# Mitigation Strategies To Protect Food Against Intentional Adulteration > Briefs, arguments, decisions, and more. URL: https://www.frixlaw.com/law-library/documents/fr%3A2016-12373 ## Record - **Collection:** Federal Register - **Document type:** Rule - **Published:** May 27, 2016 - **Citation:** 81 FR 34166 ## Text DEPARTMENT OF HEALTH AND HUMAN SERVICES Food and Drug Administration 21 CFR Parts 11 and 121 [Docket No. FDA-2013-N-1425] RIN 0910-AG63 Mitigation Strategies To Protect Food Against Intentional Adulteration AGENCY: Food and Drug Administration, HHS. ACTION: Final rule. SUMMARY: The Food and Drug Administration (FDA or we) is issuing this final rule to require domestic and foreign food facilities that are required to register under the Federal Food, Drug, and Cosmetic Act (the FD&C Act) to address hazards that may be introduced with the intention to cause wide scale public health harm. These food facilities are required to conduct a vulnerability assessment to identify significant vulnerabilities and actionable process steps and implement mitigation strategies to significantly minimize or prevent significant vulnerabilities identified at actionable process steps in a food operation. FDA is issuing these requirements as part of our implementation of the FDA Food Safety Modernization Act (FSMA). DATES: This rule is effective July 26, 2016. See section VIII for compliance dates. FOR FURTHER INFORMATION CONTACT: Ryan Newkirk, Center for Food Safety and Applied Nutrition (HFS-005), Food and Drug Administration, 5100 Paint Branch Pkwy., College Park, MD 20740, 240-402-3712, email: Ryan.Newkirk@fda.hhs.gov . SUPPLEMENTARY INFORMATION: Table of Contents Executive Summary Purpose and Coverage of the Rule Summary of the Major Provisions of the Rule Costs and Benefits I. Background A. FDA Food Safety Modernization Act B. Proposed Rule on Intentional Adulteration C. Appendix 4 to Draft Risk Assessment D. Public Comments II. Legal Authority A. Section 103 of FSMA B. Section 106 of FSMA C. Intrastate Activities III. General Comments on the Proposed Rule A. Comments on Overall Framework for the Regulatory Approach B. One Set of Requirements Under Sections 418 and 420 of the FD&C Act C. Require Measures Only in the Event of a Credible Threat D. General Comments on Implementation and Compliance E. Comments on Requests for Additional Exemptions F. Other General Comments G. Other Issues Discussed in the Proposed Rule IV. Subpart A: Comments on Specific Provisions A. Revisions to Definitions Also Used in Section 415 Registration Regulations (21 CFR Part 1, Subpart H) and Section 414 Recordkeeping Regulations (21 CFR Part 1, Subpart J) B. Other Definitions That We Proposed To Establish in Part 121 C. Additional Definitions to Clarify Terms Not Defined in the Proposed Rule D. Comments Asking FDA to Establish Additional Definitions or Otherwise Clarify Terms Not Defined in the Rule E. Proposed § 121.5—Exemptions V. Subpart C: Comments on Food Defense Measures A. Proposed § 121.126—Requirement for a Food Defense Plan B. Proposed § 121.130—Identification of Actionable Process Steps C. Proposed § 121.135—Focused Mitigation Strategies for Actionable Process Steps D. Final § 121.138—Mitigation Strategies Management Components E. Proposed § 121.140—Monitoring F. Proposed § 121.145—Corrective Actions G. Proposed § 121.150—Verification H. Proposed § 121.160—Training (Final § 121.4) VI. Subpart D: Comments on Requirements Applying to Records That Must Be Established and Maintained A. Proposed § 121.301—Records Subject to the Requirements of This Subpart D B. Proposed § 121.305—General Requirements Applying to Records C. Proposed § 121.310—Additional Requirements Applying to the Food Defense Plan D. Proposed § 121.315—Requirements for Record Retention E. Proposed § 121.320—Requirements for Official Review F. Proposed § 121.325—Public Disclosure G. Proposed § 121.330—Use of Existing Records VII. Subpart E: Comments on Compliance—Proposed § 121.401 VIII. Effective and Compliance Dates IX. Executive Order 13175 X. Final Regulatory Impact Analysis XI. Paperwork Reduction Act of 1995 XII. Analysis of Environmental Impact XIII. Federalism XIV. References Executive Summary Purpose and Coverage of the Rule This regulation implements three provisions of the FD&C Act, as amended by FSMA, that relate to the intentional adulteration of food. Section 418 of the FD&C Act (21 U.S.C. 350g) addresses intentional adulteration in the context of facilities that manufacture, process, pack, or hold food and are required to register under section 415 of the FD&C Act (21 U.S.C. 350d). Section 419 of the FD&C Act (21 U.S.C. 350h) addresses intentional adulteration in the context of fruits and vegetables that are raw agricultural commodities. Section 420 of the FD&C Act (21 U.S.C. 350i) addresses intentional adulteration in the context of high-risk foods and exempts farms except for farms that produce milk. FDA is implementing the intentional adulteration provisions in sections 418, 419, and 420 of the FD&C Act in this rulemaking. The purpose of this rule is to protect food from intentional acts of adulteration where there is an intent to cause wide scale public health harm. This rule applies to both domestic and foreign facilities that are required to register under section 415 of the FD&C Act. This rule establishes several exemptions as follows: • The rule does not apply to a very small business ( i.e., a business, including any subsidiaries or affiliates, averaging less than $10,000,000, adjusted for inflation, per year, during the 3-year period preceding the applicable calendar year in both sales of human food plus the market value of human food manufactured, processed, packed, or held without sale, e.g., held for a fee), except that the facility is required to provide for official review, upon request, documentation sufficient to show that the facility qualifies for this exemption. • This rule does not apply to the holding of food, except the holding of food in liquid storage tanks. • This rule does not apply to the packing, re-packing, labeling, or re-labeling of food where the container that directly contacts the food remains intact. • This rule does not apply to activities of a farm that are subject to section 419 of the Federal Food, Drug, and Cosmetic Act (Standards for Produce Safety). • This rule does not apply with respect to alcoholic beverages at a facility that meets certain conditions. • This rule does not apply to the manufacturing, processing, packing, or holding of food for animals other than man. • This rule does not apply to on-farm manufacturing, processing, packing, or holding by a small or very small business of certain foods identified as having low-risk production practices if such activities are the only activities conducted by the business subject to section 418 of the FD&C Act. Summary of the Major Provisions of the Final Rule This rule establishes various food defense measures that an owner, operator, or agent in charge of a facility is required to implement to protect against the intentional adulteration of food. Specifically: • Prepare and implement a written food defense plan that includes a vulnerability assessment to identify significant vulnerabilities and actionable process steps, mitigation strategies, and procedures for food defense monitoring, corrective actions, and verification (§ 121.126). • Identify any significant vulnerabilities and actionable process steps by conducting a vulnerability assessment for each type of food manufactured, processed, packed, or held at the facility using appropriate methods to evaluate each point, step, or procedure in a food operation (§ 121.130). • Identify and implement mitigation strategies at each actionable process step to provide assurances that the significant vulnerability at each step will be significantly minimized or prevented and the food manufactured, processed, packed, or held by the facility will not be adulterated. For each mitigation strategy implemented at each actionable process step, include a written explanation of how the mitigation strategy sufficiently minimizes or prevents the significant vulnerability associated with the actionable process step (§ 121.135). • Establish and implement mitigation strategies management components, as appropriate to ensure the proper implementation of each such mitigation strategy, taking into account the nature of the mitigation strategy and its role in the facility's food defense system (§ 121.138). • Establish and implement food defense monitoring procedures, for monitoring the mitigation strategies, as appropriate to the nature of the mitigation strategy and its role in the facility's food defense system (§ 121.140). • Establish and implement food defense corrective action procedures that must be taken if mitigation strategies are not properly implemented, as appropriate to the nature of the actionable process step and the nature of the mitigation strategy (§ 121.145). • Establish and implement specified food defense verification activities, as appropriate to the nature of the mitigation strategy and its role in the facility's food defense system (§ 121.150). • Conduct a reanalysis of the food defense plan (§ 121.157). • Ensure that all individuals who perform required food defense activities are qualified to perform their assigned duties (§ 121.4). • Establish and maintain certain records, including the written food defense plan (vulnerability assessment, mitigation strategies and procedures for food defense monitoring, corrective actions, and verification) and documentation related to training of personnel. All records are subject to certain general recordkeeping and record retention requirements (§§ 121.301 to 121.330). • The effective date is 60 days after this final rule is published. However, we are providing for a longer timeline for facilities to come into compliance. Facilities, other than small and very small businesses, have 3 years after the effective date to comply with part 121. Small businesses ( i.e., those employing fewer than 500 full-time equivalent employees) have 4 years after the effective date to comply with part 121. Very small businesses ( i.e., businesses that have less than $10,000,000, adjusted for inflation, per year, during the 3-year period preceding the applicable calendar year in both sales of human food plus the market value of human food manufactured, processed, packed, or held without sale, e.g., held for a fee) have 5 years after the effective date to comply with § 121.5(a). As discussed in detail in later sections of the rule, we made several major revisions to the provisions of this rule, mainly in response to comments, to provide for greater flexibility and clarity. These major revisions to the regulatory text include the following: • We removed the key activity types (KATs); however, the use of the KATs is still permissible to conduct a vulnerability assessment and will be further discussed in guidance. • We specified three elements that must be evaluated when conducting a vulnerability assessment: (1) The potential public health impact ( e.g., severity and scale) if a contaminant were added; (2) the degree of physical access to the product; and (3) the ability of an attacker to successfully contaminate the product. • We specified that the vulnerability assessment must consider the possibility of an inside attacker. • We removed the distinction between “broad” and “focused” mitigation strategies. • We made the mitigation strategy management components (food defense monitoring, corrective actions, and verification) more flexible by providing that they are required “as appropriate to ensure the proper implementation of the mitigation strategies, taking into account the nature of each such mitigation strategy and its role in the facility's food defense system.” • We revised the terminology used for the food defense management components such that monitoring, corrective actions, and verification are now food defense monitoring, food defense corrective actions, and food defense verification. • We made the requirement to document food defense monitoring more flexible by providing for use of exception records. • We made the food defense corrective actions requirement more flexible by providing that it is required “as appropriate to the nature of the actionable process step and the nature of the mitigation strategy.” • We made the requirement for verifying proper implementation of mitigation strategies more flexible by providing for “other activities appropriate for verification of proper implementation of mitigation strategies.” • We exempted records required by this rule from the requirements of 21 Code of Federal Regulations, part 11. • We provided for the use of existing records if certain conditions are met. • We removed the term “qualified facility” and instead refer to “very small business” in the exemption under 121.5(a). • We established an exemption for certain on-farm manufacturing, processing, packing, or holding by small and very small businesses of certain foods identified as having low-risk production processes. • We added a new definition for “qualified individual” and included new requirements to ensure that all individuals who perform activities required under subpart C are qualified to perform their assigned activities. • We provided longer timelines for facilities to come into compliance with the rule. Costs and Benefits The total cost of the rule, annualized over 10 years at a 7 percent discount rate, is between $280 and $490 million. With a 3 percent discount rate, the annualized cost is between $270 and $480 million. The first-year cost is between $680 and $930 million. Counting only domestic firms, the total annualized costs are between $90 and $150 million, with initial costs of between $220 and $300 million. The average annualized cost per covered facility is between $9,000 and $16,000, and the average annualized cost per covered firm is between $27,000 and $47,000. The benefits of the actions required by the rule are a reduction in the possibility of illness and death resulting from intentional adulteration of food. We monetize the damage that various intentional adulteration scenarios might cause, and present a breakeven analysis showing the number of prevented attacks at which the benefits are larger than the costs. For attacks that are similar in impact to acts of intentional adulteration that have happened in the United States in the past, the breakeven threshold, counting only producer costs, is 28 to 48 attacks prevented every year. For attacks causing similar casualties as major historical outbreaks of food-related illness, the breakeven threshold is one or two attacks every year. For catastrophic terrorist attacks causing thousands of fatalities, the breakeven threshold is one attack prevented every 270 to 460 years. The table shows the approximate, rounded, mean values for various cost