Title 21 CFR reference

This part applies to the owner, operator or agent in charge of a domestic or foreign food facility that manufactures/processes, packs, or holds food for consumption in the United States and is required to register under section 415 of the Federal Food, Drug, and Cosmetic Act, unless one of the exemptions in § 121.5 applies.

Requirement for a food defense plan.(a) You must prepare, or have prepared, and implement a written food defense plan. Contents of a food defense plan.(b) The written food defense plan must include: (1) The written vulnerability assessment, including required explanations, to identify significant vulnerabilities and actionable process steps as required by § 121.130(c); (2) The written mitigation strategies, including required explanations, as required by § 121.135(b); (3) The written procedures for the food defense monitoring of the implementation of the mitigation strategies as required by § 121.140(a); (4) The written procedures for food defense corrective actions as required by § 121.145(a)(1); and (5) The written procedures for food defense verification as required by § 121.150(b). Records.(c) The food defense plan required by this section is a record that is subject to the requirements of subpart D of this part.

Requirement for a vulnerability assessment.(a) You must conduct or have conducted a vulnerability assessment for each type of food manufactured, processed, packed, or held at your facility using appropriate methods to evaluate each point, step, or procedure in your food operation to identify significant vulnerabilities and actionable process steps. Appropriate methods must include, at a minimum, an evaluation of: e.g.,(1) The potential public health impact ( severity and scale) if a contaminant were added; (2) The degree of physical access to the product; and (3) The ability of an attacker to successfully contaminate the product. Inside attacker.(b) The assessment must consider the possibility of an inside attacker. Written vulnerability assessment.(c) Regardless of the outcome, the vulnerability assessment must be written and must include an explanation as to why each point, step, or procedure either was or was not identified as an actionable process step.

(a) You must identify and implement mitigation strategies at each actionable process step to provide assurances that the significant vulnerability at each step will be significantly minimized or prevented and the food manufactured, processed, packed, or held by your facility will not be adulterated under section 402 of the Federal Food, Drug, and Cosmetic Act. For each mitigation strategy implemented at each actionable process step, you must include a written explanation of how the mitigation strategy sufficiently minimizes or prevents the significant vulnerability associated with the actionable process step. (b) Mitigation strategies and accompanying explanations must be written.

Mitigation strategies required under§ 121.135 are subject to the following mitigation strategies management components as appropriate to ensure the proper implementation of the mitigation strategies, taking into account the nature of each such mitigation strategy and its role in the facility's food defense system: (a) Food defense monitoring in accordance with § 121.140; (b) Food defense corrective actions in accordance with § 121.145; and (c) Food defense verification in accordance with § 121.150.

As appropriate to the nature of the mitigation strategy and its role in the facility's food defense system: Written procedures.(a) You must establish and implement written procedures, including the frequency with which they are to be performed, for food defense monitoring of the mitigation strategies. Food defense monitoring.(b) You must monitor the mitigation strategies with adequate frequency to provide assurances that they are consistently performed. RecordsRequirement to document food defense monitoring.(c) —(1) You must document the monitoring of mitigation strategies in accordance with this section in records that are subject to verification in accordance with § 121.150(a)(1) and records review in accordance with § 121.150(a)(3)(i). Exception records.(2) Records may be affirmative records demonstrating the mitigation strategy is functioning as intended. Exception records demonstrating the mitigation strategy is not functioning as intended may be adequate in some circumstances.

Food defense corrective action procedures.(a) As appropriate to the nature of the actionable process step and the nature of the mitigation strategy: (1) You must establish and implement written food defense corrective action procedures that must be taken if mitigation strategies are not properly implemented. (2) The food defense corrective action procedures must describe the steps to be taken to ensure that: (i) Appropriate action is taken to identify and correct a problem that has occurred with implementation of a mitigation strategy; and (ii) Appropriate action is taken, when necessary, to reduce the likelihood that the problem will recur. Records.(b) All food defense corrective actions taken in accordance with this section must be documented in records that are subject to food defense verification in accordance with § 121.150(a)(2) and records review in accordance with § 121.150(a)(3)(i).

