Contains Nonbinding Recommendations 
 
 
 
 
Mitigation Strategies to Protect Food 
Against Intentional Adulteration: What 
You Need to Know About the FDA 
Regulation: 
Guidance for Industry  
Small Entity Compliance Guide 
Additional copies are available from: 
Center for Food Safety and Applied Nutrition 
Food and Drug Administration 
5001 Campus Drive 
College Park, MD 20740 
(Tel) 240-402-1700 
 http://www.fda.gov/FoodGuidances 
 
You may submit either electronic or written comments regarding this guidance at any time.  
Submit electronic comments to http://www.regulations.gov.  Submit written comments on the 
guidance to the Division of Dockets Management (HFA-305), Food and Drug Administration, 
5630 Fishers Lane, rm. 1061, Rockville, MD 20852.  All comments should be identified with the 
docket number FDA-2013-N-1425 listed in the notice of availability that publishes in the 
Federal Register.   
U.S. Department of Health and Human Services 
Food and Drug Administration 
Center for Food Safety and Applied Nutrition  
August 2017 
 
1 
  Contains Nonbinding Recommendations 
 
 
   
TABLE OF CONTENTS
I.  INTRODUCTION ................................................................................................................... 4 
A.  Purpose of this Compliance Guide ...................................................................................... 5 
B.  Key Requirements ................................................................................................................ 5 
II.  WHO MUST COMPLY WITH THE RULE? ........................................................................ 6 
A.  Definitions............................................................................................................................ 6 
B.  Who is exempt from the requirements for the IA Rule? ...................................................... 7 
C.  Do I have to comply with the requirements of the IA rule if I am not required to register 
with the FDA? ............................................................................................................................. 9 
D.  Am I exempted from the rule if my firm is a very small business? ..................................... 9 
III.  WHEN DO I HAVE TO COMPLY WITH THE RULE?....................................................... 9 
IV.  FOOD DEFENSE MEASURES ........................................................................................... 10 
A.  Food Defense Plan ............................................................................................................. 10 
1.  What contents are required in a written food defense plan? .......................................... 10 
2.  Who must sign the food defense plan?........................................................................... 10 
B.  Vulnerability assessment to identify significant vulnerabilities and actionable process 
steps ........................................................................................................................................... 10 
1.  What is a vulnerability assessment? ............................................................................... 10 
2.  What are actionable process steps? ................................................................................ 11 
3.  How do I conduct a vulnerability assessment? .............................................................. 11 
4.  What are the ways to conduct a vulnerability assessment to identify actionable process 
steps? ..................................................................................................................................... 11 
5.  What training requirements are there for the individual(s) conducting a vulnerability 
assessment? ............................................................................................................................ 11 
C.  Mitigation Strategies for Actionable Process Steps ........................................................... 11 
1.  What are mitigation strategies? ...................................................................................... 12 
2.  When am I required to identify and implement mitigation strategies? .......................... 12 
2 
  Contains Nonbinding Recommendations 
 
 
3.  What training requirements are there for the individual(s) identifying and writing 
explanations of mitigation strategies? ................................................................................... 12 
4.  What do I have to do once the mitigation strategies are in place? ................................. 12 
D.  Mitigation Strategies Management Components ............................................................... 12 
E.  Reanalysis .......................................................................................................................... 15 
1.  When must I conduct a reanalysis of the food defense plan? ........................................ 15 
2.  Are there other conditions that would require a reanalysis of the food defense plan or 
sections of the food defense plan? ......................................................................................... 16 
3.  Do I have to make any changes to the food defense plan as a result of the reanalysis? 16 
V.  RECORDS REQUIREMENTS ............................................................................................. 16 
A.  What records am I required to make and keep? ................................................................. 16 
B.  What specific information must I include in my records? ................................................. 17 
C.  What are requirements for records? ................................................................................... 18 
D.  Do records have to be in electronic format? ...................................................................... 18 
E.  Can I enter information on required records at the end of the day or the end of the week?
  18 
F.  How long must I retain my records? .................................................................................. 18 
G.  Can I store my records offsite? .......................................................................................... 19 
H.  Do I have to make required records available to FDA officials? ...................................... 19 
I.  If FDA collects or copies my records, including the food defense plan, are they protected 
from public disclosure? ............................................................................................................. 19 
J.  Can I use existing records to meet the records requirements of the IA rule? .................... 19 
VI.  EDUCATION, TRAINING, AND QUALIFICATIONS ...................................................... 19 
VII. DEFINITIONS (21 CFR 121.3) ............................................................................................ 21 
 
