# Focused Mitigation Strategies To Protect Food Against Intentional Adulteration

> Briefs, arguments, decisions, and more.

URL: https://www.frixlaw.com/law-library/documents/fr%3A2013-30373

## Record

- **Collection:** Federal Register
- **Document type:** Proposed Rule
- **Published:** December 24, 2013
- **Citation:** 78 FR 78014

## Text

DEPARTMENT OF HEALTH AND HUMAN SERVICES
Food and Drug Administration
21 CFR Parts 16 and 121
[Docket No. FDA-2013-N-1425]
RIN 0910-AG63
Focused Mitigation Strategies To Protect Food Against Intentional Adulteration

AGENCY:

Food and Drug Administration, HHS.

ACTION:

Proposed rule.

SUMMARY:

The Food and Drug Administration (FDA or we) is proposing to require domestic and foreign food facilities that are required to register under the Federal Food, Drug, and Cosmetic Act (the FD&C Act) to address hazards that may be intentionally introduced by acts of terrorism. These food facilities would be required to identify and implement focused mitigation strategies to significantly minimize or prevent significant vulnerabilities identified at actionable process steps in a food operation. FDA is proposing these requirements as part of our implementation of the FDA Food Safety Modernization Act (FSMA). Further, as part of the proposal, FDA discusses an approach to addressing economically motivated intentional adulteration. We expect the proposed rule, if finalized as proposed, would help to protect food from intentional adulteration caused by acts of terrorism.

DATES:

Submit either electronic or written comments on the proposed rule by March 31, 2014. Submit comments on information collection issues under the Paperwork Reduction Act of 1995 by January 23, 2014, (see the “Paperwork Reduction Act of 1995” section of this document).

ADDRESSES:

You may submit comments, identified by Docket No. FDA-2013-N-1425 and/or Regulatory Information Number (RIN) 0910-AG63, by any of the following methods, except that comments on information collection issues under the Paperwork Reduction Act of 1995 must be submitted to the Office of Information and Regulatory Affairs, Office of Management and Budget (OMB) (see the “Paperwork Reduction Act of 1995” section of this document).

Electronic Submissions

Submit electronic comments in the following way:

•
Federal eRulemaking Portal: http://www.regulations.gov.
Follow the instructions for submitting comments.

Written Submissions

Submit written submissions in the following ways:

•
Mail/Hand delivery/Courier (for paper or CD-ROM submissions
): Division of Dockets Management (HFA-305), Food and Drug Administration, 5630 Fishers Lane, rm. 1061, Rockville, MD 20852.

Instructions:
All submissions received must include the Agency name and Docket No. FDA-2013-N-1425 and Regulatory Information Number (RIN) 0910-AG63 for this rulemaking. All comments received may be posted without change to
http://www.regulations.gov,
including any personal information provided. For additional information on submitting comments, see the “Comments” heading of the
SUPPLEMENTARY INFORMATION
section of this document.

Docket:
For access to the docket to read background documents or comments received, go to
http://www.regulations.gov
and insert the docket number, found in brackets in the heading of this document, into the “Search” box and follow the prompts and/or go to the Division of Dockets Management, 5630 Fishers Lane, rm. 1061, Rockville, MD 20852.

FOR FURTHER INFORMATION CONTACT:

Regarding the provisions with respect to human food: Ryan Newkirk, Center for Food Safety and Applied Nutrition (HFS-005), Food and Drug Administration, 5100 Paint Branch Pkwy., College Park, MD 20740, 240-402-2428. Regarding the provisions with respect to food for animals: Alfred Montgomery, Center for Veterinary Medicine (HFV-200), Food and Drug Administration, 7519 Standish Pl., Rockville, MD 20855, 240-453-6836.

SUPPLEMENTARY INFORMATION:

Table of Contents

Executive Summary

Scope of Coverage of the Proposed Rule

Summary of the Major Provisions of the Proposed Rule

Costs and Benefits

I. Introduction

II. Background

A. Incidents of Intentional Adulteration of Food

B. Interagency Approach to Food Defense

C. Resources for the Food Sector

D. Outreach

E. Industry Standards

F. International Food Defense Guidelines

III. Legal Authority

A. Section 103 of FSMA

B. Section 106 of FSMA

C. Intrastate Activities

IV. Regulatory Approach

A. Framework of the Rule

B. Activities That Occur on Produce Farms

C. Transportation Carriers

D. Food for Animals

E. Acts of Disgruntled Employees, Consumers, or Competitors

F. Economically Motivated Adulteration

G. Low-Risk Activities at Farm Mixed-Type Facilities

H. Activities That Occur on Dairy Farms

I. Other Ways To Focus on Foods With a High Risk of Intentional Adulteration Caused by Terrorism

V. The Proposal

A. Definitions

B. Exemptions

C. Food Defense Measures

D. Requirements Applying to Records That Must Be Established and Maintained

E. Compliance

VI. Preliminary Regulatory Impact Analysis

VII. Analysis of Environmental Impact

VIII. Federalism

IX. Comments

X. References

Executive Summary

This proposed regulation implements three provisions of the Federal Food, Drug, and Cosmetic (FD&C) Act, as amended by the FDA Food Safety Modernization Act (FSMA), that relate to the intentional adulteration of food. Section 418 of the FD&C Act (21 U.S.C. 350g) addresses intentional adulteration in the context of facilities that manufacture, process, pack, or hold food and are required to register under section 415 of the FD&C Act (21 U.S.C. 350d). Section 419 of the FD&C Act (21 U.S.C. 350h) addresses intentional adulteration in the context of fruits and vegetables that are raw agricultural commodities. Section 420 of the FD&C Act (21 U.S.C. 350i) addresses intentional adulteration in the context of high risk foods and exempts farms except for farms that produce milk. FDA is implementing the intentional adulteration provisions in sections 418, 419, and 420 of the FD&C Act in this rulemaking.

Scope of Coverage of the Proposed Rule

The subject of this proposed rule is protection of food against intentional adulteration caused by acts of terrorism. This proposed rule would apply to both domestic and foreign facilities that are required to register under section 415 of the FD&C Act. However, as explained in the remainder of this document and shown in Diagram 1 and Table 1, the proposed rule contains several exemptions. (The diagrams and table below are intended to illustrate the proposed scope and requirements of this rule, and do not include all aspects of the proposed regulation.) These exemptions are:

• The proposed rule would not apply to a qualified facility, except that the

facility would be required to provide for official review, upon request, documentation that was relied upon to demonstrate that the facility qualifies for this exemption. As proposed, a qualified facility would be: (1) A very small business (i.e., a business that has less than $10,000,000 in total annual sales of food, adjusted for inflation), or (2) a facility that meets two requirements, i.e., (a) During the 3-year period preceding the applicable calendar year, the average annual monetary value of the food manufactured, processed, packed or held at such facility that is sold directly to qualified end-users (as defined in this part) during such period exceeded the average annual monetary value of the food sold by such facility to all other purchasers; and (b) the average annual monetary value of all food sold during the 3-year period preceding the applicable calendar year was less than $500,000, adjusted for inflation.

• This proposed rule would not apply to the holding of food, except the holding of food in liquid storage tanks.

• This proposed rule would not apply to the packing, re-packing, labeling, or re-labeling of food where the container that directly contacts the food remains intact.

• This proposed rule would not apply to activities of a facility that are subject to section 419 of the Federal Food, Drug, and Cosmetic Act (Standards for Produce Safety).

• This proposed rule would not apply with respect to alcoholic beverages at a facility that meets certain conditions.

• This proposed rule would not apply to the manufacturing, processing, packing, or holding of food for animals other than man.

We seek comment on these exclusions and whether additional exclusions are warranted.

BILLING CODE 4160-01-P

EP24DE13.026

BILLING CODE 4160-01-C

Table 1—Scope of Intentional Adulteration and Proposed Exclusions and Exemptions

Type of intentional adulteration

Coverage within scope of proposed
21 CFR 121

Brief rationale, and relevant corresponding section of the rule *

I. Types of Intentional Adulteration Considered in this Proposed Rulemaking

1. Acts of disgruntled employees, consumers, or competitors intended to attack the reputation of a company, and not to cause public health harm, although public health harm may occur
Not within the scope of intentional adulteration covered under proposed 21 CFR 121

Not considered “high risk” because not intended to cause widespread, significant public health harm.
See section IV.E of this document.

2. Economically motivated adulteration (EMA) intended to obtain economic gain, and not to cause public health harm, although public health harm may occur
Not within the scope of intentional adulteration covered under proposed 21 CFR 121

Considering addressing as part of hazard analysis in a preventive controls framework where EMA is “reasonably likely to occur.”
See section IV.F of this document.

3. Acts intended to cause massive public health harm, including acts of terrorism
Covered within scope, and is the focus of proposed 21 CFR 121
Considered “high risk” because intent of the act is to cause widespread, significant public health harm.

See section IV.A of this document.

II. Facilities or Operations Excluded or Exempted from Proposed 21 CFR 121

Facility or Operation
Exclusion or Exemption (and any associated modified requirements)
Brief rationale, and relevant corresponding section of the rule *

Activities that fall within the definition of “farm” (as defined in 21 CFR § 1.227)
Excluded

Activities that occur on produce farms are not considered “high risk.”
Activities that occur on dairy farms are addressed below.

Activities that occur on other farms are outside the scope of 103, 105, and 106 of FSMA.
See section IV.B of this document.

Transportation carriers
Excluded
Transportation of bulk liquids is addressed by coverage of shippers and receivers.

Other transportation activities are not considered “high risk.”
See section IV.C of this document.

Activities that occur on dairy farms
Fluid milk storage and loading appear to pose a significant vulnerability.

We seek comment on practical and effective approach to address this vulnerability.

See section IV.H of this document.

Qualified facility, as defined in proposed § 121.3
Exempt, except must provide for FDA review, upon request, documentation relied on to demonstrate that the facility qualifies for this exemption

Very small businesses are not considered “high risk.”
See section V.B.1 of this document.

Holding of food, except the holding of food in liquid storage tanks
Exempt
Not considered “high risk” because these activities do not fit within any of the FDA-identified key activity types.

See section V.B.2 of this document.

Packing, re-packing, labeling, or re-labeling of food where the container that directly contacts the food remains intact
Exempt

Not considered “high risk” because these activities do not fit within any of the FDA-identified key activity types.
See section V.B.3 of this document.

Activities of a facility that are subject to Standards for Produce Safety (proposed 21 CFR 112)
Exempt

Activities that occur on produce farms are not considered “high risk.”
See section V.B.4 of this document.

Alcoholic beverages at certain alcohol-related facilities, and certain prepackaged food sold in limited quantities along with alcoholic beverages at the same facilities (see proposed § 121.5(e))
Exempt

Alcoholic beverages at these facilities are outside the scope of 103, 105, and 106 of FSMA.
See section V.B.5 of this document.

Manufacturing, processing, packing, or holding of food for animals
Exempt
Not considered “high risk” because unlikely to impact human health.

See section V.B.6 of this document.

* Please see the corresponding sections of the rule identified in the column for a complete discussion of our analysis, rationale, and tentative conclusions related to the proposed exclusions or exemption.

Summary of the Major Provisions of the Proposed Rule

This proposed rule would establish various food defense measures that an owner, operator, or agent in charge of a facility would be required to implement to protect against the intentional adulteration of food, as summarized in Diagram 2. Specifically:

• Prepare and implement a written food defense plan that includes actionable process steps, focused mitigation strategies, and procedures for monitoring, corrective actions, and verification (proposed § 121.126).

