(a) You must conduct a reanalysis of the food defense plan, as a whole at least once every 3 years;

(b) You must conduct a reanalysis of the food defense plan as a whole, or the applicable portion of the food defense plan:

(1) Whenever a significant change made in the activities conducted at your facility creates a reasonable potential for a new vulnerability or a significant increase in a previously identified vulnerability;

(2) Whenever you become aware of new information about potential vulnerabilities associated with the food operation or facility;

(3) Whenever you find that a mitigation strategy, a combination of mitigation strategies, or the food defense plan as a whole is not properly implemented; and

(4) Whenever FDA requires reanalysis to respond to new vulnerabilities, credible threats to the food supply, and developments in scientific understanding including, as appropriate, results from the Department of Homeland Security biological, chemical, radiological, or other terrorism risk assessment.

(c) You must complete such reanalysis required by paragraphs (a) and (b) of this section and implement any additional mitigation strategies needed to address the significant vulnerabilities identified, if any:

(1) Before any change in activities (including any change in mitigation strategy) at the facility is operative;

(2) When necessary within 90-calendar days after production; and

(3) Within a reasonable timeframe, providing a written justification is prepared for a timeframe that exceeds 90 days after production of the applicable food first begins.

(d) You must revise the written food defense plan if a significant change in the activities conducted at your facility creates a reasonable potential for a new vulnerability or a significant increase in a previously identified vulnerability or document the basis for the conclusion that no revisions are needed.