This part applies to the owner, operator or agent in charge of a domestic or foreign food facility that manufactures/processes, packs, or holds food for consumption in the United States and is required to register under section 415 of the Federal Food, Drug, and Cosmetic Act, unless one of the exemptions in § 121.5 applies.

The definitions and interpretations of terms in section 201 of the Federal Food, Drug, and Cosmetic Act are applicable to such terms when used in this part. The following definitions also apply:

Actionable process step means a point, step, or procedure in a food process where a significant vulnerability exists and at which mitigation strategies can be applied and are essential to significantly minimize or prevent the significant vulnerability.

Adequate means that which is needed to accomplish the intended purpose in keeping with good public health practices.

Affiliate means any facility that controls, is controlled by, or is under common control with another facility.

Calendar day means every day as shown on the calendar.

Contaminant means, for purposes of this part, any biological, chemical, physical, or radiological agent that may be added to food to intentionally cause illness, injury, or death.

Facility means a domestic facility or a foreign facility that is required to register under section 415 of the Federal Food, Drug, and Cosmetic Act, in accordance with the requirements of part 1, subpart H of this chapter.

Farm means farm as defined in § 1.227 of this chapter.

FDA means the Food and Drug Administration.

Food means food as defined in section 201(f) of the Federal Food, Drug, and Cosmetic Act and includes raw materials and ingredients.

Food defense means, for purposes of this part, the effort to protect food from intentional acts of adulteration where there is an intent to cause wide scale public health harm.

Food defense monitoring means to conduct a planned sequence of observations or measurements to assess whether mitigation strategies are operating as intended.

Food defense verification means the application of methods, procedures, and other evaluations, in addition to food defense monitoring, to determine whether a mitigation strategy or combination of mitigation strategies is or has been operating as intended according to the food defense plan.

Full-time equivalent employee is a term used to represent the number of employees of a business entity for the purpose of determining whether the business qualifies as a small business. The number of full-time equivalent employees is determined by dividing the total number of hours of salary or wages paid directly to employees of the business entity and of all of its affiliates and subsidiaries by the number of hours of work in 1 year, 2,080 hours (i.e., 40 hours × 52 weeks). If the result is not a whole number, round down to the next lowest whole number.

Holding means storage of food and also includes activities performed incidental to storage of food (e.g., activities performed for the safe or effective storage of that food, such as fumigating food during storage, and drying/dehydrating raw agricultural commodities when the drying/dehydrating does not create a distinct commodity (such as drying/dehydrating hay or alfalfa)). Holding also includes activities performed as a practical necessity for the distribution of that food (such as blending of the same raw agricultural commodity and breaking down pallets), but does not include activities that transform a raw agricultural commodity into a processed food as defined in section 201(gg) of the Federal Food, Drug, and Cosmetic Act. Holding facilities could include warehouses, cold storage facilities, storage silos, grain elevators, and liquid storage tanks.

Manufacturing/processing means making food from one or more ingredients, or synthesizing, preparing, treating, modifying or manipulating food, including food crops or ingredients. Examples of manufacturing/processing activities include: Baking, boiling, bottling, canning, cooking, cooling, cutting, distilling, drying/dehydrating raw agricultural commodities to create a distinct commodity (such as drying/dehydrating grapes to produce raisins), evaporating, eviscerating, extracting juice, formulating, freezing, grinding, homogenizing, irradiating, labeling, milling, mixing, packaging (including modified atmosphere packaging), pasteurizing, peeling, rendering, treating to manipulate ripening, trimming, washing, or waxing. For farms and farm mixed-type facilities, manufacturing/processing does not include activities that are part of harvesting, packing, or holding.

Mitigation strategies mean those risk-based, reasonably appropriate measures that a person knowledgeable about food defense would employ to significantly minimize or prevent significant vulnerabilities identified at actionable process steps, and that are consistent with the current scientific understanding of food defense at the time of the analysis.

