34166 Federal Register / Vol. 81, No. 103 / Friday, May 27, 2016 / Rules and Regulations

DEPARTMENT OF HEALTH AND C. Require Measures Only in the Event of pack, or hold food and are required to HUMAN SERVICES a Credible Threat register under section 415 of the FD&C D. General Comments on Implementation Act (21 U.S.C. 350d). Section 419 of the Food and Drug Administration and Compliance FD&C Act (21 U.S.C. 350h) addresses E. Comments on Requests for Additional Exemptions intentional adulteration in the context 21 CFR Parts 11 and 121 F. Other General Comments of fruits and vegetables that are raw [Docket No. FDA–2013–N–1425] G. Other Issues Discussed in the Proposed agricultural commodities. Section 420 of Rule the FD&C Act (21 U.S.C. 350i) addresses RIN 0910–AG63 IV. Subpart A: Comments on Specific intentional adulteration in the context Provisions of high-risk foods and exempts farms Mitigation Strategies To Protect Food A. Revisions to Definitions Also Used in except for farms that produce milk. FDA Against Intentional Adulteration Section 415 Registration Regulations (21 is implementing the intentional CFR Part 1, Subpart H) and Section 414 AGENCY: Food and Drug Administration, Recordkeeping Regulations (21 CFR Part adulteration provisions in sections 418, HHS. 1, Subpart J) 419, and 420 of the FD&C Act in this rulemaking. ACTION: Final rule. B. Other Definitions That We Proposed To Establish in Part 121 The purpose of this rule is to protect SUMMARY: The Food and Drug C. Additional Definitions to Clarify Terms food from intentional acts of Administration (FDA or we) is issuing Not Defined in the Proposed Rule adulteration where there is an intent to D. Comments Asking FDA to Establish cause wide scale public health harm. this final rule to require domestic and Additional Definitions or Otherwise foreign food facilities that are required Clarify Terms Not Defined in the Rule This rule applies to both domestic and to register under the Federal Food, Drug, E. Proposed § 121.5—Exemptions foreign facilities that are required to and Cosmetic Act (the FD&C Act) to V. Subpart C: Comments on Food Defense register under section 415 of the FD&C address hazards that may be introduced Measures Act. This rule establishes several with the intention to cause wide scale A. Proposed § 121.126—Requirement for a exemptions as follows: public health harm. These food facilities Food Defense Plan • The rule does not apply to a very are required to conduct a vulnerability B. Proposed § 121.130—Identification of Actionable Process Steps small business (i.e., a business, assessment to identify significant C. Proposed § 121.135—Focused Mitigation including any subsidiaries or affiliates, vulnerabilities and actionable process Strategies for Actionable Process Steps averaging less than $10,000,000, steps and implement mitigation D. Final § 121.138—Mitigation Strategies adjusted for inflation, per year, during strategies to significantly minimize or Management Components the 3-year period preceding the prevent significant vulnerabilities E. Proposed § 121.140—Monitoring applicable calendar year in both sales of identified at actionable process steps in F. Proposed § 121.145—Corrective Actions human food plus the market value of a food operation. FDA is issuing these G. Proposed § 121.150—Verification human food manufactured, processed, requirements as part of our H. Proposed § 121.160—Training (Final § 121.4) packed, or held without sale, e.g., held implementation of the FDA Food Safety VI. Subpart D: Comments on Requirements for a fee), except that the facility is Modernization Act (FSMA). Applying to Records That Must Be required to provide for official review, DATES: This rule is effective July 26, Established and Maintained upon request, documentation sufficient 2016. See section VIII for compliance A. Proposed § 121.301—Records Subject to to show that the facility qualifies for this dates. the Requirements of This Subpart D exemption. B. Proposed § 121.305—General • This rule does not apply to the FOR FURTHER INFORMATION CONTACT: Requirements Applying to Records Ryan Newkirk, Center for Food Safety C. Proposed § 121.310—Additional holding of food, except the holding of and Applied Nutrition (HFS–005), Food Requirements Applying to the Food food in liquid storage tanks. and Drug Administration, 5100 Paint Defense Plan • This rule does not apply to the Branch Pkwy., College Park, MD 20740, D. Proposed § 121.315—Requirements for packing, re-packing, labeling, or re- 240–402–3712, email: Ryan.Newkirk@ Record Retention labeling of food where the container that E. Proposed § 121.320—Requirements for fda.hhs.gov. directly contacts the food remains Official Review intact. SUPPLEMENTARY INFORMATION: F. Proposed § 121.325—Public Disclosure G. Proposed § 121.330—Use of Existing • This rule does not apply to Table of Contents Records activities of a farm that are subject to Executive Summary VII. Subpart E: Comments on Compliance— section 419 of the Federal Food, Drug, Purpose and Coverage of the Rule Proposed § 121.401 and Cosmetic Act (Standards for VIII. Effective and Compliance Dates Summary of the Major Provisions of the Produce Safety). IX. Executive Order 13175 Rule • X. Final Regulatory Impact Analysis This rule does not apply with Costs and Benefits XI. Paperwork Reduction Act of 1995 respect to alcoholic beverages at a I. Background XII. Analysis of Environmental Impact facility that meets certain conditions. A. FDA Food Safety Modernization Act XIII. Federalism • B. Proposed Rule on Intentional This rule does not apply to the XIV. References Adulteration manufacturing, processing, packing, or C. Appendix 4 to Draft Risk Assessment Executive Summary holding of food for animals other than D. Public Comments man. II. Legal Authority Purpose and Coverage of the Rule • This rule does not apply to on-farm A. Section 103 of FSMA This regulation implements three manufacturing, processing, packing, or B. Section 106 of FSMA provisions of the FD&C Act, as amended holding by a small or very small C. Intrastate Activities III. General Comments on the Proposed Rule by FSMA, that relate to the intentional business of certain foods identified as A. Comments on Overall Framework for adulteration of food. Section 418 of the having low-risk production practices if the Regulatory Approach FD&C Act (21 U.S.C. 350g) addresses such activities are the only activities B. One Set of Requirements Under Sections intentional adulteration in the context conducted by the business subject to 418 and 420 of the FD&C Act of facilities that manufacture, process, section 418 of the FD&C Act.

VerDate Sep<11>2014 19:43 May 26, 2016 Jkt 238001 PO 00000 Frm 00002 Fmt 4701 Sfmt 4700 E:\FR\FM\27MYR4.SGM 27MYR4 mstockstill on DSK3G9T082PROD with RULES4 Federal Register / Vol. 81, No. 103 / Friday, May 27, 2016 / Rules and Regulations 34167

Summary of the Major Provisions of the • Conduct a reanalysis of the food that they are required ‘‘as appropriate to Final Rule defense plan (§ 121.157). ensure the proper implementation of the • Ensure that all individuals who This rule establishes various food mitigation strategies, taking into account perform required food defense activities defense measures that an owner, the nature of each such mitigation are qualified to perform their assigned operator, or agent in charge of a facility strategy and its role in the facility’s food duties (§ 121.4). is required to implement to protect defense system.’’ • Establish and maintain certain • We revised the terminology used for against the intentional adulteration of records, including the written food the food defense management food. Specifically: defense plan (vulnerability assessment, • Prepare and implement a written components such that monitoring, mitigation strategies and procedures for corrective actions, and verification are food defense plan that includes a food defense monitoring, corrective vulnerability assessment to identify now food defense monitoring, food actions, and verification) and defense corrective actions, and food significant vulnerabilities and documentation related to training of actionable process steps, mitigation defense verification. personnel. All records are subject to • We made the requirement to strategies, and procedures for food certain general recordkeeping and document food defense monitoring defense monitoring, corrective actions, record retention requirements more flexible by providing for use of and verification (§ 121.126). (§§ 121.301 to 121.330). exception records. • Identify any significant • The effective date is 60 days after • We made the food defense vulnerabilities and actionable process this final rule is published. However, corrective actions requirement more steps by conducting a vulnerability we are providing for a longer timeline flexible by providing that it is required assessment for each type of food for facilities to come into compliance. ‘‘as appropriate to the nature of the manufactured, processed, packed, or Facilities, other than small and very actionable process step and the nature held at the facility using appropriate small businesses, have 3 years after the of the mitigation strategy.’’ methods to evaluate each point, step, or effective date to comply with part 121. • We made the requirement for procedure in a food operation Small businesses (i.e., those employing verifying proper implementation of (§ 121.130). • fewer than 500 full-time equivalent mitigation strategies more flexible by Identify and implement mitigation employees) have 4 years after the providing for ‘‘other activities strategies at each actionable process step effective date to comply with part 121. appropriate for verification of proper to provide assurances that the Very small businesses (i.e., businesses implementation of mitigation significant vulnerability at each step that have less than $10,000,000, strategies.’’ will be significantly minimized or adjusted for inflation, per year, during • We exempted records required by prevented and the food manufactured, the 3-year period preceding the this rule from the requirements of 21 processed, packed, or held by the applicable calendar year in both sales of Code of Federal Regulations, part 11. facility will not be adulterated. For each human food plus the market value of • We provided for the use of existing mitigation strategy implemented at each human food manufactured, processed, records if certain conditions are met. actionable process step, include a packed, or held without sale, e.g., held • We removed the term ‘‘qualified written explanation of how the for a fee) have 5 years after the effective facility’’ and instead refer to ‘‘very small mitigation strategy sufficiently date to comply with § 121.5(a). business’’ in the exemption under minimizes or prevents the significant As discussed in detail in later sections 121.5(a). vulnerability associated with the of the rule, we made several major • We established an exemption for actionable process step (§ 121.135). certain on-farm manufacturing, • revisions to the provisions of this rule, Establish and implement mitigation mainly in response to comments, to processing, packing, or holding by small strategies management components, as provide for greater flexibility and and very small businesses of certain appropriate to ensure the proper clarity. These major revisions to the foods identified as having low-risk implementation of each such mitigation regulatory text include the following: production processes. strategy, taking into account the nature • We removed the key activity types • We added a new definition for of the mitigation strategy and its role in (KATs); however, the use of the KATs ‘‘qualified individual’’ and included the facility’s food defense system is still permissible to conduct a new requirements to ensure that all (§ 121.138). vulnerability assessment and will be individuals who perform activities • Establish and implement food further discussed in guidance. required under subpart C are qualified defense monitoring procedures, for • We specified three elements that to perform their assigned activities. monitoring the mitigation strategies, as must be evaluated when conducting a • We provided longer timelines for appropriate to the nature of the vulnerability assessment: (1) The facilities to come into compliance with mitigation strategy and its role in the potential public health impact (e.g., the rule. facility’s food defense system severity and scale) if a contaminant Costs and Benefits (§ 121.140). were added; (2) the degree of physical • Establish and implement food access to the product; and (3) the ability The total cost of the rule, annualized defense corrective action procedures of an attacker to successfully over 10 years at a 7 percent discount that must be taken if mitigation contaminate the product. rate, is between $280 and $490 million. strategies are not properly implemented, • We specified that the vulnerability With a 3 percent discount rate, the as appropriate to the nature of the assessment must consider the annualized cost is between $270 and actionable process step and the nature possibility of an inside attacker. $480 million. The first-year cost is of the mitigation strategy (§ 121.145). • We removed the distinction between $680 and $930 million. • Establish and implement specified between ‘‘broad’’ and ‘‘focused’’ Counting only domestic firms, the total food defense verification activities, as mitigation strategies. annualized costs are between $90 and appropriate to the nature of the • We made the mitigation strategy $150 million, with initial costs of mitigation strategy and its role in the management components (food defense between $220 and $300 million. The facility’s food defense system monitoring, corrective actions, and average annualized cost per covered (§ 121.150). verification) more flexible by providing facility is between $9,000 and $16,000,

VerDate Sep<11>2014 19:43 May 26, 2016 Jkt 238001 PO 00000 Frm 00003 Fmt 4701 Sfmt 4700 E:\FR\FM\27MYR4.SGM 27MYR4 mstockstill on DSK3G9T082PROD with RULES4 34168 Federal Register / Vol. 81, No. 103 / Friday, May 27, 2016 / Rules and Regulations

and the average annualized cost per showing the number of prevented related illness, the breakeven threshold covered firm is between $27,000 and attacks at which the benefits are larger is one or two attacks every year. For $47,000. than the costs. For attacks that are catastrophic terrorist attacks causing The benefits of the actions required by similar in impact to acts of intentional thousands of fatalities, the breakeven the rule are a reduction in the adulteration that have happened in the threshold is one attack prevented every possibility of illness and death resulting United States in the past, the breakeven 270 to 460 years. from intentional adulteration of food. threshold, counting only producer costs, We monetize the damage that various is 28 to 48 attacks prevented every year. The table shows the approximate, intentional adulteration scenarios might For attacks causing similar casualties as rounded, mean values for various cost cause, and present a breakeven analysis major historical outbreaks of food- components of the rule:

ANNUALIZED COST AND BENEFIT OVERVIEW

All Numbers are USD 2014 (millions), annualized over 10 years 3% Discount 7% Discount

Costs: Learning about Rule ...... $3 $4 Creating Food Defense Plans ...... 10 11 Mitigation Costs ...... 26 28 Monitoring, Corrective Action, Verification ...... 62 62 Employee Training ...... 5 6 Documentation ...... 9 9 Subtotal (Domestic cost) ...... 115 119 Cost to Foreign Firms ...... 247 256

Total ...... 362 375 Benefits:

Lower Chance of Intentional Adulteration ...... Unquantified

I. Background on reacting to problems after they occur. and territorial authorities. A top priority A. FDA Food Safety Modernization Act The law also provides new enforcement for FDA are those FSMA-required authorities to help achieve higher rates regulations that provide the framework The FDA Food Safety Modernization of compliance with risk-based, for industry’s implementation of Act (FSMA) (Pub. L. 111–353), signed prevention-oriented safety standards preventive controls and enhance our into law by President Obama on January and to better respond to and contain ability to oversee their implementation 4, 2011, is intended to allow FDA to problems when they do occur. In for both domestic and imported food. To better protect public health by helping addition, the law contains important that end, we proposed the seven to ensure the safety and security of the food supply. FSMA enables us to focus new tools to better ensure the safety of foundational rules listed in table 1 and more on preventing food safety imported foods and encourages requested comments on all aspects of problems rather than relying primarily partnerships with State, local, tribal, these proposed rules.

TABLE 1—PUBLISHED FOUNDATIONAL RULES FOR IMPLEMENTATION OF FSMA

Title Abbreviation Publication

Current Good Manufacturing Practice and Hazard Analysis and Risk- 2013 proposed human preventive 78 FR 3646, January 16, 2013. Based Preventive Controls for Human Food. controls rule. Standards for the Growing, Harvesting, Packing, and Holding of 2013 proposed produce safety rule 78 FR 3504, January 16, 2013. Produce for Human Consumption. Current Good Manufacturing Practice and Hazard Analysis and Risk- 2013 proposed animal preventive 78 FR 64736, October 29, 2013. Based Preventive Controls for Food for Animals. controls rule. Foreign Supplier Verification Programs (FSVP) for Importers of Food 2013 proposed FSVP rule ...... 78 FR 45730, July 29, 2013. for Humans and Animals. Accreditation of Third-Party Auditors/Certification Bodies to Conduct 2013 proposed third-party certifi- 78 FR 45782, July 29, 2013. Food Safety Audits and to Issue Certifications. cation rule. Focused Mitigation Strategies To Protect Food Against Intentional 2013 proposed intentional adulter- 78 FR 78014, December 24, 2013. Adulteration. ation rule. Sanitary Transportation of Human and Animal Food ...... 2014 proposed sanitary transpor- 79 FR 7006, February 5, 2014. tation rule.

We also issued a supplemental notice listed in table 2 and requested in each supplemental notice of of proposed rulemaking for the rules comments on specific issues identified proposed rulemaking.