• Identify any actionable process steps, using one of two procedures. FDA has analyzed vulnerability assessments conducted using the CARVER+Shock methodology and identified four key activity types: Bulk liquid receiving and loading; Liquid storage and handling; Secondary ingredient handling; and Mixing and similar activities. FDA has determined that the presence of one or more of these key activity types at a process step (e.g., manufacturing, processing, packing, or holding of food) indicates a significant vulnerability under section 418 of the FD&C Act and that the food is at high risk of intentional adulteration caused by acts of terrorism under section 420 of the FD&C Act. Facilities may identify actionable process steps using the FDA-identified key activity types as described in proposed § 121.130(a) or conduct their own facility-specific vulnerability assessments as provided in proposed § 121.130(b).

• Identify and implement focused mitigation strategies at each actionable process step to provide assurances that the significant vulnerability at each step will be significantly minimized or prevented and the food manufactured, processed, packed, or held by the facility will not be adulterated (proposed § 121.135).

• Establish and implement procedures, including the frequency with which they are to be performed, for monitoring the focused mitigation strategies (proposed § 121.140).

• Establish and implement corrective action procedures that must be taken if focused mitigation strategies are not properly implemented (proposed § 121.145).

• Verify that monitoring is being conducted and appropriate decisions about corrective actions are being made; verify that the focused mitigation strategies are consistently implemented and are effectively and significantly minimizing or preventing the significant vulnerabilities; and conduct a reanalysis of the food defense plan (proposed § 121.150).

• Ensure that personnel and supervisors assigned to actionable process steps receive appropriate training in food defense awareness and their respective responsibilities in implementing focused mitigation strategies (proposed § 121.160).

• Establish and maintain certain records, including the written food defense plan; written identification of actionable process steps and the assessment leading to that identification; written focused mitigation strategies; written procedures for monitoring, corrective actions, and verification; and documentation related to training of personnel (proposed §§ 121.301 to 121.325).

As proposed, the effective date is 60 days after a final rule is published. However, we are providing for a longer timeline for facilities to come into compliance. Facilities, other than small and very small businesses, would have one year after the effective date to comply with proposed part 121. Small businesses (i.e., those employing fewer than 500 persons) would have 2 years after the effective date to comply with proposed part 121. Very small businesses (i.e., businesses that have less than $10,000,000 in total annual sales of food, adjusted for inflation) would be considered a qualified facility and would have 3 years after the effective date to comply with proposed § 121.5(a).

BILLING CODE 4160-01-P

EP24DE13.027

BILLING CODE 4160-01-C

In addition, we describe our current thinking and seek comment on other issues, including activities that occur on dairy farms and economically motivated adulteration. Finally, elsewhere in this issue of the
Federal Register
, FDA is publishing for comment its evaluation that identifies low-risk activities that occur at farm mixed-type facilities, with a specific focus on the risk presented by hazards that may be intentionally introduced by acts of terrorism.

Costs and Benefits

As described in the Preliminary Regulatory Impact Analysis (PRIA), we estimate the annualized costs of the actions required by this proposed rule to be about $370 million. The benefits of these actions are a reduction in the possibility of illness, death, and economic disruption resulting from intentional adulteration of food. We are unable to quantify these benefits. However, we monetize the damage that various intentional adulteration scenarios might cause, and present a breakeven analysis showing the number of prevented attacks at which the benefits are larger than the costs.

Annualized Cost and Benefit Overview

All numbers are USD millions, annualized over 10 years
3% discount
7% discount

Costs:

Learning about Rule
$3
$3

Mitigation Costs
59
63

Monitoring and Corrective Action
100
100

Employee Training
4
5

Documentation
6
6

Subtotal (Domestic cost)
172
177

Cost to Foreign Firms
185
190

Total
357
367

Benefits: Lower Chance of Intentional Adulteration
Unquantified.

I. Introduction

The FDA Food Safety Modernization Act (FSMA) (Pub. L. 111-353), signed into law on January 4, 2011, enables FDA to better protect public health by helping to ensure the safety and security of the food supply. FSMA enables us to focus more on preventing food safety problems rather than primarily reacting to problems after they occur. The law also provides us with new enforcement authorities to help us achieve higher rates of compliance with prevention- and risk-based safety standards and to better respond to and contain problems when they do occur. In addition, the law gives us important new tools to better ensure the safety of imported foods and directs us to build an integrated national food safety system in partnership with State, local, tribal, and territorial authorities.

Section 103 of FSMA directs FDA to issue regulations establishing requirements for facilities that manufacture, process, pack or hold food and requires facilities to consider hazards that may be intentionally introduced, including by acts of terrorism. Section 106 of FSMA requires FDA to issue regulations to protect food for which there is a high risk of intentional contamination and for which such intentional contamination could cause serious adverse health consequences or death to humans or animals. In addition, section 105 of FSMA directs FDA to issue regulations setting forth science-based minimum standards for the safe production and harvesting of produce, and requires that the rulemaking consider hazards that may be intentionally introduced, including by acts of terrorism.

Efforts to protect against intentional adulteration require a shift in perspective from that applied to traditional food safety. In proposed rules entitled “Current Good Manufacturing Practice and Hazard Analysis and Risk-Based Preventive Controls for Human Food” (78 FR 3646, January 16, 2013) (Docket No. FDA-2011-N-0920; hereafter referred to as “the PC proposed rule”), “Current Good Manufacturing Practice and Hazard Analysis and Risk-Based Preventive Controls for Food for Animals” (78 FR 64736, October 29, 2013) (Docket No. FDA-2011-N-0922; hereafter referred to as “the Animal Food PC proposed rule”), and “Standards for the Growing, Harvesting, Packing and Holding of Produce for Human Consumption” (78 FR 3504, January 16, 2013) (Docket No. FDA-2011-N-0921; hereafter referred to as “the Produce Safety proposed rule”), FDA tentatively decided not to include requirements to address “hazards that may be intentionally introduced, including by acts of terrorism” (sections 418(b)(2) and 419(a)(3)(C) of the FD&C Act (21 U.S.C. 350g(b)(2) and 350h(a)(3)(C))) and to implement sections 103 and 105 of FSMA regarding such hazards in a separate rulemaking (this proposed rule). As noted in those proposed rules, FDA tentatively concluded that intentional adulteration, which is not addressed by traditional Hazard Analysis and Critical Controls Point (HACCP) or other food safety systems, likely will require different kinds of controls. FDA is taking the action described in this proposed rule to implement the intentional adulteration provisions in sections 103, 105, and 106 of FSMA.

II. Background

Intentional adulteration of the food supply can result in catastrophic public health consequences, widespread public fear, loss of public confidence in the safety of food and the ability of government to ensure food safety, and significant adverse economic impacts, including disruption of trade (Ref. 1, Ref. 2, Ref. 3, Ref. 4). Acts of intentional adulteration may take several forms, including acts of terrorism; acts of disgruntled employees, consumers, or competitors; and economically motivated adulteration. Acts of terrorism are associated with an intent to cause massive public health harm and, to a lesser extent, economic disruption (Ref. 5, Ref. 2, Ref. 3, Ref. 6). Acts of disgruntled employees, consumers, or competitors are generally understood to be directed at attacking the reputation of the company and not at public health harm. The primary purpose of economically motivated adulteration is to obtain economic gain, and not to impact public health (Ref. 7, Ref. 8, Ref. 9), although public health harm may occur (Ref. 10, Ref. 11).

“Food defense” and “food security” are terms that are sometimes used interchangeably. We use the term “food defense” to refer to the effort to protect food from acts of intentional adulteration where there is an intent to cause public health harm and economic disruption. “Food security” is defined by the World Health Organization (WHO) to mean “when all people at all times have access to sufficient, safe, nutritious food to maintain a healthy and active life” (Ref. 12). To avoid confusion, we use the term “food defense” and not the term “food security” in the context of intentional adulteration.

A. Incidents of Intentional Adulteration of Food

Several cases of intentional adulteration with the intent to cause public health harm and economic disruption in the United States have been documented. For example, in 1984, in an attempt to prevent the general public from voting in the local elections, members of a local religious commune in The Dalles, OR, intentionally contaminated food in restaurants with
Salmonella.
A total of 751 people became ill and 45 were hospitalized (Ref. 4). In another incident, in 1996, 12 laboratory workers at a large medical facility in Texas became ill from consuming anonymously donated pastries that were intentionally contaminated with
Shigella dysenteriae
type 2, which was later discovered to have originated from the facility's stock culture (Ref. 13). In 2009, two related incidents resulted in 49 individuals reporting rapid and acute onset of gastrointestinal and neurological symptoms after eating meals at a restaurant in Lenexa, KS. Investigations concluded that the illnesses were caused by methomyl (an insecticide) poisoning associated with the consumption of salsa at the restaurant. Two former employees of the restaurant were found guilty of intentionally contaminating the salsa (Ref. 14).

A widespread incident of economically motivated adulteration occurred in China in 2008. Some Chinese milk firms added melamine, a nitrogen-rich industrial by-product, to diluted dairy products to increase the apparent protein content. This adulteration resulted in significant public health consequences, with more than 290,000 ill infants and 6 deaths in China. In addition, this incident caused significant economic disruption within the Chinese dairy industry, with estimates approaching $3 billion in loss to industry (Ref. 10, Ref. 11).

B. Interagency Approach to Food Defense

1. Homeland Security Presidential Directives and Presidential Policy Directives for the Food and Agriculture Sector

Intelligence gathered since the attacks on the United States on September 11, 2001, indicates that terrorist organizations have discussed contamination of the food supply as a means to harm U.S. citizens and disrupt the global economy (Ref. 15). In response, FDA, along with the Centers for Disease Control and Prevention (CDC), the United States Department of Agriculture (USDA), the Department of Homeland Security (DHS), the Federal Bureau of Investigation (FBI), the Environmental Protection Agency (EPA), the Department of Defense, the Department of Energy, the Department of Commerce, and the Department of the Interior, as well as with State, local, tribal, territorial, and private sector partners have coordinated efforts to prevent, prepare for, and respond to threats against the food supply. Many of these efforts were accomplished in accordance with applicable Homeland Security Presidential Directives (HSPD), specifically HSPD-7, HSPD-8, and HSPD-9, and Presidential Policy Directives (PPD), specifically PPD-8 and PPD-21 (Ref. 16, Ref. 17, Ref. 18, Ref. 19, Ref. 20). In accordance with these directives, FDA, USDA, DHS, State and local governments and the food industry collaborated to conduct vulnerability assessments of a variety of products and processes within the food and agriculture sector.

2. The Evolution of Vulnerability Assessments

Initially, FDA used Operational Risk Management (ORM), which is a vulnerability assessment methodology that uses a six-step sequence of identifying hazards and reducing the potential for negative public health consequences. The ORM process resulted in three main outcomes: (1) A calculation of risk by combining assessments of severity and probability of an attack on a specific food; (2) calculations for specific contaminants and specific food processes or related activities; and (3) a categorization of specific food/contaminant/food process or related activity into a high, medium, or low risk scheme.

At first, ORM-based assessments were focused on reducing large public health consequences of attacks on the food supply. FDA realized that other significant considerations (i.e., large economic disruptions, public alarm, loss of confidence in the food supply, and interruption of the food stream) warranted incorporation into the vulnerability assessment calculus. To incorporate these considerations, FDA and USDA's Food Safety and Inspection Service (FSIS) adapted a military targeting tool known as CARVER to assess vulnerabilities of the food and agriculture sector. CARVER is an acronym for the following six attributes used to evaluate the attractiveness of a target for attack:

• Criticality—measure of public health and economic impacts of an attack;

• Accessibility—ability to physically access and egress from target;

• Recuperability—ability of a system to recover from an attack;

• Vulnerability—ease of accomplishing an attack;

• Effect—amount of direct loss from an attack as measured by loss in production; and

• Recognizability—ease of identifying a target.