Mixed-type facility means an establishment that engages in both activities that are exempt from registration under section 415 of the Federal Food, Drug, and Cosmetic Act and activities that require the establishment to be registered. An example of such a facility is a “farm mixed-type facility,” which is an establishment that is a farm, but also conducts activities outside the farm definition that require the establishment to be registered.

Packing means placing food into a container other than packaging the food and also includes re-packing and activities performed incidental to packing or re-packing a food (e.g., activities performed for the safe or effective packing or re-packing of that food (such as sorting, culling, grading, and weighing or conveying incidental to packing or re-packing)), but does not include activities that transform a raw agricultural commodity into a processed food as defined in section 201(gg) of the Federal Food, Drug, and Cosmetic Act.

Qualified individual means a person who has the education, training, or experience (or a combination thereof) necessary to perform an activity required under subpart C of this part, as appropriate to the individual's assigned duties. A qualified individual may be, but is not required to be, an employee of the establishment.

Significant vulnerability means a vulnerability that, if exploited, could reasonably be expected to cause wide scale public health harm. A significant vulnerability is identified by a vulnerability assessment conducted by a qualified individual, that includes consideration of the following: (1) Potential public health impact (e.g., severity and scale) if a contaminant were added, (2) degree of physical access to the product, and (3) ability of an attacker to successfully contaminate the product. The assessment must consider the possibility of an inside attacker.

Significantly minimize means to reduce to an acceptable level, including to eliminate.

Small business means, for purposes of this part, a business (including any subsidiaries and affiliates) employing fewer than 500 full-time equivalent employees.

Subsidiary means any company which is owned or controlled directly or indirectly by another company.

Very small business means, for purposes of this part, a business (including any subsidiaries and affiliates) averaging less than $10,000,000, adjusted for inflation, per year, during the 3-year period preceding the applicable calendar year in sales of human food plus the market value of human food manufactured, processed, packed, or held without sale (e.g., held for a fee).

Vulnerability means the susceptibility of a point, step, or procedure in a facility's food process to intentional adulteration.

You means, for purposes of this part, the owner, operator, or agent in charge of a facility.

(a) Applicability. You must ensure that each individual who performs activities required under subpart C of this part is a qualified individual as that term is defined in § 121.3.

(b) Qualifications of individuals assigned to an actionable process step. Each individual assigned to an actionable process step (including temporary and seasonal personnel) or in the supervision thereof must:

(1) Be a qualified individual as that term is defined in § 121.3 - i.e., have the appropriate education, training, or experience (or a combination thereof) necessary to properly implement the mitigation strategy or combination of mitigation strategies at the actionable process step; and

(2) Receive training in food defense awareness.

(c) Qualifications of individuals for certain activities described in paragraph (c)(3) of this section. Each individual assigned to certain activities described in paragraph (c)(3) of this section must:

(1) Be a qualified individual as that term is defined in § 121.3 - i.e., have the appropriate education, training, or experience (or a combination thereof) necessary to properly perform the activities; and

(2) Have successfully completed training for the specific function at least equivalent to that received under a standardized curriculum recognized as adequate by FDA or be otherwise qualified through job experience to conduct the activities. Job experience may qualify an individual to perform these functions if such experience has provided an individual with knowledge at least equivalent to that provided through the standardized curriculum. This individual may be, but is not required to be, an employee of the facility.

(3) One or more qualified individuals must do or oversee:

(i) The preparation of the food defense plan as required in § 121.126;

(ii) The conduct of a vulnerability assessment as required in § 121.130;

(iii) The identification and explanation of the mitigation strategies as required in § 121.135; and

(iv) Reanalysis as required in § 121.157.

(d) Additional qualifications of supervisory personnel. Responsibility for ensuring compliance by individuals with the requirements of this part must be clearly assigned to supervisory personnel with a combination of education, training, and experience necessary to supervise the activities under this subpart.

(e) Records. Training required by paragraphs (b)(2) and (c)(2) of this section must be documented in records, and must:

(1) Include the date of training, the type of training, and the persons trained; and

(2) Be established and maintained in accordance with the requirements of subpart D of this part.