components of the rule: Annualized Cost and Benefit Overview All Numbers are USD 2014 (millions), annualized over 10 years 3% Discount 7% Discount Costs: Learning about Rule $3 $4 Creating Food Defense Plans 10 11 Mitigation Costs 26 28 Monitoring, Corrective Action, Verification 62 62 Employee Training 5 6 Documentation 9 9 Subtotal (Domestic cost) 115 119 Cost to Foreign Firms 247 256 Total 362 375 Benefits: Lower Chance of Intentional Adulteration Unquantified I. Background A. FDA Food Safety Modernization Act The FDA Food Safety Modernization Act (FSMA) (Pub. L. 111-353), signed into law by President Obama on January 4, 2011, is intended to allow FDA to better protect public health by helping to ensure the safety and security of the food supply. FSMA enables us to focus more on preventing food safety problems rather than relying primarily on reacting to problems after they occur. The law also provides new enforcement authorities to help achieve higher rates of compliance with risk-based, prevention-oriented safety standards and to better respond to and contain problems when they do occur. In addition, the law contains important new tools to better ensure the safety of imported foods and encourages partnerships with State, local, tribal, and territorial authorities. A top priority for FDA are those FSMA-required regulations that provide the framework for industry's implementation of preventive controls and enhance our ability to oversee their implementation for both domestic and imported food. To that end, we proposed the seven foundational rules listed in table 1 and requested comments on all aspects of these proposed rules. Table 1—Published Foundational Rules for Implementation of FSMA Title Abbreviation Publication Current Good Manufacturing Practice and Hazard Analysis and Risk-Based Preventive Controls for Human Food 2013 proposed human preventive controls rule 78 FR 3646, January 16, 2013. Standards for the Growing, Harvesting, Packing, and Holding of Produce for Human Consumption 2013 proposed produce safety rule 78 FR 3504, January 16, 2013. Current Good Manufacturing Practice and Hazard Analysis and Risk-Based Preventive Controls for Food for Animals 2013 proposed animal preventive controls rule 78 FR 64736, October 29, 2013. Foreign Supplier Verification Programs (FSVP) for Importers of Food for Humans and Animals 2013 proposed FSVP rule 78 FR 45730, July 29, 2013. Accreditation of Third-Party Auditors/Certification Bodies to Conduct Food Safety Audits and to Issue Certifications 2013 proposed third-party certification rule 78 FR 45782, July 29, 2013. Focused Mitigation Strategies To Protect Food Against Intentional Adulteration 2013 proposed intentional adulteration rule 78 FR 78014, December 24, 2013. Sanitary Transportation of Human and Animal Food 2014 proposed sanitary transportation rule 79 FR 7006, February 5, 2014. We also issued a supplemental notice of proposed rulemaking for the rules listed in table 2 and requested comments on specific issues identified in each supplemental notice of proposed rulemaking. Table 2—Published Supplemental Notices of Proposed Rulemaking for the Foundational Rules for Implementation of FSMA Title Abbreviation Publication Current Good Manufacturing Practice and Hazard Analysis and Risk-Based Preventive Controls for Human Food 2014 supplemental human preventive controls notice 79 FR 58524, September 29, 2014. Standards for the Growing, Harvesting, Packing, and Holding of Produce for Human Consumption 2014 supplemental produce safety notice 79 FR 58434, September 29, 2014. Current Good Manufacturing Practice and Hazard Analysis and Risk-Based Preventive Controls for Food for Animals 2014 supplemental animal preventive controls notice 79 FR 58476, September 29, 2014. Foreign Supplier Verification Programs (FSVP) for Importers of Food for Humans and Animals 2014 supplemental FSVP notice 79 FR 58574, September 29, 2014. We have finalized six of the foundational rulemakings, as listed in table 3. Table 3—Published Foundational Final Rules for Implementation of FSMA Title Abbreviation Publication Current Good Manufacturing Practice, Hazard Analysis and Risk-Based Preventive Controls for Human Food PCHF final rule 80 FR 55908, September 17, 2015. Current Good Manufacturing Practice, Hazard Analysis and Risk-Based Preventive Controls for Food for Animals PCAF final rule 80 FR 56170, September 17, 2015. Standards for the Growing, Harvesting, Packing, and Holding of Produce for Human Consumption Produce final rule 80 FR 74354, November 27, 2015. Foreign Supplier Verification Programs (FSVP) for Importers of Food for Humans and Animals FSVP final rule 80 FR 74226, November 27, 2015. Accreditation of Third-Party Certification Bodies to Conduct Food Safety Audits and to Issue Certifications Third-party final rule 80 FR 74570, November 27, 2015. Sanitary Transportation of Human and Animal Food Transport final rule 81 FR 20092, April 6, 2016. As FDA finalizes these seven foundational rulemakings, we are putting in place a framework for food safety that is modern and brings to bear the most recent science on provisions to enhance food safety and food defense, that is risk-based and focuses effort where the hazards are most significant, and that is flexible and practical given our current knowledge of food safety and food defense practices. To achieve this, FDA has engaged in a great deal of outreach to the stakeholder community to find the right balance in these regulations of flexibility and accountability. Since FSMA was enacted in 2011, we have been involved in approximately 600 engagements on FSMA and the proposed rules, including public meetings, Webinars, listening sessions, farm tours, and extensive presentations and meetings with various stakeholder groups (Ref. 1) (Ref. 2). As a result of this stakeholder dialogue, FDA decided to issue the four supplemental notices of proposed rulemaking to share our current thinking on key issues and get additional stakeholder input on those issues. As we move forward into the next phase of FSMA implementation, we intend to continue this dialogue and collaboration with our stakeholders, through guidance, education, training, and assistance, to ensure that stakeholders understand and engage in their roles in food safety and food defense. FDA believes these seven foundational final rules, when implemented, will fulfill the paradigm shift toward prevention that was envisioned in FSMA and be a major step forward for food safety and food defense that will protect consumers into the future. B. Proposed Rule on Intentional Adulteration In the Federal Register of December 24, 2013 (78 FR 78014), we issued a proposed rule to implement the intentional adulteration provisions in sections 103, 105, and 106 of FSMA (proposed rule). We initially requested public comments on the proposed rule by March 31, 2014. We extended the comment period for the proposed rule until June 30, 2014, in response to several requests for an extension. The proposed rule proposed to require various food defense measures that an owner, operator, or agent in charge of a facility would be required to implement to protect against the intentional adulteration of food, and can be summarized as follows: • Prepare and implement a written food defense plan that includes actionable process steps, focused mitigation strategies, and procedures for monitoring, corrective actions, and verification (proposed § 121.126). • Identify any actionable process steps, using one of two procedures. In the proposed rule, we explained that FDA has analyzed vulnerability assessments conducted using the CARVER+Shock methodology and identified four key activity types: Bulk liquid receiving and loading; Liquid storage and handling; Secondary ingredient handling; and Mixing and similar activities. We further explained that FDA has determined that the presence of one or more of these key activity types at a process step ( e.g., manufacturing, processing, packing, or holding of food) indicates a significant vulnerability under section 418 of the FD&C Act and that the food is at high risk of intentional adulteration caused by acts of terrorism under section 420 of the FD&C Act. We proposed that facilities may identify actionable process steps using the FDA-identified key activity types as described in proposed § 121.130(a) or conduct their own facility-specific vulnerability assessments as provided in proposed § 121.130(b). • Identify and implement focused mitigation strategies at each actionable process step to provide assurances that the significant vulnerability at each step will be significantly minimized or prevented and the food manufactured, processed, packed, or held by the facility will not be adulterated (proposed § 121.135). • Establish and implement procedures, including the frequency with which they are to be performed, for monitoring the focused mitigation strategies (proposed § 121.140) • Establish and implement corrective action procedures that must be taken if focused mitigation strategies are not properly implemented (proposed § 121.145). • Verify that monitoring is being conducted and appropriate decisions about corrective actions are being made; verify that the focused mitigation strategies are consistently implemented and are effectively and significantly minimizing or preventing the significant vulnerabilities; and conduct a reanalysis of the food defense plan (proposed § 121.150). • Ensure that personnel and supervisors assigned to actionable process steps receive appropriate training in food defense awareness and their respective responsibilities in implementing focused mitigation strategies (proposed § 121.160). • Establish and maintain certain records, including the written food defense plan; written identification of actionable process steps and the assessment leading to that identification; written focused mitigation strategies; written procedures for monitoring, corrective actions, and verification; and documentation related to training of personnel. All such records are subject to certain recordkeeping requirements, record retention requirements, requirements for official review and public disclosure requirements (proposed §§ 121.301 to 121.325). • Proposed the effective date as 60 days after this final rule is published. However, we proposed for a longer timeline for facilities to come into compliance. Facilities, other than small and very small businesses, would have 1 year after the effective date to comply with part 121. Small businesses ( i.e., those employing fewer than 500 persons) would have 2 years after the effective date to comply with part 121. Very small businesses ( i.e., businesses that have less than $10,000,000 in total annual sales of food, adjusted for inflation) would be considered a qualified facility and have 3 years after the effective date to comply with § 121.5(a). We requested comment on all aspects of the proposed requirements. In addition, we described our thinking and sought comment on other issues, including the framework of the rule; activities that occur on produce farms; transportation carriers; food for animals; acts of disgruntled employees, consumers, or competitors; economically motivated adulteration; low-risk activities at farm mixed-type facilities; activities that occur on dairy farms; and other ways to focus on foods with a high risk of intentional adulteration caused by terrorism. C. Appendix 4 to Draft Risk Assessment We issued for public comment an “Appendix 4 to Draft Qualitative Risk Assessment of Risk of Activity/Food Combinations for Activities (Outside the Farm Definition) Conducted in a Facility Co-Located on a Farm” (the draft RA Appendix) (78 FR 78064, December 24, 2013). The purpose of the draft RA Appendix was to provide a science-based risk analysis of those foods whose production processes would be considered low risk with respect to the risk of intentional adulteration caused by acts of terrorism. We used the tentative conclusions of the section 103(c)(1)(C) draft RA Appendix to seek comment in the proposed rule on possible exemptions or modified requirements for this final rule (78 FR 78014 at 78029). We are including the final appendix to the risk assessment in the docket established for this document (Ref. 3). D. Public Comments We received more than 200 public submissions on the proposed rule, each containing one or more comments. We received submissions from diverse members of the public, including food facilities (including facilities co-located on a farm); farms; cooperatives; coalitions; trade organizations; consulting firms; law firms; academia; public health organizations; public advocacy groups; consumers; consumer groups; Congress, Federal, State, local, and tribal Governments; and other organizations. Some submissions included signatures and statements from multiple individuals. Comments addressed virtually every provision of the proposed rule, including our requests for comment on including additional provisions that we did not include in the proposed regulatory text. In the remainder of this document, we describe these comments, respond to them, and explain any revisions we made to the proposed rule. Some comments address issues that are outside the scope of this rule. For example, some comments express concern about overregulation in general. Some comments believe the Department of Homeland Security is the Federal Agency that should protect the food supply. Some comments express concern about “genetically modified organisms”, while other comments express concern about the amount of chemicals in food. Some comments express concern that extreme consolidation of our food system is the main reason that it could be a target for terrorism or other intentional acts aimed at causing widespread human casualties. These comments state that decentralization is the most resilient defense against those who wish to contaminate the food supply. We do not discuss such comments in this document. II. Legal Authority The proposed rule contained an explanation of its legal basis under authorities in the FDA Food Safety Modernization Act and section 701 of the FD&C Act. After considering the comments received in response to the proposed rule, FDA made changes in the final rule. The legal authorities relied on in the final rule are the same as those in the proposed rule unless otherwise described in the sections that follow. A. Section 103 of FSMA Section 103 of FSMA, Hazard Analysis and Risk-Based Preventive Controls, amends the FD&C Act to create a new section 418, which mandates rulemaking. Section 418(n)(1)(A) of the FD&C Act requires that the Secretary issue regulations “to establish science-based minimum standards for conducting a hazard analysis, documenting hazards, implementing preventive controls, and documenting the implementation of the preventive controls. . . .” Section 418(n)(1)(B) of the FD&C Act requires that the regulations define