A seventh attribute, “Shock”, was added to the original six attributes to assess the combined health, economic, and psychological impacts of an attack on the food industry. ORM and CARVER+Shock assessment conclusions were consistent; however, the CARVER+Shock methodology improved vulnerability assessment efforts because its process allowed for the identification and estimation of economic and psychological impacts throughout the food system.

In 2005, the Strategic Partnership Program Agroterrorism (SPPA), a public-private cooperative effort was established by FDA, USDA, FBI, and DHS, in partnership with State and industry partners. The intent of the SPPA Initiative was to collect the necessary data to identify food and agriculture sector-specific vulnerabilities using the CARVER+Shock method, develop mitigation strategies, identify research gaps, and increase coordination between government and industry partners. The SPPA initiative ran from 2005 to 2008, resulting in vulnerability assessments of 36 food products and processes (Ref. 21). The SPPA Initiative was a significant step towards identifying vulnerabilities, mitigation strategies, and research needs within the food and agriculture industries. This initiative also provided Federal, State, and local government agencies with an in-depth look at the vulnerabilities that may be associated with the food and agriculture industry, and helped enhance communication among industry, government, and law enforcement

stakeholders concerned with the protection of the U.S. food supply. Since the conclusion of the SPPA Initiative, we have conducted additional vulnerability assessments, which continue to help inform our research and policy.

C. Resources for the Food Sector

FDA has issued guidance documents and developed other resources to assist industry in their efforts to protect the food supply against intentional adulteration. In 2003, FDA issued five guidance documents covering food defense preventive measures for various segments of the food and cosmetic industry: (1) Guidance for Industry: Food Producers, Processors, and Transporters: Food Security Preventive Measures Guidance (Ref. 22); (2) Guidance for Industry: Importers and Filers: Food Security Preventive Measures Guidance (Ref. 23); (3) Guidance for Industry: Dairy Farms, Bulk Milk Transporters, Bulk Milk Transfer Stations and Fluid Milk Processors: Food Security Preventive Measures Guidance (Ref. 24); (4) Retail Food Stores and Food Service Establishments: Food Security Preventive Measures Guidance (Ref. 25); and(5) Cosmetics Processors and Transporters of Cosmetics Security Preventive Measures Guidance (Ref. 26). These guidance documents provide FDA's recommendations for best practices in food defense, and describe preventive measures that establishments can take to minimize the risk of intentional adulteration of food. We updated the guidance documents in 2007 to include a self-assessment tool that guides the user through an assessment of recommended preventive measures to identify those most applicable to the facility.

FDA also has made available other resources to help industry identify and mitigate potential vulnerabilities for intentional adulteration. These include:

• The “ALERT” program,

• The “Employees FIRST” training tool,

• The “CARVER+Shock Vulnerability Assessment” software tool,

• The “Mitigations Strategies Database,”

• The “Food Defense Plan Builder” software tool,

• The Food Related Emergency Exercise Bundle, and

• The “Food Defense 101” training courses.

We describe each briefly in this section of the document.

The ALERT program, originally released in 2006, is an educational program intended to raise the awareness of State and local governments and industry regarding food defense (Ref. 27). ALERT identifies five key elements that industry can use in food defense planning:

• A—How do you ASSURE that the supplies and ingredients you use are from safe and secure sources?

• L—How do you LOOK after the security of the products and ingredients in your facility?

• E—What do you know about your EMPLOYEES and people coming in and out of your facility?

• R—Could you provide REPORTS about the security of your products while under your control?

• T—What do you do and who do you notify if you have a THREAT or issue at your facility, including suspicious behavior?

Similarly, the Employees FIRST educational tool, originally released in 2008, is a food defense awareness training program for front-line food industry workers about the risk of intentional adulteration and the actions they can take to identify and reduce these risks (Ref. 28). This tool identifies the following five key elements:

• F—Follow company food defense plan and procedures;

• I—Inspect your work area and surrounding areas;

• R—Recognize anything out of the ordinary;

• S—Secure all ingredients, supplies, and finished product; and

• T—Tell management if you notice anything unusual or suspicious.

The CARVER+Shock Vulnerability Assessment software tool, originally released in 2007, helps users conduct vulnerability assessments for their establishments to identify and prioritize the “critical nodes,” (also known as critical process steps) the potential targets vulnerable to intentional adulteration attacks (Ref. 29). It guides users through a series of questions to determine the vulnerability of each of the nodes within their facility. After the vulnerabilities are identified, the software helps users to identify mitigation strategies for reducing the risk of intentional adulteration. Using the software tool, the user can focus resources on protecting the most susceptible points in their system.

The Mitigation Strategies Database (MSD), originally released in 2011, is a database of mitigation strategies that can be applied to different steps in a food operation to reduce the risk of intentional adulteration (Ref. 30). The database is searchable by key words and processing steps common to agriculture and food operations (e.g., growing, harvesting, packing, manufacturing, processing, and holding). See also the discussion in section V.C.3 of this document.

The Food Defense Plan Builder (FDPB) software tool, released in 2013, is a user-friendly computer software program designed to assist owners and operators of food facilities in developing food defense plans for their facilities (Ref. 31). In addition to providing new functionality for food defense planning and implementation, the FDPB software tool harnesses our food defense guidance documents, CARVER+Shock Vulnerability Assessment software tool, and the MSD into a single application.

The Food Related Emergency Exercise Bundle (FREE-B), which FDA released in 2011 and developed in collaboration with CDC and FSIS and USDA's Animal and Plant Health Inspection Service (APHIS), is a compilation of scenarios based on both intentional and unintentional food contamination events. The FREE-B is designed to assist the food industry, government regulatory agencies, and public health organizations in assessing existing food emergency response plans, protocols, and procedures (Ref. 32). The FREE-B tool is designed to allow an individual agency or industry entity to test its own plans, protocols, and procedures independently. Additionally, the tool allows multiple jurisdictions and organizations (e.g., medical community, private sector, law enforcement, and first responder communities) to jointly conduct exercises. The tool is a set of five scenarios, each of which contains a Facilitator's Guide, a Lead Planner's guide, and a Situation Manual.

Finally, our food defense training courses, entitled “Food Defense 101” and released in 2013, reflect FDA's current thinking on how to minimize the likelihood and impact of incidents of intentional adulteration (Ref. 27). Four courses integrated into one module include: (1) Food Defense Awareness for Professionals, (2) Food Defense Awareness for Frontline Employees, (3) FDA Regulations, and (4) ALERT for owners and operators of food facilities. The ALERT program is described previously. The other programs are described in section V.C.7 of this document.

D. Outreach

We have conducted food defense awareness outreach to international and domestic stakeholders. Beginning in 2008, under the auspices of the Asia-Pacific Economic Cooperation (APEC), we collaborated with the U.S. Department of State, USDA's Foreign Agricultural Service, and FSIS to launch the Food Defense Pilot Program for the

APEC member countries. The Pilot Program was developed with the intent to implement the food defense principles endorsed by the APEC Counter Terrorism Task Force. The goal of the program was to build and foster global capacity to prevent and protect against deliberate tampering and intentional contamination of the food supply through information sharing, outreach, and technical assistance on food defense, thereby safeguarding food trade and public health across the APEC member countries. In addition, to support the international capacity building goals of FSMA, we conducted several workshops in various countries to discuss topics such as increasing food defense awareness, developing food defense plans, conducting vulnerability assessments, and implementing mitigation strategies.

In 2013, we increased our domestic outreach activities with a series of workshops in the United States. Using a similar format and agenda as the international workshops, we conducted 1-day food defense awareness workshops to provide industry, State and local governments, and academic partners with information on food defense, and share tools and resources. During these workshops, we shared information on how to use the new FDPB software tool to develop a comprehensive food defense plan. These workshops also served as a forum to discuss food defense concerns, understand industry's current practices, and share ideas for collaboration to better protect the food supply against intentional adulteration. We plan to continue to hold additional workshops in 2014.

E. Industry Standards

Guidelines accompanying industry standards in the United States have addressed intentional adulteration of food. For example, the Global Food Safety Initiative's (GFSI) Guidance Document Sixth Edition (Ref. 33) addresses food defense. Some organizations that own and manage industry standards have worked or are working to incorporate food defense requirements into their standards to meet this GFSI guideline. For example, the Safe Quality Foods (SQF) Code, edition 7.1, issued in 2013, is a process and product certification standard that specifies various food defense elements, including that the methods, responsibility, and criteria for preventing food adulteration caused by a deliberate act of sabotage or terrorist-like incident shall be documented, implemented and maintained (Ref. 34). Another example of industry standards that incorporate food defense elements is the International Featured Standards (IFS) Food Version 6 Standard, which specifies that areas critical to security be identified, food defense hazard analysis and assessment of associated risks be conducted annually or upon changes that affect food integrity, and an appropriate alert system be defined and periodically tested for effectiveness (Ref. 35).

F. International Food Defense Guidelines

In 2008, WHO issued its “Terrorist Threats to Food—Guidelines for Establishing and Strengthening Prevention and Response Systems” to provide policy guidance to its Member States for integrating consideration of deliberate acts of sabotage of food into existing prevention and response programs (Ref. 6). WHO uses the term “food terrorism” and defines it as “an act or threat of deliberate contamination of food for human consumption with biological, chemical and physical agents or radionuclear materials for the purpose of causing injury or death to civilian populations and/or disrupting social, economic or political stability.” Focusing on the two key strategies of prevention and response, WHO recommends that all segments of the food industry consider the development of security and response plans for their establishments, proportional to the threat and their resources. The guidelines state that the key to preventing food terrorism is enhancing existing food safety programs and implementing reasonable security measures on the basis of vulnerability assessments. The guidelines further state that the most vulnerable foods, food ingredients, and food processes should be identified, including: the most readily accessible food processes; foods that are most vulnerable to undetected tampering; foods that are the most widely disseminated or spread; and the least supervised food production areas and processes.

Other national governments, including Australia, China, France, Germany, and the United Kingdom, also have issued guidelines to assist their food industry stakeholders in protecting food against intentional adulteration (Ref. 5, Ref. 36, Ref. 37, Ref. 38, Ref. 39).

III. Legal Authority

FDA is proposing this regulation under the FD&C Act as amended by FSMA. Under sections 103 and 106 of FSMA, FDA is proposing the requirements applicable to the owner, operator, or agent in charge of a facility required to register under section 415 of the FD&C Act. Under section 106 of FSMA, FDA is proposing the requirements applicable to activities at some facilities not covered by section 103 of FSMA (i.e., activities subject to and in compliance with the juice and seafood HACCP regulations in parts 120 and 123 (21 CFR parts 120 and 123) and the manufacturing, processing, packing, or holding of a dietary supplement in compliance with certain requirements). Under section 701(a) of the FD&C Act (21 U.S.C. 371(a)), FDA is authorized to issue regulations for the efficient enforcement of the FD&C Act.

A. Section 103 of FSMA

Section 103 of FSMA, Hazard Analysis and Risk-Based Preventive Controls, amends the FD&C Act to create a new section 418 that mandates rulemaking. Section 418(n)(1)(A) of the FD&C Act requires that the Secretary of Health and Human Services issue regulations “to establish science-based minimum standards for conducting a hazard analysis, documenting hazards, implementing preventive controls, and documenting the implementation of the preventive controls . . ..” Section 418(n)(1)(B) of the FD&C Act requires that the regulations define the terms “small business” and “very small business,” taking into consideration the study of the food processing sector required by section 418(l)(5) of the FD&C Act. Further, section 103(e) of FSMA creates a new section 301(uu) in the FD&C Act (21 U.S.C. 331(uu)) to prohibit “[t]he operation of a facility that manufactures, processes, packs, or holds food for sale in the United States if the owner, operator, or agent in charge of such facility is not in compliance with section 418 [of the FD&C Act].”