3 
  Contains Nonbinding Recommendations 
 
 
Mitigation Strategies to Protect Food 
Against Intentional Adulteration: What 
You Need to Know About the FDA 
Regulation:  
1
Guidance for Industry   
Small Entity Compliance Guide 
This guidance represents the Food and Drug Administrations (FDA or Agency) current thinking 
on this topic.  It does not establish any rights for any person and does not bind FDA or the 
public.  You can use an alternative approach if it satisfies the requirements of the applicable 
statutes and regulations.  To discuss an alternative approach, contact the FDA staff responsible 
for this guidance using the contact information on the title page. 
I.  INTRODUCTION 
The FDA Food Safety Modernization Act (FSMA) directs the Food and Drug Administration 
(FDA) as the food regulatory agency of the U.S. Department of Health and Human Services to 
better protect public health by, among other things, adopting a modern, preventive, and risk-
based approach to food safety regulation.  On May 27, 2016, FDA published in the Federal 
Register a final rule, Mitigation Strategies to Protect Food Against Intentional Adulteration (IA 
rule) (81 FR 34165), that creates new requirements for the production of food by registered food 
facilities to protect the food supply against intentional adulteration.  The final rule became 
effective on July 26, 2016. Compliance dates are staggered  see WHEN DO I HAVE TO 
COMPLY WITH THE RULE? 
 
We have prepared this Small Entity Compliance Guide in accordance with section 212 of the 
Small Business Regulatory Enforcement Fairness Act (Public Law 104-121, as amended by 
                                                 
1 This guidance has been prepared by the Office of Analytics and Outreach in the Center for Food Safety and 
Applied Nutrition at the U.S. Food and Drug Administration. 
4 
  Contains Nonbinding Recommendations 
 
 
Public Law 110-28).  This guidance document is intended to assist small entities in complying 
with the rule set forth in 21 CFR 121 concerning Mitigation Strategies to Protect Food Against 
Intentional Adulteration.  The rule is binding and has the full force and effect of law. 
FDA's guidance documents, including this guidance, do not establish legally enforceable 
responsibilities.  Instead, guidances describe our current thinking on a topic and should be 
viewed only as recommendations, unless specific regulatory or statutory requirements are cited.  
The use of the word should in FDA guidances means that something is suggested or 
recommended, but not required.  
A.  Purpose of this Compliance Guide  
 
This guide was developed to inform domestic and foreign food facilities about the IA rule and 
how to comply with it. It contains important information that may affect your firm. 
 
B.  Key Requirements 
 
Covered facilities must develop and implement a food defense plan that includes an analysis 
of vulnerabilities and implementation of mitigation strategies. 
 
1.  The rule requires a written food defense plan for all covered facilities unless an 
exemption applies (21 CFR 121.5). The written plan must include (21 CFR 121.126): 
  A vulnerability assessment to identify significant vulnerabilities and actionable 
process steps, and associated explanations  
  Mitigation strategies and associated explanations  
  Procedures for food defense monitoring  
  Procedures for food defense corrective actions  
  Procedures for food defense verification  
2.  The rule requires training for certain personnel.   See EDUCATION, TRAINING, AND 
QUALIFICATIONS section (21 CFR 121.4) 
3.  The rule requires covered facilities to maintain the food defense plan as a record as well 
as records for training, food defense monitoring, food defense corrective actions, and 
food defense verification. (21 CFR 121.126(c), 121.140(c), 121.145(b), and 121.150(c)) 
4.  The rule requires reanalysis of the food defense plan. (21 CFR 121.157) 
 
 
 
5 
  Contains Nonbinding Recommendations 
 
 
II.  WHO MUST COMPLY WITH THE RULE?  
The requirements of this rule apply to facilities  either in the U.S. or any other country  that are 
required to register with FDA as food facilities because they manufacture/process, pack, or hold 
human food for consumption in the U.S. (21 CFR 121.1) 
A.  Definitions  
 
The IA rule uses a number of terms in very specific ways. A full list of these terms appears in 
this guide on page 21. The terms defined here and in the section entitled Who is exempt from 
the requirements for Mitigation Strategies to Protect Food Against Intentional Adulteration? 
will help you determine if your business is subject to the rule. (21 CFR 121.3) 
Table 1--Key Terms Used in Part 121 
Term  Definition 
Facility  Any establishment, structure, or structures under one 
ownership at one general physical location, or a mobile facility 
traveling to multiple locations, that manufactures/processes, 
packs, or holds food for consumption in the U.S. 
Manufacturing/Processing  Making food from one or more ingredients, or creating, 
preparing, treating, modifying or manipulating food, including 
food crops or ingredients. 
Packing  Placing food into a container other than a container that 
directly contacts the food and that the consumer receives, 
including incidental activities to ensure the safe or effective 
packing of that food such as sorting, culling, grading, and 
weighing or conveying.  
Holding  Storage of food, including activities ensuring the safe or 
effective storage of a food such as fumigating food during 
storage, and drying/dehydrating raw agricultural commodities 
(when the drying/dehydrating does not create a distinct 
commodity, e.g., drying/dehydrating hay or alfalfa).  Holding 
also includes activities necessary for the distribution of food 
such as blending of a raw agricultural commodity or breaking 
down pallets. 
6 
  Contains Nonbinding Recommendations 
 
 
Mixed-type facility  An establishment that engages in both activities that are 
exempt from registration under section 415 of the Federal 
Food, Drug, and Cosmetic Act and activities that require the 
establishment to be registered.  An example of such a facility is 
a farm mixed-type facility, which is an establishment that is 
a farm, but also conducts activities outside the farm definition 
that require the establishment to be registered. 
B.  Who is exempt from the requirements for the IA Rule?  
 