the terms “small business” and “very small business,” taking into consideration the study of the food processing sector required by section 418(l)(5) of the FD&C Act. Further, section 103(e) of FSMA creates a new section 301(uu) in the FD&C Act (21 U.S.C. 331(uu)) to prohibit “[t]he operation of a facility that manufactures, processes, packs, or holds food for sale in the United States if the owner, operator, or agent in charge of such facility is not in compliance with section 418 [of the FD&C Act].” In addition to rulemaking requirements, section 418 contains requirements applicable to the owner, operator, or agent in charge of a facility required to register under section 415. Section 418(a) is a general provision that requires the owner, operator, or agent in charge of a facility to evaluate the hazards that could affect food manufactured, processed, packed, or held by the facility, identify and implement preventive controls, monitor the performance of those controls, and maintain records of the monitoring. In addition to the general requirements in section 418(a) of the FD&C Act, sections 418(b)-(i) contain more specific requirements applicable to facilities, including several provisions explicitly directed at intentional adulteration. For example, section 418(b)(2) of the FD&C Act specifies that the owner, operator, or agent in charge of a facility shall identify and evaluate hazards that may be intentionally introduced, including by acts of terrorism. Section 418(c)(2) of the FD&C Act specifies that the owner, operator, or agent in charge of a facility shall identify and implement preventive controls to provide assurances that any hazards that relate to intentional adulteration will be significantly minimized or prevented and addressed, consistent with section 420 of the FD&C Act. Sections 418(j)-(m) of the FD&C Act and sections 103(c)(1)(D) and (g) of FSMA provide authority for certain exemptions and modifications to the requirements of section 418 of the FD&C Act. These include provisions related to seafood and juice hazard analysis critical control point (HACCP), and low-acid canned food (section 418(j)); activities of facilities subject to section 419 of the FD&C Act (Standards for Produce Safety) (section 418(k)); qualified facilities (section 418(l)); facilities that are solely engaged in the production of food for animals other than man, the storage of raw agricultural commodities (other than fruits and vegetables) intended for further distribution or processing, or the storage of packaged foods that are not exposed to the environment (section 418(m)); facilities engaged only in certain low risk on-farm activities on certain foods conducted by small or very small businesses (section 103(c)(1)(D) of FSMA), and dietary supplements (section 103(g) of FSMA). We are issuing all of the provisions of the rule under section 418 of the FD&C Act, except with respect to facilities that are exempt from its coverage. B. Section 106 of FSMA Section 106 of FSMA, Protection Against Intentional Adulteration, amends the FD&C Act to create a new section 420, which mandates rulemaking. Section 420 of the FD&C Act requires FDA to issue regulations to protect against the intentional adulteration of food. Section 420(b)(1) of the FD&C Act requires that such regulations are to specify how a person is to assess whether the person is required to implement mitigation strategies or measures intended to protect against the intentional adulteration of food. Section 420(b)(2) of the FD&C Act requires that the regulations specify appropriate science-based mitigation strategies or measures to prepare and protect the food supply chain at specific vulnerable points, as appropriate. Section 420(c) of the FD&C Act provides that such regulations are to apply only to food for which there is a high risk of intentional adulteration and for which such intentional adulteration could cause serious adverse health consequences or death to humans or animals. Section 420(c)(1) provides that such foods are to include those for which FDA has identified clear vulnerabilities. Section 420(d) of the FD&C Act limits applicability on farms to farms that produce milk. Further, section 106(d) of FSMA creates a new section 301(ww) in the FD&C Act to prohibit “[t]he failure to comply with section 420 [of the FD&C Act].” We are issuing all of the provisions of the rule under section 420 of the FD&C Act. C. Intrastate Activities FDA concludes that the rule should apply to activities that are intrastate in character. Facilities are required to register under section 415 of the FD&C Act regardless of whether the food from the facility enters interstate commerce (§ 1.225(b)). The plain language of section 418 of the FD&C Act applies to facilities that are required to register under section 415 of the FD&C Act (section 418(o)(2)) and does not exclude a facility because food from such a facility is not in interstate commerce. Similarly, the plain language of section 420 of the FD&C Act requires FDA to issue regulations to protect against the intentional adulteration of food and does not include a limitation to interstate commerce. Further, the prohibited act provisions in sections 301(uu) and (ww) of the FD&C Act (21 U.S.C. 331(uu) and (ww)) do not require an interstate commerce nexus. Notably, other subsections in section 301 of the FD&C Act, and section 304 of the FD&C Act (21 U.S.C. 334) demonstrate that Congress has included a specific interstate commerce nexus in the provisions of the FD&C Act when that is its intent. Accordingly, it is reasonable to interpret sections 418, 420, 301(uu), and 301(ww) of the FD&C Act as not limited to those facilities with a direct connection to interstate commerce. III. General Comments on the Proposed Rule A. Comments on Overall Framework for the Regulatory Approach We proposed a HACCP-type approach, like the one proposed for the systematic control of food safety hazards in the PCHF proposed rule, as the most effective means of ensuring that mitigation strategies are consistently applied once the significant vulnerabilities are identified and appropriate mitigation strategies are developed. We requested comment on the appropriateness of a HACCP-type system to ensure that mitigation strategies designed to significantly minimize or prevent intentional adulteration related to terrorism are effective and implemented as intended. We also requested comment about whether there are other approaches that would be more suitable to address intentional adulteration related to terrorism. In the following paragraphs, we discuss the comments that disagree with, or request changes to, the proposed approach. After considering these comments, we are continuing to require an approach based on an analysis of hazards/vulnerabilities and the implementation of measures to mitigate the identified hazards/vulnerabilities (a HACCP-type approach); however, we are providing for additional flexibility, as requested. (Comment 1) Some comments state food defense and food safety require different approaches because they are different disciplines. The comments explain that the science is different, that food safety deals with known and identifiable risks whereas food defense deals with unknown, often unidentifiable, and ever changing threats and that food safety risks can be prevented or reduced to an acceptable level but food defense threats only can be mitigated. The comments conclude that regulatory requirements addressing food defense must reflect these key differences between food defense and food safety and use different terminology. Some comments state that FSMA does not require a preventive controls approach for food defense, and a traditional HACCP approach is too rigorous and prescriptive for food defense. Conversely, other comments support regulatory requirements for food defense that are based on the proactive approach found in HACCP, specifically HACCP concepts related to analyzing problems and devising appropriate solutions. (Response 1) We disagree that food safety and food defense require entirely different approaches to ensure that food is not adulterated. We agree that there are important, specific differences between food safety and food defense, and these differences require different requirements for particular components of the approaches. However, we believe that food safety and food defense are more similar than they are different. For both food safety and food defense, the framework for preventing adulteration, whether it is intentional or unintentional, is the same: (1) An analysis is needed to identify the hazards for which measures should be taken to mitigate the hazard; (2) appropriate measures must be identified and implemented; and (3) management components are needed to ensure systematically that the measures are functioning as intended. This is the foundation of the HACCP approach, and we continue to believe this approach is appropriate for food defense as well as food safety. In food defense terms, the three elements are as follows: (1) A vulnerability assessment is needed to identify significant vulnerabilities; (2) mitigation strategies must be identified and implemented; and (3) mitigation strategy management components are needed to ensure systematically that the mitigation strategies are functioning as intended. See the proposed rule (78 FR 78014 at 78025) for a discussion of how the hazard analysis/preventive control model is consistent with a vulnerability assessment/mitigation strategy model. We agree that the nature of the hazards being analyzed for food safety and food defense purposes are different, but we disagree that this means they need a different analytical approach. As discussed more in the responses to Comment 71 and Comment 72, the vulnerabilities considered for food defense, while not as predictable as some food safety hazards, lend themselves to analytical assessment because they have commonalities that would make them attractive to an attacker, particularly an inside attacker. In this rule, we are focusing on preventing the actions of an inside attacker. Our interactions with the intelligence community, as well as the conclusions reached during vulnerability assessments conducted in collaboration with industry, have identified the inside attacker as the highest threat. Though FDA is not aware of any information that points to an imminent, credible threat to the food supply, achieving public health harm through an attack via food remains an advocated option for terrorist groups (Ref. 4). Additionally, recent events have shown a general evolution in terrorist activity away from large, centrally planned attacks to attacks that are locally planned and implemented. These locally planned attacks may be conducted by assailants inspired by terrorist groups but who otherwise have no formal connection to, or regular contact with, a terrorist organization (Ref. 5, 6, 7). Moreover, recent attacks indicate that terrorist groups are adept at responding to protections put in place to harden certain targets and will evolve their thinking toward less-protected targets. Given the potential for wide scale public health harm from intentional adulteration of the food supply, we believe that a comprehensive, systematic approach, such as a HACCP-type approach, is the most appropriate one and is not too rigorous. Further, as an example of what can happen when someone intending harm has inside access, in December 2013 a contract employee at Aqlifoods (a subsidiary of Naruha Nichiro Holdings, Japan's largest seafood company), intentionally adulterated several frozen foods with the pesticide malathion. Japanese authorities believe the assailant brought malathion to the plant and injected it into frozen foods during the manufacturing process (Ref. 8). The employee exploited his access to the food prior to packaging to introduce the agent. The adulteration resulted in at least 2,843 mild foodborne illnesses and a recall of 6.4 million packages of frozen seafood (Ref. 9). Though this assailant was most likely trying to harm the company and not trying to cause massive public health harm, this example indicates the damage that can be done by an inside attacker. Section 103 of FSMA reflects a Congressional determination that the “hazard analysis and risk-based preventive controls” approach is appropriate for food defense. Section 103 directs us to promulgate a framework for intentional adulteration that includes concepts that are similar to those in HACCP. Section 103 of FSMA contains requirements applicable to the owner, operator, or agent in charge of a facility required to register under section 415 of the FD&C Act. Section 103(a) of FSMA is a general provision that requires the owner, operator, or agent in charge of a facility to evaluate the hazards that could affect food manufactured, processed, packed, or held by the facility, identify and implement preventive controls, monitor the performance of those controls, and maintain records of the monitoring. Section 103(a) specifies that the purpose of the preventive controls is to “prevent the occurrence of such hazards and provide assurances that such food is not adulterated under section 402 [of the FD&C Act] or misbranded under section 403(w) [of the FD&C Act]. . . .” In addition to the general requirements in section 418(a) of the FD&C Act, sections 418(b)-(i) contain more specific requirements applicable to facilities. These include hazard analyses for both unintentionally and intentionally introduced hazards (section 418(b)(1)(2)), preventive controls for both unintentionally and intentionally introduced hazards (section 418(c) (1)(2)), monitoring (section 418(d)), corrective actions (section 418(e)), verification (section 418(f)), recordkeeping (section 418(g)), a written plan and documentation (section 418(h)), and reanalysis of hazards (section 418(i)). Therefore, we believe that FSMA directs us to take a “preventive controls approach” for food defense, as well as food safety. We agree that, while the regulatory approaches for food defense and food safety fundamentally should be similar, there need to be differences in how the approach is implemented for food defense. We do not agree that a HACCP-type approach is too prescriptive in general for food defense, but additional flexibility is needed in the application of the approach for food defense given the difference in the nature of the potential adulteration and the implementation of mitigation strategies that are not likely to be process-oriented or readily lend themselves to validation. We also agree that differences in terminology are appropriate. (See responses to Comment 2, Comment 45, and Comment 47.) (Comment 2) While some comments acknowledge that section 103 of FSMA directs us to promulgate a framework for intentional adulteration that includes concepts that are similar to those in HACCP, these comments also request that we provide more