In addition to rulemaking requirements, section 418 of the FD&C Act contains requirements applicable to the owner, operator, or agent in charge of a facility required to register under section 415 of the FD&C Act. Section 418(a) of the FD&C Act is a general provision that requires the owner, operator, or agent in charge of a facility to evaluate the hazards that could affect food manufactured, processed, packed, or held by the facility, identify and implement preventive controls, monitor the performance of those controls, and maintain records of the monitoring. In addition to the general requirements in section 418(a) of the FD&C Act, sections 418(b) to (i) of the FD&C Act contain more specific requirements applicable to facilities, including several provisions explicitly directed at intentional adulteration. For example, section 418(b)(2) of the FD&C Act specifies that the owner, operator, or

agent in charge of a facility shall identify and evaluate hazards that may be intentionally introduced, including by acts of terrorism. Section 418(c)(2) of the FD&C Act specifies that the owner, operator, or agent in charge of a facility shall identify and implement preventive controls to provide assurances that any hazards that relate to intentional adulteration will be significantly minimized or prevented and addressed, consistent with section 420 of the FD&C Act. In sections IV and V of this document, we discuss proposed requirements (proposed subparts C and D of part 121) that would implement these provisions of section 418 of the FD&C Act.

Sections 418(j) to (m) of the FD&C Act and sections 103(c)(1)(D) and (g) of FSMA provide authority for certain exemptions and modifications to the requirements of section 418 of the FD&C Act. These include provisions related to seafood and juice HACCP, and low-acid canned food (section 418(j) of the FD&C Act); activities of facilities subject to section 419 of the FD&C Act (Standards for Produce Safety) (section 418(k)); qualified facilities (section 418(l)); facilities that are solely engaged in the production of food for animals other than man, the storage of raw agricultural commodities (other than fruits and vegetables) intended for further distribution or processing, or the storage of packaged foods that are not exposed to the environment (section 418(m)); facilities engaged only in certain low-risk on-farm activities on certain foods conducted by small or very small businesses (section 103(c)(1)(D) of FSMA), and dietary supplements (section 103(g) of FSMA). In sections IV and V of this document, we discuss the related proposed provisions that would implement these provisions of section 418 of the FD&C Act and section 103 of FSMA.

B. Section 106 of FSMA

Section 106 of FSMA, Protection Against Intentional Adulteration, amends the FD&C Act to create a new section 420, which mandates rulemaking. Section 420 of the FD&C Act requires FDA to issue regulations to protect against the intentional adulteration of food. Section 420(b)(1) of the FD&C Act requires that such regulations are to specify how a person is to assess whether the person is required to implement mitigation strategies or measures intended to protect against the intentional adulteration of food. Section 420(b)(2) of the FD&C Act requires that the regulations specify appropriate science—based mitigation strategies or measures to prepare and protect the food supply chain at specific vulnerable points, as appropriate. Section 420(c) of the FD&C Act provides that such regulations are to apply only to food for which there is a high risk of intentional adulteration and for which such intentional adulteration could cause serious adverse health consequences or death to humans or animals. Section 420(c)(1) provides that such foods are to include those for which FDA has identified clear vulnerabilities. Section 420(d) of the FD&C Act limits applicability on farms to farms that produce milk. Further, section 106(d) of FSMA creates a new section 301(ww) in the FD&C Act to prohibit “[t]he failure to comply with section 420 [of the FD&C Act].” We are proposing all of the provisions under section 420 of the FD&C Act.

C. Intrastate Activities

FDA tentatively concludes that the provisions in the proposed rule should be applicable to activities that are intrastate in character. Facilities are required to register under section 415 of the FD&C Act regardless of whether the food from the facility enters interstate commerce (§ 1.225(b)). The plain language of section 418 of the FD&C Act applies to facilities that are required to register under section 415 of the FD&C Act (section 418(o)(2)) and does not exclude a facility because food from such a facility is not in interstate commerce. Similarly, the plain language of section 420 of the FD&C Act requires FDA to issue regulations to protect against the intentional adulteration of food and does not include a limitation to interstate commerce. Further, the prohibited act provisions in sections 301(uu) and (ww) of the FD&C Act (21 U.S.C. 331(uu) and (ww)) do not require an interstate commerce nexus. Notably, other subsections in section 301 of the FD&C Act, and section 304 of the FD&C Act (21 U.S.C. 334) demonstrate that Congress has included a specific interstate commerce nexus in the provisions of the FD&C Act when that is its intent. Accordingly, it is reasonable to interpret sections 418, 420, 301(uu) and (ww) of the FD&C Act as not limiting the application of the proposed rule only to those facilities with a direct connection to interstate commerce. However, we seek comment on this interpretation and potential alternatives.

IV. Regulatory Approach

A. Framework of the Rule

This proposed regulation implements three provisions of FSMA that relate to the intentional adulteration of food. Section 103 of FSMA addresses intentional adulteration in the context of facilities that manufacture, process, pack, or hold food and are required to register under section 415 of the FD&C Act. Section 105 of FSMA addresses intentional adulteration in the context of fruits and vegetables that are raw agricultural commodities. Section 106 of FSMA addresses intentional adulteration in the context of high risk foods and exempts farms except for farms that produce milk.

1. Scope of Intentional Adulteration Covered by this Rule

As noted in section I of this document, acts of intentional adulteration may take several forms, including: (1) Acts of terrorism; (2) acts of disgruntled employees, consumers, or competitors; and (3) economically motivated adulteration. With regard to intentional adulteration from acts of terrorism, we are proposing to require certain facilities covered by this rule to address significant vulnerabilities by implementing focused mitigation strategies at actionable process steps. While we refer to the protection of the food supply from “acts of terrorism” throughout this rule, we expect our proposed approach and the proposed implementation of focused mitigation strategies would generally address acts intended to cause massive public health harm and, to a lesser extent, economic disruption, whether committed by terrorists, terrorist organizations, individuals, or groups of individuals. For the reasons described in section IV.E of this document, we have tentatively concluded not to propose additional requirements for the protection of food against intentional adulteration caused by acts of disgruntled employees, consumers, or competitors. We describe our approach to address economically motivated adulteration in section IV.F of this document, and seek comment on our current thinking on this issue.

2. Identification of Key Activity Types

Terrorist attacks on the U.S. food supply have been exceedingly rare. However, vulnerability assessments performed by FDA, USDA, DHS, and FBI, under the SPPA Initiative (Ref. 21), show that an attack could have devastating public health and economic consequences. Because such an attack is a low probability but potentially exceedingly high consequence event, we have tentatively determined that requirements should focus on those facilities and process steps within those facilities that pose the greatest risk. To

assess this risk, FDA and USDA, in collaboration with DHS, FBI, and State and local government and industry partners, performed vulnerability assessments using the CARVER+Shock methodology. This methodology is specifically tailored to assess the risk of a terrorist attack and is different from an assessment of risk posed by food safety hazards (i.e., unintentional adulteration).

As discussed in section V.C.2 of this document, based on an analysis of the vulnerability assessments that FDA has conducted using the CARVER+Shock methodology, we have identified four key activity types: Bulk liquid receiving and loading; Liquid storage and handling; Secondary ingredient handling; and Mixing and similar activities. FDA has tentatively determined that the presence of one or more of these key activity types at a process step (e.g., manufacturing, processing, packing, or holding of food) indicates a significant vulnerability under section 418 of the FD&C Act and that the food is at high risk of intentional adulteration caused by acts of terrorism under section 420 of the FD&C Act. We seek comment on the inclusion of these key activity types.

Designation of these key activity types would serve two purposes. First, it would provide a facility with a means to assess whether it is required to implement focused mitigation strategies or measures intended to protect against intentional adulteration under section 420(b)(1) of the FD&C Act. Second, it would assist a facility subject to section 418 of the FD&C Act with the performance of a hazard analysis to identify and evaluate hazards that may be intentionally introduced by acts of terrorism, in accordance with section 418(b)(2).

Facilities would be able to determine whether their operations involve one or more of the key activity types or choose to perform a vulnerability assessment. Our experience is that the most challenging part of developing a system of controls for intentional adulteration related to terrorism is identifying the points in the food operation that are most vulnerable to attack by performing a vulnerability assessment. By using the FDA-identified key activity types, facilities would be able to concentrate their efforts on the identification of appropriate focused mitigation strategies and the development and implementation of the HACCP-type system for ensuring that those strategies are consistently and effectively implemented.

3. Requirement for a HACCP-Type System of Controls

We have tentatively concluded that a preventive controls approach like the one we proposed for the systematic control of food safety hazards in the PC proposed rule is the most effective means of ensuring that the focused mitigation strategies are consistently applied once the significant vulnerabilities are identified and appropriate focused mitigation strategies are developed. The evolution and advantages of this system, derived from the HACCP methodology, is discussed in detail in section II.C of the PC proposed rule. The application of HACCP-type controls for ensuring the implementation of food defense mitigation strategies is consistent with the approach taken in Publicly Available Specification (PAS) 96, developed by the Centre for the Protection of National Infrastructure in collaboration with the British Standards Institution, entitled “The Threat Assessment Critical Control Point (TACCP) Approach” (Ref. 5). It is also consistent with WHO recommendations on protection against intentional adulteration (Ref. 6). We request comment on the appropriateness of a HACCP-type system to ensure that mitigation strategies designed to significantly minimize or prevent intentional adulteration related to terrorism and whether there are approaches that would be more suitable.

Section 418 of the FD&C Act exempts several kinds of activities (e.g., those related to seafood, juice, dietary supplements, low-acid canned food [for certain microbiological hazards]). These activities are subject to preventive control-type regulations that address food safety, but not food defense, concerns. Section 420 of the FD&C Act instructs FDA to issue regulations to require that science-based mitigation strategies or measures be applied to foods that are at high risk of intentional adulteration. The exemptions set out in section 418 of the FD&C Act are not applicable to the provisions of section 420 of the FD&C Act. We also have tentatively determined that some activities that are not subject to section 418 of the FD&C Act that involve manufacturing, processing, packing, or holding of food are likely to involve one of the key activity types (e.g., juice manufacturing, breaded seafood manufacturing, and mixing activity in a low-acid canned food process). Based on our tentative conclusion that the HACCP-type system in section 418 of the FD&C Act is generally appropriate for application to intentional adulteration related to terrorism, this same system would be required for these activities. Applying the same regulatory framework under sections 418 and 420 of the FD&C Act would facilitate a concise and consistent approach to protection against intentional adulteration of food and the efficient enforcement of the requirements. Further, this approach would be consistent with the approach for unintentional adulteration that many of these facilities (those subject to section 418 of the FD&C Act relative to the control of food safety hazards) would already be required to take for unintentional hazards under the PC proposed rule.

We acknowledge that regulation of entities in the food production system (in this case, facilities) to reduce the risk of intentional adulteration of food caused by acts of terrorism is, essentially, without precedent. Such an endeavor is further complicated by the low probability and potentially high impact nature of such an attack which makes estimating potential public health benefits and establishing an appropriate threshold for requiring action difficult. We are further challenged by the paucity of data on the extent to which facilities have already implemented programs to mitigate this risk, and the effectiveness of various strategies to prevent intentional adulteration of food caused by acts of terrorism.

In developing this proposed rule we have relied on our experience in both implementing preventive control schemes targeting unintentional food safety hazards as well as working with the U.S. intelligence community on the threat of a terrorist attack on the food and agriculture sector, including performing vulnerability assessments and developing guidance for industry. While these activities have provided us with a useful foundation on which to develop this proposed rule, the challenges described previously remain. We request comment on our proposed approach, including on the following issues:

• From which entities would implementation of measures to protect against intentional adulteration derive the greatest benefit to public health protection? How could this proposed regulation be modified to better target such entities?