Table 2--Exemptions for Part 121 
Exemption  Conditions 
Very small businesses   A business (including any subsidiaries and 
affiliates) averaging less than $10,000,000, 
(21 CFR 121.5(a)) 
adjusted for inflation, per year, during the 3-
year period preceding the applicable calendar 
year in sales of human food plus the market 
value of human food manufactured, processed, 
packed, or held without sale (e.g., held for a 
fee). (21 CFR 121.3) 
 
Holding of food, except the holding of food in  Holding of food in liquid storage tanks is 
liquid storage tanks   subject to the IA rule. See DEFINITIONS, 
 
page 21 for the definition of holding. 
(21 CFR 121.5(b)) 
 
Packing, re-packing, labeling, or re-labeling of  See DEFINITIONS, page 21 for the definition 
food where the container that directly contacts  of packing. 
the food remains intact  
(21 CFR 121.5(c)) 
Activities of a farm that are subject to  See FDAs Produce Safety Rule for a 
Standards for Produce Safety, section 419 of  description of these activities  
the Federal Food, Drug, & Cosmetic Act  
(https://www.federalregister.gov/articles/2015/11
/27/2015-28159/standards-for-the-growing-
7 
  Contains Nonbinding Recommendations 
 
 
Exemption  Conditions 
(21 CFR 121.5(d))  harvesting-packing-and-holding-of-produce-for-
human-consumption)  
 
Alcoholic beverages regulated by the Alcohol  Exemption for alcoholic beverages must meet 
and Tobacco Tax and Trade Bureau (TTB) of  the following two conditions: 
the U.S. Treasury Department 
1)   Under the Federal Alcohol 
(21 CFR 121.5(e))  Administration Act (27 U.S.C. 201 et 
seq.) or chapter 51 of subtitle E of the 
Internal Revenue Code of 1986 (26 
U.S.C. 5001 et seq.) the facility is 
required to obtain a permit from, 
register with, or obtain approval of a 
notice or application from the Secretary 
of the Treasury as a condition of doing 
business in the United States, or is a 
foreign facility of a type that would 
require such a permit, registration, or 
approval if it were a domestic facility;  
2)  Under section 415 of the Federal Food, 
Drug, and Cosmetic Act the facility is 
required to register as a facility because 
it is engaged in manufacturing, 
processing, packing, or holding one or 
more alcoholic beverages. 
 
Additionally, this exemption applies to food at 
these facilities that is not an alcoholic 
beverage, if such food is in prepackaged form 
that prevents any direct human contact with 
such food and it constitutes not more than 5 
percent of the overall sales of the facility. 
 
Manufacturing, processing, packing, or holding  If a facility manufactures, processes, packs, or 
of food for animals other than man  holds food for both humans and animals, the 
activities related to human food would be 
(21 CFR 121.5(f)) 
covered under this rule. 
On-farm manufacturing, processing, packing,  See DEFINITIONS, page 21 for definition of 
or holding of the following foods on a farm  mixed-type facility.   
mixed-type facility, when conducted by a small 
8 
  Contains Nonbinding Recommendations 
 
 
Exemption  Conditions 
or very small business if such activities are the 
only activities conducted by the business 
subject to section 418 of the FD&C Act: 
1.  Eggs (in-shell, other than raw agricultural 
commodities, e.g., pasteurized); 
2.  Game Meats (whole or cut, not ground or 
shredded, without secondary ingredients) 
(21 CFR 121.5(g)) 
 
C.  Do I have to comply with the requirements of the IA rule if I am not required to 
register with the FDA? 
 
No. This rule would not apply to you. (21 CFR 121.1) 
D.  Am I exempted from the rule if my firm is a very small business? 
 
You are exempt from the requirements of the IA rule if your firm is a very small business.  
However, you would be required to provide, upon request, documentation sufficient to show that 
your facility meets this exemption.   
III.  WHEN DO I HAVE TO COMPLY WITH THE RULE?  
We encourage you to comply with the IA rule as soon as possible.  However, we are not 
requiring you to comply with the IA rule right away. As shown in the table below, the amount of 
time we are allowing you to comply with the IA rule depends on your particular business. 
Table 3--Compliance Dates for IA Rule Based on Size of Business 
Size of Business  Compliance Date 
Very small businesses (see definition  July 26, 2021 
in Table 2) 
Small businesses, i.e., a business  July 27, 2020 
(including any subsidiaries and 
affiliates) with fewer than 500 full-
9 
  Contains Nonbinding Recommendations 
 
 
time equivalent employees  
 
Other businesses that do not qualify  July 26, 2019 
for exemptions 
IV.  FOOD DEFENSE MEASURES 
A.  Food Defense Plan  
1.  What contents are required in a written food defense plan?  
A food defense plan must include (21 CFR 121.126(b) and 121.310): 
 