VerDate Sep<11>2014 19:43 May 26, 2016 Jkt 238001 PO 00000 Frm 00004 Fmt 4701 Sfmt 4700 E:\FR\FM\27MYR4.SGM 27MYR4 mstockstill on DSK3G9T082PROD with RULES4 Federal Register / Vol. 81, No. 103 / Friday, May 27, 2016 / Rules and Regulations 34169

TABLE 2—PUBLISHED SUPPLEMENTAL NOTICES OF PROPOSED RULEMAKING FOR THE FOUNDATIONAL RULES FOR IMPLEMENTATION OF FSMA

Title Abbreviation Publication

Current Good Manufacturing Practice and Hazard Analysis and Risk- 2014 supplemental human preven- 79 FR 58524, September 29, Based Preventive Controls for Human Food. tive controls notice. 2014. Standards for the Growing, Harvesting, Packing, and Holding of 2014 supplemental produce safety 79 FR 58434, September 29, Produce for Human Consumption. notice. 2014. Current Good Manufacturing Practice and Hazard Analysis and Risk- 2014 supplemental animal preven- 79 FR 58476, September 29, Based Preventive Controls for Food for Animals. tive controls notice. 2014. Foreign Supplier Verification Programs (FSVP) for Importers of Food 2014 supplemental FSVP notice... 79 FR 58574, September 29, for Humans and Animals. 2014.

We have finalized six of the foundational rulemakings, as listed in table 3.

TABLE 3—PUBLISHED FOUNDATIONAL FINAL RULES FOR IMPLEMENTATION OF FSMA

Title Abbreviation Publication

Current Good Manufacturing Practice, Hazard Analysis and Risk- PCHF final rule...... 80 FR 55908, September 17, Based Preventive Controls for Human Food. 2015. Current Good Manufacturing Practice, Hazard Analysis and Risk- PCAF final rule...... 80 FR 56170, September 17, Based Preventive Controls for Food for Animals. 2015. Standards for the Growing, Harvesting, Packing, and Holding of Produce final rule ...... 80 FR 74354, November 27, 2015. Produce for Human Consumption. Foreign Supplier Verification Programs (FSVP) for Importers of Food FSVP final rule ...... 80 FR 74226, November 27, 2015. for Humans and Animals. Accreditation of Third-Party Certification Bodies to Conduct Food Third-party final rule ...... 80 FR 74570, November 27, 2015. Safety Audits and to Issue Certifications. Sanitary Transportation of Human and Animal Food ...... Transport final rule ...... 81 FR 20092, April 6, 2016.

As FDA finalizes these seven and assistance, to ensure that actionable process steps, focused foundational rulemakings, we are stakeholders understand and engage in mitigation strategies, and procedures for putting in place a framework for food their roles in food safety and food monitoring, corrective actions, and safety that is modern and brings to bear defense. FDA believes these seven verification (proposed § 121.126). the most recent science on provisions to foundational final rules, when • Identify any actionable process enhance food safety and food defense, implemented, will fulfill the paradigm steps, using one of two procedures. In that is risk-based and focuses effort shift toward prevention that was the proposed rule, we explained that where the hazards are most significant, envisioned in FSMA and be a major step FDA has analyzed vulnerability and that is flexible and practical given forward for food safety and food defense assessments conducted using the our current knowledge of food safety that will protect consumers into the CARVER+Shock methodology and and food defense practices. To achieve future. identified four key activity types: Bulk this, FDA has engaged in a great deal of liquid receiving and loading; Liquid B. Proposed Rule on Intentional outreach to the stakeholder community storage and handling; Secondary Adulteration to find the right balance in these ingredient handling; and Mixing and regulations of flexibility and In the Federal Register of December similar activities. We further explained accountability. 24, 2013 (78 FR 78014), we issued a that FDA has determined that the Since FSMA was enacted in 2011, we proposed rule to implement the presence of one or more of these key have been involved in approximately intentional adulteration provisions in activity types at a process step (e.g., 600 engagements on FSMA and the sections 103, 105, and 106 of FSMA manufacturing, processing, packing, or proposed rules, including public (proposed rule). We initially requested holding of food) indicates a significant meetings, Webinars, listening sessions, public comments on the proposed rule vulnerability under section 418 of the farm tours, and extensive presentations by March 31, 2014. We extended the FD&C Act and that the food is at high and meetings with various stakeholder comment period for the proposed rule risk of intentional adulteration caused groups (Ref. 1) (Ref. 2). As a result of until June 30, 2014, in response to by acts of terrorism under section 420 of this stakeholder dialogue, FDA decided several requests for an extension. the FD&C Act. We proposed that to issue the four supplemental notices of The proposed rule proposed to facilities may identify actionable proposed rulemaking to share our require various food defense measures process steps using the FDA-identified current thinking on key issues and get that an owner, operator, or agent in key activity types as described in additional stakeholder input on those charge of a facility would be required to proposed § 121.130(a) or conduct their issues. As we move forward into the implement to protect against the own facility-specific vulnerability next phase of FSMA implementation, intentional adulteration of food, and can assessments as provided in proposed we intend to continue this dialogue and be summarized as follows: § 121.130(b). collaboration with our stakeholders, • Prepare and implement a written • Identify and implement focused through guidance, education, training, food defense plan that includes mitigation strategies at each actionable

VerDate Sep<11>2014 19:43 May 26, 2016 Jkt 238001 PO 00000 Frm 00005 Fmt 4701 Sfmt 4700 E:\FR\FM\27MYR4.SGM 27MYR4 mstockstill on DSK3G9T082PROD with RULES4 34170 Federal Register / Vol. 81, No. 103 / Friday, May 27, 2016 / Rules and Regulations

process step to provide assurances that We requested comment on all aspects example, some comments express the significant vulnerability at each step of the proposed requirements. In concern about overregulation in general. will be significantly minimized or addition, we described our thinking and Some comments believe the Department prevented and the food manufactured, sought comment on other issues, of Homeland Security is the Federal processed, packed, or held by the including the framework of the rule; Agency that should protect the food facility will not be adulterated activities that occur on produce farms; supply. Some comments express (proposed § 121.135). transportation carriers; food for animals; concern about ‘‘genetically modified • Establish and implement acts of disgruntled employees, organisms’’, while other comments procedures, including the frequency consumers, or competitors; express concern about the amount of with which they are to be performed, for economically motivated adulteration; chemicals in food. Some comments monitoring the focused mitigation low-risk activities at farm mixed-type express concern that extreme strategies (proposed § 121.140) facilities; activities that occur on dairy consolidation of our food system is the • Establish and implement corrective farms; and other ways to focus on foods main reason that it could be a target for action procedures that must be taken if with a high risk of intentional terrorism or other intentional acts aimed focused mitigation strategies are not adulteration caused by terrorism. at causing widespread human casualties. These comments state that properly implemented (proposed C. Appendix 4 to Draft Risk Assessment § 121.145). decentralization is the most resilient We issued for public comment an • Verify that monitoring is being defense against those who wish to ‘‘Appendix 4 to Draft Qualitative Risk conducted and appropriate decisions contaminate the food supply. We do not Assessment of Risk of Activity/Food about corrective actions are being made; discuss such comments in this Combinations for Activities (Outside the verify that the focused mitigation document. Farm Definition) Conducted in a strategies are consistently implemented Facility Co-Located on a Farm’’ (the II. Legal Authority and are effectively and significantly draft RA Appendix) (78 FR 78064, The proposed rule contained an minimizing or preventing the significant December 24, 2013). The purpose of the explanation of its legal basis under vulnerabilities; and conduct a reanalysis draft RA Appendix was to provide a authorities in the FDA Food Safety of the food defense plan (proposed science-based risk analysis of those Modernization Act and section 701 of § 121.150). • foods whose production processes the FD&C Act. After considering the Ensure that personnel and would be considered low risk with comments received in response to the supervisors assigned to actionable respect to the risk of intentional proposed rule, FDA made changes in process steps receive appropriate adulteration caused by acts of terrorism. the final rule. The legal authorities training in food defense awareness and We used the tentative conclusions of the relied on in the final rule are the same their respective responsibilities in section 103(c)(1)(C) draft RA Appendix as those in the proposed rule unless implementing focused mitigation to seek comment in the proposed rule otherwise described in the sections that strategies (proposed § 121.160). on possible exemptions or modified follow. • Establish and maintain certain requirements for this final rule (78 FR A. Section 103 of FSMA records, including the written food 78014 at 78029). We are including the defense plan; written identification of final appendix to the risk assessment in Section 103 of FSMA, Hazard actionable process steps and the the docket established for this document Analysis and Risk-Based Preventive assessment leading to that (Ref. 3). Controls, amends the FD&C Act to identification; written focused create a new section 418, which mitigation strategies; written procedures D. Public Comments mandates rulemaking. Section for monitoring, corrective actions, and We received more than 200 public 418(n)(1)(A) of the FD&C Act requires verification; and documentation related submissions on the proposed rule, each that the Secretary issue regulations ‘‘to to training of personnel. All such containing one or more comments. We establish science-based minimum records are subject to certain received submissions from diverse standards for conducting a hazard recordkeeping requirements, record members of the public, including food analysis, documenting hazards, retention requirements, requirements for facilities (including facilities co-located implementing preventive controls, and official review and public disclosure on a farm); farms; cooperatives; documenting the implementation of the requirements (proposed §§ 121.301 to coalitions; trade organizations; preventive controls. . . .’’ Section 121.325). consulting firms; law firms; academia; 418(n)(1)(B) of the FD&C Act requires • Proposed the effective date as 60 public health organizations; public that the regulations define the terms days after this final rule is published. advocacy groups; consumers; consumer ‘‘small business’’ and ‘‘very small However, we proposed for a longer groups; Congress, Federal, State, local, business,’’ taking into consideration the timeline for facilities to come into and tribal Governments; and other study of the food processing sector compliance. Facilities, other than small organizations. Some submissions required by section 418(l)(5) of the and very small businesses, would have included signatures and statements from FD&C Act. Further, section 103(e) of 1 year after the effective date to comply multiple individuals. Comments FSMA creates a new section 301(uu) in with part 121. Small businesses (i.e., addressed virtually every provision of the FD&C Act (21 U.S.C. 331(uu)) to those employing fewer than 500 the proposed rule, including our prohibit ‘‘[t]he operation of a facility persons) would have 2 years after the requests for comment on including that manufactures, processes, packs, or effective date to comply with part 121. additional provisions that we did not holds food for sale in the United States Very small businesses (i.e., businesses include in the proposed regulatory text. if the owner, operator, or agent in charge that have less than $10,000,000 in total In the remainder of this document, we of such facility is not in compliance annual sales of food, adjusted for describe these comments, respond to with section 418 [of the FD&C Act].’’ inflation) would be considered a them, and explain any revisions we In addition to rulemaking qualified facility and have 3 years after made to the proposed rule. requirements, section 418 contains the effective date to comply with Some comments address issues that requirements applicable to the owner, § 121.5(a). are outside the scope of this rule. For operator, or agent in charge of a facility

VerDate Sep<11>2014 19:43 May 26, 2016 Jkt 238001 PO 00000 Frm 00006 Fmt 4701 Sfmt 4700 E:\FR\FM\27MYR4.SGM 27MYR4 mstockstill on DSK3G9T082PROD with RULES4 Federal Register / Vol. 81, No. 103 / Friday, May 27, 2016 / Rules and Regulations 34171

required to register under section 415. Act requires FDA to issue regulations to with a direct connection to interstate Section 418(a) is a general provision protect against the intentional commerce. that requires the owner, operator, or adulteration of food. Section 420(b)(1) of III. General Comments on the Proposed agent in charge of a facility to evaluate the FD&C Act requires that such Rule the hazards that could affect food regulations are to specify how a person manufactured, processed, packed, or is to assess whether the person is A. Comments on Overall Framework for held by the facility, identify and required to implement mitigation the Regulatory Approach implement preventive controls, monitor strategies or measures intended to the performance of those controls, and protect against the intentional We proposed a HACCP-type maintain records of the monitoring. In adulteration of food. Section 420(b)(2) of approach, like the one proposed for the addition to the general requirements in the FD&C Act requires that the systematic control of food safety hazards section 418(a) of the FD&C Act, sections regulations specify appropriate science- in the PCHF proposed rule, as the most 418(b)–(i) contain more specific based mitigation strategies or measures effective means of ensuring that requirements applicable to facilities, to prepare and protect the food supply mitigation strategies are consistently including several provisions explicitly chain at specific vulnerable points, as applied once the significant directed at intentional adulteration. For appropriate. Section 420(c) of the FD&C vulnerabilities are identified and example, section 418(b)(2) of the FD&C Act provides that such regulations are to appropriate mitigation strategies are Act specifies that the owner, operator, apply only to food for which there is a developed. We requested comment on or agent in charge of a facility shall high risk of intentional adulteration and the appropriateness of a HACCP-type identify and evaluate hazards that may for which such intentional adulteration system to ensure that mitigation be intentionally introduced, including could cause serious adverse health strategies designed to significantly by acts of terrorism. Section 418(c)(2) of consequences or death to humans or minimize or prevent intentional the FD&C Act specifies that the owner, animals. Section 420(c)(1) provides that adulteration related to terrorism are operator, or agent in charge of a facility such foods are to include those for effective and implemented as intended. shall identify and implement preventive which FDA has identified clear We also requested comment about controls to provide assurances that any vulnerabilities. Section 420(d) of the whether there are other approaches that hazards that relate to intentional FD&C Act limits applicability on farms would be more suitable to address adulteration will be significantly to farms that produce milk. Further, intentional adulteration related to minimized or prevented and addressed, section 106(d) of FSMA creates a new terrorism. consistent with section 420 of the FD&C section 301(ww) in the FD&C Act to In the following paragraphs, we Act. prohibit ‘‘[t]he failure to comply with discuss the comments that disagree Sections 418(j)–(m) of the FD&C Act section 420 [of the FD&C Act].’’ We are with, or request changes to, the and sections 103(c)(1)(D) and (g) of issuing all of the provisions of the rule proposed approach. After considering FSMA provide authority for certain under section 420 of the FD&C Act. these comments, we are continuing to exemptions and modifications to the C. Intrastate Activities require an approach based on an requirements of section 418 of the FD&C analysis of hazards/vulnerabilities and FDA concludes that the rule should Act. These include provisions related to the implementation of measures to apply to activities that are intrastate in seafood and juice hazard analysis mitigate the identified hazards/ character. Facilities are required to critical control point (HACCP), and low- vulnerabilities (a HACCP-type register under section 415 of the FD&C acid canned food (section 418(j)); approach); however, we are providing Act regardless of whether the food from activities of facilities subject to section for additional flexibility, as requested. 419 of the FD&C Act (Standards for the facility enters interstate commerce Produce Safety) (section 418(k)); (§ 1.225(b)). The plain language of (Comment 1) Some comments state qualified facilities (section 418(l)); section 418 of the FD&C Act applies to food defense and food safety require facilities that are solely engaged in the facilities that are required to register different approaches because they are production of food for animals other under section 415 of the FD&C Act different disciplines. The comments than man, the storage of raw agricultural (section 418(o)(2)) and does not exclude explain that the science is different, that commodities (other than fruits and a facility because food from such a food safety deals with known and vegetables) intended for further facility is not in interstate commerce. identifiable risks whereas food defense distribution or processing, or the storage Similarly, the plain language of section deals with unknown, often of packaged foods that are not exposed 420 of the FD&C Act requires FDA to unidentifiable, and ever changing to the environment (section 418(m)); issue regulations to protect against the threats and that food safety risks can be facilities engaged only in certain low intentional adulteration of food and prevented or reduced to an acceptable risk on-farm activities on certain foods does not include a limitation to level but food defense threats only can conducted by small or very small interstate commerce. Further, the be mitigated. The comments conclude businesses (section 103(c)(1)(D) of prohibited act provisions in sections that regulatory requirements addressing FSMA), and dietary supplements 301(uu) and (ww) of the FD&C Act (21 food defense must reflect these key (section 103(g) of FSMA). We are U.S.C. 331(uu) and (ww)) do not require differences between food defense and issuing all of the provisions of the rule an interstate commerce nexus. Notably, food safety and use different under section 418 of the FD&C Act, other subsections in section 301 of the terminology. Some comments state that except with respect to facilities that are FD&C Act, and section 304 of the FD&C FSMA does not require a preventive exempt from its coverage. Act (21 U.S.C. 334) demonstrate that controls approach for food defense, and Congress has included a specific a traditional HACCP approach is too B. Section 106 of FSMA interstate commerce nexus in the rigorous and prescriptive for food Section 106 of FSMA, Protection provisions of the FD&C Act when that defense. Conversely, other comments Against Intentional Adulteration, is its intent. Accordingly, it is support regulatory requirements for amends the FD&C Act to create a new reasonable to interpret sections 418, food defense that are based on the section 420, which mandates 420, 301(uu), and 301(ww) of the FD&C proactive approach found in HACCP, rulemaking. Section 420 of the FD&C Act as not limited to those facilities specifically HACCP concepts related to