• Would it be feasible to require measures to protect against intentional adulteration only in the event of a credible threat? If so, would such an approach be consistent with the intentional adulteration provisions of FSMA? How would such requirements

be communicated to industry in a timely and actionable manner?

• What is an appropriate level of public health protection with respect to intentional adulteration, considering the intentional adulteration provisions of FSMA?

• Are there other ways to further focus the scope of the rule (see also section IV.I of this document)?

4. Compliance Dates

Section 103(i)(1) of FSMA, General Rule, provides that “[t]he amendments made by this section shall take effect 18 months after the date of enactment” (i.e., by July 4, 2012). Section 103(i)(2) of FSMA, Flexibility for Small Businesses, provides that “[n]otwithstanding paragraph (1),” the amendments made by this section “shall apply” to a small business and very small business beginning on the date that are 6 months and 18 months, respectively, “after the effective date” of FDA's final regulation. Section 106 of FSMA does not contain similar language. FDA is implementing the amendments made by sections 103 and 106 of FSMA to the FD&C Act, as they relate to intentional adulteration, through this rulemaking.

We have tentatively concluded that it is appropriate to provide a sufficient time period following publication of the final regulation for facilities to come into compliance with proposed part 121. FDA recognizes that it can take time to develop and implement a food defense plan that would require, among other things, identification of actionable process steps, implementation of focused mitigation strategies, and monitoring of focused mitigation strategies.

FDA is proposing that the final rule would be effective 60 days after publication in the
Federal Register
, with staggered compliance dates, consistent with the proposed effective dates in the PC proposed rule and Produce Safety proposed rule. Similarly, we recognize that businesses of all sizes may need more time to comply with the new requirements established under FSMA. As noted in section VII of the PC proposed rule, FDA believes that it is reasonable to allow for 1 year after the date of publication of the final rule for businesses other than small and very small businesses to come into compliance with the new requirements established under FSMA. FDA also believes that it is reasonable to allow for 2 years after the date of publication of the final rule for small businesses to come into compliance with the new requirements established under FSMA, and 3 years after the date of publication of the final rule for very small businesses to come into compliance with the new requirements established under FSMA.

Therefore, as proposed, facilities, other than small and very small businesses, that are subject to part 121 would have 1 year after the effective date to comply with proposed part 121. Small businesses would have 2 years after the effective date to comply with proposed part 121 (see section V.A of this document for a discussion of the proposed definition of a “small business”). With respect to very small businesses, we are proposing to exempt qualified facilities, which include very small businesses, from the requirements of proposed part 121, except that such facilities must, upon request, provide for official review documentation that was relied upon to demonstrate that the facility meets this exemption. Very small businesses then would have 3 years after the effective date to comply with proposed § 121.5(a). FDA intends to work closely with the food industry, extension and education organizations, and State partners to develop any necessary additional tools and training programs needed to facilitate implementation of this rule.

B. Activities That Occur on Produce Farms

Section 419 of the FD&C Act requires FDA to issue regulations to establish science-based minimum standards for the safe production and harvesting of fruits and vegetables. In developing these regulations, the Act requires us to consider, among others, those hazards that may be intentionally introduced, including by acts of terrorism (section 419(a)(3)(C) and (c)(1)(A) of the FD&C Act). Note that neither section 418 of the FD&C Act nor section 420 of the FD&C Act apply to these activities. Section 420 of the FD&C Act specifically exempts farms, except those that produce milk, and section 418 of the FD&C Act exempts activities of facilities subject to section 419 of the FD&C Act.

In implementing section 419 of the FD&C Act, we considered the risks posed by a terrorist attack on the kinds of activities that occur on produce farms. We considered those activities that fall within the definition of “farm” (as defined in 21 CFR 1.227) (e.g., planting, tilling, irrigating, treating with pesticides, harvesting, drying for purposes of storing or transporting, hydro-cooling, packing, refrigerating, waxing, shelling, sifting, removing leaves, stems and husks, culling, shelling, and washing). We utilized data gathered from vulnerability assessments that we conducted employing the CARVER+Shock methodology, and evaluated whether activities that occur on produce farms pose significant vulnerabilities (Ref. 40).

Our evaluation found that activities that are typically performed on produce farms are at relatively low risk for intentional adulteration of food from acts of terrorism (Ref. 40). Based on this evaluation, we have tentatively concluded that requirements for produce farms are not necessary to minimize the risk of serious adverse health consequences or death from this type of adulteration. Further, we have tentatively concluded that requirements relating to this form of adulteration are not reasonably necessary to prevent the introduction of known or reasonably foreseeable hazards and to provide reasonable assurances that the produce is not adulterated under section 402 of the FD&C Act. For these reasons, we are not proposing requirements for produce farms to specifically address intentional adulteration related to terrorism. We seek comment on this tentative conclusion and our analysis that informed this tentative decision.

We acknowledge that there may be activities that occur on produce farms for which we are not proposing requirements that are similar to off-farm activities for which we are proposing to require the implementation of focused mitigation strategies. However, there are aspects of the specific on-farm activities that minimize the risk for intentional adulteration caused by acts of terrorism. For example, waxing is an on-farm activity that is similar to coating and that fits within one of the key activity types. However, there are key differences that make an on-farm waxing operation less vulnerable compared to a coating operation. With waxing, there is difficulty of mixing a contaminant into a clear, heated wax in a tank in close proximity to the busy packing line in an on-farm packing house. Conversely, a coating operation involves an opaque, ambient or refrigerated, aqueous coating mix in a tank and occurs in a relatively isolated part of the manufacturing plant. In addition, the uncertainty about whether the produce leaving the farm is destined for direct consumption or for further processing, such as removal of the wax, which could inactivate or remove any contaminant intentionally added, makes it a relatively less likely target for intentional adulteration.

C. Transportation Carriers

One of the key activity types that we have tentatively determined indicates a significant vulnerability to intentional adulteration caused by acts of terrorism

is Bulk liquid receiving and loading. As proposed, receiving and loading of other types of foods (e.g., non-bulk liquids, solid foods, gaseous foods) are not identified as key activity types because we determined that they do not present this same level of risk. By requiring that shippers and receivers of bulk liquids implement focused mitigation strategies at actionable process steps involving this key activity, as proposed in § 121.135(a), we expect that shippers and receivers will institute focused mitigation strategies that will significantly minimize or prevent the potential for intention adulteration of these foods during transportation. Such mitigation strategies may include sealing or locking outbound conveyances of bulk liquid, or requiring that inbound conveyances be sealed or locked as a condition of receipt of the bulk liquid. Where such measures are implemented by the shippers and receivers of bulk liquids, we have tentatively concluded that the food would be sufficiently protected from intentional adulteration caused by acts of terrorism, and that no further actions by a carrier would be needed to ensure the safety of the food. For this reason, we are not proposing to cover transportation carriers in this proposed rule. We request comment on our analysis of this issue, and our tentative conclusion.

Note that FDA will issue a proposed rule in the near future related to transportation carriers and sanitary transportation practices.

D. Food for Animals

As discussed in section V.B.6 of this document, we are proposing to exempt the manufacturing, processing, packing, and holding of animal food from this proposed regulation with respect to intentional adulteration caused by acts of terrorism.

E. Acts of Disgruntled Employees, Consumers, or Competitors

While the goals and outcomes of acts of disgruntled employees, consumers or competitors can overlap with acts of terrorism, generally, the distinction has to do with differences in scale. Disgruntled employees are generally understood to be interested primarily in attacking the reputation of the company, and otherwise have little interest in public health harm. On the other hand, terrorist organizations are generally understood to be interested in maximizing public health harm and, to a lesser extent, economic disruption (Ref. 5, Ref. 6).

Section 420(c) of the FD&C Act requires that the regulation prepared under that section apply to “food for which there is a high risk of intentional contamination.” In the spectrum of risk associated with intentional adulteration of food, attacks perpetrated by terrorist organizations intent on causing massive casualties and, to a lesser extent, economic disruption would be ranked as relatively high risk. On the other hand, attacks by disgruntled employees, consumers, or competitors would be consistently ranked as relatively low risk; although these events occur annually, their public health and economic impact would be generally quite small. In general, the target food and the point in its production are those of convenience (i.e., a point to which the employee, consumer, or competitor has ready access). Should a disgruntled employee, consumer, or competitor choose to attack at an actionable process step, where the adverse public health and economic consequences could be greater, the provisions of this proposed rule would be effective in minimizing the opportunity for success. Actions taken to mitigate the potential for a terrorist attack against the food supply are likely to have collateral benefits in reducing the potential for an attack by a disgruntled employee, consumer, or competitor (as well as on other security related issues, such as theft and vandalism). As a practical matter, hardening the food supply (i.e., reducing the opportunity for attack) to attacks by disgruntled employees, consumers, or competitors could require taking steps at many more points in the food system than would be required to harden the food supply to minimize the potential for terrorist attack. We have tentatively concluded that the latter can be accomplished by focusing on those points in the food system where an attack would be expected to cause massive adverse public health impact, and, to a lesser extent, economic disruption.

F. Economically Motivated Adulteration

Efforts to protect against intentional adulteration require a shift in perspective from that applied to traditional food safety. In the PC, Animal Food PC, and Produce Safety proposed rules, we tentatively concluded that hazards associated with intentional adulteration, which are not addressed in traditional HACCP or other food safety systems, likely will require different kinds of controls, and would be best addressed in a separate rulemaking (this proposed rule). However, we also explained how in some circumstances economically motivated adulteration could be viewed as reasonably likely to occur. Further, we requested comment on where to address those hazards that may be intentionally introduced for economic gain. After additional consideration, we present our current thinking in this section of the document.

For facilities subject to section 418 of the FD&C Act, we have tentatively concluded that economically motivated adulteration would be best addressed under the regulatory regime described in the PC and Animal Food PC proposed rules and thus best addressed in those rulemakings. Before we decide to finalize provisions on economically motivated adulteration in the PC and Animal Food PC final rules, FDA plans to provide new language and an analysis of costs associated with these provisions, and seek comment. Under this approach, the owner, operator, or agent in charge of a covered facility would be required to perform a hazard analysis to identify those hazards related to economically motivated adulteration that are reasonably likely to occur. Economically motivated adulteration could be reasonably likely to occur, for example, when obtaining certain ingredients from a country in which economically motivated adulteration has occurred in those ingredients in the past. Because of past incidents regarding the addition of melamine to certain food products apparently to enhance perceived quality and/or protein content, even if there is no known history regarding the specific supplier or the specific food product, a prudent person would implement preventive controls to address the potential presence of this hazard in a food. The goal of the perpetrator of economically motivated adulteration is for the adulterant to be undetected in the product, so that the perpetrator can continue to obtain the desired economic benefits (Ref. 7, Ref. 9). Accordingly, unlike with acts of terrorism, such occurrences of economic adulteration are expected to be long term, and would not be appropriately viewed as a rare occurrence, but rather as reasonably likely to occur.