  Information adequate to identify the facility (e.g., the name and, when necessary, location 
of the facility) 
  Vulnerability assessment to identify significant vulnerabilities and actionable process 
steps and associated explanations 
  Mitigation strategies and associated explanations 
  Food defense monitoring procedures  
  Food defense corrective action procedures  
  Food defense verification procedures 
  Appropriate signature(s)  
2.  Who must sign the food defense plan?  
The owner, operator, or agent in charge of the facility must sign and date the food defense plan 
upon initial completion of the plan and whenever there are any modifications made to the food 
defense plan. (21 CFR 121.310) 
B.  Vulnerability assessment to identify significant vulnerabilities and actionable process 
steps  
 
You (the owner, operator, or agent in charge of the facility) must conduct, or have conducted, a 
vulnerability assessment to identify any actionable process steps in your facility.  For each point, 
step, or procedure, you must provide a written explanation as to why that point, step, or 
procedure was or was not identified as an actionable process step. (21 CFR 121.130) 
1.  What is a vulnerability assessment?  
10 
  Contains Nonbinding Recommendations 
 
 
A vulnerability assessment is an evaluation of each point, step, or procedure in your food 
operation to identify significant vulnerabilities and actionable process steps.  
2.  What are actionable process steps? 
An actionable process step is a point, step, or procedure in a food process where a significant 
vulnerability exists and at which mitigation strategies can be applied and are essential to 
significantly minimize or prevent the significant vulnerability. (21 CFR 121.3)  Actionable 
process steps are identified during a vulnerability assessment and are facility and process-
specific.  
3.  How do I conduct a vulnerability assessment? 
When conducting a vulnerability assessment the three elements that must be evaluated at each 
point, step, or procedure include (21 CFR 121.130(a)): 
(1) The potential public health impact (e.g., severity and scale) if a contaminant were added; 
(2) The degree of physical access to the product; and 
(3) The ability of an attacker to successfully contaminate the product. 
Additional factors may also be evaluated in the vulnerability assessment, but at a minimum, 
these three elements must be included in the vulnerability assessment for each point, step, or 
procedure.  The assessment must also consider the possibility of an inside attacker. (21 CFR 
121.130(b))  For each point, step or procedure, you must also provide an explanation as to why 
that point, step, or procedure was or was not identified as an actionable process step. (21 CFR 
121.130(c)) 
4.  What are the ways to conduct a vulnerability assessment to identify actionable process 
steps? 
FDA does not prescribe or require a specific methodology for conducting vulnerability 
assessments. Facilities have the option to choose the methodology for conducting a vulnerability 
assessment to identify significant vulnerabilities and actionable process steps.  The main 
requirement is that vulnerability assessments include an evaluation of the three elements 
identified above, and consider the possibility of an inside attacker.   
5.  What training requirements are there for the individual(s) conducting a vulnerability 
assessment?  
See the EDUCATION, TRAINING, AND QUALIFICATIONS section for details on training 
requirements. 
C.  Mitigation Strategies for Actionable Process Steps 
11 
  Contains Nonbinding Recommendations 
 
 
1.  What are mitigation strategies? 
Mitigation strategies are risk-based, reasonably appropriate measures that a person 
knowledgeable about food defense would employ to significantly minimize or prevent 
significant vulnerabilities identified at actionable process steps, and that are consistent with the 
current scientific understanding of food defense at the time of the analysis. (21 CFR 121.3) 
2.  When am I required to identify and implement mitigation strategies? 
You must identify and implement mitigation strategies for each actionable process step identified 
during the vulnerability assessment.  In addition, you must include a written explanation for how 
each strategy significantly minimizes or prevents the significant vulnerability at that actionable 
process step.  FDA provides facilities with the flexibility to determine their own appropriate 
mitigation strategies.  (21 CFR 121.135)   
 
3.  What training requirements are there for the individual(s) identifying and writing 
explanations of mitigation strategies?  
See the EDUCATION, TRAINING, AND QUALIFICATIONS section for details on training 
requirements.  
4.  What do I have to do once the mitigation strategies are in place? 
Once you have identified and implemented the mitigation strategies, you are required to conduct 
activities for food defense monitoring, food defense corrective actions, and food defense 
verification.  (21 CFR 121.138)  See MITIGATION STRATEGIES MANAGEMENT 
COMPONENTS section. 
D.  Mitigation Strategies Management Components 
The rule provides flexibility in the steps needed to ensure that mitigation strategies are properly 
implemented and to correct problems that may arise. These procedures must be written in the 
food defense plan, and are designed to provide assurance that mitigation strategies are 
consistently performed and properly implemented. Mitigation strategies are subject to the 
following mitigation strategies management components as appropriate to ensure the proper 
implementation of the mitigation strategies, taking into account the nature of each mitigation 
strategy and its role in the facility's food defense system (21 CFR 121.138): 
  Food defense monitoring; 
  Food defense corrective actions; and  
  Food defense verification.  
Table 4Mitigation Strategies Management Components  
12 
  Contains Nonbinding Recommendations 
 