flexibility than a traditional HACCP framework, with specific requests for flexibility in the management components of monitoring, corrective actions, and verification. (Response 2) We agree that the intentional adulteration regulatory framework should provide more flexibility than that of a traditional HACCP approach. We believe there are key disciplinary differences between food safety and food defense that argue for additional flexibility in the intentional adulteration framework. Most significantly, improper implementation of preventive controls is more likely to result in adulterated food than is improper implementation of mitigation strategies. Preventive controls are more likely to be process-oriented and lend themselves to being scientifically validated. Mitigation strategies are more likely to be implemented to reduce physical access to a point, step, or procedure, and/or reduce the opportunity for an attacker to successfully contaminate the food and, in most instances, do not lend themselves to scientific validation. These differences indicate a need to apply the concepts of the HACCP approach in a more flexible manner for food defense. Recognizing the differences in the likelihood of adulteration and the differences in mitigation strategies compared to the process-oriented preventive controls, the intentional adulteration corrective actions requirements contain neither provisions for the evaluation of all affected food for safety in the event a corrective action is required nor provisions for unanticipated corrective actions (see § 121.145). Further, the intentional adulteration verification requirement does not contain provisions for validation, calibration, product testing, environmental monitoring, review of records for calibration, testing, or supplier verification (see § 121.150). We believe this more flexible approach for food defense is appropriate and adds flexibility compared to the provisions of the PCHF final rule. We also have added flexibility to the identification of mitigation strategies similar to the flexibility added to the identification of preventive controls in the PCHF final rule (80 FR 55908 at 56020). Although each facility subject to this rule must prepare and implement a food defense plan, the mitigation strategies that the facility would establish and implement would depend on the facility, the food, and the outcome of the facility's vulnerability assessment to identify actionable process steps (§§ 121.130 and 121.135). For examples of this added flexibility related to mitigation strategies, see the discussion in section V.C. As requested in comments, we also have changed regulatory text to reflect the inclusion of more flexibility in monitoring, corrective actions, and verification (see §§ 121.138, 121.140, 121.145, and 121.150 and discussed in more detail in the relevant sections later in this document). These changes are similar to those made in the regulatory text for preventive controls management components. As we have concluded that similar regulatory approaches are appropriate for both food safety and food defense, we have adopted the flexibility included in the PCHF final rule management components regulatory text, as appropriate for these intentional adulteration requirements. The intentional adulteration provisions for mitigation strategies management components make clear that mitigation strategies management components are required as appropriate to ensure the proper implementation of each such mitigation strategy, taking into account the nature of the mitigation strategy and its role in the facility's food defense system, and we have added § 121.138 to reflect this change. Likewise, the provisions for each of the individual mitigation strategies management components ( i.e., food defense monitoring, food defense corrective actions and food defense verification) individually provide flexibility, either by specifying that the provisions apply as appropriate to the nature of the mitigation strategy and its role in the facility's food defense system ( i.e., for food defense monitoring and food defense verification) or as appropriate to both the nature of the mitigation strategy and the nature of the significant vulnerability ( i.e., for food defense corrective actions) (see §§ 121.140, 121.145, and 121.150). For additional discussion of the flexibility added for the mitigation strategies management components, see sections V.E, V.F, and V.G and in particular the responses to Comment 88, Comment 89, Comment 90, Comment 92, Comment 93, and Comment 95. (Comment 3) Some comments state that the intentional adulteration proposed HACCP approach is “one size fits all.” (Response 3) We disagree. The intentional adulteration requirements to conduct a vulnerability assessment to identify actionable process steps, identify and implement mitigation strategies, and use mitigation strategies management components provide significant flexibility, are tailored to the facility and its processes, and are therefore not “one-size-fits-all.” Although each facility with significant vulnerabilities is required to identify and implement mitigation strategies, the mitigation strategies that the facility would establish and implement would depend on the facility, the food, and the outcome of the facility's vulnerability assessment (§§ 121.130 and 121.135). In addition, the mitigation strategies management components ( i.e., food defense monitoring, food defense corrective actions, and food defense verification) that a facility would establish and implement for its mitigation strategies would be established as appropriate to ensure the proper implementation of the mitigation strategies, taking into account the nature of each such mitigation strategy and its role in the facility's food safety system (§ 121.138). (Comment 4) Some comments state that management and oversight activities of mitigation strategies should occur if they are “appropriate” (suitable for a particular purpose or capable of being applied) and “necessary” (taking into account the nature of both the significance of the vulnerability and the particular mitigation strategy) for food defense. (Response 4) We agree that mitigation strategies management components of the HACCP-type framework should occur if they are appropriate and necessary. As we have concluded that similar regulatory approaches are appropriate for food safety and food defense, we have adopted the flexibility included in the PCHF final rule management components regulatory text (§ 117.140(a)), as appropriate for these intentional adulteration requirements. The intentional adulteration provisions for mitigation strategies management components make clear that mitigation strategies management components are required as appropriate to ensure the proper implementation of the mitigation strategies, taking into account the nature of each such mitigation strategy and its role in the facility's food defense system, and we have revised proposed requirements for monitoring, corrective actions, and verification to reflect these changes (see §§ 121.138, 121.140, 121.145, and 121.150). (Comment 5) Some comments state that the requirement for the amount of paperwork associated with a HACCP-type approach, and the information contained therein, may be counterproductive to the goal of mitigating or preventing vulnerabilities because individuals or groups interested in conducting these types of attacks may try to access this information. (Response 5) We disagree. A written food defense plan and its required contents, which include the vulnerability assessment, the identification and implementation of mitigation strategies, and mitigation strategies management components, are essential to significantly minimizing or preventing significant vulnerabilities related to intentional adulteration of food, where the intent of the adulteration is to cause wide scale public health harm. The required documentation of the plan and implementation of the plan are necessary so that both the facility and FDA can ensure that the significant vulnerabilities are being addressed properly. We encourage facilities covered by this rule to adequately protect food defense plans and associated information and records. For a more detailed discussion related to protecting food defense plan information, see section VI.F. (Comment 6) One comment disagrees with the HACCP framework, and requests we use a current good manufacturing practice (CGMP) approach. This comment states that such an approach provides facilities with sufficient flexibility to address intentional adulteration. Another comment supports using a HACCP approach in the context of allowing facilities to utilize prerequisite programs. (Response 6) We disagree that a CGMP approach is the most appropriate approach. We address the appropriateness and flexibility of the HACCP-type approach in responses to Comment 1 and Comment 2. We address the potential to consider pre-existing activities while conducting a vulnerability assessment and identifying and implementing mitigation strategies in Response 72 and Response 83. We are requiring a HACCP-type approach rather than a CGMP-type approach for several reasons. First, the management components in a HACCP-type approach are the most effective means, as discussed in the response to Comment 1, of ensuring that the mitigation strategies are consistently applied. Second, as with food safety, there are hazards (or in food defense terms, vulnerabilities) that warrant requirements that are more rigorous than general, non-targeted CGMP provisions. The vulnerabilities that warrant such requirements are those that we have concluded are the highest risk, namely intentional adulteration conducted at actionable process steps, including those vulnerabilities associated with an inside attacker, intended to cause wide scale public health harm. It is precisely these attacks at these points that require the most robust and rigorous system to ensure that vulnerabilities are assessed, significant vulnerabilities are identified, and mitigation strategies are properly implemented to reduce these significant vulnerabilities. General, non-targeted CGMP requirements ( e.g., restricting access to outsiders) would not necessarily focus on the significant vulnerabilities or ensure that mitigation strategies are implemented to harden the potential targets. Finally, section 418 of the FD&C Act requires that hazards intentionally introduced be addressed in a HACCP-type framework. (Comment 7) One comment asserts that because we already have required food safety plans for facilities under a separate rulemaking, and because an act of intentional adulteration of food that would cause wide scale public health harm is not likely to occur, a separate food defense plan, and thus this rule, is not necessary. (Response 7) We disagree. Although it is true that most facilities covered by this rule will also have a food safety or HACCP plan, the focus of those plans is on preventing the contamination of food from hazards that are unintentionally introduced and, therefore, the control points and the measures implemented in those plans differ from those in a food defense plan. It is unlikely that a facility would choose preventive controls under the PCHF final rule that would be sufficient to address vulnerabilities to intentional adulteration. For example, it is unlikely that a facility conducting a hazard analysis would identify the step of holding a liquid, such as a syrup, in a tank in a facility as a hazard requiring a preventive control. In conducting a hazard analysis, the facility would likely be considering whether there are hazards associated with the incoming syrup or ingredients for the syrup or the syrup production process (inadequate heating), but would not likely identify the step of holding the syrup as requiring a preventive control. However, in a vulnerability assessment, the step of holding liquid syrup may be identified as a significant vulnerability if (1) there would be significant public health consequences if a contaminant were added, (2) there is access to the product while being held, and (3) an attacker would be able to successfully contaminate the product. With regard to the statement that an act of intentional adulteration is not likely to occur, we agree that the likelihood of an incident is low. However, given the potential for a successful intentional adulteration of food to cause wide scale public health harm, it is prudent for the largest facilities to take preventive measures, and it is required by sections 418 and 420 of the FD&C Act that they do so. B. One Set of Requirements Under Sections 418 and 420 of the FD&C Act (Comment 8) One comment asserts that the proposed rule blends sections 103 and 106 of FSMA into one set of requirements and disagrees with that approach. The comment states that section 103 requires basic foundational food defense activities, including food defense plans at all registered food facilities. The comment contrasts this with section 106, which it states provides FDA with the authority to designate certain foods as “high risk,” and to require certain escalated food defense activities for those foods. The comment asserts that FDA should designate foods as “high risk” based on real-time actionable intelligence of a credible threat. The comment acknowledges that section 103 of FSMA does not apply to facilities required to comply with the seafood HACCP program, the juice HACCP program, or the dietary supplement CGMPs, but because none of these regulations address food defense programs, the comment asserts the Agency can use other legal authority to require these food facilities to have food defense programs. (Response 8) The final rule requires “basic foundation[al] food defense activities” as well as providing for “escalated food defensive activities” where warranted. To provide for foundational food defense, the rule requires a food defense plan ( i.e., a vulnerability assessment, mitigation strategies, and procedures for food defense monitoring, corrective actions, and verification) and associated actions. These requirements are the minimum measures necessary to provide assurances that hazards that relate to intentional adulteration intended to cause wide scale public health harm will be significantly minimized or prevented. Weakening these provisions, such as by eliminating the requirement to implement mitigation strategies to address significant vulnerabilities at each actionable process step, would result in food defense measures inadequate to address the threat of an inside attacker. As discussed in response to Comment 1, our interactions with the intelligence community, as well as the conclusions reached during vulnerability assessments conducted in collaboration with industry, have identified an inside attacker as the highest threat. Further, the suggested approach would place too much reliance on FDA having