VerDate Sep<11>2014 19:43 May 26, 2016 Jkt 238001 PO 00000 Frm 00007 Fmt 4701 Sfmt 4700 E:\FR\FM\27MYR4.SGM 27MYR4 mstockstill on DSK3G9T082PROD with RULES4 34172 Federal Register / Vol. 81, No. 103 / Friday, May 27, 2016 / Rules and Regulations

analyzing problems and devising advocated option for terrorist groups Section 103(a) specifies that the purpose appropriate solutions. (Ref. 4). Additionally, recent events of the preventive controls is to ‘‘prevent (Response 1) We disagree that food have shown a general evolution in the occurrence of such hazards and safety and food defense require entirely terrorist activity away from large, provide assurances that such food is not different approaches to ensure that food centrally planned attacks to attacks that adulterated under section 402 [of the is not adulterated. We agree that there are locally planned and implemented. FD&C Act] or misbranded under section are important, specific differences These locally planned attacks may be 403(w) [of the FD&C Act]. . . .’’ In between food safety and food defense, conducted by assailants inspired by addition to the general requirements in and these differences require different terrorist groups but who otherwise have section 418(a) of the FD&C Act, sections requirements for particular components no formal connection to, or regular 418(b)–(i) contain more specific of the approaches. However, we believe contact with, a terrorist organization requirements applicable to facilities. that food safety and food defense are (Ref. 5, 6, 7). Moreover, recent attacks These include hazard analyses for both more similar than they are different. For indicate that terrorist groups are adept unintentionally and intentionally both food safety and food defense, the at responding to protections put in place introduced hazards (section framework for preventing adulteration, to harden certain targets and will evolve 418(b)(1)(2)), preventive controls for whether it is intentional or their thinking toward less-protected both unintentionally and intentionally unintentional, is the same: (1) An targets. Given the potential for wide introduced hazards (section 418(c) analysis is needed to identify the scale public health harm from (1)(2)), monitoring (section 418(d)), hazards for which measures should be intentional adulteration of the food corrective actions (section 418(e)), taken to mitigate the hazard; (2) supply, we believe that a verification (section 418(f)), appropriate measures must be identified comprehensive, systematic approach, recordkeeping (section 418(g)), a written and implemented; and (3) management such as a HACCP-type approach, is the plan and documentation (section components are needed to ensure most appropriate one and is not too 418(h)), and reanalysis of hazards systematically that the measures are rigorous. Further, as an example of what (section 418(i)). Therefore, we believe functioning as intended. This is the can happen when someone intending that FSMA directs us to take a foundation of the HACCP approach, and harm has inside access, in December ‘‘preventive controls approach’’ for food we continue to believe this approach is 2013 a contract employee at Aqlifoods defense, as well as food safety. appropriate for food defense as well as (a subsidiary of Naruha Nichiro We agree that, while the regulatory food safety. In food defense terms, the Holdings, Japan’s largest seafood approaches for food defense and food three elements are as follows: (1) A company), intentionally adulterated safety fundamentally should be similar, vulnerability assessment is needed to several frozen foods with the pesticide there need to be differences in how the identify significant vulnerabilities; (2) malathion. Japanese authorities believe approach is implemented for food mitigation strategies must be identified the assailant brought malathion to the defense. We do not agree that a HACCP- and implemented; and (3) mitigation plant and injected it into frozen foods type approach is too prescriptive in strategy management components are during the manufacturing process (Ref. general for food defense, but additional needed to ensure systematically that the 8). The employee exploited his access to flexibility is needed in the application mitigation strategies are functioning as the food prior to packaging to introduce of the approach for food defense given intended. See the proposed rule (78 FR the agent. The adulteration resulted in the difference in the nature of the potential adulteration and the 78014 at 78025) for a discussion of how at least 2,843 mild foodborne illnesses the hazard analysis/preventive control implementation of mitigation strategies and a recall of 6.4 million packages of model is consistent with a vulnerability that are not likely to be process-oriented frozen seafood (Ref. 9). Though this assessment/mitigation strategy model. or readily lend themselves to validation. assailant was most likely trying to harm We agree that the nature of the We also agree that differences in the company and not trying to cause hazards being analyzed for food safety terminology are appropriate. (See massive public health harm, this and food defense purposes are different, responses to Comment 2, Comment 45, example indicates the damage that can but we disagree that this means they and Comment 47.) need a different analytical approach. As be done by an inside attacker. (Comment 2) While some comments discussed more in the responses to Section 103 of FSMA reflects a acknowledge that section 103 of FSMA Comment 71 and Comment 72, the Congressional determination that the directs us to promulgate a framework for vulnerabilities considered for food ‘‘hazard analysis and risk-based intentional adulteration that includes defense, while not as predictable as preventive controls’’ approach is concepts that are similar to those in some food safety hazards, lend appropriate for food defense. Section HACCP, these comments also request themselves to analytical assessment 103 directs us to promulgate a that we provide more flexibility than a because they have commonalities that framework for intentional adulteration traditional HACCP framework, with would make them attractive to an that includes concepts that are similar specific requests for flexibility in the attacker, particularly an inside attacker. to those in HACCP. Section 103 of management components of monitoring, In this rule, we are focusing on FSMA contains requirements applicable corrective actions, and verification. preventing the actions of an inside to the owner, operator, or agent in (Response 2) We agree that the attacker. Our interactions with the charge of a facility required to register intentional adulteration regulatory intelligence community, as well as the under section 415 of the FD&C Act. framework should provide more conclusions reached during Section 103(a) of FSMA is a general flexibility than that of a traditional vulnerability assessments conducted in provision that requires the owner, HACCP approach. We believe there are collaboration with industry, have operator, or agent in charge of a facility key disciplinary differences between identified the inside attacker as the to evaluate the hazards that could affect food safety and food defense that argue highest threat. Though FDA is not aware food manufactured, processed, packed, for additional flexibility in the of any information that points to an or held by the facility, identify and intentional adulteration framework. imminent, credible threat to the food implement preventive controls, monitor Most significantly, improper supply, achieving public health harm the performance of those controls, and implementation of preventive controls through an attack via food remains an maintain records of the monitoring. is more likely to result in adulterated

VerDate Sep<11>2014 19:43 May 26, 2016 Jkt 238001 PO 00000 Frm 00008 Fmt 4701 Sfmt 4700 E:\FR\FM\27MYR4.SGM 27MYR4 mstockstill on DSK3G9T082PROD with RULES4 Federal Register / Vol. 81, No. 103 / Friday, May 27, 2016 / Rules and Regulations 34173

food than is improper implementation we have adopted the flexibility included established as appropriate to ensure the of mitigation strategies. Preventive in the PCHF final rule management proper implementation of the mitigation controls are more likely to be process- components regulatory text, as strategies, taking into account the nature oriented and lend themselves to being appropriate for these intentional of each such mitigation strategy and its scientifically validated. Mitigation adulteration requirements. The role in the facility’s food safety system strategies are more likely to be intentional adulteration provisions for (§ 121.138). implemented to reduce physical access mitigation strategies management (Comment 4) Some comments state to a point, step, or procedure, and/or components make clear that mitigation that management and oversight reduce the opportunity for an attacker to strategies management components are activities of mitigation strategies should successfully contaminate the food and, required as appropriate to ensure the occur if they are ‘‘appropriate’’ (suitable in most instances, do not lend proper implementation of each such for a particular purpose or capable of themselves to scientific validation. mitigation strategy, taking into account being applied) and ‘‘necessary’’ (taking These differences indicate a need to the nature of the mitigation strategy and into account the nature of both the apply the concepts of the HACCP its role in the facility’s food defense significance of the vulnerability and the approach in a more flexible manner for system, and we have added § 121.138 to particular mitigation strategy) for food food defense. reflect this change. Likewise, the defense. Recognizing the differences in the provisions for each of the individual (Response 4) We agree that mitigation likelihood of adulteration and the mitigation strategies management strategies management components of differences in mitigation strategies components (i.e., food defense the HACCP-type framework should compared to the process-oriented monitoring, food defense corrective occur if they are appropriate and preventive controls, the intentional actions and food defense verification) necessary. As we have concluded that adulteration corrective actions individually provide flexibility, either similar regulatory approaches are requirements contain neither provisions by specifying that the provisions apply appropriate for food safety and food for the evaluation of all affected food for as appropriate to the nature of the defense, we have adopted the flexibility safety in the event a corrective action is mitigation strategy and its role in the included in the PCHF final rule required nor provisions for facility’s food defense system (i.e., for management components regulatory text unanticipated corrective actions (see food defense monitoring and food (§ 117.140(a)), as appropriate for these § 121.145). Further, the intentional defense verification) or as appropriate to intentional adulteration requirements. adulteration verification requirement both the nature of the mitigation The intentional adulteration provisions does not contain provisions for strategy and the nature of the significant for mitigation strategies management validation, calibration, product testing, vulnerability (i.e., for food defense components make clear that mitigation environmental monitoring, review of corrective actions) (see §§ 121.140, strategies management components are records for calibration, testing, or 121.145, and 121.150). For additional required as appropriate to ensure the supplier verification (see § 121.150). We discussion of the flexibility added for proper implementation of the mitigation believe this more flexible approach for the mitigation strategies management strategies, taking into account the nature food defense is appropriate and adds components, see sections V.E, V.F, and of each such mitigation strategy and its flexibility compared to the provisions of V.G and in particular the responses to role in the facility’s food defense the PCHF final rule. Comment 88, Comment 89, Comment system, and we have revised proposed We also have added flexibility to the 90, Comment 92, Comment 93, and requirements for monitoring, corrective identification of mitigation strategies Comment 95. actions, and verification to reflect these similar to the flexibility added to the (Comment 3) Some comments state changes (see §§ 121.138, 121.140, identification of preventive controls in that the intentional adulteration 121.145, and 121.150). the PCHF final rule (80 FR 55908 at proposed HACCP approach is ‘‘one size (Comment 5) Some comments state 56020). Although each facility subject to fits all.’’ that the requirement for the amount of this rule must prepare and implement a (Response 3) We disagree. The paperwork associated with a HACCP- food defense plan, the mitigation intentional adulteration requirements to type approach, and the information strategies that the facility would conduct a vulnerability assessment to contained therein, may be establish and implement would depend identify actionable process steps, counterproductive to the goal of on the facility, the food, and the identify and implement mitigation mitigating or preventing vulnerabilities outcome of the facility’s vulnerability strategies, and use mitigation strategies because individuals or groups interested assessment to identify actionable management components provide in conducting these types of attacks may process steps (§§ 121.130 and 121.135). significant flexibility, are tailored to the try to access this information. For examples of this added flexibility facility and its processes, and are (Response 5) We disagree. A written related to mitigation strategies, see the therefore not ‘‘one-size-fits-all.’’ food defense plan and its required discussion in section V.C. Although each facility with significant contents, which include the As requested in comments, we also vulnerabilities is required to identify vulnerability assessment, the have changed regulatory text to reflect and implement mitigation strategies, the identification and implementation of the inclusion of more flexibility in mitigation strategies that the facility mitigation strategies, and mitigation monitoring, corrective actions, and would establish and implement would strategies management components, are verification (see §§ 121.138, 121.140, depend on the facility, the food, and the essential to significantly minimizing or 121.145, and 121.150 and discussed in outcome of the facility’s vulnerability preventing significant vulnerabilities more detail in the relevant sections later assessment (§§ 121.130 and 121.135). In related to intentional adulteration of in this document). These changes are addition, the mitigation strategies food, where the intent of the similar to those made in the regulatory management components (i.e., food adulteration is to cause wide scale text for preventive controls management defense monitoring, food defense public health harm. The required components. corrective actions, and food defense documentation of the plan and As we have concluded that similar verification) that a facility would implementation of the plan are regulatory approaches are appropriate establish and implement for its necessary so that both the facility and for both food safety and food defense, mitigation strategies would be FDA can ensure that the significant

VerDate Sep<11>2014 19:43 May 26, 2016 Jkt 238001 PO 00000 Frm 00009 Fmt 4701 Sfmt 4700 E:\FR\FM\27MYR4.SGM 27MYR4 mstockstill on DSK3G9T082PROD with RULES4 34174 Federal Register / Vol. 81, No. 103 / Friday, May 27, 2016 / Rules and Regulations