(a) This part does not apply to a very small business, except that a very small business must, upon request, provide for official review documentation sufficient to show that the facility meets this exemption. Such documentation must be retained for 2 years.

(b) This part does not apply to the holding of food, except the holding of food in liquid storage tanks.

(c) This part does not apply to the packing, re-packing, labeling, or re-labeling of food where the container that directly contacts the food remains intact.

(d) This part does not apply to activities of a farm that are subject to section 419 of the Federal Food, Drug, and Cosmetic Act (Standards for Produce Safety).

(e)(1) This part does not apply with respect to alcoholic beverages at a facility that meets the following two conditions:

(i) Under the Federal Alcohol Administration Act (27 U.S.C. 201 et seq.) or chapter 51 of subtitle E of the Internal Revenue Code of 1986 (26 U.S.C. 5001 et seq.) the facility is required to obtain a permit from, register with, or obtain approval of a notice or application from the Secretary of the Treasury as a condition of doing business in the United States, or is a foreign facility of a type that would require such a permit, registration, or approval if it were a domestic facility; and

(ii) Under section 415 of the Federal Food, Drug, and Cosmetic Act the facility is required to register as a facility because it is engaged in manufacturing, processing, packing, or holding one or more alcoholic beverages.

(2) This part does not apply with respect to food that is not an alcoholic beverage at a facility described in paragraph (e)(1) of this section, provided such food:

(i) Is in prepackaged form that prevents any direct human contact with such food; and

(ii) Constitutes not more than 5 percent of the overall sales of the facility, as determined by the Secretary of the Treasury.

(f) This part does not apply to the manufacturing, processing, packing, or holding of food for animals other than man.

(g) This part does not apply to on-farm manufacturing, processing, packing, or holding of the following foods on a farm mixed-type facility, when conducted by a small or very small business if such activities are the only activities conducted by the business subject to section 418 of the Federal Food, Drug, and Cosmetic Act.

(1) Eggs (in-shell, other than raw agricultural commodities, e.g., pasteurized); and

(2) Game meats (whole or cut, not ground or shredded, without secondary ingredients).

(a) Requirement for a food defense plan. You must prepare, or have prepared, and implement a written food defense plan.

(b) Contents of a food defense plan. The written food defense plan must include:

(1) The written vulnerability assessment, including required explanations, to identify significant vulnerabilities and actionable process steps as required by § 121.130(c);

(2) The written mitigation strategies, including required explanations, as required by § 121.135(b);

(3) The written procedures for the food defense monitoring of the implementation of the mitigation strategies as required by § 121.140(a);

(4) The written procedures for food defense corrective actions as required by § 121.145(a)(1); and

(5) The written procedures for food defense verification as required by § 121.150(b).

(c) Records. The food defense plan required by this section is a record that is subject to the requirements of subpart D of this part.

(a) Requirement for a vulnerability assessment. You must conduct or have conducted a vulnerability assessment for each type of food manufactured, processed, packed, or held at your facility using appropriate methods to evaluate each point, step, or procedure in your food operation to identify significant vulnerabilities and actionable process steps. Appropriate methods must include, at a minimum, an evaluation of:

(1) The potential public health impact (e.g., severity and scale) if a contaminant were added;

(2) The degree of physical access to the product; and

(3) The ability of an attacker to successfully contaminate the product.

(b) Inside attacker. The assessment must consider the possibility of an inside attacker.

(c) Written vulnerability assessment. Regardless of the outcome, the vulnerability assessment must be written and must include an explanation as to why each point, step, or procedure either was or was not identified as an actionable process step.

(a) You must identify and implement mitigation strategies at each actionable process step to provide assurances that the significant vulnerability at each step will be significantly minimized or prevented and the food manufactured, processed, packed, or held by your facility will not be adulterated under section 402 of the Federal Food, Drug, and Cosmetic Act. For each mitigation strategy implemented at each actionable process step, you must include a written explanation of how the mitigation strategy sufficiently minimizes or prevents the significant vulnerability associated with the actionable process step.