real-time actionable intelligence of a credible threat. As discussed in the responses to Comment 11 and Comment 12, there are a number of limitations to this approach. FDA may not receive specific, real-time, credible threat intelligence. Further, rapidly communicating even specific, actionable information to the food industry so that it is received by all of the relevant facilities would present challenges. Although some facilities may be able to identify some or all actionable process steps and implement mitigation strategies within a short timeframe, many other facilities would not be able to identify and implement the necessary mitigation strategies and the mitigation strategies management components ( e.g., food defense monitoring, corrective actions, verification) within the short time period that could be required in the event of a credible threat. In addition, taking action only in the event of a credible threat may not be sufficient to prevent wide scale public health harm. Measures taken after the threat is known may not be sufficient to prevent an attack if the intelligence does not provide enough specific information, such as the food product, contaminant, point of attack in a facility, and geographic location of an attack. Because the vulnerability assessment identifies the specific foods at specific process steps at greatest risk, it also serves to identify those foods that must be protected against intentional adulteration under section 420. Having one set of requirements for food defense measures helps ensure that the significant vulnerabilities will be significantly minimized or prevented and addressed consistently across sections 418 and 420 (see section 418(c)(2)). Further, as suggested by the comment, the rule provides for escalated food defense activities when necessary. Specifically, § 121.157(b)(4) requires reanalysis of a food defense plan (which could lead to the identification of additional needed mitigation strategies) whenever FDA requires it to respond to new vulnerabilities or credible threats to the food supply. (Comment 9) One comment asserts that the proposed combination of provisions under sections 418 and 420 of the FD&C Act has created complexity that could be eliminated by removing acts intended to cause massive public health harm from section 418 and covering them solely under section 420. The comment further asserts that although section 418 includes “acts of terrorism” within the hazard analysis, Congress did not intend to add this level of complexity to the rule and create new work that is inconsistent with materials previously created to address food defense. Further, the comment states that it appears these new requirements were included in the rule as a consequence of the statutory language rather than to reduce risk. The comment states that one key difference between sections 418 and 420 is that section 418 requires the facility to identify hazards related to intentional adulteration while section 420 requires FDA to identify vulnerabilities that could result in serious adverse health consequences. The comment asserts that due to the confidentiality of information that serves as the basis for the FDA vulnerability assessments, it would be more appropriate for FDA to perform the assessment for acts that could cause massive public health harm and for the facility to perform a vulnerability assessment for other types of intentional adulteration that may be specific to a facility and are outside of the FDA's vulnerability assessment. (Response 9) FDA believes that a single unified set of requirements ( i.e., this rule) is more clear and less complex than dividing the types of intentional adulteration covered by this rule into two categories with two sets of requirements, as suggested by the comment. It is not clear what would be covered under section 418 if it applied only to “other types of intentional adulteration that may be specific to a facility,” as suggested by the comment. Further, we do not believe the provisions of the rule are inconsistent with our current guidance; rather, they are more comprehensive and robust. FDA believes that these new requirements will reduce risk beyond what is contained in our current guidance documents. Our guidance documents mainly focus on assessing vulnerabilities and identifying mitigation strategies, but do not include recommendations for mitigation strategy management components. We believe the management components (part of a HACCP-type framework) are critical to ensuring that any hazards that relate to intentional adulteration intended to cause wide scale public health harm will be significantly minimized or prevented. Further, the confidentiality of vulnerability assessments that FDA conducted is not a barrier to a facility conducting a vulnerability assessment under this rule. The key activity types that FDA has identified were derived from FDA's vulnerability assessments and using key activity types to conduct a vulnerability assessment remains a permissible option under the final rule. In addition, as recognized by the comment, section 418 explicitly applies to “acts of terrorism.” Specifically, 418(b)(2) requires that a hazard analysis identify and evaluate hazards that may be intentionally introduced, including by acts of terrorism. Further, section 418(i) authorizes FDA to require a reanalysis to respond to new hazards including, as appropriate, results from terrorism risk assessments. Generally, acts of terrorism involving the food supply would be committed with the intention to cause wide scale public health harm. Therefore, they are clearly covered by section 418. (Comment 10) Some comments suggest that FDA require a hybrid approach where all facilities subject to section 103 are required to conduct a vulnerability assessment and develop and implement a basic food defense plan. Under the hybrid approach, if a credible threat is identified, then section 106 would serve as an escalation provision and allow FDA to designate specific food(s) associated with the credible threat as “high risk.” Comments suggest that FDA could then require facilities with these high risk foods to reassess their food defense plans and implement appropriate mitigation strategies that FDA may specify to address the threat. Comments argue that if all potential mitigation strategies need to be identified through the vulnerability assessment and are managed in the absence of actionable intelligence of a credible threat, then there is no ability to escalate the plan with respect to certain mitigation strategies when needed. (Response 10) FDA agrees with the comment in part. As discussed in response to Comment 8, this rule requires facilities to conduct a vulnerability assessment and develop and implement foundational food defense activities. Further, the rule provides a mechanism which serves a similar function to the “escalation provision” described in the comment. Specifically, under § 121.157(b)(4), FDA can require facilities to reassess their food defense plans, which could trigger a requirement to implement additional mitigation strategies. FDA disagrees that the rule requires “all potential mitigation strategies” to be identified and managed. We believe we have appropriately balanced the need to provide assurances that hazards associated with intentional adulteration are being prevented with the low likelihood of a successful attack on the food supply. The rule does not mandate specific mitigation strategies be implemented at actionable process steps but rather allows strategies to be tailored to the facility and its procedures. We also disagree that there is “no ability to escalate the plan with respect to certain mitigation strategies.” In response to a credible threat involving a specific agent, a covered facility could reanalyze its food defense plan with specific focus on the relevant agent. The facility then could implement specific mitigation strategies to counter this threat (such as processing changes, product testing, or other appropriate measures) that are not currently required by the rule. C. Require Measures Only in the Event of a Credible Threat In the proposed rule, we sought comment on whether it would be feasible to require measures to protect against intentional adulteration only in the event of a credible threat. We also sought comment on whether such an approach would be consistent with the intentional adulteration provisions of FSMA and how such requirements would be communicated to industry in a timely and actionable manner. Many comments agree with the requirements as proposed that measures to protect food against intentional adulteration be required even in the absence of a credible threat but some comments support requirements only in the event of a credible threat. Some comments assert that FDA has the tools available in the Registration of Food Facility database to establish a communications protocol to notify industry if there is a credible threat. A few comments express concern over the difficulty of developing and implementing food defense plans in a timely manner in the event of a credible threat. In the following paragraphs, we discuss these comments and our responses. After considering the comments, we have revised the regulatory text in § 121.157(b)(4) to include specific language that provides for FDA to require facilities to conduct a reanalysis of their food defense plans to, among other things, respond to credible threats to the food supply. (Comment 11) Some comments state that this rule should only go into effect in the event of a credible threat. One of these comments argues that the oilseed processing industry that they represent has never been the target of attacks or threats and therefore they are unlikely targets for intentional adulteration and should be exempted from the rule unless there is a credible threat against a facility or industry as a whole. (Response 11) We disagree with these comments. The fact that the oilseed processing industry and other food industry sectors have not been attacked in the past does not mean that these industry sectors will never be attacked. Nor does it mean that preventive mitigation strategies are unnecessary. As discussed in response to Comment 8, taking action only in the event of a credible threat may not be sufficient to prevent wide scale public health harm. (Comment 12) Some comments encourage FDA to collaborate with the U.S. Department of Homeland Security (DHS), the Federal Bureau of Investigation (FBI), and other Federal and State Agencies to ensure that the relevant stakeholders of the food industry are notified in a timely manner upon discovery of a credible threat. These comments discuss that alerting the food industry to known credible threat information would be valuable because there may be additional mitigation strategies that could be put into place when there is a threat. The comments further explain that having such knowledge would allow for industry stakeholders with specific, technical knowledge of their products, equipment and plant security to better collaborate and support the efforts of law enforcement. Some comments recommend that we establish and formalize a mechanism and process to communicate credible threat information to relevant stakeholders in industry and that the Food Facility Registration database could help facilitate this. The comments also recommend that we conduct exercises to test this mechanism so that all stakeholders are aware of the established communications process and can make adjustments and improvements as necessary. Several comments recommended that we convene a panel of industry stakeholders annually to discuss threat intelligence at the “Secret” level. (Response 12) We concur with the recommendation that we should collaborate with our Federal and State Agency partners on the discovery and communication of credible threats in a timely manner. Currently, FDA regularly meets and communicates with DHS, FBI, the U.S. Department of Agriculture (USDA), and State and local Agency partners through the Food and Agriculture Sector Government Coordinating Council (GCC) to discuss food defense issues and research activities and introduce new initiatives for mutual evaluation, implementation, and education. FDA's Office of Criminal Investigations (OCI) works closely with the FBI and other Agencies on a regular basis on threats against FDA-regulated products, including food. We also agree that notifying relevant stakeholders within industry of credible threats is essential to protecting the food supply. The Food and Agriculture Sector GCC and Sector Coordinating Council (consisting of private sector members) hold in-person joint meetings twice a year and, when needed, classified meetings at the “Secret” level are held to exchange information. As we move towards implementing this rule, we will continue to work with our partners—both in government and the private sector—to include them in discussions regarding communicating credible threat information. (Comment 13) One comment states that the term “credible threat” is not adequately defined in the proposed rule, nor is the relationship between a “credible threat” and a “reasonably foreseeable hazard” adequately described. The same comment also notes that because the term “credible threat” is commonly used to discuss sensitive or classified information, the use of the term may place an unrealistic expectation for sharing of sensitive or classified threat information between government agencies and the private sector. The comment suggests either removing the term “credible threat” from the rule or including a definition with an explanation of the mechanism for sharing information about credible threats with the food industry. (Response 13) We disagree with this comment and decline the request to include a definition for credible threat. It is not possible to identify with precision what constitutes a credible threat. There are many factors to consider in regards to how, what, when, or why those who intend to cause harm may take action. As such, it is not possible to write a definition for credible threat that is neither so broad that it covers potentially any piece of intelligence, nor so narrow that it is unnecessarily limiting. FDA routinely works with other agencies to maintain situational awareness of potential threats to the food supply and will consider that information in determining whether intelligence rises to the level of a credible threat. Within the context of protecting food against intentional adulteration with the intent to cause wide scale public health harm, we see no direct relationship between a “credible threat” and a “reasonably foreseeable hazard.” “Known or reasonably foreseeable hazard” is defined in the PCHF final rule to mean a biological, chemical (including radiological), or physical hazard that is known to be, or has the potential to be, associated with the facility or the