PART 121—MITIGATION STRATEGIES TO PROTECT FOOD AGAINST INTENTIONAL ADULTERATION Authority: 21 U.S.C. 331, 342, 350g, 350(i), 371, 374. Source: 81 FR 34219, May 27, 2016, unless otherwise noted. Subpart A—General Provisions § 121.1 Applicability. This part applies to the owner, operator or agent in charge of a domestic or foreign food facility that manufactures/processes, packs, or holds food for consumption in the United States and is required to register under section 415 of the Federal Food, Drug, and Cosmetic Act, unless one of the exemptions in § 121.5 applies. § 121.3 Definitions. The definitions and interpretations of terms in section 201 of the Federal Food, Drug, and Cosmetic Act are applicable to such terms when used in this part. The following definitions also apply: Actionable process step Adequate Affiliate Calendar day Contaminant Facility Farm FDA Food Food defense Food defense monitoring Food defense verification Full-time equivalent employee i.e., Holding e.g., Manufacturing/processing Mitigation strategies Mixed-type facility Packing e.g., Qualified individual Significant vulnerability e.g., Significantly minimize Small business Subsidiary Very small business e.g., Vulnerability You § 121.4 Qualifications of individuals who perform activities under subpart C of this part. (a) Applicability. (b) Qualifications of individuals assigned to an actionable process step. (1) Be a qualified individual as that term is defined in § 121.3— i.e., (2) Receive training in food defense awareness. (c) Qualifications of individuals for certain activities described in paragraph (c)(3) of this section. (1) Be a qualified individual as that term is defined in § 121.3— i.e., (2) Have successfully completed training for the specific function at least equivalent to that received under a standardized curriculum recognized as adequate by FDA or be otherwise qualified through job experience to conduct the activities. Job experience may qualify an individual to perform these functions if such experience has provided an individual with knowledge at least equivalent to that provided through the standardized curriculum. This individual may be, but is not required to be, an employee of the facility. (3) One or more qualified individuals must do or oversee: (i) The preparation of the food defense plan as required in § 121.126; (ii) The conduct of a vulnerability assessment as required in § 121.130; (iii) The identification and explanation of the mitigation strategies as required in § 121.135; and (iv) Reanalysis as required in § 121.157. (d) Additional qualifications of supervisory personnel. (e) Records. (1) Include the date of training, the type of training, and the persons trained; and (2) Be established and maintained in accordance with the requirements of subpart D of this part. § 121.5 Exemptions. (a) This part does not apply to a very small business, except that a very small business must, upon request, provide for official review documentation sufficient to show that the facility meets this exemption. Such documentation must be retained for 2 years. (b) This part does not apply to the holding of food, except the holding of food in liquid storage tanks. (c) This part does not apply to the packing, re-packing, labeling, or re-labeling of food where the container that directly contacts the food remains intact. (d) This part does not apply to activities of a farm that are subject to section 419 of the Federal Food, Drug, and Cosmetic Act (Standards for Produce Safety). (e)(1) This part does not apply with respect to alcoholic beverages at a facility that meets the following two conditions: (i) Under the Federal Alcohol Administration Act (27 U.S.C. 201 et seq. et seq. (ii) Under section 415 of the Federal Food, Drug, and Cosmetic Act the facility is required to register as a facility because it is engaged in manufacturing, processing, packing, or holding one or more alcoholic beverages. (2) This part does not apply with respect to food that is not an alcoholic beverage at a facility described in paragraph (e)(1) of this section, provided such food: (i) Is in prepackaged form that prevents any direct human contact with such food; and (ii) Constitutes not more than 5 percent of the overall sales of the facility, as determined by the Secretary of the Treasury. (f) This part does not apply to the manufacturing, processing, packing, or holding of food for animals other than man. (g) This part does not apply to on-farm manufacturing, processing, packing, or holding of the following foods on a farm mixed-type facility, when conducted by a small or very small business if such activities are the only activities conducted by the business subject to section 418 of the Federal Food, Drug, and Cosmetic Act. (1) Eggs (in-shell, other than raw agricultural commodities, e.g., (2) Game meats (whole or cut, not ground or shredded, without secondary ingredients). Subpart B—Reserved Subpart C—Food Defense Measures § 121.126 Food defense plan. (a) Requirement for a food defense plan. (b) Contents of a food defense plan. (1) The written vulnerability assessment, including required explanations, to identify significant vulnerabilities and actionable process steps as required by § 121.130(c); (2) The written mitigation