 
Function  Explanation  
Food Defense Monitoring          For each mitigation strategy, you must establish and 
(21 CFR 121.140)  implement written procedures for monitoring as 
appropriate to the nature of the mitigation strategy and its 
role in the facilitys food defense system.  Food defense 
monitoring is conducting a planned sequence of 
observations or measurements to assess whether mitigation 
strategies are operating as intended.  (21 CFR 121.3) 
You must monitor the mitigation strategies with adequate 
frequency to provide assurances that they are consistently 
performed.  FDA does not specify any specific monitoring 
frequencies for mitigation strategies.   
Records: All food defense monitoring activities must be 
documented in records and are subject to verification 
requirements and records review.  Records may be 
affirmative records, or exception records.  See RECORDS 
REQUIREMENTS section for more details on specific 
requirements. (21 CFR 121.140(c)(1)) 
Food Defense Corrective Actions  For each mitigation strategy, you must establish and 
(21 CFR 121.145)  implement written procedures for corrective actions as 
appropriate to the nature of the actionable process step and 
the nature of the mitigation strategy.  You must establish 
and implement written food defense corrective action 
procedures that must be taken if the mitigation strategies 
are not properly implemented. Food defense corrective 
action procedures must describe the steps to be taken to 
ensure that: 
  Appropriate action is taken to identify and correct a 
problem that has occurred with implementation of a 
mitigation strategy; and 
  Appropriate action is taken, when necessary, to 
reduce the likelihood that the problem will reoccur.   
 
Records: All food defense corrective actions taken must be 
documented in records and are subject to verification 
requirements and records review. (21 CFR 121.145(b))  
13 
  Contains Nonbinding Recommendations 
 
 
Function  Explanation  
See RECORDS REQUIREMENTS section for more 
details on specific requirements for records. 
Food Defense Verification           Food defense verification is the application of methods, 
(21 CFR 121.150)  procedures, and other evaluations, in addition to food 
defense monitoring, to determine whether a mitigation 
strategy or combination of mitigation strategies is or has 
been operating as intended according to the food defense 
plan. (21 CFR 121.3) 
For each mitigation strategy, you must establish and 
implement procedures for food defense verification.  Food 
defense verification activities must include, as appropriate 
to the nature of the mitigation strategy and its role in the 
facilitys food defense system:  
  Verification that food defense monitoring is being 
conducted as required (21 CFR 121.150(a)(1)); 
  Verification that appropriate decisions about food 
defense corrective actions are being made as 
required (21 CFR 121.150(a)(2)); 
  Verification that mitigation strategies are properly 
implemented and are significantly minimizing or 
preventing the significant vulnerabilities (21 CFR 
121.150(a)(3)); and  
  Verification of reanalysis in accordance with 21 
CFR 121.157 (21 CFR 121.150(a)(4)) 
 
To verify that mitigation strategies are properly 
implemented and are significantly minimizing or 
preventing the significant vulnerabilities, you must conduct 
activities that include the following, as appropriate to the 
facility, the food, and the nature of the mitigation strategy 
and its role in the facilitys food defense system: 
  Review of the food defense monitoring and food 
defense corrective actions records within 
appropriate timeframes to ensure that the records 
14 
  Contains Nonbinding Recommendations 
 
 
Function  Explanation  
are complete, the activities reflected in the records 
occurred in accordance with the food defense plan, 
the mitigation strategies are properly implemented, 
and appropriate decisions were made about food 
defense corrective actions (21 CFR 
121.150(a)(3)(i)); and 
  Other activities appropriate for verification of 
proper implementation of mitigation strategies  (21 
CFR 121.150(a)(3)(ii)) 
If you are conducting verification through other activities 
for verification of proper implementation of mitigation 
strategies according to 21 CFR 121.150(a)(3)(ii), you must 
establish and implement written procedures, including the 
frequency for which they are to be performed.  (21 CFR 
121.150(b))  
Records: All verification activities conducted must be 
documented in records. (21 CFR 121.150(c))  See 
RECORDS REQUIREMENTS section for more details on 
specific requirements for records. 
E.  Reanalysis 
1.  When must I conduct a reanalysis of the food defense plan?   
At a minimum, you must conduct a reanalysis of the entire food defense plan at least once every 
3 years. (21 CFR 121.157(a))  
 
In addition, you must complete reanalysis of the entire food defense plan or the applicable 
portions of the plan (21 CFR 121.157(c)): 
  Before any change in activities (including any change in mitigation strategy) at the 
facility is operative; 
  When necessary within 90-calendar days after production; and 
  Within a reasonable timeframe, providing a written justification is prepared for a 
timeframe that exceeds 90 days after production of the applicable food first begins. 
15 
  Contains Nonbinding Recommendations 
 
 
2.  Are there other conditions that would require a reanalysis of the food defense plan or 
sections of the food defense plan?  
You must also conduct a reanalysis of the entire food defense plan or on the applicable section of 
the food defense plan: 
  Whenever a significant change made in the activities conducted at your facility creates a 
reasonable potential for a new vulnerability or a significant increase in a previously 
identified vulnerability.  (21 CFR 121.157(b)(1)) 
 