food. We do not use the phrase “reasonably foreseeable” within the context of intentional adulteration because it does not apply. We acknowledge that there will be challenges to sharing sensitive or classified threat information between government agencies and the private sector. That is one of several reasons that we are not making the requirement for mitigation strategies dependent on a particular credible threat. In the event such information was to become known, FDA intends to work with its government partners to determine the appropriate course of action. (Comment 14) Some comments recommend that in the event of a credible threat, a facility could conduct a reassessment or reanalysis of its food defense plan so that it could better tailor its mitigation strategies to the threat. Some comments recommend that FDA revise the regulatory text within proposed § 121.150 for reanalysis to require facilities to reassess their food defense plans when the Agency has actionable intelligence of a credible threat of intentional adulteration. (Response 14) In the proposed rule, we describe that we may require a reanalysis of the food defense plan in the event of a credible threat. However, this was not specifically stated within the regulatory text. Therefore, we have revised § 121.157(b)(4) to provide that reanalysis may be required by FDA to respond to credible threats to the food supply. We did not see the need to include “actionable intelligence” in the regulatory text because we believe that “credible threat to the food supply” implies a threat that also requires actionable intelligence. D. General Comments on Implementation and Compliance We received a substantial number of comments with regard to how the Agency will implement this rule. Many comments focused specifically on the need for inspectors to be provided food defense training to enable them to make informed decisions during inspections and compliance activities. Another issue raised by many comments is that the Agency should make available guidance resources, tools, training, and other information to help facilities comply with the final rule. In the section that follows, comments related to implementation and compliance are discussed. (Comment 15) Some comments state that existing regulatory inspections should include evaluation of the intentional adulteration rule requirements for the best use of time and resources. (Response 15) FDA is currently considering the best approach for structuring and conducting food defense inspections. We recognize that inspections require resources from facilities and recognize that some facilities may prefer that food defense inspections be conducted as part of an inspection for other regulatory programs, such as preventive controls for human food. We will consider this when developing our enforcement strategy. (Comment 16) Some comments express concern about the level of training that will be needed for inspectors. These comments state that the inspectors must be trained specifically on food defense and that FDA should be transparent about the training that we provide the inspectors. Comments emphasize the importance that FDA provide specialized training to ensure consistent compliance and enforcement activity by the Agency. (Response 16) FDA understands and agrees with comments that state that training for inspectors conducting food defense inspections is critical to a consistent and adequate inspection, compliance, and enforcement system. We agree with the comment that specialized training in food defense will be required for inspection and compliance staff to evaluate a facility's compliance with this rule. FDA has begun the process of assessing its training needs for inspectors on food defense. It is our intention that training provided to our inspection and compliance staff will be consistent with that training for industry that will be provided by the Intentional Adulteration subcommittee organized within the Food Safety Preventive Controls Alliance (see Comment 105) to facilitate consistent implementation of this rule. This strategy is consistent with the other FSMA food safety regulations and training strategies. (Comment 17) Some comments state that inspections should have a “big picture” focus, and focus on the evaluation of the facility's vulnerability assessment. Additionally, comments state that this inspection should not compare the mitigation strategies used at other facilities to the facility being inspected. (Response 17) We agree. The rule is designed to provide flexibility such that facilities can select appropriate mitigation strategies that are best suited for their operations. FDA investigators will consider a facility's written explanations regarding identification of actionable process steps and selection of mitigation strategies when evaluating a food defense plan to understand a facility's rationale. In addition, we will work to educate industry before and while we regulate to assist industry to gain and maintain compliance with the rule. (Comment 18) Some comments request that FDA not cite food defense-related items on FDA's Form 483 until the facilities and inspectors learn about compliance with the intentional adulteration rule. Additionally, some comments state concerns about FDA including potentially sensitive information from food defense plans when citing food defense-related items on Form 483. (Response 18) FDA is currently in the process of developing its inspection and compliance strategy for the intentional adulteration rule and an important part of this strategy development will include methods and processes for information exchange with regulated industry. We recognize that food defense inspections could include evaluation of sensitive information, including vulnerability assessments and mitigation strategies. For a more detailed discussion on how FDA will protect food defense-related information, see section VI.F, Public disclosure. (Comment 19) Some comments request that FDA include State departments of agriculture in the process to develop and implement inspection and compliance programs. (Response 19) As mentioned previously, FDA is currently in the process of developing its inspection and compliance strategy for the intentional adulteration rule. FDA's implementation working group for this rule includes representation from State partners, and State partners will continue to play an essential and collaborative role throughout the process. (Comment 20) Several comments state that an alliance would be beneficial for the implementation of the intentional adulteration rule. (Response 20) Training alliances have played an important role in facilitating industry compliance with many regulations in the past. We agree with the comment and are in the initial stages of organizing and establishing the Intentional Adulteration subcommittee within the Food Safety Preventive Controls Alliance operated out of the Institute for Food Safety and Health at the Illinois Institute of Technology. We anticipate the Intentional Adulteration training subcommittee will assist industry compliance with this final rule by supporting the development and dissemination of training resources. We further anticipate that the curriculum developed through the Intentional Adulteration subcommittee will form the basis of training for regulators as well. (Comment 21) Some comments state that equal enforcement of this rule across companies domestically and globally may require FDA to adopt different enforcement mechanisms. (Response 21) We intend to enforce this rule in a consistent manner with regard to imported and domestically produced foods. FDA is currently in the process of developing its inspection and compliance strategy, including how facilities will be selected for inspections and how inspections will be conducted for both domestic and foreign facilities. Further, we intend to engage in significant outreach activities—both domestically and internationally—to facilitate industry compliance with this rule and to communicate the Agency's current thinking on inspection, compliance, and enforcement strategies. Additionally, we intend to develop fact sheets, FAQ documents, guidance documents, and other informational materials as needed to support domestic and foreign industry compliance with the rule. (Comment 22) Several comments recommend that food defense activities conducted under programs, such as the Department of Homeland Security's (DHS) Customs-Trade Partnership Against Terrorism (C-TPAT) and mutually recognized international programs, the Chemical Facility Anti-Terrorism Standards (CFATS), the USDA Food Safety and Inspection Services (FSIS) food defense plan template, should be recognized as meeting the requirements of this rule. Several comments state that there are global food safety schemes that include food defense requirements which could be leveraged in inspections and implementation. Comments suggest that audits and private certifications done under these food safety schemes should be sufficient for meeting the requirements of this rule. (Response 22) We disagree. The programs identified by comments are not sufficient to substitute for compliance with this rule. For example, they do not require mitigation strategies at all actionable process steps and therefore are not sufficient to significantly minimize or prevent intentional adulteration intended to cause wide scale public health harm. Further, even if currently they were sufficient for compliance for this rule, they could change at any time. C-TPAT is a voluntary supply-chain security certification program led by U.S. Customs and Border Protection (CBP) that focuses on private companies (including food companies) implementing anti-terrorism measures to protect their supply chains. When companies join C-TPAT, they sign an agreement to work with CBP to identify supply chain security gaps and implement specific security measures and best practices. CBP has found that the security standards of some foreign industry partnership programs are similar to those of the C-TPAT program. CFATS is a DHS program which regulates high-risk chemical facilities to ensure they have anti-terrorism measures in place to reduce risks associated with the storage and use of these high-risk chemicals. Any facility that possesses “chemicals of interest,” as identified by DHS, in certain quantities is considered a covered facility that must meet some or all of the requirements under CFATS. Some agriculture and food facilities are subject to CFATS requirements. Covered chemical facilities are required to prepare Security Vulnerability Assessments that identify facility security vulnerabilities and to develop and implement Site Security Plans that identify measures that satisfy risk-based performance standards. These risk-based performance standards focus on physical security of the chemicals. Although both CFATS and C-TPAT programs address some of the security concerns related to some food facilities, neither program addresses the unique vulnerabilities associated with the food being manufactured, processed, packed or held at the facility. In general, voluntary security programs such as C-TPAT focus on global supply chain security measures involved in the transportation of goods from location to location. The CFATS program focuses on reducing risks related to chemicals, even in facilities that are mainly geared toward food production. In contrast, vulnerability assessments required by this rule require identification of significant vulnerabilities at discrete processing steps within a facility, where the intent of the attack is to cause wide scale public health harm by contaminating the food supply. Further, a vulnerability assessment must consider the threat stemming from an inside attacker. Once these significant vulnerabilities are identified, mitigation strategies are implemented at or near those most vulnerable processing steps. Given these differences, it is unlikely that facilities would be compliant with this rule were they to rely wholly on assessments and mitigation strategies conducted as part of other programs. The food defense plan template from USDA FSIS is voluntary for FSIS-regulated facilities, and is organized in four sections: (1) Outside Security Measures, (2) Inside Security Measures, (3) Personnel Security Measures, and (4) Incident Response Security Measures. The template focuses on a facility's physical security measures, which are analogous to recommended, but not required, facility wide security measures in this rule. FSIS-regulated facilities are encouraged to read and sign the template, adopt it as their food defense plan, and then implement, test, and maintain the plan. There are important similarities between the plan template and some requirements in this rule. For example, some security measures listed in the template are similar to some mitigation strategies included in the FDA Mitigation Strategies Database. The testing of the plan is somewhat similar to food defense monitoring. The plan template also suggests awareness training for employees, which is similar to a food defense awareness training requirement in this rule. The similarities reflect FDA and USDA collaboration on food defense activities for many years as discussed in the proposed rule (78 FR 78014 at 78021). However, food defense plans developed using the FSIS template would not meet all requirements of this final rule. Specifically, FSIS's food defense plan template does not include a vulnerability assessment of the points, steps, or procedures in a food process, nor does it include implementation of mitigation strategies specific to the vulnerable points. Additionally, the plan template does not include food defense monitoring, food defense corrective action, food defense verification, and some training required by this rule. In addition, we recognize that there are existing global food safety schemes that include food defense requirements and that many in the food industry have already adopted and implemented these requirements. For example, the Global Food Safety Initiative's (GFSI) Guidance Document Sixth Edition (Ref. 10) addresses food defense. Subsequently, many of the GFSI-recognized schemes include more specific food defense requirements. The Safe Quality Foods (SQF) Code, edition 7.1 is a process and product certification standard that specifies various food defense elements, including that the methods, responsibility, and criteria for preventing food adulteration caused by a deliberate act of sabotage or terrorist-like incident shall be documented, implemented and maintained (Ref. 11). Another example of industry standards that incorporate food defense elements is the International Featured Standards (IFS) Food Version 6 Standard, which specifies that areas critical to security be identified, food defense hazard analysis and assessment of associated risks be conducted annually or upon changes