We have tentatively concluded that this hazard-analysis type approach is better suited to address economically motivated adulteration than the vulnerability assessment-type approach we are proposing to address intentional adulteration related to terrorism. In the latter approach, which we are not proposing, significant vulnerabilities would be identified based either on the presence of key activity types (which reflect FDA-conducted vulnerability assessments) or facility-specific vulnerability assessments. Under a vulnerability assessment-type approach,

the assessment would need to consider the degree to which a food is a likely target for economically motivated adulteration based on the attributes of the food (such as the nature of the food, its production system, and its supply chain) and the capabilities of a perpetrator (such as availability and access to adulterants that can be readily disguised and undetected by currently accepted testing methods). Factors to consider could include previous occurrences of economically motivated adulteration; a highly complex supply chain; sudden changes in commodity prices; known inadequacies in identification and assay testing methods for potential adulterants; a highly complex and variable food ingredient; the widespread availability of a potential adulterant; the lack of organoleptic properties of a potential adulterant; the high cost or scarcity of an ingredient; and variation in the value of a food based on variations in levels of a high value attribute of that food. The nature of economically motivated adulteration makes it difficult to identify all relevant factors to be considered in a vulnerability assessment to predict when novel events of economic adulteration are expected to occur. Moreover, predictive tools such as CARVER+Shock are not currently configured to assess the risk of economically motivated adulteration, nor have extensive vulnerability assessments for economically motivated adulteration in food products been conducted by FDA or others. Therefore, we believe the most appropriate framework to assess the risk of economically motivated adulteration is to consider whether it is reasonably likely to occur (such as whether it has occurred under similar circumstances with some regularity in the past) as part of a hazard analysis.

Under this approach, facilities subject to section 418 of the FD&C Act would be expected to implement controls against economically motivated adulteration under circumstances where there has been a pattern of such adulteration in the past, even though the past occurrences may not be associated with the specific supplier or the specific food product but the pattern suggests a potential for intentional adulteration. Further, a system of monitoring, corrective action, verification, and recordkeeping that is similar to those in the PC and Animal Food PC proposed rules would be appropriate for economically motivated adulteration. In addition, the elements of a preventive control system, including hazard analysis, preventive controls, monitoring, corrective actions, verification, and recordkeeping would be documented in a food safety plan that would include control of economically motivated adulteration. We believe that addressing both of these potential sources for contamination within the same framework is likely to streamline requirements and reduce costs to industry.

We seek comment on our tentative conclusions presented above. Specifically, we are interested in information on the specific factors that are most relevant for determining whether economically motivated adulteration is reasonably likely to occur, particularly in instances where the specific product or supplier has not been previously associated with such adulteration. In addition, we seek comment on whether and how these relevant factors may be used to develop appropriate predictive tools or establish a standard for when preventive controls are necessary.

Section 418 of the FD&C Act contains certain exemptions related to compliance with FDA's seafood and juice HACCP regulations and with regard to manufacturing, processing, packing or holding dietary supplements that are in compliance with the requirements of sections 402(g)(2) and 761 of the FD&C Act. Section 420 of the FD&C Act does not contain these exemptions and requires FDA to issue regulations to protect against the intentional adulteration of food. Seafood and juice are currently subject to HACCP-type regulations in §§ 123 and 120, respectively, and our current thinking is that under section 420 economically motivated adulteration could be addressed through the existing frameworks for these foods. Under this option, FDA would amend the seafood and juice HACCP regulations to specify that economically motivated adulteration is a hazard that must be considered in a hazard analysis of these foods, and addressed in a HACCP plan. For example, for seafood, we could propose to add “economically motivated adulteration that could result in serious adverse health consequences or death” to the list of hazards to be considered in a hazard analysis in accordance with § 123.6(c)(1). Similarly, for juice we could propose to add “economically motivated adulteration that could result in serious adverse health consequences or death” to the list of hazards to be considered in a hazard analysis in accordance with § 120.7(c). Also under this option, FDA would consider proposing to amend part 111 (21 CFR part 111), the Dietary Supplements current good manufacturing practice (CGMP) rule, to include economically motivated adulteration that could result in serious adverse health consequences or death. Current § 111.70(b) and (c) require establishing component specifications and in-process specifications to ensure the identity, purity, strength, and composition of the dietary supplement, and we could amend these provisions to cover economically motivated adulteration that could result in serious adverse health consequences or death.

We have also tentatively concluded not to require produce farms subject to section 419 of the FD&C Act and farms that produce milk (also referred to in this document as “dairy farms”) subject to section 420 of the FD&C Act to take measures to address economically motivated adulteration. With regard to produce farms subject to section 419 of the FD&C Act, we have tentatively concluded that there are not procedures, processes, or practices that are reasonably necessary to be implemented by these entities to prevent the introduction of known or reasonably foreseeable biological, chemical, or physical hazards that can cause serious adverse health consequences or death as a result of economically motivated adulteration. With regard to farms that produce milk subject to section 420 of the FD&C Act, we have tentatively concluded that there are not appropriate science-based strategies or measures intended to protect against economically motivated adulteration that can be applied at the farm. These tentative conclusions are based on our assessment that preventive controls for economically motivated adulteration are suitable to address such adulteration when it is perpetrated by the entity's supplier, but not when it is perpetrated by the entity itself, as would be the case for economically motivated adulteration at a produce farm or a farm that produces milk. Actions such as auditing of suppliers or reliance upon supplier-supplied test results or production control records are generally considered unsuitable to address economically motivated adulteration where the supplier, if intentionally adulterating the food, would already be violating the law and would be able to subvert these controls. For both types of farms, we are not aware of inputs into the growing, harvesting, packing, or holding of produce or milk (i.e., within our farm definition) that could be subject to economically motivated adulteration that could cause serious adverse health consequences or death under sections 419 and 420 of the FD&C Act. We seek comment on this tentative conclusion.

G. Low-Risk Activities at Farm Mixed-Type Facilities

Section 103(c)(1)(C) of FSMA directs the Secretary of Health and Human Services to conduct a science-based risk analysis as part of the section 103(c) rulemaking. The science-based risk analysis is to cover “(i) specific types of on-farm packing or holding of food that is not grown, raised, or consumed on such farm or another farm under the same ownership, as such packing and holding relates to specific foods; and (ii) specific on-farm manufacturing and processing activities as such activities relate to specific foods that are not consumed on that farm or on another farm under common ownership.” In section VIII.G of the PC proposed rule, we describe a draft Qualitative Risk Assessment (the draft RA) we performed to satisfy this requirement. Section 103(c)(1)(D)(i) of FSMA requires FDA to use the results of this analysis to establish exemptions and inspection frequencies, or modify requirements, for facilities engaged only in specific types of on-farm activities that FDA determines to be low risk.

Elsewhere in this issue of the
Federal Register
, FDA is publishing a notice announcing the availability for public comment Appendix 4 to the draft RA (the draft RA Appendix). The purpose of the draft RA Appendix is to provide a science-based risk analysis of those foods whose production processes would be considered low risk with respect to the risk of intentional adulteration caused by acts of terrorism. FDA conducted this evaluation to satisfy the requirement in Section 103(c)(1)(C) of FSMA to conduct a science-based risk analysis with respect to the risk of intentional adulteration caused by acts of terrorism. We evaluated the production processes for the types of finished foods we expect are produced at farm mixed-type facilities to determine whether or not they are low-risk with respect to hazards that may be intentionally introduced by acts of terrorism. For the purposes of this analysis, we evaluated whether a production process involved any of the four FDA-identified key activity types, and identified a production process that did not involve any of the four key activity types as a “low risk production process.” Based on this evaluation, we concluded that the production processes for the following finished foods are “low-risk”:

• Eggs (In-Shell)

• Fruits & Vegetables Other Than Pods, Seeds for Direct Consumption, and Hesperidia (Fresh, Intact)

• Game Meats (Whole or Cut, Not Ground or Shredded, Without Secondary Ingredients)

• Peanuts & Tree Nuts (Raw, In-Shell)

• Sugarcane & Sugar Beets (Fresh, Intact)

We are considering the results of this analysis in determining any specific exemptions or modified requirements. We request comment on whether we should exempt on-farm manufacturing, processing, packing, or holding of the foods identified as having low-risk production practices when conducted by a small or very small business if such activities are the only activities conducted by the business that are subject to section 418 of the FD&C Act. If we were to take this approach, only facilities meeting all of the specified criteria would be exempt as a result of being engaged in low-risk activities. Thus, a facility located on-farm, that is a small or very small business, and only produces fresh, intact apples as a finished product (e.g., by packing apples grown on a different farm that is under different ownership) would be exempt from this proposed rule. On the other hand, an apple-packing facility that is off-farm would not be exempt, an apple packing facility that is on-farm but that is not a small or very small business would not be exempt, and an apple packing facility that also packs green beans would not be exempt. We request comment on whether we should broaden this potential exemption in any way, such as by removing certain of the restrictions mentioned immediately above. We also seek comment on whether we should instead establish modified requirements for facilities that produce foods identified as having low-risk production processes, and if so, what those modified requirements should be and the scope of application of the modified requirements. In addition, we seek comment on whether and how we should consider the results of this analysis in determining whether to exempt or modify the inspections frequency requirements under Section 421 of the FD&C Act, Targeting of Inspection Resources for Domestic Facilities.

H. Activities That Occur on Dairy Farms

1. Assessment of Vulnerabilities

Under section 420 of the FD&C Act, we considered whether activities that occur on farms that produce milk pose a high risk for intentional adulteration of food caused by acts of terrorism that could cause significant adverse health consequences or death. A preliminary evaluation indicates that fluid milk storage appears to fit within the key activity type, Liquid storage and handling, and fluid milk loading appears to fit within the key activity type, Bulk liquid receiving and holding. The fluid milk storage tank is one of the actionable process steps that would be applicable to both of these activities on a dairy farm.

As discussed in section V.C.2 of this document, FDA is proposing to require that the owner, operator, or agent in charge of a facility that has one or more of the FDA-identified key activity types identify actionable process steps for those key activity types and implement focused mitigation strategies at any actionable process steps. Because dairy farms generally are not facilities as defined in this rule, they would not be subject to this requirement. However, section 420 is applicable to dairy farms (see § 420(d)) and fluid milk storage and loading in a dairy farm operation appear to pose a significant vulnerability.

The risk posed by intentional adulteration of milk on-farm results from a number of factors: (1) The system of milk collection from farms and subsequent holding and processing serves to distribute contaminants added to the milk on the farm into much larger quantities of fluid milk, increasing the potential magnitude of an intentional adulteration event; (2) in its fluid form milk has a short shelf life, increasing the potential for significant adverse public health impacts before detection and, once detected, before a public health intervention can be implemented; (3) fluid milk is widely consumed across different sub-populations, including infants and children, increasing the potential for significant adverse public health impacts and, because of public reaction to child and infant morbidity and mortality, decreasing public confidence in the food supply; (4) fluid milk is consumed in a variety of food forms, including as a beverage (finished food) and as an ingredient in other finished foods, complicating public health intervention; and (5) milk storage tanks are commonly left unlocked (Ref. 41, Ref. 42, Ref. 43, Ref. 44, Ref. 45, Ref. 46, Ref. 47).

2. Mitigation Strategies

Farms are not subject to the HACCP-type system of preventive controls prescribed in section 418 of the FD&C Act, and our current thinking is that, should we include requirements relative to dairy farms in the final rule, we would not require HACCP-type controls for dairy farms under section 420 of the FD&C Act. Similarly, under section 419 of the FD&C Act we did not propose to apply such an approach to unintentional adulteration on produce

farms in the Produce Safety proposed rule (see section IV.D of the Produce Safety proposed rule). Rather, as with produce farms, a more appropriate approach might be a CGMP-type provision that relates directly to the significant vulnerability. Generally, CGMPs set out mandatory, broad, generally applicable practices and conditions that are required to be met, and the criteria and definitions that are applicable in determining whether the food is adulterated. For example, a CGMP approach would identify the broad, generally applicable mitigation strategies that dairy farm operators must implement (e.g., limiting access to fluid milk storage tanks), without specifying how that strategy must be accomplished and without a further requirement for monitoring, recordkeeping or the development of a plan. We seek comment on this approach.