(b) Mitigation strategies and accompanying explanations must be written.

Mitigation strategies required under§ 121.135 are subject to the following mitigation strategies management components as appropriate to ensure the proper implementation of the mitigation strategies, taking into account the nature of each such mitigation strategy and its role in the facility's food defense system:

(a) Food defense monitoring in accordance with § 121.140;

(b) Food defense corrective actions in accordance with § 121.145; and

(c) Food defense verification in accordance with § 121.150.

As appropriate to the nature of the mitigation strategy and its role in the facility's food defense system:

(a) Written procedures. You must establish and implement written procedures, including the frequency with which they are to be performed, for food defense monitoring of the mitigation strategies.

(b) Food defense monitoring. You must monitor the mitigation strategies with adequate frequency to provide assurances that they are consistently performed.

(c) Records - (1) Requirement to document food defense monitoring. You must document the monitoring of mitigation strategies in accordance with this section in records that are subject to verification in accordance with § 121.150(a)(1) and records review in accordance with § 121.150(a)(3)(i).

(2) Exception records. Records may be affirmative records demonstrating the mitigation strategy is functioning as intended. Exception records demonstrating the mitigation strategy is not functioning as intended may be adequate in some circumstances.

(a) Food defense corrective action procedures. As appropriate to the nature of the actionable process step and the nature of the mitigation strategy:

(1) You must establish and implement written food defense corrective action procedures that must be taken if mitigation strategies are not properly implemented.

(2) The food defense corrective action procedures must describe the steps to be taken to ensure that:

(i) Appropriate action is taken to identify and correct a problem that has occurred with implementation of a mitigation strategy; and

(ii) Appropriate action is taken, when necessary, to reduce the likelihood that the problem will recur.

(b) Records. All food defense corrective actions taken in accordance with this section must be documented in records that are subject to food defense verification in accordance with § 121.150(a)(2) and records review in accordance with § 121.150(a)(3)(i).

(a) Food defense verification activities. Food defense verification activities must include, as appropriate to the nature of the mitigation strategy and its role in the facility's food defense system:

(1) Verification that food defense monitoring is being conducted as required by § 121.138 (and in accordance with § 121.140);

(2) Verification that appropriate decisions about food defense corrective actions are being made as required by § 121.138 (and in accordance with § 121.145);

(3) Verification that mitigation strategies are properly implemented and are significantly minimizing or preventing the significant vulnerabilities. To do so, you must conduct activities that include the following, as appropriate to the facility, the food, and the nature of the mitigation strategy and its role in the facility's food defense system:

(i) Review of the food defense monitoring and food defense corrective actions records within appropriate timeframes to ensure that the records are complete, the activities reflected in the records occurred in accordance with the food defense plan, the mitigation strategies are properly implemented, and appropriate decisions were made about food defense corrective actions; and

(ii) Other activities appropriate for verification of proper implementation of mitigation strategies; and

(4) Verification of reanalysis in accordance with § 121.157.

(b) Written procedures. You must establish and implement written procedures, including the frequency for which they are to be performed, for verification activities conducted according to § 121.150(a)(3)(ii).

(c) Documentation. All verification activities conducted in accordance with this section must be documented in records.

(a) You must conduct a reanalysis of the food defense plan, as a whole at least once every 3 years;

(b) You must conduct a reanalysis of the food defense plan as a whole, or the applicable portion of the food defense plan:

(1) Whenever a significant change made in the activities conducted at your facility creates a reasonable potential for a new vulnerability or a significant increase in a previously identified vulnerability;

(2) Whenever you become aware of new information about potential vulnerabilities associated with the food operation or facility;

(3) Whenever you find that a mitigation strategy, a combination of mitigation strategies, or the food defense plan as a whole is not properly implemented; and

(4) Whenever FDA requires reanalysis to respond to new vulnerabilities, credible threats to the food supply, and developments in scientific understanding including, as appropriate, results from the Department of Homeland Security biological, chemical, radiological, or other terrorism risk assessment.