strategies, including required explanations, as required by § 121.135(b); (3) The written procedures for the food defense monitoring of the implementation of the mitigation strategies as required by § 121.140(a); (4) The written procedures for food defense corrective actions as required by § 121.145(a)(1); and (5) The written procedures for food defense verification as required by § 121.150(b). (c) Records. § 121.130 Vulnerability assessment to identify significant vulnerabilities and actionable process steps. (a) Requirement for a vulnerability assessment. (1) The potential public health impact ( e.g., (2) The degree of physical access to the product; and (3) The ability of an attacker to successfully contaminate the product. (b) Inside attacker. (c) Written vulnerability assessment. § 121.135 Mitigation strategies for actionable process steps. (a) You must identify and implement mitigation strategies at each actionable process step to provide assurances that the significant vulnerability at each step will be significantly minimized or prevented and the food manufactured, processed, packed, or held by your facility will not be adulterated under section 402 of the Federal Food, Drug, and Cosmetic Act. For each mitigation strategy implemented at each actionable process step, you must include a written explanation of how the mitigation strategy sufficiently minimizes or prevents the significant vulnerability associated with the actionable process step. (b) Mitigation strategies and accompanying explanations must be written. § 121.138 Mitigation strategies management components. Mitigation strategies required under§ 121.135 are subject to the following mitigation strategies management components as appropriate to ensure the proper implementation of the mitigation strategies, taking into account the nature of each such mitigation strategy and its role in the facility's food defense system: (a) Food defense monitoring in accordance with § 121.140; (b) Food defense corrective actions in accordance with § 121.145; and (c) Food defense verification in accordance with § 121.150. § 121.140 Food defense monitoring. As appropriate to the nature of the mitigation strategy and its role in the facility's food defense system: (a) Written procedures. (b) Food defense monitoring. (c) Records Requirement to document food defense monitoring. (2) Exception records. § 121.145 Food defense corrective actions. (a) Food defense corrective action procedures. (1) You must establish and implement written food defense corrective action procedures that must be taken if mitigation strategies are not properly implemented. (2) The food defense corrective action procedures must describe the steps to be taken to ensure that: (i) Appropriate action is taken to identify and correct a problem that has occurred with implementation of a mitigation strategy; and (ii) Appropriate action is taken, when necessary, to reduce the likelihood that the problem will recur. (b) Records. § 121.150 Food defense verification. (a) Food defense verification activities. (1) Verification that food defense monitoring is being conducted as required by § 121.138 (and in accordance with § 121.140); (2) Verification that appropriate decisions about food defense corrective actions are being made as required by § 121.138 (and in accordance with § 121.145); (3) Verification that mitigation strategies are properly implemented and are significantly minimizing or preventing the significant vulnerabilities. To do so, you must conduct activities that include the following, as appropriate to the facility, the food, and the nature of the mitigation strategy and its role in the facility's food defense system: (i) Review of the food defense monitoring and food defense corrective actions records within appropriate timeframes to ensure that the records are complete, the activities reflected in the records occurred in accordance with the food defense plan, the mitigation strategies are properly implemented, and appropriate decisions were made about food defense corrective actions; and (ii) Other activities appropriate for verification of proper implementation of mitigation strategies; and (4) Verification of reanalysis in accordance with § 121.157. (b) Written procedures. (c) Documentation. § 121.157 Reanalysis. (a) You must conduct a reanalysis of the food defense plan, as a whole at least once every 3 years; (b) You must conduct a reanalysis of the food defense plan as a whole, or the applicable portion of the food defense plan: (1) Whenever a significant change made in the activities conducted at your facility creates a reasonable potential for a new vulnerability or a significant increase in a previously identified vulnerability; (2) Whenever you become aware of new information about potential vulnerabilities associated with the food operation or facility; (3) Whenever you find that a mitigation strategy, a combination of mitigation strategies, or the food defense plan as a whole is not properly implemented; and (4) Whenever FDA requires reanalysis to respond to new vulnerabilities, credible threats to the food supply, and developments in scientific understanding including, as appropriate, results from the Department of Homeland Security biological, chemical, radiological, or