vulnerabilities are being addressed (Comment 7) One comment asserts with section 106, which it states properly. We encourage facilities that because we already have required provides FDA with the authority to covered by this rule to adequately food safety plans for facilities under a designate certain foods as ‘‘high risk,’’ protect food defense plans and separate rulemaking, and because an act and to require certain escalated food associated information and records. For of intentional adulteration of food that defense activities for those foods. The a more detailed discussion related to would cause wide scale public health comment asserts that FDA should protecting food defense plan harm is not likely to occur, a separate designate foods as ‘‘high risk’’ based on information, see section VI.F. food defense plan, and thus this rule, is real-time actionable intelligence of a (Comment 6) One comment disagrees not necessary. credible threat. The comment with the HACCP framework, and (Response 7) We disagree. Although it acknowledges that section 103 of FSMA requests we use a current good is true that most facilities covered by does not apply to facilities required to manufacturing practice (CGMP) this rule will also have a food safety or comply with the seafood HACCP approach. This comment states that HACCP plan, the focus of those plans is program, the juice HACCP program, or such an approach provides facilities on preventing the contamination of food the dietary supplement CGMPs, but with sufficient flexibility to address from hazards that are unintentionally because none of these regulations intentional adulteration. Another introduced and, therefore, the control address food defense programs, the comment supports using a HACCP points and the measures implemented comment asserts the Agency can use approach in the context of allowing in those plans differ from those in a other legal authority to require these facilities to utilize prerequisite food defense plan. It is unlikely that a food facilities to have food defense programs. facility would choose preventive programs. (Response 6) We disagree that a controls under the PCHF final rule that (Response 8) The final rule requires CGMP approach is the most appropriate would be sufficient to address ‘‘basic foundation[al] food defense approach. We address the vulnerabilities to intentional activities’’ as well as providing for appropriateness and flexibility of the adulteration. For example, it is unlikely ‘‘escalated food defensive activities’’ HACCP-type approach in responses to that a facility conducting a hazard where warranted. To provide for Comment 1 and Comment 2. We address analysis would identify the step of foundational food defense, the rule the potential to consider pre-existing holding a liquid, such as a syrup, in a requires a food defense plan (i.e., a activities while conducting a tank in a facility as a hazard requiring vulnerability assessment, mitigation vulnerability assessment and identifying a preventive control. In conducting a strategies, and procedures for food and implementing mitigation strategies hazard analysis, the facility would defense monitoring, corrective actions, in Response 72 and Response 83. likely be considering whether there are and verification) and associated actions. We are requiring a HACCP-type hazards associated with the incoming These requirements are the minimum approach rather than a CGMP-type syrup or ingredients for the syrup or the measures necessary to provide approach for several reasons. First, the syrup production process (inadequate assurances that hazards that relate to management components in a HACCP- heating), but would not likely identify intentional adulteration intended to type approach are the most effective the step of holding the syrup as cause wide scale public health harm means, as discussed in the response to requiring a preventive control. However, will be significantly minimized or Comment 1, of ensuring that the in a vulnerability assessment, the step of prevented. Weakening these provisions, mitigation strategies are consistently holding liquid syrup may be identified such as by eliminating the requirement applied. Second, as with food safety, as a significant vulnerability if (1) there to implement mitigation strategies to there are hazards (or in food defense would be significant public health address significant vulnerabilities at terms, vulnerabilities) that warrant consequences if a contaminant were each actionable process step, would requirements that are more rigorous added, (2) there is access to the product result in food defense measures than general, non-targeted CGMP while being held, and (3) an attacker inadequate to address the threat of an provisions. The vulnerabilities that would be able to successfully inside attacker. As discussed in warrant such requirements are those contaminate the product. response to Comment 1, our interactions that we have concluded are the highest With regard to the statement that an with the intelligence community, as risk, namely intentional adulteration act of intentional adulteration is not well as the conclusions reached during conducted at actionable process steps, likely to occur, we agree that the vulnerability assessments conducted in including those vulnerabilities likelihood of an incident is low. collaboration with industry, have associated with an inside attacker, However, given the potential for a identified an inside attacker as the intended to cause wide scale public successful intentional adulteration of highest threat. health harm. It is precisely these attacks food to cause wide scale public health Further, the suggested approach at these points that require the most harm, it is prudent for the largest would place too much reliance on FDA robust and rigorous system to ensure facilities to take preventive measures, having real-time actionable intelligence that vulnerabilities are assessed, and it is required by sections 418 and of a credible threat. As discussed in the significant vulnerabilities are identified, 420 of the FD&C Act that they do so. responses to Comment 11 and Comment and mitigation strategies are properly 12, there are a number of limitations to implemented to reduce these significant B. One Set of Requirements Under this approach. FDA may not receive vulnerabilities. General, non-targeted Sections 418 and 420 of the FD&C Act specific, real-time, credible threat CGMP requirements (e.g., restricting (Comment 8) One comment asserts intelligence. Further, rapidly access to outsiders) would not that the proposed rule blends sections communicating even specific, necessarily focus on the significant 103 and 106 of FSMA into one set of actionable information to the food vulnerabilities or ensure that mitigation requirements and disagrees with that industry so that it is received by all of strategies are implemented to harden approach. The comment states that the relevant facilities would present the potential targets. Finally, section section 103 requires basic foundational challenges. Although some facilities 418 of the FD&C Act requires that food defense activities, including food may be able to identify some or all hazards intentionally introduced be defense plans at all registered food actionable process steps and implement addressed in a HACCP-type framework. facilities. The comment contrasts this mitigation strategies within a short

VerDate Sep<11>2014 19:43 May 26, 2016 Jkt 238001 PO 00000 Frm 00010 Fmt 4701 Sfmt 4700 E:\FR\FM\27MYR4.SGM 27MYR4 mstockstill on DSK3G9T082PROD with RULES4 Federal Register / Vol. 81, No. 103 / Friday, May 27, 2016 / Rules and Regulations 34175

timeframe, many other facilities would consequences. The comment asserts that (Comment 10) Some comments not be able to identify and implement due to the confidentiality of information suggest that FDA require a hybrid the necessary mitigation strategies and that serves as the basis for the FDA approach where all facilities subject to the mitigation strategies management vulnerability assessments, it would be section 103 are required to conduct a components (e.g., food defense more appropriate for FDA to perform vulnerability assessment and develop monitoring, corrective actions, the assessment for acts that could cause and implement a basic food defense verification) within the short time massive public health harm and for the plan. Under the hybrid approach, if a period that could be required in the facility to perform a vulnerability credible threat is identified, then section event of a credible threat. In addition, assessment for other types of intentional 106 would serve as an escalation taking action only in the event of a adulteration that may be specific to a provision and allow FDA to designate credible threat may not be sufficient to facility and are outside of the FDA’s specific food(s) associated with the prevent wide scale public health harm. vulnerability assessment. credible threat as ‘‘high risk.’’ Measures taken after the threat is known (Response 9) FDA believes that a Comments suggest that FDA could then may not be sufficient to prevent an single unified set of requirements (i.e., require facilities with these high risk attack if the intelligence does not this rule) is more clear and less complex provide enough specific information, than dividing the types of intentional foods to reassess their food defense such as the food product, contaminant, adulteration covered by this rule into plans and implement appropriate point of attack in a facility, and two categories with two sets of mitigation strategies that FDA may geographic location of an attack. requirements, as suggested by the specify to address the threat. Comments Because the vulnerability assessment comment. It is not clear what would be argue that if all potential mitigation identifies the specific foods at specific covered under section 418 if it applied strategies need to be identified through process steps at greatest risk, it also only to ‘‘other types of intentional the vulnerability assessment and are serves to identify those foods that must adulteration that may be specific to a managed in the absence of actionable be protected against intentional facility,’’ as suggested by the comment. intelligence of a credible threat, then adulteration under section 420. Having Further, we do not believe the there is no ability to escalate the plan one set of requirements for food defense provisions of the rule are inconsistent with respect to certain mitigation measures helps ensure that the with our current guidance; rather, they strategies when needed. significant vulnerabilities will be are more comprehensive and robust. (Response 10) FDA agrees with the significantly minimized or prevented FDA believes that these new comment in part. As discussed in and addressed consistently across requirements will reduce risk beyond response to Comment 8, this rule sections 418 and 420 (see section what is contained in our current requires facilities to conduct a 418(c)(2)). Further, as suggested by the guidance documents. Our guidance comment, the rule provides for documents mainly focus on assessing vulnerability assessment and develop escalated food defense activities when vulnerabilities and identifying and implement foundational food necessary. Specifically, § 121.157(b)(4) mitigation strategies, but do not include defense activities. Further, the rule requires reanalysis of a food defense recommendations for mitigation strategy provides a mechanism which serves a plan (which could lead to the management components. We believe similar function to the ‘‘escalation identification of additional needed the management components (part of a provision’’ described in the comment. mitigation strategies) whenever FDA HACCP-type framework) are critical to Specifically, under § 121.157(b)(4), FDA requires it to respond to new ensuring that any hazards that relate to can require facilities to reassess their vulnerabilities or credible threats to the intentional adulteration intended to food defense plans, which could trigger food supply. cause wide scale public health harm a requirement to implement additional (Comment 9) One comment asserts will be significantly minimized or mitigation strategies. that the proposed combination of prevented. Further, the confidentiality FDA disagrees that the rule requires provisions under sections 418 and 420 of vulnerability assessments that FDA ‘‘all potential mitigation strategies’’ to of the FD&C Act has created complexity conducted is not a barrier to a facility be identified and managed. We believe that could be eliminated by removing conducting a vulnerability assessment we have appropriately balanced the acts intended to cause massive public under this rule. The key activity types need to provide assurances that hazards health harm from section 418 and that FDA has identified were derived associated with intentional adulteration covering them solely under section 420. from FDA’s vulnerability assessments are being prevented with the low The comment further asserts that and using key activity types to conduct likelihood of a successful attack on the although section 418 includes ‘‘acts of a vulnerability assessment remains a food supply. The rule does not mandate terrorism’’ within the hazard analysis, permissible option under the final rule. Congress did not intend to add this level In addition, as recognized by the specific mitigation strategies be of complexity to the rule and create new comment, section 418 explicitly applies implemented at actionable process steps work that is inconsistent with materials to ‘‘acts of terrorism.’’ Specifically, but rather allows strategies to be tailored previously created to address food 418(b)(2) requires that a hazard analysis to the facility and its procedures. We defense. Further, the comment states identify and evaluate hazards that may also disagree that there is ‘‘no ability to that it appears these new requirements be intentionally introduced, including escalate the plan with respect to certain were included in the rule as a by acts of terrorism. Further, section mitigation strategies.’’ In response to a consequence of the statutory language 418(i) authorizes FDA to require a credible threat involving a specific rather than to reduce risk. reanalysis to respond to new hazards agent, a covered facility could reanalyze The comment states that one key including, as appropriate, results from its food defense plan with specific focus difference between sections 418 and 420 terrorism risk assessments. Generally, on the relevant agent. The facility then is that section 418 requires the facility acts of terrorism involving the food could implement specific mitigation to identify hazards related to intentional supply would be committed with the strategies to counter this threat (such as adulteration while section 420 requires intention to cause wide scale public processing changes, product testing, or FDA to identify vulnerabilities that health harm. Therefore, they are clearly other appropriate measures) that are not could result in serious adverse health covered by section 418. currently required by the rule.

VerDate Sep<11>2014 19:43 May 26, 2016 Jkt 238001 PO 00000 Frm 00011 Fmt 4701 Sfmt 4700 E:\FR\FM\27MYR4.SGM 27MYR4 mstockstill on DSK3G9T082PROD with RULES4 34176 Federal Register / Vol. 81, No. 103 / Friday, May 27, 2016 / Rules and Regulations

C. Require Measures Only in the Event and State Agencies to ensure that the regarding communicating credible of a Credible Threat relevant stakeholders of the food threat information. In the proposed rule, we sought industry are notified in a timely manner (Comment 13) One comment states comment on whether it would be upon discovery of a credible threat. that the term ‘‘credible threat’’ is not feasible to require measures to protect These comments discuss that alerting adequately defined in the proposed rule, against intentional adulteration only in the food industry to known credible nor is the relationship between a the event of a credible threat. We also threat information would be valuable ‘‘credible threat’’ and a ‘‘reasonably sought comment on whether such an because there may be additional foreseeable hazard’’ adequately approach would be consistent with the mitigation strategies that could be put described. The same comment also intentional adulteration provisions of into place when there is a threat. The notes that because the term ‘‘credible FSMA and how such requirements comments further explain that having threat’’ is commonly used to discuss would be communicated to industry in such knowledge would allow for sensitive or classified information, the a timely and actionable manner. industry stakeholders with specific, use of the term may place an unrealistic Many comments agree with the technical knowledge of their products, expectation for sharing of sensitive or requirements as proposed that measures equipment and plant security to better classified threat information between to protect food against intentional collaborate and support the efforts of government agencies and the private adulteration be required even in the law enforcement. Some comments sector. The comment suggests either absence of a credible threat but some recommend that we establish and removing the term ‘‘credible threat’’ comments support requirements only in formalize a mechanism and process to from the rule or including a definition the event of a credible threat. Some communicate credible threat with an explanation of the mechanism comments assert that FDA has the tools information to relevant stakeholders in for sharing information about credible available in the Registration of Food industry and that the Food Facility threats with the food industry. Facility database to establish a Registration database could help (Response 13) We disagree with this communications protocol to notify facilitate this. The comments also comment and decline the request to industry if there is a credible threat. A recommend that we conduct exercises include a definition for credible threat. few comments express concern over the to test this mechanism so that all It is not possible to identify with difficulty of developing and stakeholders are aware of the precision what constitutes a credible implementing food defense plans in a established communications process threat. There are many factors to timely manner in the event of a credible and can make adjustments and consider in regards to how, what, when, threat. improvements as necessary. Several or why those who intend to cause harm In the following paragraphs, we comments recommended that we may take action. As such, it is not discuss these comments and our convene a panel of industry possible to write a definition for responses. After considering the stakeholders annually to discuss threat credible threat that is neither so broad comments, we have revised the intelligence at the ‘‘Secret’’ level. that it covers potentially any piece of regulatory text in § 121.157(b)(4) to (Response 12) We concur with the intelligence, nor so narrow that it is include specific language that provides recommendation that we should unnecessarily limiting. FDA routinely for FDA to require facilities to conduct collaborate with our Federal and State works with other agencies to maintain a reanalysis of their food defense plans Agency partners on the discovery and situational awareness of potential to, among other things, respond to communication of credible threats in a threats to the food supply and will credible threats to the food supply. timely manner. Currently, FDA consider that information in (Comment 11) Some comments state regularly meets and communicates with determining whether intelligence rises that this rule should only go into effect DHS, FBI, the U.S. Department of to the level of a credible threat. in the event of a credible threat. One of Agriculture (USDA), and State and local Within the context of protecting food these comments argues that the oilseed Agency partners through the Food and against intentional adulteration with the processing industry that they represent Agriculture Sector Government intent to cause wide scale public health has never been the target of attacks or Coordinating Council (GCC) to discuss harm, we see no direct relationship threats and therefore they are unlikely food defense issues and research between a ‘‘credible threat’’ and a targets for intentional adulteration and activities and introduce new initiatives ‘‘reasonably foreseeable hazard.’’ should be exempted from the rule for mutual evaluation, implementation, ‘‘Known or reasonably foreseeable unless there is a credible threat against and education. FDA’s Office of Criminal hazard’’ is defined in the PCHF final a facility or industry as a whole. Investigations (OCI) works closely with rule to mean a biological, chemical (Response 11) We disagree with these the FBI and other Agencies on a regular (including radiological), or physical comments. The fact that the oilseed basis on threats against FDA-regulated hazard that is known to be, or has the processing industry and other food products, including food. We also agree potential to be, associated with the industry sectors have not been attacked that notifying relevant stakeholders facility or the food. We do not use the in the past does not mean that these within industry of credible threats is phrase ‘‘reasonably foreseeable’’ within industry sectors will never be attacked. essential to protecting the food supply. the context of intentional adulteration Nor does it mean that preventive The Food and Agriculture Sector GCC because it does not apply. mitigation strategies are unnecessary. As and Sector Coordinating Council We acknowledge that there will be discussed in response to Comment 8, (consisting of private sector members) challenges to sharing sensitive or taking action only in the event of a hold in-person joint meetings twice a classified threat information between credible threat may not be sufficient to year and, when needed, classified government agencies and the private prevent wide scale public health harm. meetings at the ‘‘Secret’’ level are held sector. That is one of several reasons (Comment 12) Some comments to exchange information. As we move that we are not making the requirement encourage FDA to collaborate with the towards implementing this rule, we will for mitigation strategies dependent on a U.S. Department of Homeland Security continue to work with our partners— particular credible threat. In the event (DHS), the Federal Bureau of both in government and the private such information was to become known, Investigation (FBI), and other Federal sector—to include them in discussions FDA intends to work with its