(c) You must complete such reanalysis required by paragraphs (a) and (b) of this section and implement any additional mitigation strategies needed to address the significant vulnerabilities identified, if any:

(1) Before any change in activities (including any change in mitigation strategy) at the facility is operative;

(2) When necessary within 90-calendar days after production; and

(3) Within a reasonable timeframe, providing a written justification is prepared for a timeframe that exceeds 90 days after production of the applicable food first begins.

(d) You must revise the written food defense plan if a significant change in the activities conducted at your facility creates a reasonable potential for a new vulnerability or a significant increase in a previously identified vulnerability or document the basis for the conclusion that no revisions are needed.

(a) Except as provided by paragraph (b) of this section, all records required by subpart C of this part are subject to all requirements of this subpart.

(b) The requirements of § 121.310 apply only to the written food defense plan.

Records must:

(a) Be kept as original records, true copies (such as photocopies, pictures, scanned copies, microfilm, microfiche, or other accurate reproductions of the original records), or electronic records;

(b) Contain the actual values and observations obtained during food defense monitoring;

(c) Be accurate, indelible, and legible;

(d) Be created concurrently with performance of the activity documented;

(e) Be as detailed as necessary to provide history of work performed; and

(f) Include:

(1) Information adequate to identify the facility (e.g., the name, and when necessary, the location of the facility);

(2) The date and, when appropriate, the time of the activity documented;

(3) The signature or initials of the person performing the activity; and

(4) Where appropriate, the identity of the product and the lot code, if any.

(g) Records that are established or maintained to satisfy the requirements of this part and that meet the definition of electronic records in § 11.3(b)(6) of this chapter are exempt from the requirements of part 11 of this chapter. Records that satisfy the requirements of this part, but that also are required under other applicable statutory provisions or regulations, remain subject to part 11 of this chapter.

The owner, operator, or agent in charge of the facility must sign and date the food defense plan:

(a) Upon initial completion; and

(b) Upon any modification.

(a)(1) All records required by this part must be retained at the facility for at least 2 years after the date they were prepared.

(2) Records that a facility relies on during the 3-year period preceding the applicable calendar year to support its status as exempt as a very small business must be retained at the facility as long as necessary to support the status of a facility as a very small business during the applicable calendar year.

(b) The food defense plan must be retained for at least 2 years after its use is discontinued.

(c) Except for the food defense plan, offsite storage of records is permitted if such records can be retrieved and provided onsite within 24 hours of request for official review. The food defense plan must remain onsite. Electronic records are considered to be onsite if they are accessible from an onsite location.

(d) If the facility is closed for a prolonged period, the food defense plan may be transferred to some other reasonably accessible location but must be returned to the facility within 24 hours for official review upon request.

All records required by this part must be made promptly available to a duly authorized representative of the Secretary of Health and Human Services for official review and copying upon oral or written request.

Records required by this part will be protected from public disclosure to the extent allowable under part 20 of this chapter.

(a) Existing records (e.g., records that are kept to comply with other Federal, State, or local regulations, or for any other reason) do not need to be duplicated if they contain all of the required information and satisfy the requirements of this subpart. Existing records may be supplemented as necessary to include all of the required information and satisfy the requirements of this subpart.

(b) The information required by this part does not need to be kept in one set of records. If existing records contain some of the required information, any new information required by this part may be kept either separately or combined with the existing records.

(a) The operation of a facility that manufactures, processes, packs, or holds food for sale in the United States if the owner, operator, or agent in charge of such facility is required to comply with, and is not in compliance with, section 418 of the Federal Food, Drug, and Cosmetic Act or subparts C or D of this part is a prohibited act under section 301(uu) of the Federal Food, Drug, and Cosmetic Act.

(b) The failure to comply with section 420 of the Federal Food, Drug, and Cosmetic Act or subparts C or D of this part is a prohibited act under section 301(ww) of the Federal Food, Drug, and Cosmetic Act.