  Whenever you become aware of new information about potential vulnerabilities 
associated with the food operation or facility.  (21 CFR 121.157(b)(2)) 
 
  Whenever you find that a mitigation strategy, a combination of mitigation strategies, or 
the food defense plan as a whole is not properly implemented.  (21 CFR 121.157(b)(3)) 
 
  Whenever FDA requires reanalysis to respond to new vulnerabilities, credible threats to 
the food supply, and developments in scientific understanding including, as appropriate, 
results from the Department of Homeland Security biological, chemical, radiological, or 
other terrorism risk assessment. (21 CFR 121.157(b)(4)) 
3.  Do I have to make any changes to the food defense plan as a result of the reanalysis?  
You must revise the written food defense plan if a significant change in the activities conducted 
at your facility creates a reasonable potential for a new vulnerability or a significant increase in a 
previously identified vulnerability.  If after reanalysis it is determined that no changes are 
needed, you must document the basis for the conclusion that no revisions are needed.  (21 CFR 
121.157(d)) 
V.  RECORDS REQUIREMENTS 
A.  What records am I required to make and keep? 
 
You are required to make and keep the records shown in the table below.  
 
Table 5Records that must be kept  
Required Records  Description 
Food defense plan, including:  The food defense plan is a record that is 
16 
  Contains Nonbinding Recommendations 
 
 
  Vulnerability assessment, including  subject to all of the records requirements 
explanations  described in this section, unless otherwise 
  Mitigation strategies, including  noted.  
explanations 
The owner, operator, or agent in charge of the 
  Food defense monitoring procedures  
facility must sign and date the food defense 
  Food defense corrective action 
plan upon initial completion of the plan and 
procedures  
whenever there are any modifications made to 
  Food defense verification procedures 
the food defense plan.  
(21 CFR 121.126(c)) 
   
Records documenting food defense monitoring  Monitoring records may be affirmative records 
of the mitigation strategies (21 CFR  demonstrating the mitigation strategy is 
121.140(c))  functioning as intended.  Exception records, 
demonstrating the mitigation strategy is not 
functioning as intended, may be adequate in 
some circumstances.  
Records documenting food defense corrective   
actions taken (21 CFR 121.145(b)) 
Records documenting food defense verification   
activities (21 CFR 121.150(c))  
Training records must: 
Records documenting required training (21 
CFR 121.4)  (1) Include the date of training, the type of 
training, and the persons trained; and  
 
(2) Be established and maintained in 
 
accordance with other records requirements.  
B.  What specific information must I include in my records? 
 
Records must include (21 CFR 121.305): 
  Information adequate to identify the facility (e.g., the name, and when necessary, the 
location of the facility); 
  The date and, when appropriate, the time of the activity documented; 
  The signature or initials of the person performing the activity; and 
17 
  Contains Nonbinding Recommendations 
 
 
  Where appropriate, the identity of the product and the lot code, if any. 
C.  What are requirements for records?  
 
Records must (21 CFR 121.305): 
  Be kept as original records, true copies (such as photocopies, pictures, scanned copies, 
microfilm, microfiche, or other accurate reproductions of the original records), or 
electronic records; 
  Contain the actual values and observations obtained during food defense monitoring; 
  Be accurate, indelible, and legible; 
  Be created concurrently with performance of the activity documented; and 
  Be as detailed as necessary to provide history of work performed. 
 
D.  Do records have to be in electronic format?  
 
Records do not have to be in electronic format.   
 
Records that are established or maintained for the IA rule that meet the definition of electronic 
records in 21 CFR 11.3(b)(6) are exempt from the requirements of 21 CFR part 11.  However, 
records that satisfy the requirements of 21 CFR 121, but that also are required under other 
applicable statutory provisions or regulations, remain subject to part 11.  (21 CFR 121.305(g)) 
 
E.  Can I enter information on required records at the end of the day or the end of the 
week? 
 
Records must be created concurrently with performance of the activity documented.  
(21 CFR 121.305(d)) 
 
F.  How long must I retain my records? 
 
Records are required to be retained for at least 2 years after they were prepared.  Food defense 
plans must be retained for 2 years after they have stopped being used. 
 
Records that a facility relies on during the 3-year period preceding the applicable calendar year 
to support its status as exempt as a very small business must be retained at the facility as long as 
necessary to support the status of a facility as a very small business during the applicable 
calendar year.  (21 CFR 121.315)  A very small business must, upon request, provide for official 
review documentation sufficient to show that the facility meets this exemption.  Such 
documentation must be retained for 2 years.(21 CFR 121.5(a)).  
18 
  Contains Nonbinding Recommendations 
 
 
G. Can I store my records offsite? 
 
Except for the food defense plan, offsite storage of records is permitted if such records can be 
retrieved and provided onsite within 24 hours of request for official review.  The food defense 
plan must always be on site. Electronic records are considered onsite if they are accessible from 
an onsite location.  If the facility is closed for a prolonged period, the food defense plan may be 
transferred to some other reasonably accessible location but must be returned to the facility 
within 24 hours for official review upon request.  (21 CFR 121.315) 
H. Do I have to make required records available to FDA officials?  
 