VerDate Sep<11>2014 19:43 May 26, 2016 Jkt 238001 PO 00000 Frm 00012 Fmt 4701 Sfmt 4700 E:\FR\FM\27MYR4.SGM 27MYR4 mstockstill on DSK3G9T082PROD with RULES4 Federal Register / Vol. 81, No. 103 / Friday, May 27, 2016 / Rules and Regulations 34177

government partners to determine the (Comment 16) Some comments information from food defense plans appropriate course of action. express concern about the level of when citing food defense-related items (Comment 14) Some comments training that will be needed for on Form 483. recommend that in the event of a inspectors. These comments state that (Response 18) FDA is currently in the credible threat, a facility could conduct the inspectors must be trained process of developing its inspection and a reassessment or reanalysis of its food specifically on food defense and that compliance strategy for the intentional defense plan so that it could better tailor FDA should be transparent about the adulteration rule and an important part its mitigation strategies to the threat. training that we provide the inspectors. of this strategy development will Some comments recommend that FDA Comments emphasize the importance include methods and processes for revise the regulatory text within that FDA provide specialized training to information exchange with regulated proposed § 121.150 for reanalysis to ensure consistent compliance and industry. We recognize that food require facilities to reassess their food enforcement activity by the Agency. defense inspections could include defense plans when the Agency has (Response 16) FDA understands and evaluation of sensitive information, actionable intelligence of a credible agrees with comments that state that including vulnerability assessments and threat of intentional adulteration. training for inspectors conducting food mitigation strategies. For a more (Response 14) In the proposed rule, defense inspections is critical to a detailed discussion on how FDA will we describe that we may require a consistent and adequate inspection, protect food defense-related reanalysis of the food defense plan in compliance, and enforcement system. information, see section VI.F, Public the event of a credible threat. However, We agree with the comment that disclosure. (Comment 19) Some comments this was not specifically stated within specialized training in food defense will request that FDA include State the regulatory text. Therefore, we have be required for inspection and departments of agriculture in the revised § 121.157(b)(4) to provide that compliance staff to evaluate a facility’s process to develop and implement reanalysis may be required by FDA to compliance with this rule. FDA has inspection and compliance programs. respond to credible threats to the food begun the process of assessing its training needs for inspectors on food (Response 19) As mentioned supply. We did not see the need to previously, FDA is currently in the include ‘‘actionable intelligence’’ in the defense. It is our intention that training provided to our inspection and process of developing its inspection and regulatory text because we believe that compliance staff will be consistent with compliance strategy for the intentional ‘‘credible threat to the food supply’’ that training for industry that will be adulteration rule. FDA’s implies a threat that also requires provided by the Intentional implementation working group for this actionable intelligence. Adulteration subcommittee organized rule includes representation from State D. General Comments on within the Food Safety Preventive partners, and State partners will Implementation and Compliance Controls Alliance (see Comment 105) to continue to play an essential and facilitate consistent implementation of collaborative role throughout the We received a substantial number of this rule. This strategy is consistent with process. comments with regard to how the the other FSMA food safety regulations (Comment 20) Several comments state Agency will implement this rule. Many and training strategies. that an alliance would be beneficial for comments focused specifically on the (Comment 17) Some comments state the implementation of the intentional need for inspectors to be provided food that inspections should have a ‘‘big adulteration rule. defense training to enable them to make picture’’ focus, and focus on the (Response 20) Training alliances have informed decisions during inspections evaluation of the facility’s vulnerability played an important role in facilitating and compliance activities. Another assessment. Additionally, comments industry compliance with many issue raised by many comments is that state that this inspection should not regulations in the past. We agree with the Agency should make available compare the mitigation strategies used the comment and are in the initial stages guidance resources, tools, training, and at other facilities to the facility being of organizing and establishing the other information to help facilities inspected. Intentional Adulteration subcommittee comply with the final rule. In the (Response 17) We agree. The rule is within the Food Safety Preventive section that follows, comments related designed to provide flexibility such that Controls Alliance operated out of the to implementation and compliance are facilities can select appropriate Institute for Food Safety and Health at discussed. mitigation strategies that are best suited the Illinois Institute of Technology. We (Comment 15) Some comments state for their operations. FDA investigators anticipate the Intentional Adulteration that existing regulatory inspections will consider a facility’s written training subcommittee will assist should include evaluation of the explanations regarding identification of industry compliance with this final rule intentional adulteration rule actionable process steps and selection of by supporting the development and requirements for the best use of time mitigation strategies when evaluating a dissemination of training resources. We and resources. food defense plan to understand a further anticipate that the curriculum (Response 15) FDA is currently facility’s rationale. In addition, we will developed through the Intentional considering the best approach for work to educate industry before and Adulteration subcommittee will form structuring and conducting food defense while we regulate to assist industry to the basis of training for regulators as inspections. We recognize that gain and maintain compliance with the well. inspections require resources from rule. (Comment 21) Some comments state facilities and recognize that some (Comment 18) Some comments that equal enforcement of this rule facilities may prefer that food defense request that FDA not cite food defense- across companies domestically and inspections be conducted as part of an related items on FDA’s Form 483 until globally may require FDA to adopt inspection for other regulatory the facilities and inspectors learn about different enforcement mechanisms. programs, such as preventive controls compliance with the intentional (Response 21) We intend to enforce for human food. We will consider this adulteration rule. Additionally, some this rule in a consistent manner with when developing our enforcement comments state concerns about FDA regard to imported and domestically strategy. including potentially sensitive produced foods. FDA is currently in the

VerDate Sep<11>2014 19:43 May 26, 2016 Jkt 238001 PO 00000 Frm 00013 Fmt 4701 Sfmt 4700 E:\FR\FM\27MYR4.SGM 27MYR4 mstockstill on DSK3G9T082PROD with RULES4 34178 Federal Register / Vol. 81, No. 103 / Friday, May 27, 2016 / Rules and Regulations

process of developing its inspection and CFATS is a DHS program which defense plan, and then implement, test, compliance strategy, including how regulates high-risk chemical facilities to and maintain the plan. facilities will be selected for inspections ensure they have anti-terrorism There are important similarities and how inspections will be conducted measures in place to reduce risks between the plan template and some for both domestic and foreign facilities. associated with the storage and use of requirements in this rule. For example, Further, we intend to engage in these high-risk chemicals. Any facility some security measures listed in the significant outreach activities—both that possesses ‘‘chemicals of interest,’’ template are similar to some mitigation domestically and internationally—to as identified by DHS, in certain strategies included in the FDA facilitate industry compliance with this quantities is considered a covered Mitigation Strategies Database. The rule and to communicate the Agency’s facility that must meet some or all of the testing of the plan is somewhat similar current thinking on inspection, requirements under CFATS. Some to food defense monitoring. The plan compliance, and enforcement strategies. agriculture and food facilities are template also suggests awareness Additionally, we intend to develop fact subject to CFATS requirements. Covered training for employees, which is similar sheets, FAQ documents, guidance chemical facilities are required to to a food defense awareness training documents, and other informational prepare Security Vulnerability requirement in this rule. The materials as needed to support domestic Assessments that identify facility similarities reflect FDA and USDA and foreign industry compliance with security vulnerabilities and to develop collaboration on food defense activities the rule. and implement Site Security Plans that for many years as discussed in the (Comment 22) Several comments identify measures that satisfy risk-based proposed rule (78 FR 78014 at 78021). recommend that food defense activities performance standards. These risk- However, food defense plans conducted under programs, such as the based performance standards focus on developed using the FSIS template Department of Homeland Security’s physical security of the chemicals. would not meet all requirements of this (DHS) Customs-Trade Partnership Although both CFATS and C–TPAT final rule. Specifically, FSIS’s food Against Terrorism (C–TPAT) and programs address some of the security defense plan template does not include a vulnerability assessment of the points, mutually recognized international concerns related to some food facilities, steps, or procedures in a food process, programs, the Chemical Facility Anti- neither program addresses the unique nor does it include implementation of Terrorism Standards (CFATS), the vulnerabilities associated with the food mitigation strategies specific to the USDA Food Safety and Inspection being manufactured, processed, packed vulnerable points. Additionally, the Services (FSIS) food defense plan or held at the facility. In general, plan template does not include food template, should be recognized as voluntary security programs such as C– defense monitoring, food defense meeting the requirements of this rule. TPAT focus on global supply chain security measures involved in the corrective action, food defense Several comments state that there are transportation of goods from location to verification, and some training required global food safety schemes that include location. The CFATS program focuses by this rule. food defense requirements which could on reducing risks related to chemicals, In addition, we recognize that there be leveraged in inspections and even in facilities that are mainly geared are existing global food safety schemes implementation. Comments suggest that toward food production. In contrast, that include food defense requirements audits and private certifications done vulnerability assessments required by and that many in the food industry have under these food safety schemes should this rule require identification of already adopted and implemented these be sufficient for meeting the significant vulnerabilities at discrete requirements. For example, the Global requirements of this rule. processing steps within a facility, where Food Safety Initiative’s (GFSI) Guidance (Response 22) We disagree. The the intent of the attack is to cause wide Document Sixth Edition (Ref. 10) programs identified by comments are scale public health harm by addresses food defense. Subsequently, not sufficient to substitute for contaminating the food supply. Further, many of the GFSI-recognized schemes compliance with this rule. For example, a vulnerability assessment must include more specific food defense they do not require mitigation strategies consider the threat stemming from an requirements. The Safe Quality Foods at all actionable process steps and inside attacker. Once these significant (SQF) Code, edition 7.1 is a process and therefore are not sufficient to vulnerabilities are identified, mitigation product certification standard that significantly minimize or prevent strategies are implemented at or near specifies various food defense elements, intentional adulteration intended to those most vulnerable processing steps. including that the methods, cause wide scale public health harm. Given these differences, it is unlikely responsibility, and criteria for Further, even if currently they were that facilities would be compliant with preventing food adulteration caused by sufficient for compliance for this rule, this rule were they to rely wholly on a deliberate act of sabotage or terrorist- they could change at any time. assessments and mitigation strategies like incident shall be documented, C–TPAT is a voluntary supply-chain conducted as part of other programs. implemented and maintained (Ref. 11). security certification program led by The food defense plan template from Another example of industry standards U.S. Customs and Border Protection USDA FSIS is voluntary for FSIS- that incorporate food defense elements (CBP) that focuses on private companies regulated facilities, and is organized in is the International Featured Standards (including food companies) four sections: (1) Outside Security (IFS) Food Version 6 Standard, which implementing anti-terrorism measures Measures, (2) Inside Security Measures, specifies that areas critical to security be to protect their supply chains. When (3) Personnel Security Measures, and (4) identified, food defense hazard analysis companies join C–TPAT, they sign an Incident Response Security Measures. and assessment of associated risks be agreement to work with CBP to identify The template focuses on a facility’s conducted annually or upon changes supply chain security gaps and physical security measures, which are that affect food integrity, and an implement specific security measures analogous to recommended, but not appropriate alert system be defined and and best practices. CBP has found that required, facility wide security periodically tested for effectiveness (Ref. the security standards of some foreign measures in this rule. FSIS-regulated 12). We recognize that some in the food industry partnership programs are facilities are encouraged to read and industry have already voluntarily taken similar to those of the C–TPAT program. sign the template, adopt it as their food steps to incorporate and implement food

VerDate Sep<11>2014 19:43 May 26, 2016 Jkt 238001 PO 00000 Frm 00014 Fmt 4701 Sfmt 4700 E:\FR\FM\27MYR4.SGM 27MYR4 mstockstill on DSK3G9T082PROD with RULES4 Federal Register / Vol. 81, No. 103 / Friday, May 27, 2016 / Rules and Regulations 34179

defense measures; however, they are not rule implementation will include these of terrorism. In this document we adequate to substitute for meeting the efforts to ensure facilities gain discuss comments we received with requirements of this rule. understanding and awareness to comply specific recommendations on foods or Although participation with global with the rule. In addition, we are activities to exempt from the rule. food safety schemes and other programs providing for a longer timeline for (Comment 27) Some comments assert administered by our Federal partners facilities to come into compliance, that facilities engaged solely in cooling, are not substitutes for compliance with allowing for more outreach and dialogue holding, handling, packing, repacking, this rule, we believe that participation with industry. Facilities, other than packaging and shipping of raw, intact in programs such as C–TPAT, CFATS, small and very small businesses, have 3 fresh produce, similar to activities that the use of the FSIS food defense plan years after the effective date to comply may be performed on farms, are unlikely template, or international programs with part 121. Small businesses (i.e., to be engaged in any of the key activity granted mutual recognition status as those employing fewer than 500 full- types and should be exempt from this that of C–TPAT, for example, decreases time equivalent employees) have 4 years rule. The comments describe activities a facility’s vulnerability to intentional after the effective date to comply with conducted by these facilities, including adulteration and can work in concert part 121. Very small businesses (i.e., application of fungicide, food grade wax with the requirements of the final rule. businesses that have less than coating, sorting and placing whole Additionally, a facility’s participation in $10,000,000, adjusted for inflation, per intact produce into boxes for shipping. such programs may be considered by year, during the 3-year period preceding The comments further state that whole FDA as we prioritize risk-based the applicable calendar year in both intact produce would not be an inspections of facilities subject to the sales of human food plus the market attractive or feasible target for an act of final rule. Further, we note that a value of human food manufactured, intentional adulteration with the intent facility may use existing records (e.g., processed, packed, or held without sale, to cause wide scale public health harm, records that are kept as part of these e.g., held for a fee) have 5 years after the regardless of where the activities occur. other programs) to meet the effective date to comply with § 121.5(a). (Response 27) We decline the requirements of this rule, if they contain (Comment 25) Some comments requested exemption for facilities all of the required information and, recommend that FDA update the Food engaged solely in cooling, holding, facilities may supplement existing Defense Plan Builder software tool to handling, packing, repacking, packaging records as necessary to include all of the capture the elements of a food defense and shipping of raw, intact fresh information required by this rule plan required by the final rule, such as produce. We recognize that some of (§ 121.330). monitoring, corrective actions, and these facilities may not have any (Comment 23) Some comments state verification. significant vulnerabilities; however, that laws in the European Union (Response 25) FDA plans to update some may. For example, packaging may currently require food facilities to take existing tools and resources, including be a significant vulnerability, depending necessary measures to prevent the Food Defense Plan Builder software, on the degree of access to the food and intentional adulteration, and it is to assist industry with meeting the the characteristics of the packaging area therefore not justified to request requirements for the final rule. (e.g., in a minimally trafficked area additional safety or security (Comment 26) Several comments where individuals are working alone for requirements for facilities subject to request that FDA periodically update its extended periods of time, or if the these laws. online tools and resources for product is being sprayed with fumigant (Response 23) We disagree. This rule companies to have access to information or fungicide applications that may serve contains those measures FDA has about broad mitigation strategies, to apply a contaminant onto the food). determined are necessary to protect food although they are not required under the Therefore, to determine whether any against intentional adulteration. To the rule. mitigation strategies are needed, each extent a facility is already taking actions (Response 26) FDA intends to publish facility must conduct a facility specific that are required by this rule, a facility guidance to support industry vulnerability assessment that considers, will have to make fewer changes to its compliance with the final rule. This at a minimum: (1) The potential public operations. These security measures guidance will include information health impact if a contaminant were should be evaluated on a case-by-case relevant to the required provisions of added (e.g., severity and scale); (2) the basis to determine if they qualify as a the final rule and also will likely degree of physical access to product; mitigation strategy under this rule. include helpful information on facility- and (3) the ability of an attacker to (Comment 24) Some comments wide security measures as well as other successfully contaminate the product. request that FDA focus on education best practices and recommendations to Any of the activities described in the over enforcement and use discretion assist facilities in their development of comments that are otherwise covered by during inspections. a comprehensive food defense program. existing exemptions do not need to be (Response 24) As FSMA as a whole is In addition, FDA has a number of tools considered in the vulnerability a substantial change in how FDA and resources currently available on our assessment. For example, holding of approaches regulating the food and Web site (http://www.fda.gov/ foods other than in liquid storage tanks agriculture sector, we recognize that fooddefense) that were developed for is exempt from the rule (§ 121.5(b)). significant outreach, education, and our voluntary food defense program that Also, packing or re-packing of food training will be required to facilitate can assist industry. where the container that directly industry compliance with all FSMA contacts the food remains intact is rules. As previously stated by the E. Comments on Requests for Additional exempt (§ 121.5(c)). Agency, one of the guiding principles Exemptions If after conducting a vulnerability for implementing FSMA is that the In the proposed rule we specifically assessment, a facility appropriately Agency will educate before and while requested comments on whether there concludes that it has no actionable we regulate. This includes a focus on are other ways in which the coverage of process steps, the facility would not be sector-specific guidance, education, this regulation can be further focused on required to implement mitigation outreach, and technical assistance for foods that present a high risk of strategies. The facility’s food defense industry. The intentional adulteration intentional adulteration caused by acts plan would include the vulnerability