FDA previously provided guidance for the dairy industry, including dairy farms, on the potential for intentional contamination and identified the types of food defense measures that dairy farms may take to minimize the risk that fluid milk under their control will be subject to tampering or other malicious, criminal, or terrorist actions (Ref. 24). Among other recommendations, FDA's guidance recommends “limiting access” to raw and pasteurized milk storage as a food defense preventive measure. We acknowledge the difficulties involved in limiting access to many dairy farms, including multiple entries to the milk house, multiple visitors with customary access to the milk house (e.g., State food safety inspectors, vendors delivering veterinary medications, and drivers collecting bulk milk for transport to processing and storage facilities); continuous milk piping from the milking parlor to the bulk milk tank, providing for access points to the bulk milk tank from outside the milk house; open access to the milking parlor for workers and cows; and automated milking operations where employees are not necessarily present to escort cows into the milking parlor.

In light of these circumstances, we request comment on whether and how access to the bulk milk storage tank and associated systems can be limited, and the costs and other implications of doing so. In addition, we are interested in comment on whether and what types of focused mitigation strategies or other measures are currently employed by dairy farms. Specifically for fluid milk storage tanks, we seek comment on whether and what focused mitigation strategies would be appropriate and feasible given current dairy farming practices.

We also seek comment on whether it would be more appropriate for FDA to require that dairy farm operators receive food defense awareness training rather than requiring that they implement focused mitigation strategies to limit access to certain steps of their operation. If you support an approach based on training rather than mandated focused mitigation strategies, we are further interested in how such an approach would work at those farms where an agent of the farm may not be present at all times, given that a system based on awareness training is premised on the assumption that such training would provide the operator with the tools to report and respond to suspicious activity that they observe.

3. Scope of Dairy Farms Subject to any Requirement

Finally, we seek comment on the scope of farms that produce milk that should be subject to any requirements that we may establish in a final rule. For example, the scope of dairy farms covered could be determined based on the potential for adverse public health outcome resulting from consumption of milk produced at a farm, if a contaminant were intentionally introduced into the milk from that farm. Farms with less than 50 milk-producing cows contribute a relatively small proportion to the total volume of milk produced in the United States (i.e., approximately 4.2 percent of total milk produced in the United States), and the current trend in the dairy farm industry toward consolidation (Ref. 48) likely further reduces the percentage of production that such farms will contribute in the future. However, milk from even very small dairy farms may be pooled with milk from other farms in raw milk storage tanks at milk processing and storage facilities, potentially resulting in a public health impact from intentional adulteration that is disproportionate to the size of the farm or its contribution to the milk supply. We request comment on the appropriateness of determining the scope of dairy farms covered based on the number of cows on a farm. Alternatively, should we consider excluding farms based on how the milk from a farm is distributed (e.g., direct sale to consumers or other end users; pooling with milk from other farms; supplied to the Grade A Milk system for the production of fluid milk; or used in the production of cheese and other products that have a different risk associated with intentional adulteration caused by acts of terrorism)?

I. Other Ways to Focus on Foods With a High Risk of Intentional Adulteration Caused by Terrorism

We are requesting comment on whether, under section 420 of the FD&C Act, there are other ways in which the coverage of this proposed regulation can be further focused on foods that present a high risk of intentional adulteration caused by acts of terrorism. For example, are there ways in which a food's shelf life, turnover in the marketplace, batch size, serving size and servings per batch, distribution and consumption patterns, and intended consumer could be considered in providing for an exemption or in setting modified requirements for that food. Ordinarily, these considerations are part of a vulnerability assessment, and in such assessments the risk reduction aspects of one attribute may be offset or exacerbated by those of another attribute, and may be very facility-specific. Such attributes specific to the food(s) manufactured, processed, packed, or held at the facility can be taken into account, should a facility choose to perform its own vulnerability assessment and assign actionable process steps, as provided for in proposed § 121.130(b). However, as discussed in section V.C.2 of this document, facilities would not be required to perform a facility-specific vulnerability assessment and, instead, would have the option of identifying actionable process steps using the procedure in proposed § 121.130(a). We are particularly interested in how food-specific attributes can be taken into account in the absence of a general requirement for a facility-specific vulnerability assessment.

V. The Proposal

A. Definitions

In subpart A of proposed part 121, under § 121.3, FDA is proposing the following definitions and interpretations of terms relevant to proposed part 121. The definitions and interpretations of terms in section 201 of the FD&C Act (21 U.S.C. 321) are applicable to such terms when used in this part. As proposed, several terms in part 121 have the same definitions as in proposed part 117 and, therefore, we have not included an extensive discussion of those terms in this proposed rule. See section X.B of the PC proposed rule for a discussion of the following terms: facility, farm, holding, manufacturing/processing, mixed-type facility, packing, qualified end-user, qualified facility, and small business.

FDA is proposing to define the term “
actionable process step
” to mean a

point, step, or procedure in a food process at which food defense measures can be applied and are essential to prevent or eliminate a significant vulnerability or reduce such vulnerability to an acceptable level. The term “actionable process step” used in the food defense context is analogous to the term “critical control point” (CCP), which is defined as “a point, step, or procedure in a food process at which control can be applied and is essential to prevent or eliminate a food safety hazard or reduce such hazard to an acceptable level.” Similar to a CCP, in proposed part 121, an “actionable process step” is identified during a vulnerability assessment (analogous to a hazard analysis) in relation to a significant vulnerability (analogous to a hazard that is reasonably likely to occur), and is facility-specific.

As discussed in section V.C.2 of this document, based on vulnerability assessments, FDA has identified four key activity types that we have tentatively concluded pose significant vulnerabilities in a food operation. FDA identified and described these key activity types (which are not facility-specific) with the expectation that an owner, operator, or agent in charge would objectively determine whether the processing steps in a facility fit within one or more of these key activity types. The processing steps identified by facilities in their food operation that fit within the FDA-identified key activity types are “actionable process steps,” and are steps at which a focused mitigation strategy would be employed to prevent or eliminate a significant vulnerability or reduce it to an acceptable level. Actionable process steps might also be identified in a vulnerability assessment (proposed § 121.130(b)). Though we use the term “actionable process step” in FDA's FDPB software tool (Ref. 31), we recognize it is a relatively new term and, therefore, we solicit comment on its appropriateness and any other more appropriate alternative terms.

FDA is proposing to define the term “
contaminant
” as any biological, chemical, physical or radiological agent that may be intentionally added to food and that may cause illness, injury or death. We based the proposed definition, in part, on the definition of “contaminant” used in Codex Alimentarius guidelines (Ref. 49) that refers to any biological or chemical agent, foreign matter or other substances not intentionally added to feed or food that may compromise feed and food safety or suitability. In this proposal, the term “contaminant” is used in the context of key activity types, which are related to intentional acts of adulteration caused by acts of terrorism with intent to cause public health harm and, to a lesser extent, economic disruption. Therefore, for the purposes of proposed part 121, we focused the definition of “contaminant” on agents that may be intentionally added to food and that may cause illness, injury, or death, which is consistent with our determination that the primary goal of such an attack would be public health harm (i.e., illness, injury, or death). Our proposed definition of “contaminant” in proposed 121.3 would be applicable to proposed part 121 only. We acknowledge that this term has a broader meaning in other settings, as evidenced by its use in the Codex Alimentarius guidelines.

FDA is proposing to define the term “facility” to mean a domestic facility or a foreign facility that is required to register under section 415 of the FD&C Act in accordance with the requirements of part 1, subpart H (21 CFR part 1, subpart H). The proposed definition would incorporate the definition in section 418(o)(2) of the FD&C Act.

FDA is proposing to define the term “farm” by reference to the definition of that term in proposed § 1.227. We are proposing to cross-reference the definition of “farm” rather than to define it in proposed part 121 because the definition of “farm,” under both current § 1.227(b)(3) and proposed § 1.227, includes the word “facility” with a meaning that is broader than the meaning of “facility” in section 418(o)(2) of the FD&C Act. Under part 1, subpart H, the term “facility” is not limited to entities that are required to register under section 415 of the FD&C Act. We are proposing to cross-reference the definition to reduce the potential confusion that could result if we used the term “facility” to have two different meanings within proposed part 121. See sections X.B and VIII of the PC proposed rule for additional information.

FDA is proposing to define the term “
focused mitigation strategies
” to mean those risk-based, reasonably appropriate measures that a person knowledgeable about food defense would employ to significantly minimize or prevent significant vulnerabilities identified at actionable process steps, and that are consistent with the current scientific understanding of food defense at the time of the analysis. The term “focused mitigation strategies” used in the food defense context is analogous to the term “preventive controls” in a HACCP-type framework for food safety.

As discussed in section V.C.3 of this document, a mitigation strategy is a measure taken by a facility to reduce the potential for intentional adulteration of food. A “focused mitigation strategy” is such a strategy applied in response to the identification of a significant vulnerability and at an actionable process step. Focused mitigation strategies are customized to the processing step at which they are applied, tailored to existing facility practices and procedures, and depend on an evaluation of the vulnerabilities identified in a facility. Because they are applied in response to a significant vulnerability, we have determined that focused mitigation strategies are essential to ensure that appropriate action is taken to protect the food from intentional adulteration caused by acts of terrorism.

While an option to perform a vulnerability assessment is provided under proposed § 121.130(b), facilities may choose instead to rely on the analysis performed by FDA that resulted in the identification of the key activity types listed in proposed § 121.130(a) when identifying actionable process steps and, subsequently, focused mitigation strategies, eliminating the need for a full vulnerability assessment. See section V.C.3 of this document for examples of focused mitigation strategies.

FDA is proposing to define the term “
food defense
” as the effort to protect food from intentional acts of adulteration where there is an intent to cause public health harm and economic disruption. As discussed in section IV.A of this document, acts of intentional adulteration may take several forms, including acts of terrorism; acts of disgruntled employees, consumers, or competitors; and economically motivated adulteration. We are proposing to define the term “food defense” to refer to the sum of actions and activities (including identification of actionable process steps; implementation of focused mitigation strategies; monitoring, corrective actions, verification, and training activities) taken to protect food from intentional acts of adulteration related to terrorism.

FDA is proposing to define the term “holding” to mean the storage of food. The proposed definition would also state that holding facilities include warehouses, cold storage facilities, storage silos, grain elevators, and liquid storage tanks; and that, for farms and farm mixed-type facilities, holding also includes activities traditionally performed by farms for the safe or effective storage of raw agricultural commodities grown or raised on the same farm or another farm under the

same ownership, but does not include activities that transform a raw agricultural commodity, as defined in section 201(r) of the FD&C Act, into a processed food as defined in section 201(gg) of the FD&C Act. For consistency of terminology, we are proposing the same definition of “holding” as in the PC proposed rule (see proposed §§ 1.227 and 117.3). For a detailed discussion of “holding,” see sections VIII.E and X.B of the PC proposed rule.

FDA is proposing to define the term “manufacturing/processing” to mean making food from one or more ingredients, or synthesizing, preparing, treating, modifying or manipulating food, including food crops or ingredients. The proposed definition would also state that examples of manufacturing/processing activities are cutting, peeling, trimming, washing, waxing, eviscerating, rendering, cooking, baking, freezing, cooling, pasteurizing, homogenizing, mixing, formulating, bottling, milling, grinding, extracting juice, distilling, labeling, or packaging. The proposed definition would also specify that, for farms and farm mixed-type facilities, manufacturing/processing does not include activities that are part of harvesting, packing, or holding. For consistency of terminology, we are proposing the same definition of “manufacturing/processing” as in the PC proposed rule (see proposed §§ 1.227 and 117.3). For a detailed discussion of “manufacturing/processing,” see sections VIII.E and X.B of the PC proposed rule.

