On May 27, 2016, FDA published its final rule regarding Mitigation Strategies to Protect Food Against Intentional Adulteration (the “Food Defense Rule”). Reflecting an effort to prevent wide-scale public harm through the nation’s food supply from acts of terrorism, the rule will require covered domestic and foreign food facilities for the first time to prepare written food defense plans, ensure that personnel are properly trained, and maintain appropriate records.  The Rule focuses on larger companies whose food products reach greater numbers of people.  Smaller companies and specific sectors of the industry are exempt from the requirements.

The Food Defense Rule is the seventh and final major substantive rule to implement the landmark provisions of the FDA Food Safety Modernization Act (FSMA), the most sweeping reform of the nation’s food safety system in seventy years. Here are the highlights from the Final Rule:

  • Focus on Inside Attacks and Massive Public Health Impact: FDA clarifies in the Final Rule that its focus is on “the inside attacker” who gains access to a facility with the intention of causing wide-scale public harm or massive public health impact through an act of terrorism directed at the nation’s food supply. FDA explains that its focus on internal attacks is supported by consultations with the intelligence community, and with what FDA characterizes as a general trend in recent terrorist activity towards locally-planned and -implemented attacks.
  • Written Food Defense Plans Based on Vulnerability Assessments: Each facility will be required to develop written food defense plans based on a vulnerability assessment and an identification of “actionable process steps” where mitigation strategies are needed to minimize or prevent a “significant vulnerability” of potential wide scale public harm. The assessment must include an explanation as to why every step in the food operation was or was not identified as an “actionable process step” where food defense mitigation is necessary. Monitoring activities must be documented, the effectiveness of mitigation strategies must be verified, and corrective actions must be taken to address failed mitigation efforts. The food defense plan must be reanalyzed at least once every three years or based upon new information or FDA request.
  • Comparison of “Actionable Process Steps” to HARPC and HACCP: The Food Defense Rule takes a comprehensive and systematic approach to intentional adulteration that is similar to Hazard Analysis and Critical Control Points (HACCP) or Hazard Analysis and Risk-Based Preventive Controls (HARPC) analysis, but with some important differences. Food defense strategies are more likely to focus on reducing physical access to a process step and not on how a process step should be implemented pursuant to HACCP or HARPC. The bottom line is that most facilities covered by the Food Defense Rule also will have a HACCP or HARPC plan, but those plans will not be sufficient to address intentional adulteration for the Food Defense Rule.
  • Whatever You Are Doing Already – It Is Likely Not Enough: Firms covered by the Final Rule may already be subject to or participate in food defense activities through other government agencies or voluntary industry organizations. Although participation in such programs may decrease a facility’s vulnerability to intentional adulteration, FDA emphasizes that compliance with these other standards will not be sufficient to comply with the Food Defense Rule. However, existing records may be used to comply with the new Rule, and FDA might consider participation in such programs when prioritizing risk-based inspections of food facilities.
  • TrainingAll personnel assigned to an “actionable process step” must be “qualified individuals,” and individuals who prepare the food defense plan must either complete training under a standardized curriculum recognized as adequate by FDA or have equivalent knowledge from work experience. FDA intends to train inspectors using the same curriculum.
  • Exemptions: The Food Defense Rule exempts businesses that average less than $10,000,000 per year, during the preceding three-year period, in sales of human food plus the market value of food manufactured, processed, or held without sale. FDA’s statutory mandate is to focus on foods for which there is the highest risk of intentional adulteration, and FDA has interpreted “high risk” to mean large manufacturers whose products reach the greatest number of people. Other important exemptions include “farm” activities that are subject to the FSMA Produce Safety Rule, and facilities engaged in the “holding” of food other than in liquid storage tanks.
  • Compliance Dates: The Food Defense Rule is effective July 26, 2016. Most businesses will have three years after the effective date to comply. Small businesses with less than 500 employees will have four years to comply. Very small businesses not otherwise required to comply with the rule must still, upon request, provide documentation that they are eligible for the exemption, and will have five years to comply with the rule.


The Food Defense Rule is a unique rule that adds to the already extensive requirements imposed on domestic and foreign food facilities under FSMA. Each covered entity will be required to develop a food defense plan to address risks likely not covered by their existing food safety plans, and compliance with other agency or industry food defense programs likely will not be sufficient.  Covered entities should review the new requirements and integrate focused food defense mitigation strategies into their safety plans.