VerDate Sep<11>2014 19:43 May 26, 2016 Jkt 238001 PO 00000 Frm 00015 Fmt 4701 Sfmt 4700 E:\FR\FM\27MYR4.SGM 27MYR4 mstockstill on DSK3G9T082PROD with RULES4 34180 Federal Register / Vol. 81, No. 103 / Friday, May 27, 2016 / Rules and Regulations

assessment, the conclusion that no packaging of food ingredients from to consumers, and whether used as a actionable process steps are present, and requirements for focused mitigation food additive or an ingredient the gas an explanation for this conclusion at strategies and make them subject only to comprises a very small percentage of the each step. In contrast, facilities with requirements for broad mitigation final food product. actionable process steps are required to strategies. (Response 31) We decline the request. implement mitigation strategies and the (Response 29) We decline this The comment identifies that food gases appropriate mitigation strategies request. As discussed in section IV.B.3, may be stored in bulk storage tanks management components. the rule now refers to ‘‘mitigation either during manufacture, or prior to (Comment 28) One comment suggests strategy’’ rather than ‘‘focused containerization or transport. We that we exempt food additives used in mitigation strategy.’’ Further, our recognize at some facilities low dosages. The comment asserts that vulnerability assessments concluded manufacturing food gas may not have ‘‘the dosage of food additives are that an act of intentional adulteration any significant vulnerabilities; however, approximately 0.01—1 percent of the could still result in wide scale public each covered facility must conduct a total food, and the final amount of the health harm even if the adulteration facility specific vulnerability food additive absorbed into the human occurred during the production of an assessment, and that assessment must body should be very small, roughly 1/ ingredient. Ingredients have many consider, at a minimum: (1) The 100—1/10,000 of the total food different distribution paths. Many potential public health impact if a consumed.’’ The comment further ingredients can be sold in bulk to contaminant were added (e.g., severity asserts that if a contaminant is added to manufacturing facilities for inclusion in and scale); (2) the degree of physical a food additive used in low dosages, the processed finished foods or be sold in access to product; (3) the ability of an risk to public health is very small. consumer sized packaging for home use. aggressor to successfully contaminate (Response 28) We decline this Some ingredients can be used in later the product. The comment mentions request. Our vulnerability assessments processing as a primary ingredient or as that breaching food gas containers considered a number of factors when a secondary ingredient added in much would require use and knowledge of evaluating a product’s vulnerability to lower volumes. In either case, the specialized equipment that is not acts of intentional adulteration and the ingredient manufacturer could be an readily available. However, the potential public health consequences of effective point for an attacker to achieve vulnerability assessment must include such an act, including a wide variety of wide scale public health harm. consideration of an inside attacker, so threat agents. Our vulnerability (Comment 30) One comment supports this information may be available to assessments concluded that there were our proposed exemption § 121.5(c) such an individual. The comment also situations where an act of intentional applicable to packing, repacking, mentions that gases can be stored or adulteration could still result in wide labeling, or re-labeling of food where the transported in liquid form. Based on our scale public health harm even if the container that directly contacts the food vulnerability assessments, liquids dose of the adulterant were at or below remains intact. The comment would like storage and handling has been identified the levels highlighted in this comment. us to further exempt the transportation as potentially significantly vulnerable. Moreover, the concentration of a food and holding of foods in retail packaged Therefore, facilities manufacturing food additive in the finished product may form from coverage under this rule. gas would need to evaluate their vary depending on the nature of the (Response 30) The holding of food, manufacturing process through a product (e.g., citric acid can be added to except for holding of food in liquid vulnerability assessment. If after a food as a flavor enhancer in relatively storage tanks, is exempt under conducting a vulnerability assessment, low concentrations, or to other foods in § 121.5(b). Therefore, the holding of the facility appropriately concludes that higher concentrations as a color foods in retail packaged form is exempt there are no actionable process steps in retention agent). from this rule. Furthermore, as the facility, the facility would not be (Comment 29) One comment explained in section III.G.1, required to implement mitigation recommends that we exempt production transportation carriers are not included strategies. The food defense plan at this and packaging of food ingredients from in the scope of this rule. facility would include the vulnerability the rule. The comment asserts that (Comment 31) One comment requests assessment, the conclusion that no terrorist groups are more likely to attack that food gases be considered for an actionable process steps are present, and finished food production than food exemption for several reasons. The an explanation for this conclusion at ingredient production because they comment states that food gas containers each step. want the publicity associated with are extremely difficult to breach. (Comment 32) Some comments seeing the harm that their act causes. Further, the comment states that food request that FDA exempt research and The comment further asserts that it may gases may be stored in bulk storage development (R&D) and pilot plants be months or years before a tanks either during manufacture, or from the rule. These comments argue contaminated ingredient reaches prior to containerization (i.e., that a vulnerability assessment consumers, and therefore it would not pressurized cylinders) or transport (i.e., conducted at such a facility would in all be a likely or attractive target for cryogenic tankers) but a person likelihood conclude that there are no terrorists who want to make a more intentionally trying to contaminate the significant vulnerabilities due to the low immediate impact. The comment also product during storage or transportation volume of product produced, because states that a contaminant can be would require use and knowledge of such products are not typically for retail degraded, inactivated, or destroyed in specialized equipment that is not sale, and because of the narrow scope of further processing or prolonged storage readily available. The comment argues consuming individuals, if any. if it is added to an ingredient. The therefore that food gases are not at high (Response 32) We decline the request. comment maintains that it is far easier risk for intentional adulteration. In We note that if food at an R&D facility to select an appropriate contaminant addition, the comment notes that there is not for consumption, the facility is with some knowledge of what types of are several uses for food gases, such as not required to register and would not processing it will have to survive. The processing aids (e.g., freezing, chilling, be subject to this rule. Food processed comment requests that, at a minimum, pressure transfer) that will have at R&D facilities may be consumed as we exempt the production and minimal contact with the food provided samples, distributed at special events, or

VerDate Sep<11>2014 19:43 May 26, 2016 Jkt 238001 PO 00000 Frm 00016 Fmt 4701 Sfmt 4700 E:\FR\FM\27MYR4.SGM 27MYR4 mstockstill on DSK3G9T082PROD with RULES4 Federal Register / Vol. 81, No. 103 / Friday, May 27, 2016 / Rules and Regulations 34181

may take other routes to public comments that suggest we repropose option to identify actionable process consumption. As with other facilities this rule to give industry more time to steps. We did not identify receiving and covered by the rule, it is possible, based comply, we have addressed this issue by loading of other types of foods (e.g., on a facility specific vulnerability extending the compliance dates by an non-bulk liquid, solid, gaseous) as key assessment, that an R&D facility may additional 2 years (see section VIII). activity types because we determined conclude that it does not contain any (Comment 34) One comment through our vulnerability assessments significant vulnerabilities. If, after disagrees with the exemption for that they do not present the same level conducting a vulnerability assessment, holding non-liquid bulk food. The of risk. Further, we tentatively the facility appropriately concludes that comment asserts that most bulk foods, concluded that requiring receivers and it has no actionable process steps, the irrespective of their physical form, are shippers of bulk liquids to implement facility would not be required to likely to be mixed or blended at some mitigation strategies at actionable implement mitigation strategies. The point after receipt by the end-user (i.e., process steps involving loading and facility’s food defense plan would the manufacturer or packager that will receiving of bulk liquid foods would include the vulnerability assessment, convert the bulk food into retail significantly minimize or prevent the the conclusion that no actionable packaged food), and are likely to be potential for intentional adulteration of process steps are present, and an processed into a much larger volume of these foods during transportation. explanation for this determination at finished food. Thus, the comment Based on our vulnerability each step. In contrast, an R&D facility maintains that any contamination assessments, we proposed to require with actionable process steps is required introduced into a bulk food during that mitigation strategies to ensure the to implement mitigation strategies and storage prior to its use in the integrity of food during transport would the appropriate mitigation strategies preparation of a retail packaged food be implemented by facilities, rather than management components. may affect a large volume of finished carriers. Where such measures are implemented by the shippers and F. Other General Comments food and may thereby cause massive public health harm. receivers of bulk liquids, we tentatively (Comment 33) Some comments ask us (Response 34) As discussed in the concluded that the food would be to publish a revised proposed rule or an proposed rule, based on an analysis of sufficiently protected, and that no interim rule before proceeding to a final the vulnerability assessments that FDA further actions by a carrier would be rule because of anticipated, significant has conducted using the needed. For this reason, we did not changes resulting from comments that CARVER+Shock methodology, we propose to cover transportation carriers we received in response to the proposed identified four key activity types (Bulk in the proposed rule. We requested rule. Some comments state that food liquid receiving and loading; Liquid comment on our analysis and tentative defense is a new and evolving area storage and handling; Secondary conclusion. without existing regulatory ingredient handling; and Mixing and Some comments agree with the requirements or a long history of similar activities) as production tentative conclusion in the proposed broadly accepted practices and that processes that require focused rule to exclude transportation carriers. further substantive dialogue with mitigation strategies. With the exception Some comments oppose this approach. industry is needed. Some comments of the holding of food in liquid storage In the following paragraphs, we discuss state that a reproposal would serve the tanks, which is not included in the comments that disagree with the same purpose as an Advance Notice of exemption, we are not aware of proposed approach. After considering Proposed Rulemaking which was FDA’s activities performed during the holding the comments, we are finalizing the rule stated intent prior to the imposition of of food that fit within any of these four as proposed with regard to judicial deadlines. Some comments key activity types (see 78 FR 78014 at transportation carriers. (Comment 35) Some comments state that because FSMA rules are 78036). There is no likely way that a dependent on one another, some disagree with our conclusion that contaminant can be homogeneously proposed FSMA rules should be issued implementing mitigation strategies at mixed throughout a non-liquid bulk concurrently so that a concurrent the receiving and loading steps for bulk food during storage. We found in our evaluation and comment period may be liquids will adequately protect food vulnerability assessments that the conducted. Some comments state that during transportation. Some comments potential for uniform distribution of a industry must first get used to the new argue that transport of food is one of the contaminant into the food is a major food safety regulations and then most vulnerable stages in a process, as factor in elevating vulnerability. Since it concentrate on new food defense food is not protected by a secure facility is highly unlikely that an inside attacker regulations and believe reproposing at a and may often be parked at a truck stop would be able to evenly distribute a later date will give industry a chance to or other unsecure locations for extended comply with all the new regulations. contaminant into a dry bulk ingredient periods of time which provides the (Response 33) We decline these during storage, the vulnerability opportunity for an attacker to gain requests. These revisions in the final associated with these steps did not rise access. One comment states that food rule more closely align the rule with to the level associated with the shipments have consistently been many current food defense best vulnerability associated with the key documented as either the first or second practices and increase flexibility for activity types. most stolen truckloads on U.S. facilities to comply. With regard to the G. Other Issues Discussed in the highways, and if terrorists were to use suggestion that we should issue the Proposed Rule this mode of attack on the food supply, FSMA foundational proposed rules the result could be a major event for simultaneously for comment, this was 1. Transportation Carriers which we were not only unprepared, not feasible given our judicial deadlines In the proposed rule, we tentatively but for which we could have foreseen for the seven rules (Ref. 13). We believe determined that there is a significant the risk. that stakeholders were given adequate vulnerability to intentional adulteration (Response 35) We disagree with these opportunity to comment on the during bulk liquid receiving and comments. Based on our vulnerability proposed rules, and we extended many loading, one of the four key activity assessments, we determined that the comment periods. With regard to the types included in the proposal as an most practical mitigation strategies to

VerDate Sep<11>2014 19:43 May 26, 2016 Jkt 238001 PO 00000 Frm 00017 Fmt 4701 Sfmt 4700 E:\FR\FM\27MYR4.SGM 27MYR4 mstockstill on DSK3G9T082PROD with RULES4 34182 Federal Register / Vol. 81, No. 103 / Friday, May 27, 2016 / Rules and Regulations

ensure the integrity of food during shipments, inspecting loads prior to situations where only one of the entities transport would be implemented by receipt, and rejecting damaged or involved is covered by the intentional facilities, rather than by carriers. For suspect items. These steps together will adulteration rule (e.g., the shipper is example, to significantly minimize or then work to significantly reduce the covered, but the receiver is exempt due prevent the product from being significant vulnerabilities associated to size or vice versa) and states that FDA intentionally adulterated during with the transport of food. With respect may need to take a closer look into transport, a shipper may elect to use to the prevalence of theft of food during exemption of carriers. seals to secure access points, such as transport, such theft is economically (Response 37) A covered facility may doors or hatches, on the transport motivated; the scope of this rule is conveyance. The shipper seals the load limited to acts of intentional ship food to or receive food from a prior to departure from its facility by adulteration where the intent is to cause facility that is not covered by the rule using seals with unique identification wide scale public health harm. (e.g., it is a very small business). The numbers. The shipper includes the seal (Comment 36) One comment states covered facility is responsible for numbers on shipping documentation that the use of seals or tamper-evident implementing mitigation strategies to and transmits the seal numbers to the containers is insufficient to protect bulk address transportation if it has a receiving facility. Once the shipment foods during transportation and/or significant vulnerability associated with arrives at the receiving facility, the holding because tamper-evident seals transportation at the receiving or receiver would verify the seals are in can be defeated and cannot be expected shipping steps. The mitigation strategies place and that the identification to prevent a determined attacker. The used by the covered facility must numbers match. This mitigation strategy comment further states that tamper- significantly minimize or eliminate the ensures the food was not accessible evident containers or seals should be significant vulnerability at this step. during transport. To ensure that the used in combination with other Mitigation strategies are available to driver cannot exploit his position to measures. protect the food during transport (Response 36) Mitigation strategies are gain access and intentionally adulterate regardless of whether the shipper or the food during transport, the carrier has ‘‘risk-based,’’ ‘‘reasonably appropriate measures’’ employed to ‘‘significantly receiver is exempt from the rule. If the no role in the seal mitigation strategy. If receiving facility is exempt, the seals are missing or the identification minimize or prevent’’ significant vulnerabilities. They cannot always shipping facility can address the numbers do not match the shipping vulnerability by implementing documentation, the receiving facility eliminate entirely any possibility of intentional adulteration. Furthermore, mitigation strategies such as those would reject the load and notify the discussed in Response 36. If the shipper. each facility has some degree of discretion in determining how, and shipping facility is exempt, the Facilities are required to implement whether, each mitigation strategy is receiving facility can address the mitigation strategies that significantly properly implemented, as part of the vulnerability by implementing minimize or prevent significant facility’s written explanation of how the mitigation strategies such as visually vulnerabilities associated with mitigation strategy sufficiently inspecting seals and cargo to identify actionable process steps. Therefore, if a minimizes or prevents the significant any suspicious activity or tampering, food operation has a significant vulnerability associated with the verifying shipping documents are vulnerability associated with actionable process step. Facilities are accurate, ensuring only scheduled transportation, the facility must choose required to implement mitigation a mitigation strategy or combination of deliveries are accepted, and strategies that significantly minimize or investigating delayed or inaccurate strategies to significantly reduce the prevent the significant vulnerability; vulnerability at the receiving or loading shipments. Additionally, we do not therefore, if a significant vulnerability is believe a shipping and/or receiving step. Mitigation strategies implemented identified, the mitigation strategy or facility that qualifies for the very small at inbound receiving and outbound combination of strategies chosen by the shipping would work complementary to facility must be sufficient to reduce the business exemption is an attractive each other to protect the food during vulnerability to an acceptable level at target for attackers intending to cause transport. For example, if the these steps. wide scale public health harm, as vulnerability assessment concludes that In many cases the use of tamper detailed in section IV.B.11. loading is an actionable process step evident seals may be an appropriate (Comment 38) Some comments state because of a vulnerability during mitigation strategy for limiting access to that covering carriers under this rule transportation, the facility would the product. Additionally, if a tamper may not be the best approach and this implement mitigation strategies to evident seal had been circumvented by component of the food sector may be protect its outbound food from an attacker, a close inspection of the better addressed in guidance. Some intentional adulteration (e.g., sealing the seal at receiving may reveal suspicious comments ask us to continue to develop bulk liquid tanker truck access points). activity or tampering which reduces the materials, guidelines and other tools to Likewise, if the facility receiving the likelihood of a successful attack. promote voluntary compliance of food food identifies receiving as an However if the facility concludes that defense measures by the transportation actionable process step because of a tamper evident seals are not by component of the food sector. vulnerability during transportation, it themselves sufficient to significantly would implement mitigation strategies reduce the vulnerability, they should (Response 38) We agree with these to reduce the vulnerability of the food employ other or additional measures comments. As resources allow, we will to intentional adulteration during (such as directing carriers to travel continue to develop best practices for shipping. The mitigations employed at directly to the end destination without the transportation industry to assist the receiving/unloading step may stop-overs, or requiring teamed drivers with voluntary compliance with food include procedures to accept only to prevent the load from being defense measures. scheduled shipments, verification of unsupervised during transport). shipping documentation, procedures to (Comment 37) One comment requests investigate delayed or missing clarification of expectations in