that affect food integrity, and an appropriate alert system be defined and periodically tested for effectiveness (Ref. 12). We recognize that some in the food industry have already voluntarily taken steps to incorporate and implement food defense measures; however, they are not adequate to substitute for meeting the requirements of this rule. Although participation with global food safety schemes and other programs administered by our Federal partners are not substitutes for compliance with this rule, we believe that participation in programs such as C-TPAT, CFATS, the use of the FSIS food defense plan template, or international programs granted mutual recognition status as that of C-TPAT, for example, decreases a facility's vulnerability to intentional adulteration and can work in concert with the requirements of the final rule. Additionally, a facility's participation in such programs may be considered by FDA as we prioritize risk-based inspections of facilities subject to the final rule. Further, we note that a facility may use existing records ( e.g., records that are kept as part of these other programs) to meet the requirements of this rule, if they contain all of the required information and, facilities may supplement existing records as necessary to include all of the information required by this rule (§ 121.330). (Comment 23) Some comments state that laws in the European Union currently require food facilities to take necessary measures to prevent intentional adulteration, and it is therefore not justified to request additional safety or security requirements for facilities subject to these laws. (Response 23) We disagree. This rule contains those measures FDA has determined are necessary to protect food against intentional adulteration. To the extent a facility is already taking actions that are required by this rule, a facility will have to make fewer changes to its operations. These security measures should be evaluated on a case-by-case basis to determine if they qualify as a mitigation strategy under this rule. (Comment 24) Some comments request that FDA focus on education over enforcement and use discretion during inspections. (Response 24) As FSMA as a whole is a substantial change in how FDA approaches regulating the food and agriculture sector, we recognize that significant outreach, education, and training will be required to facilitate industry compliance with all FSMA rules. As previously stated by the Agency, one of the guiding principles for implementing FSMA is that the Agency will educate before and while we regulate. This includes a focus on sector-specific guidance, education, outreach, and technical assistance for industry. The intentional adulteration rule implementation will include these efforts to ensure facilities gain understanding and awareness to comply with the rule. In addition, we are providing for a longer timeline for facilities to come into compliance, allowing for more outreach and dialogue with industry. Facilities, other than small and very small businesses, have 3 years after the effective date to comply with part 121. Small businesses ( i.e., those employing fewer than 500 full-time equivalent employees) have 4 years after the effective date to comply with part 121. Very small businesses ( i.e., businesses that have less than $10,000,000, adjusted for inflation, per year, during the 3-year period preceding the applicable calendar year in both sales of human food plus the market value of human food manufactured, processed, packed, or held without sale, e.g., held for a fee) have 5 years after the effective date to comply with § 121.5(a). (Comment 25) Some comments recommend that FDA update the Food Defense Plan Builder software tool to capture the elements of a food defense plan required by the final rule, such as monitoring, corrective actions, and verification. (Response 25) FDA plans to update existing tools and resources, including the Food Defense Plan Builder software, to assist industry with meeting the requirements for the final rule. (Comment 26) Several comments request that FDA periodically update its online tools and resources for companies to have access to information about broad mitigation strategies, although they are not required under the rule. (Response 26) FDA intends to publish guidance to support industry compliance with the final rule. This guidance will include information relevant to the required provisions of the final rule and also will likely include helpful information on facility-wide security measures as well as other best practices and recommendations to assist facilities in their development of a comprehensive food defense program. In addition, FDA has a number of tools and resources currently available on our Web site ( http://www.fda.gov/fooddefense ) that were developed for our voluntary food defense program that can assist industry. E. Comments on Requests for Additional Exemptions In the proposed rule we specifically requested comments on whether there are other ways in which the coverage of this regulation can be further focused on foods that present a high risk of intentional adulteration caused by acts of terrorism. In this document we discuss comments we received with specific recommendations on foods or activities to exempt from the rule. (Comment 27) Some comments assert that facilities engaged solely in cooling, holding, handling, packing, repacking, packaging and shipping of raw, intact fresh produce, similar to activities that may be performed on farms, are unlikely to be engaged in any of the key activity types and should be exempt from this rule. The comments describe activities conducted by these facilities, including application of fungicide, food grade wax coating, sorting and placing whole intact produce into boxes for shipping. The comments further state that whole intact produce would not be an attractive or feasible target for an act of intentional adulteration with the intent to cause wide scale public health harm, regardless of where the activities occur. (Response 27) We decline the requested exemption for facilities engaged solely in cooling, holding, handling, packing, repacking, packaging and shipping of raw, intact fresh produce. We recognize that some of these facilities may not have any significant vulnerabilities; however, some may. For example, packaging may be a significant vulnerability, depending on the degree of access to the food and the characteristics of the packaging area ( e.g., in a minimally trafficked area where individuals are working alone for extended periods of time, or if the product is being sprayed with fumigant or fungicide applications that may serve to apply a contaminant onto the food). Therefore, to determine whether any mitigation strategies are needed, each facility must conduct a facility specific vulnerability assessment that considers, at a minimum: (1) The potential public health impact if a contaminant were added ( e.g., severity and scale); (2) the degree of physical access to product; and (3) the ability of an attacker to successfully contaminate the product. Any of the activities described in the comments that are otherwise covered by existing exemptions do not need to be considered in the vulnerability assessment. For example, holding of foods other than in liquid storage tanks is exempt from the rule (§ 121.5(b)). Also, packing or re-packing of food where the container that directly contacts the food remains intact is exempt (§ 121.5(c)). If after conducting a vulnerability assessment, a facility appropriately concludes that it has no actionable process steps, the facility would not be required to implement mitigation strategies. The facility's food defense plan would include the vulnerability assessment, the conclusion that no actionable process steps are present, and an explanation for this conclusion at each step. In contrast, facilities with actionable process steps are required to implement mitigation strategies and the appropriate mitigation strategies management components. (Comment 28) One comment suggests that we exempt food additives used in low dosages. The comment asserts that “the dosage of food additives are approximately 0.01—1 percent of the total food, and the final amount of the food additive absorbed into the human body should be very small, roughly 1/100—1/10,000 of the total food consumed.” The comment further asserts that if a contaminant is added to a food additive used in low dosages, the risk to public health is very small. (Response 28) We decline this request. Our vulnerability assessments considered a number of factors when evaluating a product's vulnerability to acts of intentional adulteration and the potential public health consequences of such an act, including a wide variety of threat agents. Our vulnerability assessments concluded that there were situations where an act of intentional adulteration could still result in wide scale public health harm even if the dose of the adulterant were at or below the levels highlighted in this comment. Moreover, the concentration of a food additive in the finished product may vary depending on the nature of the product ( e.g., citric acid can be added to a food as a flavor enhancer in relatively low concentrations, or to other foods in higher concentrations as a color retention agent). (Comment 29) One comment recommends that we exempt production and packaging of food ingredients from the rule. The comment asserts that terrorist groups are more likely to attack finished food production than food ingredient production because they want the publicity associated with seeing the harm that their act causes. The comment further asserts that it may be months or years before a contaminated ingredient reaches consumers, and therefore it would not be a likely or attractive target for terrorists who want to make a more immediate impact. The comment also states that a contaminant can be degraded, inactivated, or destroyed in further processing or prolonged storage if it is added to an ingredient. The comment maintains that it is far easier to select an appropriate contaminant with some knowledge of what types of processing it will have to survive. The comment requests that, at a minimum, we exempt the production and packaging of food ingredients from requirements for focused mitigation strategies and make them subject only to requirements for broad mitigation strategies. (Response 29) We decline this request. As discussed in section IV.B.3, the rule now refers to “mitigation strategy” rather than “focused mitigation strategy.” Further, our vulnerability assessments concluded that an act of intentional adulteration could still result in wide scale public health harm even if the adulteration occurred during the production of an ingredient. Ingredients have many different distribution paths. Many ingredients can be sold in bulk to manufacturing facilities for inclusion in processed finished foods or be sold in consumer sized packaging for home use. Some ingredients can be used in later processing as a primary ingredient or as a secondary ingredient added in much lower volumes. In either case, the ingredient manufacturer could be an effective point for an attacker to achieve wide scale public health harm. (Comment 30) One comment supports our proposed exemption § 121.5(c) applicable to packing, repacking, labeling, or re-labeling of food where the container that directly contacts the food remains intact. The comment would like us to further exempt the transportation and holding of foods in retail packaged form from coverage under this rule. (Response 30) The holding of food, except for holding of food in liquid storage tanks, is exempt under § 121.5(b). Therefore, the holding of foods in retail packaged form is exempt from this rule. Furthermore, as explained in section III.G.1, transportation carriers are not included in the scope of this rule. (Comment 31) One comment requests that food gases be considered for an exemption for several reasons. The comment states that food gas containers are extremely difficult to breach. Further, the comment states that food gases may be stored in bulk storage tanks either during manufacture, or prior to containerization ( i.e., pressurized cylinders) or transport ( i.e., cryogenic tankers) but a person intentionally trying to contaminate the product during storage or transportation would require use and knowledge of specialized equipment that is not readily available. The comment argues therefore that food gases are not at high risk for intentional adulteration. In addition, the comment notes that there are several uses for food gases, such as processing aids ( e.g., freezing, chilling, pressure transfer) that will have minimal contact with the food provided to consumers, and whether used as a food additive or an ingredient the gas comprises a very small percentage of the final food product. (Response 31) We decline the request. The comment identifies that food gases may be stored in bulk storage tanks either during manufacture, or prior to containerization or transport. We recognize at some facilities manufacturing food gas may not have any significant vulnerabilities; however, each covered facility must conduct a facility specific vulnerability assessment, and that assessment must consider, at a minimum: (1) The potential public health impact if a contaminant were added ( e.g., severity and scale); (2) the degree of physical access to product; (3) the ability of an aggressor to successfully contaminate the product. The comment mentions that breaching food gas containers would require use and knowledge of specialized equipment that is not readily available. However, the vulnerability assessment must include consideration of an inside attacker, so this information may be available to such an individual. The comment also mentions that gases can be stored or transported in liquid form. Based on our vulnerability assessments, liquids storage and handling has been identified as potentially significantly vulnerable. Therefore, facilities manufacturing food gas would need to evaluate their manufacturing process through a vulnerability assessment. If after conducting a vulnerability assessment, the facility appropriately concludes that there are no actionable process steps in the facility, the facility would not be required to implement mitigation strategies. The food defense plan at this facility would include the vulnerability assessment, the conclusion that no actionable process steps are present, and an explanation for this conclusion at each step. (Comment 32) Some comments request that FDA exempt research and development (R&D) and pilot plants from the rule. These comments argue that a vulnerability assessment conducted at such a facility would in all likelihood conclude that there are no significant vulnerabilities due to the low volume of product produced, because such products are not typically for