Yes.  You must have all records required by this rule available for official review and copying at 
the request of FDA.  FDA will copy records on a case-by-case basis as necessary and 
appropriate.  (21 CFR 121.320) 
 
I.   If FDA collects or copies my records, including the food defense plan, are they 
protected from public disclosure? 
 
Records collected or copied by FDA, including the food defense plan, will be protected from 
public disclosure to the extent allowable under 21 CFR Part 20.  (21 CFR 121.325) 
J.  Can I use existing records to meet the records requirements of the IA rule? 
  
Yes.  You may use existing records kept for other purposes (e.g., records that are kept to comply 
with other Federal, State, or local regulations or for any other reason) to meet the requirements of 
this rule if they contain all of the required information and satisfy the requirements of this rule.  
Existing records may be supplemented as necessary to include all of the required information.    
In addition, records do not need to be kept in one set of records.  If existing records contain some 
of the required information, any new information required may be kept either separately or 
combined with the existing records.  (21 CFR 121.330)  
VI.  EDUCATION, TRAINING, AND QUALIFICATIONS 
1.  What qualifications and/or training do I need to perform the activities within the IA 
rule? 
An individual performing activities required subpart C of this rule must be a qualified individual.  
A qualified individual is a person who has the education, training, or experience (or a 
combination thereof) necessary to perform an activity within the IA rule, as appropriate to the 
individuals assigned duties.  A qualified individual may be, but is not required to be, an 
19 
  Contains Nonbinding Recommendations 
 
 
employee of the facility.  Additionally, certain activities within the IA rule have specific training 
requirements as detailed in the chart below.  (21 CFR 121.4)  
Table 6Education, training, and qualification requirements  
Assigned Duties  Education, Training, and Qualification 
Requirements 
Individuals assigned to an actionable process    Must be a qualified individual, i.e.,  have the 
step (including temporary and seasonal  appropriate education, training, or experience 
personnel)  (or a combination thereof) necessary to 
properly implement the mitigation strategy or 
combination of mitigation strategies at the 
actionable process step (21 CFR 121.4(b)(1)); 
and  
  Must receive training in food defense 
awareness (21 CFR 121.4(b)(2)) 
Supervisors of those individuals assigned to    Must be a qualified individual, i.e.,  have the 
an actionable process step (including  appropriate education, training, or experience 
temporary and seasonal personnel)  (or a combination thereof) necessary to 
properly implement the mitigation strategy or 
combination of mitigation strategies at the 
actionable process step (21 CFR 121.4(b)(1));  
  Must receive training in food defense 
awareness (21 CFR 121.4(b)(2)); and 
   
Supervisor responsible for ensuring    Must have a combination of education, 
compliance with Part 121  training, and experience necessary to 
supervise the activities (21 CFR 121.4(d)) 
Individual(s) conducting or overseeing:    Must be a qualified individual, i.e.,  have the 
education, training, or experience (or a 
  the preparation of the food defense plan,  
combination thereof) necessary to properly 
  the vulnerability assessment,  
perform the activities (21 CFR 121.4(c)(1)); 
  the identification and explanation of 
and 
mitigation strategies, and  
  Must have successfully completed training 
  reanalysis 
for the specific function at least equivalent to 
 
that received under a standardized curriculum 
recognized as adequate by FDA or be 
This individual may be, but is not required to 
otherwise qualified through job experience to 
be, an employee of the facility.   
conduct these activities (21 CFR 121.4(c)(2)). 
20 
  Contains Nonbinding Recommendations 
 
 
Note that the requirements can be satisfied by 
either the individual conducting a specified 
activity or the individual overseeing that 
activity. 
 
Records: Training activities must be documented in records.  Records must include the date of 
training, the type of training, and the persons trained.  (21 CFR 121.4(e))  See RECORDS 
REQUIREMENTS section for more details on specific requirements for records. 
 
VII.  DEFINITIONS (21 CFR 121.3) 
Actionable process step means a point, step, or procedure in a food process where a significant 
vulnerability exists and at which mitigation strategies can be applied and are essential to 
significantly minimize or prevent the significant vulnerability.  
Adequate means that which is needed to accomplish the intended purpose in keeping with good 
public health practices. 
Affiliate means any facility that controls, is controlled by, or is under common control with 
another facility. 
Calendar day means every day as shown on the calendar. 
Contaminant means, for purposes of this part, any biological, chemical, physical, or radiological 
agent that may be added to food to intentionally cause illness, injury, or death.   
Facility means a domestic facility or a foreign facility that is required to register under section 
415 of the Federal Food, Drug, and Cosmetic Act, in accordance with the requirements of CFR 
Title 21, chapter 1, part 1, subpart H. 
Farm means farm as defined in  21 CFR 1.227. 
FDA means the Food and Drug Administration. 
Food means:  (1) Articles used for food or drink for man or other animals, (2) chewing gum, and 
(3) articles used for components of any such article, and includes raw materials and ingredients. 
Food defense means, for purposes of this part, the effort to protect food from intentional acts of 
adulteration where there is an intent to cause wide scale public health harm. 
21 
  Contains Nonbinding Recommendations 
 
