The Food and Drug Administration (FDA) recently issued the last of the major rules implementing the Food Safety Modernization Act, titled “Focused Mitigation Strategies to Protect Food Against Intentional Adulteration.” The accompanying materials explain that the rule seeks to protect the food supply against acts of terrorism designed to cause widespread and significant harm to public health.

The rule is expressly not designed to cover acts of disgruntled employees, consumers or competitors designed to harm a company’s reputation – even though harm to public health may occur – or economically motivated adulteration (although it discusses an approach to this latter problem also).

The final rule would establish various food defense measures that a food facility required to register with the FDA must implement to protect against the intentional adulteration of food. According to a separate summary released by the FDA, the key provisions of the final rule include the following:

Food defense plan: Each covered facility is required to prepare and implement a food defense plan. This written plan must identify vulnerabilities and actionable process steps, mitigation strategies, and procedures for food defense monitoring, corrective actions, and verification. A re-analysis is required every three years or when certain criteria are met, including mitigation strategies that are determined to be improperly implemented.

Vulnerability assessment: Food manufacturers must identify vulnerabilities and actionable process steps for each type of food manufactured, processed, packed, or held at the food facility. For each point, step, or procedure in the facility’s process, these elements must be evaluated:

• The severity and scale of the potential impact on public health. This would include such considerations as the volume of product, the number of servings, the number of exposures, how fast the food moves through the distribution system, potential agents of concern and the infectious/lethal dose of each; and the possible number of illnesses and deaths.
• The degree of physical access to the product. Things to be considered would include the presence of such physical barriers as gates, railings, doors, lids, seals, and shields.
• The ability to successfully contaminate the product.

Mitigation strategies: These should be identified and implemented at each actionable process step to provide assurances that vulnerabilities will be minimized or prevented. The mitigation strategies must be tailored to the facility and its procedures.

The final rule removes the distinction between “broad” and “focused” mitigation strategies. The original proposal only required “focused” mitigation strategies because “broad” mitigation strategies, such as a fence around the entire facility, did not protect specific points from being attacked by an insider.

The final rule also recognizes that a mitigation strategy, applied in a directed and appropriate way to protect the actionable process step from an insider attack, would sufficiently minimize the risk of intentional adulteration.

Mitigation strategy management components: Steps must be taken to ensure the proper implementation of each mitigation strategy. In each of these areas of food defense, the facilities are given more flexibility in the final rule to establish the actions most appropriate to their operation and product.

• Monitoring: Establishing and implementing procedures, including the frequency with which they are to be performed, for monitoring the mitigation strategies.
• Corrective actions: The response if mitigation strategies are not properly implemented.
• Verification: Verification activities would ensure that monitoring is being conducted and appropriate decisions about corrective actions are being made.
• Training and recordkeeping: Facilities must ensure that personnel assigned to the vulnerable areas receive appropriate training; facilities must maintain records for food defense monitoring, corrective actions, and verification activities.

Compliance Dates: For various reasons, the FDA provides a longer timeline in the final rule for facilities to comply with the intentional adulteration rule.

• Very Small Businesses - a business (including any subsidiaries and affiliates) averaging less than $10 million, adjusted for inflation, per year, during the three-year period preceding the applicable calendar year in sales of human food plus the market value of human food manufactured, processed, packed, or held without sale (e.g., held for a fee). These businesses would have to comply with modified requirements within five years after the publication of the final rule. The rule was published on May 27, 2016.
• Small Businesses - a business employing fewer than 500 persons would have to comply four years after the publication of the final rule
• Other Businesses - a business that is not small or very small and does not qualify for exemptions would have to comply three years after the publication of the final rule.

A copy of the Federal Register Notice for the final rule can be found here.