retail sale, and because of the narrow scope of consuming individuals, if any. (Response 32) We decline the request. We note that if food at an R&D facility is not for consumption, the facility is not required to register and would not be subject to this rule. Food processed at R&D facilities may be consumed as samples, distributed at special events, or may take other routes to public consumption. As with other facilities covered by the rule, it is possible, based on a facility specific vulnerability assessment, that an R&D facility may conclude that it does not contain any significant vulnerabilities. If, after conducting a vulnerability assessment, the facility appropriately concludes that it has no actionable process steps, the facility would not be required to implement mitigation strategies. The facility's food defense plan would include the vulnerability assessment, the conclusion that no actionable process steps are present, and an explanation for this determination at each step. In contrast, an R&D facility with actionable process steps is required to implement mitigation strategies and the appropriate mitigation strategies management components. F. Other General Comments (Comment 33) Some comments ask us to publish a revised proposed rule or an interim rule before proceeding to a final rule because of anticipated, significant changes resulting from comments that we received in response to the proposed rule. Some comments state that food defense is a new and evolving area without existing regulatory requirements or a long history of broadly accepted practices and that further substantive dialogue with industry is needed. Some comments state that a reproposal would serve the same purpose as an Advance Notice of Proposed Rulemaking which was FDA's stated intent prior to the imposition of judicial deadlines. Some comments state that because FSMA rules are dependent on one another, some proposed FSMA rules should be issued concurrently so that a concurrent evaluation and comment period may be conducted. Some comments state that industry must first get used to the new food safety regulations and then concentrate on new food defense regulations and believe reproposing at a later date will give industry a chance to comply with all the new regulations. (Response 33) We decline these requests. These revisions in the final rule more closely align the rule with many current food defense best practices and increase flexibility for facilities to comply. With regard to the suggestion that we should issue the FSMA foundational proposed rules simultaneously for comment, this was not feasible given our judicial deadlines for the seven rules (Ref. 13). We believe that stakeholders were given adequate opportunity to comment on the proposed rules, and we extended many comment periods. With regard to the comments that suggest we repropose this rule to give industry more time to comply, we have addressed this issue by extending the compliance dates by an additional 2 years (see section VIII). (Comment 34) One comment disagrees with the exemption for holding non-liquid bulk food. The comment asserts that most bulk foods, irrespective of their physical form, are likely to be mixed or blended at some point after receipt by the end-user ( i.e., the manufacturer or packager that will convert the bulk food into retail packaged food), and are likely to be processed into a much larger volume of finished food. Thus, the comment maintains that any contamination introduced into a bulk food during storage prior to its use in the preparation of a retail packaged food may affect a large volume of finished food and may thereby cause massive public health harm. (Response 34) As discussed in the proposed rule, based on an analysis of the vulnerability assessments that FDA has conducted using the CARVER+Shock methodology, we identified four key activity types (Bulk liquid receiving and loading; Liquid storage and handling; Secondary ingredient handling; and Mixing and similar activities) as production processes that require focused mitigation strategies. With the exception of the holding of food in liquid storage tanks, which is not included in the exemption, we are not aware of activities performed during the holding of food that fit within any of these four key activity types (see 78 FR 78014 at 78036). There is no likely way that a contaminant can be homogeneously mixed throughout a non-liquid bulk food during storage. We found in our vulnerability assessments that the potential for uniform distribution of a contaminant into the food is a major factor in elevating vulnerability. Since it is highly unlikely that an inside attacker would be able to evenly distribute a contaminant into a dry bulk ingredient during storage, the vulnerability associated with these steps did not rise to the level associated with the vulnerability associated with the key activity types. G. Other Issues Discussed in the Proposed Rule 1. Transportation Carriers In the proposed rule, we tentatively determined that there is a significant vulnerability to intentional adulteration during bulk liquid receiving and loading, one of the four key activity types included in the proposal as an option to identify actionable process steps. We did not identify receiving and loading of other types of foods ( e.g., non-bulk liquid, solid, gaseous) as key activity types because we determined through our vulnerability assessments that they do not present the same level of risk. Further, we tentatively concluded that requiring receivers and shippers of bulk liquids to implement mitigation strategies at actionable process steps involving loading and receiving of bulk liquid foods would significantly minimize or prevent the potential for intentional adulteration of these foods during transportation. Based on our vulnerability assessments, we proposed to require that mitigation strategies to ensure the integrity of food during transport would be implemented by facilities, rather than carriers. Where such measures are implemented by the shippers and receivers of bulk liquids, we tentatively concluded that the food would be sufficiently protected, and that no further actions by a carrier would be needed. For this reason, we did not propose to cover transportation carriers in the proposed rule. We requested comment on our analysis and tentative conclusion. Some comments agree with the tentative conclusion in the proposed rule to exclude transportation carriers. Some comments oppose this approach. In the following paragraphs, we discuss comments that disagree with the proposed approach. After considering the comments, we are finalizing the rule as proposed with regard to transportation carriers. (Comment 35) Some comments disagree with our conclusion that implementing mitigation strategies at the receiving and loading steps for bulk liquids will adequately protect food during transportation. Some comments argue that transport of food is one of the most vulnerable stages in a process, as food is not protected by a secure facility and may often be parked at a truck stop or other unsecure locations for extended periods of time which provides the opportunity for an attacker to gain access. One comment states that food shipments have consistently been documented as either the first or second most stolen truckloads on U.S. highways, and if terrorists were to use this mode of attack on the food supply, the result could be a major event for which we were not only unprepared, but for which we could have foreseen the risk. (Response 35) We disagree with these comments. Based on our vulnerability assessments, we determined that the most practical mitigation strategies to ensure the integrity of food during transport would be implemented by facilities, rather than by carriers. For example, to significantly minimize or prevent the product from being intentionally adulterated during transport, a shipper may elect to use seals to secure access points, such as doors or hatches, on the transport conveyance. The shipper seals the load prior to departure from its facility by using seals with unique identification numbers. The shipper includes the seal numbers on shipping documentation and transmits the seal numbers to the receiving facility. Once the shipment arrives at the receiving facility, the receiver would verify the seals are in place and that the identification numbers match. This mitigation strategy ensures the food was not accessible during transport. To ensure that the driver cannot exploit his position to gain access and intentionally adulterate the food during transport, the carrier has no role in the seal mitigation strategy. If seals are missing or the identification numbers do not match the shipping documentation, the receiving facility would reject the load and notify the shipper. Facilities are required to implement mitigation strategies that significantly minimize or prevent significant vulnerabilities associated with actionable process steps. Therefore, if a food operation has a significant vulnerability associated with transportation, the facility must choose a mitigation strategy or combination of strategies to significantly reduce the vulnerability at the receiving or loading step. Mitigation strategies implemented at inbound receiving and outbound shipping would work complementary to each other to protect the food during transport. For example, if the vulnerability assessment concludes that loading is an actionable process step because of a vulnerability during transportation, the facility would implement mitigation strategies to protect its outbound food from intentional adulteration ( e.g., sealing the bulk liquid tanker truck access points). Likewise, if the facility receiving the food identifies receiving as an actionable process step because of a vulnerability during transportation, it would implement mitigation strategies to reduce the vulnerability of the food to intentional adulteration during shipping. The mitigations employed at the receiving/unloading step may include procedures to accept only scheduled shipments, verification of shipping documentation, procedures to investigate delayed or missing shipments, inspecting loads prior to receipt, and rejecting damaged or suspect items. These steps together will then work to significantly reduce the significant vulnerabilities associated with the transport of food. With respect to the prevalence of theft of food during transport, such theft is economically motivated; the scope of this rule is limited to acts of intentional adulteration where the intent is to cause wide scale public health harm. (Comment 36) One comment states that the use of seals or tamper-evident containers is insufficient to protect bulk foods during transportation and/or holding because tamper-evident seals can be defeated and cannot be expected to prevent a determined attacker. The comment further states that tamper-evident containers or seals should be used in combination with other measures. (Response 36) Mitigation strategies are “risk-based,” “reasonably appropriate measures” employed to “significantly minimize or prevent” significant vulnerabilities. They cannot always eliminate entirely any possibility of intentional adulteration. Furthermore, each facility has some degree of discretion in determining how, and whether, each mitigation strategy is properly implemented, as part of the facility's written explanation of how the mitigation strategy sufficiently minimizes or prevents the significant vulnerability associated with the actionable process step. Facilities are required to implement mitigation strategies that significantly minimize or prevent the significant vulnerability; therefore, if a significant vulnerability is identified, the mitigation strategy or combination of strategies chosen by the facility must be sufficient to reduce the vulnerability to an acceptable level at these steps. In many cases the use of tamper evident seals may be an appropriate mitigation strategy for limiting access to the product. Additionally, if a tamper evident seal had been circumvented by an attacker, a close inspection of the seal at receiving may reveal suspicious activity or tampering which reduces the likelihood of a successful attack. However if the facility concludes that tamper evident seals are not by themselves sufficient to significantly reduce the vulnerability, they should employ other or additional measures (such as directing carriers to travel directly to the end destination without stop-overs, or requiring teamed drivers to prevent the load from being unsupervised during transport). (Comment 37) One comment requests clarification of expectations in situations where only one of the entities involved is covered by the intentional adulteration rule ( e.g., the shipper is covered, but the receiver is exempt due to size or vice versa) and states that FDA may need to take a closer look into exemption of carriers. (Response 37) A covered facility may ship food to or receive food from a facility that is not covered by the rule ( e.g., it is a very small business). The covered facility is responsible for implementing mitigation strategies to address transportation if it has a significant vulnerability associated with transportation at the receiving or shipping steps. The mitigation strategies used by the covered facility must significantly minimize or eliminate the significant vulnerability at this step. Mitigation strategies are available to protect the food during transport regardless of whether the shipper or receiver is exempt from the rule. If the receiving facility is exempt, the shipping facility can address the vulnerability by implementing mitigation strategies such as those discussed in Response 36. If the shipping facility is exempt, the receiving facility can address the vulnerability by implementing mitigation strategies such as visually inspecting seals and cargo to identify any suspicious activity or tampering, verifying shipping documents are accurate, ensuring only scheduled deliveries are accepted, and investigating delayed or inaccurate shipments. Additionally, we do not believe a shipping and/or receiving facility that qualifies for the very small business exemption is an attractive target for attackers intending to cause wide scale public health harm, as detailed in section IV.B.11. (Comment 38) Some comments state that covering carriers under this rule may not be the best approach and this component of the food sector may be better addressed in guidance. Some comments ask us to continue to develop materials, guidelines and other tools to promote voluntary compliance of food defense measures by the transportation component of the food sector. (Response 38) W [Text truncated at 120,000 characters. The full text is on the page linked above.] --- Source: Frix Law Library, https://www.frixlaw.com/law-library/documents/fr%3A2016-12373. Public record. Not legal advice.