VerDate Sep<11>2014 19:43 May 26, 2016 Jkt 238001 PO 00000 Frm 00018 Fmt 4701 Sfmt 4700 E:\FR\FM\27MYR4.SGM 27MYR4 mstockstill on DSK3G9T082PROD with RULES4 Federal Register / Vol. 81, No. 103 / Friday, May 27, 2016 / Rules and Regulations 34183

2. Other Types of Intentional intentional adulteration at an actionable milk (also referred to in this document Adulteration: Disgruntled Employees, process step—even if that act of as ‘‘dairy farms’’) subject to section 420 Consumers, and Competitors; and intentional adulteration is not intended of the FD&C Act to take measures to Economically Motivated Adulteration to cause wide-scale public health harm. address economically motivated a. Disgruntled Employees, Consumers, We continue to believe that an approach adulteration. With regard to produce and Competitors that does not focus on preventing wide- farms, we tentatively concluded that scale public health harm, but rather there are not procedures, processes, or In the proposed rule, we explained attempts to address intentional acts practices that are reasonably necessary that when we considered the spectrum regardless of their potential severity, to be implemented by these entities to of risk associated with intentional would require restricting access to prevent the introduction of known or adulteration of food, attacks conducted nearly all points in the food system reasonably foreseeable biological, with the intent of causing massive because these types of attacks are chemical, or physical hazards that can casualties and to a lesser extent, typically conducted at areas of cause serious adverse health economic disruption, would be ranked convenience and could occur at any consequences or death as a result of as relatively high risk. (Note that to point in the food system. economically motivated adulteration. further clarify the rule’s focus we have With regard to farms that produce milk, b. Economically Motivated Adulteration removed the reference to economic we tentatively concluded that there are disruption from the definition of ‘‘food In the proposed rule, we stated that not appropriate science-based strategies defense.’’) We further explained that the goal of the perpetrator of or measures intended to protect against attacks by disgruntled employees, economically motivated adulteration is economically motivated adulteration consumers, or competitors would be for the adulteration to go undetected so that can be applied at the farm. Those consistently ranked as relatively low the perpetrator can continue to obtain tentative conclusions were based on our risk mainly because their public health the desired economic benefit. Unlike assessment that preventive controls are and economic impact would be with intentional adulteration, where the suitable to address economically generally quite small. We further stated intent is to cause wide scale public motivated adulteration when it is that disgruntled employees are generally health harm through instances such as perpetrated by the entity’s supplier, but understood to be interested primarily in acts of terrorism focused on the food not when it is perpetrated by the entity attacking the reputation of the company supply, occurrences of economically itself, and supplier controls are not and otherwise have little interest in motivated adulteration are expected to warranted in this context because of the public health harm. Typically, acts of be long term, and would not be lack of inputs into the growing, disgruntled employees, consumers, or appropriately viewed as a rare harvesting, packing, or holding of competitors target food and the point(s) occurrence, but rather as reasonably produce or milk (i.e., activities within in its production that are convenient likely to occur. Because of these our farm definition) that could be (i.e., a point at which they can easily reasons, we concluded that the subject to economically motivated access the food and contaminate it). To approaches in the PCHF and PCAF final adulteration that could cause serious minimize or prevent this type of rules are better suited to address adverse health consequences or death adulteration would require restricting economically motivated adulteration. under sections 419 and 420 of the FD&C access to nearly all points in the food We sought comment on our Act. system. Instead, we proposed to focus conclusions. We received one comment suggesting on those points in the food system We received numerous comments we include requirements related to where an attack would be expected to related to economically motivated economically motivated adulteration on cause massive adverse public health adulteration, including comments produce farms and stating that impact. suggesting economically motivated economically motivated adulteration We received comments supporting the adulteration is best addressed in this (e.g., illegal use of dyes and ripening proposed approach; comments stating rule, comments suggesting it is best agents) has occurred on foreign produce that measures should be required to addressed in the PCHF and PCAF final farms. We continue to believe that protect against acts of terrorism and rules, comments recommending preventive controls are suitable to disgruntled employees; and a comment different hazard identification address economically motivated stating that disgruntled employees can methodologies, comments related to adulteration when it is perpetrated by be recruited by terrorist organizations. terminology and definitions, and an entity’s supplier, but not by the The final rule is focused on protecting comments requesting postponement of entity itself. Preventive controls for food against intentional adulteration any economically motivated economically motivated adulteration are where the intent of the adulteration is adulteration-associated requirements. not suitable to address the situation to cause wide scale public health harm. We continue to believe that the where the same farm that would be In the circumstance described by the approaches in the PCHF and PCAF final economically adulterating the food comment where a disgruntled employee rules are better suited to address (which is already prohibited) would is recruited by a terrorist organization, economically motivated adulteration, also be responsible for implementing the motivation of the employee has and have finalized this rule with no preventive controls to prevent the changed from harming the reputation of requirements related to economically adulteration. After considering this the company to that of the terrorist motivated adulteration for facilities comment, we have finalized this rule organization intending to cause wide- covered by those rules. For further with no requirements related to scale public health harm. The rule is discussion see the PCHF final rule (80 economically motivated adulteration on designed to reduce the likelihood that FR 55908 at 56028–56029) and the produce and dairy farms. such an attack would be successful. PCAF final rule (80 FR 56170 at 56243– Further, the protections required by the 56246). 3. Dairy Farms rule would be effective in minimizing In the proposed rule, we also In the proposed rule, we stated that the likelihood of success of a tentatively decided not to require FDA-led vulnerability assessments and disgruntled employee, consumer, or produce farms subject to section 419 of associated data analyses identified competitor who attempts an act of the FD&C Act and farms that produce certain categories of points, steps, or

VerDate Sep<11>2014 19:43 May 26, 2016 Jkt 238001 PO 00000 Frm 00019 Fmt 4701 Sfmt 4700 E:\FR\FM\27MYR4.SGM 27MYR4 mstockstill on DSK3G9T082PROD with RULES4 34184 Federal Register / Vol. 81, No. 103 / Friday, May 27, 2016 / Rules and Regulations

procedures in the food system which awareness training while other not farms (e.g., dairy processing scored high on vulnerability scales comments state that such training may facilities) from complying with this rule. related to intentional adulteration of be beneficial and is provided on some Unlike farms, such facilities have food, regardless of the food being farms, but more information is needed identified effective mitigation strategies assessed. Two of these key activity to identify effective training programs. available to them. In addition, PMO types, liquid storage and handling, and Additionally, several comments requirements do not currently address bulk liquid receiving and loading, are address procedural matters, with many intentional adulteration. Further, unlike present on dairy farms in areas such as comments stating that FDA must either farms, these facilities are not exempt the bulk liquid storage tank. We allow a full and separate comment from the PCHF rule. We note that the requested comment on several period for any potential requirements earliest compliance date for this rule (3 questions, including whether and how for dairy farms because there were no years) is the same as the extended access to the bulk milk storage tank and requirements related to dairy farms in compliance date in the PCHF rule, milk house could be limited; the the proposed rule, or issue a fully which was chosen to give the NCIMS presence and types of any mitigation separate proposal for dairy farms which time to modify the PMO to include the strategies currently used on farms; and will cover the requirements in their requirements of the PCHF rule. whether and what mitigation strategies entirety independent of the intentional would be appropriate and feasible given adulteration regulations for facilities IV. Subpart A: Comments on Specific current dairy farming practices. that are not farms. Some comments also Provisions Some comments acknowledge that request that dairy processing facilities A. Revisions to Definitions Also Used in limiting access to the bulk milk tank be exempt from the requirements of this Section 415 Registration Regulations (21 and milk house is an important rule. CFR Part 1, Subpart H) and Section 414 objective; however, these comments Although we believe requiring Recordkeeping Regulations (21 CFR Part describe significant challenges regarding mitigation strategies that restrict access 1, Subpart J) limiting access to milk. These comments to milk on dairy farms is warranted state that some State laws require based on risk, at this time there are not As discussed in the proposed rule (78 unannounced access to the bulk tank strategies that limit access to milk that FR 78014 at 78030), several terms we and/or the milk house for food safety are appropriate and practical to require proposed have the same definitions as inspections. Additionally, comments for all farms. We believe it is important proposed in 21 CFR part 117 (the PCHF state that locking only the bulk tank that any mitigation strategies we proposed rule) and therefore we did not would be ineffective because this would consider imposing include restricting include an extensive discussion in the still leave the milk accessible via the access to milk while it is on farms. We proposed rule of the following terms: milk house. These comments also state agree with comments that state that facility, farm, holding, manufacturing/ that it is common for many dairy farms potential mitigation strategies, such as processing, mixed-type facility, and to leave the bulk tank and the milk locking the milk tank and milk house, packing. We did not receive specific house unlocked to facilitate normal day- are not currently workable given the comments on any of our proposed to-day operations and that any realities of milking schedules and the definitions for these terms, except that regulation requiring strictly limiting access to the bulk tank needed for food many comments state that it is critical access, such as locking the milk house, safety inspections and milk collection. for FDA to cross-reference and be would be impractical due to the We need further dialogue with key consistent with the same terms as multiple entry points and the number of stakeholders and collaborative research finalized in the PCHF final rule. We personnel needed for these measures to to develop and identify strategies that agree and we have amended each of function effectively. Some comments are protective and practical; we are these terms to be consistent with the suggest that FDA engage in substantial aware of technology-mediated definitions as finalized in the PCHF dialogue with industry to gain a better advancements that are under final rule. See section IV. of the PCHF understanding of current practices and development, and are potentially final rule for extensive discussion of the better ascertain the food defense promising for the future in this area. comments received and changes made measures that would be effective and Given the current lack of mitigation to these definitions. strategies that would practically limit appropriate before issuing regulations. 1. Facility Some comments state that FDA should access to milk, we agree that working utilize existing programs to identify with the Federal-State collaborative We proposed to define the term potential activities to reduce the program for milk safety, the National ‘‘facility’’ to mean a domestic facility or vulnerability to intentional adulteration Conference on Interstate Milk a foreign facility that is required to on dairy farms because these programs Shipments (NCIMS), is the most register under section 415 of the FD&C have demonstrated efficacy and have appropriate way to address concerns Act (21 U.S.C. 350d), in accordance the structures in place to successfully regarding intentional adulteration on with the requirements of 21 CFR part 1, implement new food defense measures. dairy farms in the near term as strategies subpart H. We have finalized this term Some comments state that FDA that can limit access to milk while on as proposed, except that we have made should not issue requirements for dairy farm are developed. We believe NCIMS editorial changes by removing the U.S. farms because they are not at high risk offers an effective platform for FDA to Code citation and amended the Code of for intentional adulteration. Some advance the development and Federal Regulations citation. comments describe the willingness of implementation of mitigation strategies 2. Farm stakeholders to adopt voluntary food for dairy farms because the cooperative defense measures, with specific program includes key partners, such as We proposed to define the term examples including State-led education the U.S. Public Health Service/FDA, the ‘‘farm’’ by reference to the definition of efforts and adoption of some elements of States, and the dairy industry, and has that term in § 1.227 of this chapter. We existing FDA guidance relating to food a central role in helping to ensure the have finalized this term as proposed. defense measures on dairy farms. Some safety of milk and milk products. For a detailed discussion of the comments state that any requirements We are not exempting Pasteurized definition of ‘‘farm,’’ see sections IV.A should be limited to food defense Milk Ordinance (PMO) facilities that are and IV.B of the PCHF final rule.

VerDate Sep<11>2014 19:43 May 26, 2016 Jkt 238001 PO 00000 Frm 00020 Fmt 4701 Sfmt 4700 E:\FR\FM\27MYR4.SGM 27MYR4 mstockstill on DSK3G9T082PROD with RULES4 Federal Register / Vol. 81, No. 103 / Friday, May 27, 2016 / Rules and Regulations 34185

3. Holding 5. Mixed-Type Facility use of statutory definitions in section 201 of the FD&C Act, and we are We proposed to define the term We proposed to define mixed-type facility to mean an establishment that finalizing that provision without ‘‘holding’’ to mean storage of food. In change. In this section, we discuss each addition, we proposed that holding engages in both activities that are exempt from registration under section definition as proposed, related facilities include warehouses, cold comments, and our responses. storage facilities, storage silos, grain 415 of the FD&C Act and activities that elevators, and liquid storage tanks. require the establishment to be 1. Actionable Process Step registered. The proposed definition also Further, we proposed that for farms and We proposed to define the term stated that an example of such a facility farm mixed-type facilities, holding also ‘‘actionable process step’’ to mean a is a ‘‘farm mixed-type facility,’’ which is includes activities traditionally point, step, or procedure in a food an establishment that grows and performed by farms for the safe or process at which food defense measures harvests crops or raises animals and effective storage of raw agricultural can be applied and are essential to may conduct other activities within the commodities grown or raised on the prevent or eliminate a significant farm definition, but also conducts vulnerability or reduce such same farm or another farm under the activities that require the establishment same ownership, but does not include vulnerability to an acceptable level. to be registered. In this final rule, Although we did not receive comments activities that transform a raw consistent with PCHF final rule and as agricultural commodity (RAC), as on the proposed definition for a conforming change associated with the actionable process step, we have revised defined in section 201(r) of the Federal revisions to the ‘‘farm’’ definition, we Food, Drug, and Cosmetic Act (21 U.S.C. the definition to improve understanding have revised the example of a ‘‘farm of the regulatory requirements in 321), into a processed food as defined in mixed-type facility’’ to specify that it is § 121.130 (Vulnerability assessment to section 201(gg). In this final rule, an establishment that is a farm, but also identify significant vulnerabilities and consistent with the PCHF final rule, we conducts activities outside the farm actionable process steps) and to be have revised the definition for definition that require the establishment consistent with the definition of ‘‘holding’’ by removing the distinction to be registered. For a detailed mitigation strategies. In this final rule, for farms and farm mixed-type facilities discussion of the definition of ‘‘mixed- actionable process step is defined to and added that holding also includes type facility,’’ see section IV.F of the mean a point, step, or procedure in a activities performed incidental to PCHF final rule. food process where a significant storage of a food, but does not include 6. Packing vulnerability exists and at which activities that transform a RAC into a mitigation strategies can be applied and processed food and included additional We proposed to define packing to are essential to significantly minimize examples of holding activities. For a mean placing food into a container other or prevent the significant vulnerability. detailed discussion of the definition of than packaging the food. Further, the ‘‘holding,’’ see section IV.D of the PCHF proposed rule provided that for farms 2. Contaminant final rule. and farm mixed-type facilities, packing We proposed to define the term also includes activities traditionally ‘‘contaminant’’ to mean any biological, 4. Manufacturing/Processing performed by farms to prepare RACs chemical, physical or radiological agent We proposed to define grown or raised on the same farm or that may be intentionally added to food manufacturing/processing to mean another farm under the same ownership and that may cause illness, injury or making food from one or more for storage and transport, but does not death. (Comment 39) Some comments assert ingredients, or synthesizing, preparing, include activities that transform a RAC, as defined in section 201(r) of the FD&C the proposed language defining treating, modifying or manipulating Act, into a processed food as defined in ‘‘contaminant’’ could be interpreted to food, including food crops or section 201(gg). In this final rule, include ingredients intentionally added ingredients. Further, the proposed consistent with the PCHF final rule, we to food that resulted in harm, even if definition provided that examples of have revised the definition for unintentional, such as an unintended manufacturing/processing activities are ‘‘packing’’ by removing the distinction allergic or other adverse health cutting, peeling, trimming, washing, for farms and farm mixed-type facilities response. The comments urge FDA to waxing, eviscerating, rendering, and adding that packing includes clarify the meaning to be an cooking, baking, freezing, cooling, activities performed incidental to ‘‘intentional’’ contaminant, for the pasteurizing, homogenizing, mixing, packing a food, but does not include purpose of this rule, by amending the formulating, bottling, milling, grinding, activities that transform a RAC into a proposed definition as follows: extracting juice, distilling, labeling, or processed food. We have also revised ‘‘Contaminant means any biological, packaging. In addition, the proposed the definition to clarify that packing chemical, physical or radiological agent definition provided that for farms and includes ‘‘re-packing.’’ For a detailed added to food to intentionally cause farm mixed-type facilities, discussion of the definition of illness, injury or death.’’ manufacturing/processing does not ‘‘packing,’’ see section IV.G of the PCHF (Response 39) We agree with the include activities that are part of final rule. possible confusion as pointed out by the harvesting, packing, or holding. In this comments and have amended the final rule, consistent with PCHF final B. Other Definitions That We Proposed proposed definition. The term rule, we have revised the definition of To Establish in Part 121 ‘‘contaminant’’ is used in the context of ‘‘manufacturing/processing’’ by adding To establish the scope of facilities, intentional acts of adulteration with to the list of examples and we have activities and food covered by this intent to cause wide scale public health reorganized the listed examples to regulation, we proposed to define key harm. We agree that amending the present them in alphabetical order. For terms. We also proposed to establish proposed definition for contaminant to a detailed discussion of the definition of that the definitions in section 201 of the make clear that the harm must be ‘‘manufacturing/processing,’’ see section FD&C Act apply when used in part 121. intended better reflects how the term is IV.E of the PCHF final rule. We received no comments regarding the used in this rule.