 
Food defense monitoring means to conduct a planned sequence of observations or measurements 
to assess whether mitigation strategies are operating as intended.   
Food defense verification means the application of methods, procedures, and other evaluations, 
in addition to food defense monitoring, to determine whether a mitigation strategy or 
combination of mitigation strategies is or has been operating as intended according to the food 
defense plan. 
Full-time equivalent employee is a term used to represent the number of employees of a business 
entity for the purpose of determining whether the business qualifies as a small business.  The 
number of full-time equivalent employees is determined by dividing the total number of hours of 
salary or wages paid directly to employees of the business entity and of all of its affiliates and 
subsidiaries by the number of hours of work in 1 year, 2,080 hours (i.e., 40 hours x 52 weeks).  If 
the result is not a whole number, round down to the next lowest whole number. 
Holding means storage of food and also includes activities performed incidental to storage of 
food (e.g., activities performed for the safe or effective storage of that food, such as fumigating 
food during storage, and drying/dehydrating raw agricultural commodities when the 
drying/dehydrating does not create a distinct commodity (such as drying/dehydrating hay or 
alfalfa)).  Holding also includes activities performed as a practical necessity for the distribution 
of that food (such as blending of the same raw agricultural commodity and breaking down 
pallets), but does not include activities that transform a raw agricultural commodity into a 
processed food as defined in section 201(gg) of the Federal Food, Drug, and Cosmetic Act.  
Holding facilities could include warehouses, cold storage facilities, storage silos, grain elevators, 
and liquid storage tanks.   
Manufacturing/processing means making food from one or more ingredients, or synthesizing, 
preparing, treating, modifying or manipulating food, including food crops or ingredients.  
Examples of manufacturing/processing activities include:  Baking, boiling, bottling, canning, 
cooking, cooling, cutting, distilling, drying/dehydrating raw agricultural commodities to create a 
distinct commodity (such as drying/dehydrating grapes to produce raisins), evaporating, 
eviscerating, extracting juice, formulating, freezing, grinding, homogenizing, irradiating, 
labeling, milling, mixing, packaging (including modified atmosphere packaging), pasteurizing, 
peeling, rendering, treating to manipulate ripening, trimming, washing, or waxing.  For farms 
and farm mixed-type facilities, manufacturing/processing does not include activities that are part 
of harvesting, packing, or holding.  
Mitigation strategies mean those risk-based, reasonably appropriate measures that a person 
knowledgeable about food defense would employ to significantly minimize or prevent 
significant vulnerabilities identified at actionable process steps, and that are consistent with the 
current scientific understanding of food defense at the time of the analysis. 
Mixed-type facility means an establishment that engages in both activities that are exempt from 
registration under section 415 of the Federal Food, Drug, and Cosmetic Act and activities that 
require the establishment to be registered.  An example of such a facility is a farm mixed-type 
22 
  Contains Nonbinding Recommendations 
 
 
facility, which is an establishment that is a farm, but also conducts activities outside the farm 
definition that require the establishment to be registered. 
Packing means placing food into a container other than packaging the food and also includes re-
packing and activities performed incidental to packing or re-packing a food (e.g., activities 
performed for the safe or effective packing or re-packing of that food (such as sorting, culling, 
grading, and weighing or conveying incidental to packing or re-packing)), but does not include 
activities that transform a raw agricultural commodity into a processed food as defined in section 
201(gg) of the Federal Food, Drug, and Cosmetic Act.  
Qualified individual means a person who has the education, training, or experience (or a 
combination thereof) necessary to perform an activity required under subpart C of this part, as 
appropriate to the individuals assigned duties.  A qualified individual may be, but is not required 
to be, an employee of the establishment.  
Significant vulnerability means a vulnerability that, if exploited, could reasonably be expected to 
cause wide scale public health harm.  A significant vulnerability is identified by a vulnerability 
assessment conducted by a qualified individual, that includes consideration of the following:  (1) 
Potential public health impact (e.g., severity and scale) if a contaminant were added, (2) degree 
of physical access to the product, and (3) ability of an attacker to successfully contaminate the 
product.  The assessment must consider the possibility of an inside attacker. 
Significantly minimize means to reduce to an acceptable level, including to eliminate. 
Small business means, for purposes of this part, a business (including any subsidiaries and 
affiliates) employing fewer than 500 full-time equivalent employees. 
Subsidiary means any company which is owned or controlled directly or indirectly by another 
company.  
Very small business means, for purposes of this part, a business (including any subsidiaries and 
affiliates) averaging less than $10,000,000, adjusted for inflation, per year, during the 3-year 
period preceding the applicable calendar year in sales of human food plus the market value of 
human food manufactured, processed, packed, or held without sale (e.g., held for a fee). 
Vulnerability means the susceptibility of a point, step, or procedure in a facilitys food process to 
intentional adulteration.  
You means, for purposes of this part, the owner, operator, or agent in charge of a facility.  
 
 
23