Food defense verification activities.(a) Food defense verification activities must include, as appropriate to the nature of the mitigation strategy and its role in the facility's food defense system: (1) Verification that food defense monitoring is being conducted as required by § 121.138 (and in accordance with § 121.140); (2) Verification that appropriate decisions about food defense corrective actions are being made as required by § 121.138 (and in accordance with § 121.145); (3) Verification that mitigation strategies are properly implemented and are significantly minimizing or preventing the significant vulnerabilities. To do so, you must conduct activities that include the following, as appropriate to the facility, the food, and the nature of the mitigation strategy and its role in the facility's food defense system: (i) Review of the food defense monitoring and food defense corrective actions records within appropriate timeframes to ensure that the records are complete, the activities reflected in the records occurred in accordance with the food defense plan, the mitigation strategies are properly implemented, and appropriate decisions were made about food defense…

(a) You must conduct a reanalysis of the food defense plan, as a whole at least once every 3 years; (b) You must conduct a reanalysis of the food defense plan as a whole, or the applicable portion of the food defense plan: (1) Whenever a significant change made in the activities conducted at your facility creates a reasonable potential for a new vulnerability or a significant increase in a previously identified vulnerability; (2) Whenever you become aware of new information about potential vulnerabilities associated with the food operation or facility; (3) Whenever you find that a mitigation strategy, a combination of mitigation strategies, or the food defense plan as a whole is not properly implemented; and (4) Whenever FDA requires reanalysis to respond to new vulnerabilities, credible threats to the food supply, and developments in scientific understanding including, as appropriate, results from the Department of Homeland Security biological, chemical, radiological, or other terrorism risk assessment. (c) You must complete such reanalysis required by paragraphs (a) and (b) of this section and implement any additional mitigation strategies needed to address the significant…

The definitions and interpretations of terms in section 201 of the Federal Food, Drug, and Cosmetic Act are applicable to such terms when used in this part. The following definitions also apply: Actionable process step means a point, step, or procedure in a food process where a significant vulnerability exists and at which mitigation strategies can be applied and are essential to significantly minimize or prevent the significant vulnerability. Adequate means that which is needed to accomplish the intended purpose in keeping with good public health practices. Affiliate means any facility that controls, is controlled by, or is under common control with another facility. Calendar day means every day as shown on the calendar. Contaminant means, for purposes of this part, any biological, chemical, physical, or radiological agent that may be added to food to intentionally cause illness, injury, or death. Facility means a domestic facility or a foreign facility that is required to register under section 415 of the Federal Food, Drug, and Cosmetic Act, in accordance with the requirements of part 1, subpart H of this chapter. Farm means farm as defined in § 1.227 of this chapter.…

(a) Except as provided by paragraph (b) of this section, all records required by subpart C of this part are subject to all requirements of this subpart. (b) The requirements of § 121.310 apply only to the written food defense plan.

Records must: (a) Be kept as original records, true copies (such as photocopies, pictures, scanned copies, microfilm, microfiche, or other accurate reproductions of the original records), or electronic records; (b) Contain the actual values and observations obtained during food defense monitoring; (c) Be accurate, indelible, and legible; (d) Be created concurrently with performance of the activity documented; (e) Be as detailed as necessary to provide history of work performed; and (f) Include: e.g.,(1) Information adequate to identify the facility ( the name, and when necessary, the location of the facility); (2) The date and, when appropriate, the time of the activity documented; (3) The signature or initials of the person performing the activity; and (4) Where appropriate, the identity of the product and the lot code, if any. (g) Records that are established or maintained to satisfy the requirements of this part and that meet the definition of electronic records in § 11.3(b)(6) of this chapter are exempt from the requirements of part 11 of this chapter. Records that satisfy the requirements of this part, but that also are required under other applicable statutory…

The owner, operator, or agent in charge of the facility must sign and date the food defense plan: (a) Upon initial completion; and (b) Upon any modification.