FDA is proposing to define the term “mixed-type facility” to mean an establishment that engages in both activities that are exempt from registration under section 415 of the FD&C Act and activities that require the establishment to be registered. The proposed definition would also state that an example of such a facility is a “farm mixed-type facility,” which is an establishment that grows and harvests crops or raises animals and may conduct other activities within the farm definition, but also conducts activities that require the establishment to be registered. For consistency of terminology, we are proposing the same definition of “mixed-type facility” as in the PC proposed rule (see proposed §§ 1.227 and 117.3). For a detailed discussion of “mixed-type facilities,” see sections VIII.E and X.B of the PC proposed rule.

FDA is proposing to define the term “monitor” to mean to conduct a planned sequence of observations or measurements to assess whether focused mitigation strategies are consistently applied and to produce an accurate record for use in verification. In the intentional adulteration framework, monitoring would be performed to ensure that focused mitigation strategies are consistently applied and to provide a record for use in verifying consistent application.

FDA is proposing to define the term “packing” to mean placing food into a container other than packaging the food. The proposed definition would also specify that, for farms and farm mixed-type facilities, packing also includes activities traditionally performed by farms to prepare raw agricultural commodities grown or raised on the same farm or another farm under the same ownership for storage and transport, but does not include activities that transform a raw agricultural commodity, as defined in section 201(r) of the FD&C Act, into a processed food as defined in section 201(gg). We are proposing to use the same definition of “packing” as in the PC proposed rule (see proposed §§ 1.227 and 117.3). For a detailed discussion of “packing,” see sections VIII.E and X.B of the PC proposed rule.

FDA is proposing to define the term “qualified end-user” to mean, with respect to a food, the consumer of the food (where the term consumer does not include a business); or a restaurant or retail food establishment (as those terms are defined in § 1.227) that: (1) Is located: (i) in the same State as the qualified facility that sold the food to such restaurant or establishment; or (ii) not more than 275 miles from such facility; and (2) is purchasing the food for sale directly to consumers at such restaurant or retail food establishment. The proposed definition would incorporate the definition in section 418(l)(4)(B) of the FD&C Act.

FDA is proposing to define the term “qualified facility” to mean (when including the sales by any subsidiary; affiliate; or subsidiaries or affiliates, collectively, of any entity of which the facility is a subsidiary or affiliate) a facility that is: (1) A very small business as defined in this part; or (2) a facility to which both of the following apply: (i) During the 3-year period preceding the applicable calendar year, the average annual monetary value of the food manufactured, processed, packed or held at such facility that is sold directly to qualified end-users (as defined in this part) during such period exceeded the average annual monetary value of the food sold by such facility to all other purchasers; and (ii) the average annual monetary value of all food sold during the 3-year period preceding the applicable calendar year was less than $500,000, adjusted for inflation.

We acknowledge that facilities would not need to consider the applicability of previous paragraph (2) because facilities that meet this second prong of the definition would be included in our proposed definition of a very small business, which is broader.

The proposed definition would incorporate the description of “qualified facility” in section 418(l)(1) of the FD&C Act with editorial changes to improve clarity.

FDA is proposing to define the term “
significant vulnerability
” to mean a vulnerability for which a prudent person knowledgeable about food defense would employ food defense measures because of the potential for serious adverse health consequences or death and the degree of accessibility to that point in the food process. The term “significant vulnerability” is analogous to the term “hazard that is reasonably likely to occur” in a HACCP-type framework for food safety. As proposed, a “significant vulnerability” is a type of vulnerability for which there is both: (1) The potential for serious adverse health consequences or death from the intentional introduction of a contaminant at the particular point in the process at which the significant vulnerability exists; and (2) a significant degree of accessibility at the particular point in the process. Unlike a “hazard that is reasonably likely to occur” in a HACCP system, a “significant vulnerability” exists at a particular point in a process (e.g., during storage in a bulk tank or during mixing). As discussed in section V.C.2 of this document, we have determined that significant vulnerabilities exist in a food operation at those actionable process steps that fit in the FDA-identified key activity types or that are identified as part of a vulnerability assessment.

We have retained in this proposed definition the concept of a “prudent person” used in the definition of a “hazard that is reasonably likely to occur” in the PC proposed rule. However, because intentional adulteration is a potentially high consequence but low probability occurrence, the portion of the proposed definition in the PC proposed rule that reads, “experience, illness data, scientific reports, or other information provides a basis to conclude that there is a reasonable possibility that the hazard will occur in the type of food being manufactured, processed, packed, or held in the absence of those controls,” does not appear to be appropriate. Successful intentional adulteration caused by an act of

terrorism requires not only the absence of focused mitigation strategies designed to address a significant vulnerability, but also simultaneous intent by an attacker to adulterate the food. As such, the absence of focused mitigation strategies to address a significant vulnerability alone may not present a reasonable possibility of intentional adulteration. Instead, as described above, we have tentatively concluded that the prudent person would consider the potential for public health consequences should intentional adulteration occur, and the degree of access by the attacker to commit the intentional adulteration, in determining which vulnerabilities are significant.

FDA is proposing to define the term “significantly minimize” to mean to reduce to an acceptable level, including to eliminate. As noted in section X.B of the PC proposed rule, the term “significantly minimize” is used in FSMA and is consistent with the outcome of a “control measure” as described in the HACCP regulations for seafood (part 123), juice (part 120), and meat and poultry (9 CFR part 417). Generally, a “control measure” is implemented so that hazards are prevented, reduced to an acceptable level, or eliminated.

FDA is proposing to define the term “small business” to mean, for the purposes of proposed part 121, a business employing fewer than 500 persons. The proposed limit of 500 employees would include all employees of the business rather than be limited to the employees of a particular facility. We are proposing to establish the same definition for small business as that which has been established by the U.S. Small Business Administration under 13 CFR part 121 for most food manufacturers.

FDA is proposing to define the term “verification” to mean those activities, other than monitoring, that establish that the system is operating according to the food defense plan. As discussed in section V.C.6 of this document, we are not proposing to require validation of the focused mitigation strategies and, therefore, we are not proposing to include a determination of the validity of the food defense plan within the definition of verification in proposed § 121.3.

FDA is proposing to define the term “very small business” to mean, for the purposes of proposed part 121, a business that has less than $10,000,000 in total annual sales of food, adjusted for inflation. In the discussion on the regulatory framework in section IV.A of this document, we discuss our assessment that the goal of terrorist organizations is to maximize public health harm and, to a lesser extent, economic disruption. It is our assessment that such goals are likely to drive terrorist organizations to target the product of relatively large facilities, especially those for which the brand is nationally or internationally recognizable. An attack on such a target would potentially provide the wide-scale consequences desired by a terrorist organization and the significant public attention that would accompany an attack on a recognizable brand. Such facilities are likely to have larger batch sizes, potentially resulting in greater human morbidity and mortality. Further, an attack on a well-recognized, trusted brand is likely to result in greater loss of consumer confidence in the food supply and in the government's ability to ensure its safety and, consequently, cause greater economic disruption than a relatively unknown brand that is distributed regionally (Ref. 2, Ref. 50, Ref. 3, Ref. 51, Ref. 6). Therefore, we have set a threshold of $10,000,000 in total food sales, adjusted for inflation, as the level defining a very small business. Data from the Dun & Bradstreet Global Business Database show that businesses with less than $10,000,000 in total food sales represent about 3 percent of the market share of food commodities, but include the majority of food facilities. Of a total of 65,900 domestic food facilities that are estimated to have actionable process steps, about 51,700 are owned by businesses with less than $10,000,000 in total annual sales. We request comment on our proposed definition, and whether a dollar amount of sales more than or less than $10,000,000 would be more appropriate. We also seek comment on whether this threshold should be based on total food sold, as we proposed, or on some appropriate proportion of food sales. For example, in the case of foreign facilities, would it be more appropriate to consider the proportion of food sold for marketing in the United States?

FDA is proposing to define the term “
vulnerability
” to mean the susceptibility of a point, step, or procedure in a facility's food process to intentional adulteration. “Vulnerability” is used in the term “vulnerability assessment” in section 420 of the FD&C Act and may best be described in the food defense context as analogous to the term “hazard” in a HACCP-type framework for food safety. While hazards in the unintentional adulteration context may also be thought of as analogous to agents or contaminants in the intentional adulteration context, we have tentatively concluded that focusing on individual agents or contaminants is generally not effective or efficient in minimizing the risk of intentional adulteration caused by acts of terrorism. There are a significant number of potential agents or contaminants that could be used in a terrorist attack on food, with one or more being suitable for essentially any point in the production of any specific food. It would be extremely difficult, if not impossible, to consider the multiple combinations of potential contaminants, points in a food operation, and food categories, and to determine a strategy that would effectively address all possible agents. For this reason, determining whether there is an agent that could be intentionally introduced to a specific food that would then cause serious adverse health consequences or death would not be a useful exercise. Further, many agents or contaminants that could be used in such an attack are different from those that are associated with foodborne illnesses caused by unintentional adulteration and, as such, are not expected to be well understood by operators of food facilities. Therefore, we have tentatively concluded that in the intentional adulteration framework related to acts of terrorism, it is appropriate to refer to “vulnerabilities” rather than “hazards”. According to the Merriam-Webster dictionary (Ref. 52), vulnerability is a “susceptibility,” and we believe this concept best captures the idea of a point, step, or procedure where someone intent on intentional adulteration would focus an attack in a facility's food process. See section V.C.2 of this document for a discussion of assessing vulnerabilities to identify actionable process steps.

We solicit comment on the proposed definitions.

B. Exemptions

In subpart A of proposed part 121, proposed § 121.5 would establish exemptions from some or all of the provisions of this proposed regulation.

1. Proposed § 121.5(a)—Exemption for Qualified Facilities

Proposed § 121.5(a) would provide that proposed part 121 does not apply to a qualified facility, except that qualified facilities must, upon request, provide for official review documentation that was relied upon to demonstrate that the facility meets this exemption. Such documentation must be retained for 2 years.

a. Exemption of qualified facilities.
As discussed in section V.A of this document, proposed § 121.3 would

define a
qualified facility
to mean (when including the sales by any subsidiary; affiliate; or subsidiaries or affiliates, collectively, of any entity of which the facility is a subsidiary or affiliate) a facility that is: (1) A very small business as defined in this part, or (2) a facility to which both of the following apply: (i) During the 3-year period preceding the applicable calendar year, the average annual monetary value of the food manufactured, processed, packed or held at such facility that is sold directly to qualified end-users (as defined in this part) during such period exceeded the average annual monetary value of the food sold by such facility to all other purchasers; and (ii) the average annual monetary value of all food sold during the 3-year period preceding the applicable calendar year was less than $500,000, adjusted for inflation. In addition, we are proposing to define very small business to mean a business that has less than $10,000,000 in total annual sales of food, adjusted for inflation.

Section 418(l)(2)(A) of the FD&C Act provides that a qualified facility “shall not be subject to the requirements under [sections 418(a) through (i) and (n) of the FD&C Act].” We have tentatively concluded that we should include the exemption provided in section 418(l)(2)(A) of the FD&C Act in proposed § 121.5(a) to establish by regulation the reach of the provision.

Section 418(l)(5) of the FD&C Act requires the Secretary of Health and Human Services, in consultation with the Secretary of Agriculture, to conduct a study of the food processing sector regulated by the Secretary of Health and Human Services and to make determinations in five areas. These areas include, in part: (1) Distribution of food production by type and size of operation; (2) the proportion of food produced by each type and size of operation

[Text truncated at 120,000 characters. The full text is on the page linked above.]

---

Source: Frix Law Library, https://www.frixlaw.com/law-library/documents/fr%3A2013-30373. Public record. Not legal advice.