other terrorism risk assessment. (c) You must complete such reanalysis required by paragraphs (a) and (b) of this section and implement any additional mitigation strategies needed to address the significant vulnerabilities identified, if any: (1) Before any change in activities (including any change in mitigation strategy) at the facility is operative; (2) When necessary within 90-calendar days after production; and (3) Within a reasonable timeframe, providing a written justification is prepared for a timeframe that exceeds 90 days after production of the applicable food first begins. (d) You must revise the written food defense plan if a significant change in the activities conducted at your facility creates a reasonable potential for a new vulnerability or a significant increase in a previously identified vulnerability or document the basis for the conclusion that no revisions are needed. Subpart D—Requirements Applying to Records That Must Be Established and Maintained § 121.301 Records subject to the requirements of this subpart. (a) Except as provided by paragraph (b) of this section, all records required by subpart C of this part are subject to all requirements of this subpart. (b) The requirements of § 121.310 apply only to the written food defense plan. § 121.305 General requirements applying to records. Records must: (a) Be kept as original records, true copies (such as photocopies, pictures, scanned copies, microfilm, microfiche, or other accurate reproductions of the original records), or electronic records; (b) Contain the actual values and observations obtained during food defense monitoring; (c) Be accurate, indelible, and legible; (d) Be created concurrently with performance of the activity documented; (e) Be as detailed as necessary to provide history of work performed; and (f) Include: (1) Information adequate to identify the facility ( e.g., (2) The date and, when appropriate, the time of the activity documented; (3) The signature or initials of the person performing the activity; and (4) Where appropriate, the identity of the product and the lot code, if any. (g) Records that are established or maintained to satisfy the requirements of this part and that meet the definition of electronic records in § 11.3(b)(6) of this chapter are exempt from the requirements of part 11 of this chapter. Records that satisfy the requirements of this part, but that also are required under other applicable statutory provisions or regulations, remain subject to part 11 of this chapter. § 121.310 Additional requirements applying to the food defense plan. The owner, operator, or agent in charge of the facility must sign and date the food defense plan: (a) Upon initial completion; and (b) Upon any modification. § 121.315 Requirements for record retention. (a)(1) All records required by this part must be retained at the facility for at least 2 years after the date they were prepared. (2) Records that a facility relies on during the 3-year period preceding the applicable calendar year to support its status as exempt as a very small business must be retained at the facility as long as necessary to support the status of a facility as a very small business during the applicable calendar year. (b) The food defense plan must be retained for at least 2 years after its use is discontinued. (c) Except for the food defense plan, offsite storage of records is permitted if such records can be retrieved and provided onsite within 24 hours of request for official review. The food defense plan must remain onsite. Electronic records are considered to be onsite if they are accessible from an onsite location. (d) If the facility is closed for a prolonged period, the food defense plan may be transferred to some other reasonably accessible location but must be returned to the facility within 24 hours for official review upon request. § 121.320 Requirements for official review. All records required by this part must be made promptly available to a duly authorized representative of the Secretary of Health and Human Services for official review and copying upon oral or written request. § 121.325 Public disclosure. Records required by this part will be protected from public disclosure to the extent allowable under part 20 of this chapter. § 121.330 Use of existing records. (a) Existing records ( e.g., (b) The information required by this part does not need to be kept in one set of records. If existing records contain some of the required information, any new information required by this part may be kept either separately or combined with the existing records. Subpart E—Compliance § 121.401 Compliance. (a) The operation of a facility that manufactures, processes, packs, or holds food for sale in the United States if the owner, operator, or agent in charge of such facility is required to comply with, and is not in compliance with, section 418 of the Federal Food, Drug, and Cosmetic Act or subparts C or D of this part is a prohibited act under section 301(uu) of the Federal Food, Drug, and Cosmetic Act. (b) The failure to comply with section 420 of the Federal Food, Drug, and Cosmetic Act or subparts C or D of this part is a prohibited act under section 301(ww) of the Federal Food, Drug, and Cosmetic Act.