(a)(1) All records required by this part must be retained at the facility for at least 2 years after the date they were prepared. (2) Records that a facility relies on during the 3-year period preceding the applicable calendar year to support its status as exempt as a very small business must be retained at the facility as long as necessary to support the status of a facility as a very small business during the applicable calendar year. (b) The food defense plan must be retained for at least 2 years after its use is discontinued. (c) Except for the food defense plan, offsite storage of records is permitted if such records can be retrieved and provided onsite within 24 hours of request for official review. The food defense plan must remain onsite. Electronic records are considered to be onsite if they are accessible from an onsite location. (d) If the facility is closed for a prolonged period, the food defense plan may be transferred to some other reasonably accessible location but must be returned to the facility within 24 hours for official review upon request.

All records required by this part must be made promptly available to a duly authorized representative of the Secretary of Health and Human Services for official review and copying upon oral or written request.

Records required by this part will be protected from public disclosure to the extent allowable under part 20 of this chapter.

e.g.,(a) Existing records ( records that are kept to comply with other Federal, State, or local regulations, or for any other reason) do not need to be duplicated if they contain all of the required information and satisfy the requirements of this subpart. Existing records may be supplemented as necessary to include all of the required information and satisfy the requirements of this subpart. (b) The information required by this part does not need to be kept in one set of records. If existing records contain some of the required information, any new information required by this part may be kept either separately or combined with the existing records.

Applicability.(a) You must ensure that each individual who performs activities required under subpart C of this part is a qualified individual as that term is defined in § 121.3. Qualifications of individuals assigned to an actionable process step.(b) Each individual assigned to an actionable process step (including temporary and seasonal personnel) or in the supervision thereof must: i.e.,(1) Be a qualified individual as that term is defined in § 121.3— have the appropriate education, training, or experience (or a combination thereof) necessary to properly implement the mitigation strategy or combination of mitigation strategies at the actionable process step; and (2) Receive training in food defense awareness. Qualifications of individuals for certain activities described in paragraph (c)(3) of this section.(c) Each individual assigned to certain activities described in paragraph (c)(3) of this section must: i.e.,(1) Be a qualified individual as that term is defined in § 121.3— have the appropriate education, training, or experience (or a combination thereof) necessary to properly perform the activities; and (2) Have successfully completed training for the specific…

(a) The operation of a facility that manufactures, processes, packs, or holds food for sale in the United States if the owner, operator, or agent in charge of such facility is required to comply with, and is not in compliance with, section 418 of the Federal Food, Drug, and Cosmetic Act or subparts C or D of this part is a prohibited act under section 301(uu) of the Federal Food, Drug, and Cosmetic Act. (b) The failure to comply with section 420 of the Federal Food, Drug, and Cosmetic Act or subparts C or D of this part is a prohibited act under section 301(ww) of the Federal Food, Drug, and Cosmetic Act.

(a) This part does not apply to a very small business, except that a very small business must, upon request, provide for official review documentation sufficient to show that the facility meets this exemption. Such documentation must be retained for 2 years. (b) This part does not apply to the holding of food, except the holding of food in liquid storage tanks. (c) This part does not apply to the packing, re-packing, labeling, or re-labeling of food where the container that directly contacts the food remains intact. (d) This part does not apply to activities of a farm that are subject to section 419 of the Federal Food, Drug, and Cosmetic Act (Standards for Produce Safety). (e)(1) This part does not apply with respect to alcoholic beverages at a facility that meets the following two conditions: et seq.et seq.(i) Under the Federal Alcohol Administration Act (27 U.S.C. 201 ) or chapter 51 of subtitle E of the Internal Revenue Code of 1986 (26 U.S.C. 5001 ) the facility is required to obtain a permit from, register with, or obtain approval of a notice or application from the Secretary of the Treasury as a condition of doing business in the United States, or is a foreign facility…