facility must verify that monitoring is being conducted, as required by
Sec. 121.140.
(b) Corrective actions. The owner, operator, or agent in charge of
a facility must verify that appropriate decisions about corrective
actions are being made, as required by Sec. 121.145.
(c) Implementation and effectiveness. The owner, operator, or agent
in charge of a facility must verify that the focused mitigation
strategies are consistently implemented and are effectively and
significantly minimizing or preventing the significant vulnerabilities.
As appropriate to the facility and the food, this must include review
of the monitoring and corrective actions records within appropriate
timeframes to ensure that the records are complete, the activities
reflected in the records occurred in accordance with the food defense
plan, the focused mitigation strategies are effective, and appropriate
decisions were made about corrective actions.
(d) Reanalysis. The owner, operator, or agent in charge of a
facility must:
(1) Conduct a reanalysis of the food defense plan:
(i) At least once every 3 years;
(ii) Whenever a significant change is made in the activities
conducted at a facility operated by such owner, operator, or agent in
charge if the change creates a reasonable potential for a new
vulnerability or a significant increase in a previously identified
vulnerability;
(iii) Whenever such owner, operator or agent in charge becomes
aware of new information about potential vulnerabilities associated
with the food operation or facility;
(iv) Whenever a focused mitigation strategy is found to be
ineffective; and
(v) Whenever FDA requires reanalysis to respond to new
vulnerabilities and developments in scientific understanding including,
as appropriate, results from the Department of Homeland Security
biological, chemical, radiological, or other terrorism risk assessment.
(2) Complete such reanalysis and implement any additional focused
mitigation strategies needed to address the significant vulnerabilities
identified, if any, before the change in activities at the facility is
operative or, when necessary, during the first 6 weeks of production;
and
(3) Revise the written plan if a significant change is made or
document the basis for the conclusion that no additional or revised
focused mitigation strategies are needed.
(e) Documentation. All verification activities taken in accordance
with this section must be documented in records.
Sec. 121.160 Training.
(a) Personnel and supervisors assigned to actionable process steps
must receive appropriate training in food defense awareness and their
respective responsibilities in implementing focused mitigation
strategies.
(b) All training received in accordance with this section must be
documented in records.
Subpart D--Requirements Applying to Records That Must Be
Established and Maintained
Sec. 121.301 Records subject to the requirements of this subpart D.
(a) Except as provided by paragraph (b) of this section, all
records required by subpart C of this part are subject to all
requirements of this subpart D.
(b) The requirements of Sec. 121.310 apply only to the written
food defense plan.
Sec. 121.305 General requirements applying to records.
Records must:
(a) Be kept as original records, true copies (such as photocopies,
pictures, scanned copies, microfilm, microfiche,
[[Page 78061]]
or other accurate reproductions of the original records), or electronic
records, which must be kept in accordance with part 11 of this chapter;
(b) Contain the actual values and observations obtained during
monitoring;
(c) Be accurate, indelible, and legible;
(d) Be created concurrently with performance of the activity
documented;
(e) Be as detailed as necessary to provide history of work
performed; and
(f) Include:
(1) The name and location of the facility;
(2) The date and time of the activity documented;
(3) The signature or initials of the person performing the
activity; and
(4) Where appropriate, the identity of the product and the
production code, if any.
Sec. 121.310 Additional requirements applying to the food defense
plan.
The food defense plan must be signed and dated by the owner,
operator, or agent in charge of the facility:
(a) Upon initial completion; and
(b) Upon any modification.
Sec. 121.315 Requirements for record retention.
(a) All records required by this part must be retained at the
facility for at least 2 years after the date they were prepared.
(b) The food defense plan must be retained for at least 2 years
after its use is discontinued;
(c) Except for the food defense plan, offsite storage of records is
permitted after 6 months following the date that the record was made if
such records can be retrieved and provided onsite within 24 hours of
request for official review. The food defense plan must remain onsite.
Electronic records are considered to be onsite if they are accessible
from an onsite location.
(d) If the facility is closed for a prolonged period, the records
may be transferred to some other reasonably accessible location but
must be returned to the facility within 24 hours for official review
upon request.
Sec. 121.320 Requirements for official review.
All records required by this part must be made promptly available
to a duly authorized representative of the Secretary of Health and
Human Services upon oral or written request.
Sec. 121.325 Public disclosure.
Records required by this part will be protected from public
disclosure to the extent allowable under part 20 of this chapter.
Subpart E--Compliance
Sec. 121.401 Compliance.
(a) The operation of a facility that manufactures, processes,
packs, or holds food for sale in the United States if the owner,
operator, or agent in charge of such facility is required to comply
with, and is not in compliance with, section 418 of the Federal Food,
Drug, and Cosmetic Act (21 U.S.C. 350g) or subparts C or D of this part
is a prohibited act under section 301(uu) of the Federal Food, Drug,
and Cosmetic Act (21 U.S.C. 331(uu)).
(b) The failure to comply with section 420 of the Federal Food,
Drug, and Cosmetic Act (21 U.S.C. 350i) or subparts C or D of this part
is a prohibited act under section 301(ww) of the Federal Food, Drug,
and Cosmetic Act.
Dated: December 13, 2013.
Leslie Kux,
Assistant Commissioner for Policy.
[FR Doc. 2013-30373 Filed 12-20-13; 8:45 am]
BILLING CODE 4160-01-P