VerDate Sep<11>2014 19:43 May 26, 2016 Jkt 238001 PO 00000 Frm 00021 Fmt 4701 Sfmt 4700 E:\FR\FM\27MYR4.SGM 27MYR4 mstockstill on DSK3G9T082PROD with RULES4 34186 Federal Register / Vol. 81, No. 103 / Friday, May 27, 2016 / Rules and Regulations

(Comment 40) One comment asserts laboratory materials, and pesticides; (4) or an attacker who circumvents the term ‘‘contaminant,’’ is used widely management practices, such as perimeter protections (e.g., scaling a in the food and dietary supplement ingredient storage inventory procedures; fence), with the goal of intentionally industries and that if FDA were to key security procedures, PINs or contaminating the food. include a definition for this term, it passwords; procedures to restrict Although the regulatory text now only must employ a definition that is personal items from all food production refers to ‘‘mitigation strategies,’’ we consistent throughout all regulations areas; procedures requiring IDs and continue to believe that facilities must pertaining to food and dietary uniforms to be returned when a person’s protect vulnerable points in their supplements. Further, one comment employment ends; and supplier operation from acts of intentional notes that this term is defined verification or certification procedures; adulteration intended to cause wide differently in the proposed rule (i.e., a and (5) crisis management planning, scale public health harm and that a contaminant is any agent that may be such as maintenance of updated facility’s vulnerability to acts of added to food) than it is in the Codex emergency contact information, Alimentarius guidelines (i.e., procedures for responding to reported intentional adulteration by attackers contaminants are substances that are threats, and establishment of a who have achieved access to the facility ‘‘not intentionally added to food or designated food defense leadership must be significantly reduced or feed’’). The comment suggests that FDA team. We further explained that broad prevented to protect the food from take note of this difference and consider mitigation strategies, by nature, are intentional adulteration intended to revisions with the goal of promoting generally applicable to a facility, cause wide scale public health harm. consistency and common understanding regardless of the type of food being General, facility-level protections do not of terminology. processed, and, as such, are not targeted sufficiently address the significant (Response 40) As discussed in the to a specific processing step in a food vulnerabilities within a facility because proposed rule (78 FR 78014 at 78031), operation. they do not address an inside attacker we based the proposed definition, in In contrast, focused mitigation who has obtained access to the facility. part, on the definition of ‘‘contaminant’’ strategies are specific to an actionable (Comment 41) Some comments state used in Codex Alimentarius guidelines, process step in a food operation where that the distinction between ‘‘broad’’ but made modifications to reflect the a significant vulnerability is identified. and ‘‘focused’’ mitigation strategies is narrower context that the term is used They represent reasonably appropriate confusing, and request that the within this rule. Further, as discussed in measures that are necessary to reduce distinction be removed. One comment response to Comment 39, we are the likelihood of intentional states the line between broad and amending the definition of adulteration intended to cause wide focused mitigation strategies is often ‘‘contaminant’’ to better reflect its scale public health harm. Focused blurry. The comment asks how close limited use in this rule. mitigation strategies are customized to ingredient handling needs to be to a gate the processing step at which they are 3. Focused Mitigation Strategies for the gate to be considered a focused applied, tailored to existing facility mitigation strategy and not a broad one. We proposed to define the term practices and procedures, and depend The comment further asserts that a ‘‘focused mitigation strategies’’ to mean on an evaluation of the significant mandate for focused mitigation those risk-based, reasonably appropriate vulnerability associated with the strategies will result in endless debates measures that a person knowledgeable actionable process step at which they between facility management and FDA about food defense would employ to are applied. In the proposal we investigators as to whether a particular significantly minimize or prevent tentatively concluded, based on our mitigation strategy is broad or focused significant vulnerabilities identified at vulnerability assessments, that the and that this potential for difference of actionable process steps, and that are implementation of focused mitigation opinion between facilities and FDA consistent with the current scientific strategies at actionable process steps in understanding of food defense at the investigators is of significant concern for a food operation is necessary to industry stakeholders. time of the analysis. minimize or prevent the significant We explained in the proposed rule vulnerabilities that are identified in a (Response 41) The question asked by that a ‘‘mitigation strategy’’ is a measure vulnerability assessment, regardless of the comment highlights the nuance and taken by a facility to reduce the the existence of broad mitigation gradation that exists within mitigation potential for intentional adulteration of strategies. strategies. After considering the food. We further explained that FDA We further explained, in contrast to comments, we agree that many divides mitigation strategies into two broad mitigation strategies, focused mitigation strategies may not lend types, ‘‘broad mitigation strategies’’ and mitigation strategies are targeted to themselves to clear categorizations as ‘‘focused mitigation strategies.’’ We actionable process steps and, therefore, either ‘‘broad’’ or ‘‘focused,’’ and we explained that broad mitigation are more effective at countering an agree that the delineation between broad strategies are general facility-level attacker who has legitimate access to the and focused mitigation strategies, as measures that are intended to minimize facility. Our conclusion was based upon described in the proposed rule, may be a facility’s vulnerability, as a whole, to our interactions with the intelligence confusing because of the wide diversity potential acts of intentional community and the many vulnerability of potential mitigations as well as adulteration. We provided some assessments we conducted with variation as to how a facility chooses to examples of broad mitigation strategies, industry, which showed that an act of implement a particular strategy. As a such as (1) physical security, such as intentional adulteration by an insider result, we have modified the regulatory perimeter security fencing, locking presents significant risk for that text throughout the final rule to refer to exterior doors, penetration alarms; (2) adulteration to result in wide scale ‘‘mitigation strategy’’ rather than personnel security, such as pre-hire public health harm and that broad ‘‘focused mitigation strategy.’’ For background and reference checks, mitigation strategies are not specific example, § 121.135 now requires identification badges, and controlled enough, for example, to counter the ‘‘mitigation strategies for actionable visitor access; (3) securing hazardous actions of an attacker who has legitimate process steps.’’ Also, the title of the rule materials, such as cleaning products, access to the facility (i.e., insider attack) has been modified to reflect this change.

VerDate Sep<11>2014 19:43 May 26, 2016 Jkt 238001 PO 00000 Frm 00022 Fmt 4701 Sfmt 4700 E:\FR\FM\27MYR4.SGM 27MYR4 mstockstill on DSK3G9T082PROD with RULES4 Federal Register / Vol. 81, No. 103 / Friday, May 27, 2016 / Rules and Regulations 34187

4. Food the rule is not the protection against safety and food defense HACCP-type We proposed to define the term economic disruption we have removed system differ in important, specific ‘‘food’’ to mean food as defined in that language from the definition of ways. As noted in the Regulatory section 201(f) of the FD&C Act and ‘‘food defense’’ for purposes of this rule. Approach discussion in section III.A, include raw materials and ingredients. In addition, as discussed in section food safety uses the term ‘‘hazard (Comment 42) Some comments urged III.G.2, economically motivated analysis’’ to identify hazards, while food us to clarify that the definition of food adulteration is not addressed in this defense uses the term ‘‘vulnerability does not include food contact final rule. assessment’’ to identify significant (Comment 44) One comment states vulnerabilities. These terms are substances as defined in section that the proposed rule defines ‘‘food completely different because they 409(h)(6) of the FD&C Act (21 U.S.C. defense’’ within the scope of the rule represent key disciplinary differences 348(h)(6)). One comment recommends and requests that FDA establish a which require different methodological FDA amend the definition of food to generalized definition of ‘‘food defense’’ considerations related to whether the exempt EPA registered antimicrobials/ that can be adopted for the purposes of adulteration is intentional. A hazard pesticides and food contact substances all FDA activities and subsequently the analysis has very different which have no ongoing intended scope of this rule can then be further considerations than a vulnerability technical effect in the final finished elaborated. The comment proposes the assessment. food. following definition of food defense: However, we disagree that completely (Response 42) This rule only applies ‘‘Actions and activities related to different terminology is appropriate for to facilities required to register with prevention, protection, mitigation, a term that describes the performance of FDA. The registration rule does not response, and recovery of the food similar activities for both food safety include food contact substances and system from intentional acts of and food defense. Monitoring is pesticides (21 CFR 1.227(a)(4)(i)). No adulteration. This includes intentional conducted to perform a similar function change to the definition of food in this adulteration from both terrorism and and in similar ways in both a food rule is necessary. criminal activities. Criminal activities defense and a food safety framework. In 5. Food Defense include economically motivated both contexts monitoring is conducted adulteration, as well as acts by to assess whether control measures are We proposed to define the term ‘‘food disgruntled employees, consumers, or operating as intended, and in defense’’ to mean the effort to protect competitors intending to cause public accordance with the food safety or food food from intentional acts of health harm or business disruption.’’ defense plan. However, constant adulteration where there is an intent to (Response 44) We decline this monitoring of some preventive controls cause public health harm and economic request. The purpose of § 121.3 is necessary (e.g., time-temperature disruption. (Definitions) is to define terminology monitoring for pasteurization), while (Comment 43) One comment states that is used within the regulatory text of periodic monitoring is likely to be more that references to ‘‘terrorism’’ in the the rule. Therefore, the definitions of appropriate for many mitigation preamble to the proposed rule were terms need to be within the context and strategies (e.g., checking the lock on an unnecessarily limiting and confusing scope of the rule, rather than a access hatch to a liquid storage tank at and recommends that instead of definition to be used by FDA or industry the end of the tank cleaning cycle). attempting to narrow the scope of activities not related to the rule in Therefore, to recognize that the intentional adulteration to ‘‘terrorism,’’ particular. management components for food safety FDA should use the definition of ‘‘food and food defense perform similar 6. Monitor defense’’ to explain and further clarify activities, but also include some the focus of activities covered by the We proposed to define the term differences, we are changing the term to rule. ‘‘monitor’’ to mean to conduct a ‘‘food defense monitoring’’ to make (Response 43) We agree with this planned sequence of observations or clear that the expectations for comment and have modified the measurements to assess whether compliance are different. In additional definition of ‘‘food defense’’ in the final focused mitigation strategies are recognition that the management rule as follows: ‘‘Food defense means, consistently applied and to produce an components for food safety and food for purposes of this part, the effort to accurate record for use in verification. defense perform similar activities, we protect food from intentional acts of (Comment 45) Some comments assert are finalizing the definition of food adulteration where there is intent to that food safety and food defense defense monitoring to mean to conduct cause wide scale public health harm.’’ require different terminology and a planned sequence of observations or As discussed in the preamble to the suggest referring to the activities as measurements to assess whether proposed rule, although we referred to ‘‘checking’’ instead of ‘‘monitoring.’’ mitigation strategies are operating as the protection of the food supply from These comments go on to suggest that intended. This definition is similar to ‘‘acts of terrorism’’ throughout the the definition of checking should be ‘‘to the definition of monitoring in the proposed rule, we expect our approach observe or otherwise assess whether PCHF final rule. would generally address acts intended mitigation strategies or measures are in As we have concluded that, in some to cause wide scale public health harm, place and fully implemented.’’ The instances, similar terminology is whether committed by terrorists, comments also state that ‘‘a planned appropriate for activities that are terrorist organizations, individuals or sequence of observations and conducted to perform similar functions groups of individuals. The purpose of measurements’’ may not be appropriate for food safety and food defense, this rule is to protect the food supply for all or any mitigation strategies, and incorporation of elements from against individuals or organizations questions what kind of measurements of definitions of internationally recognized with the intent to cause wide scale a mitigation strategy a facility would standards (e.g., Codex) is appropriate for public health harm. Further, although take. this rule. A ‘‘planned sequence’’ is economic disruption is likely to occur (Response 45) We agree that using included in the definition because it is in any such instance of wide scale completely different terminology is important to thoughtfully and public health harm, because the focus of appropriate when components of a food systematically assess whether mitigation

VerDate Sep<11>2014 19:43 May 26, 2016 Jkt 238001 PO 00000 Frm 00023 Fmt 4701 Sfmt 4700 E:\FR\FM\27MYR4.SGM 27MYR4 mstockstill on DSK3G9T082PROD with RULES4 34188 Federal Register / Vol. 81, No. 103 / Friday, May 27, 2016 / Rules and Regulations

strategies are operating as intended, and death and the degree of accessibility to (see § 1.328). Under this approach, the the inclusion of ‘‘a planned sequence’’ that point in the food process. number of full-time equivalent in the definition conveys this Although we did not receive employees is determined by dividing importance. For example, a facility may comments on the proposed definition the total number of hours of salary or establish and implement written for significant vulnerability, we have wages paid directly to employees of the monitoring procedures to include a revised the definition to improve business entity claiming the exemption planned sequence of observations to understanding of the regulatory and of all of its affiliates and monitor a lock on an access hatch to requirements in § 121.130 (Vulnerability subsidiaries by the number of hours of occur at the end of every silo cleaning assessment to identify significant work in 1 year, 2,080 hours (i.e., 40 cycle, when there is potential to add a vulnerabilities and actionable process hours × 52 weeks). contaminant because the access hatch steps). In this final rule, significant In addition, we are adding ‘‘including can be opened without the contents of vulnerability is defined to mean a any subsidiaries and affiliates’’ to the the silo spilling out. Without planning vulnerability that, if exploited, could definition to provide clarity on how to the sequence of observations of this reasonably be expected to cause wide calculate ‘‘500 full-time equivalent mitigation strategy, monitoring the scale public health harm. A significant employees’’ for purposes of this rule. strategy may occur in the middle of the vulnerability is identified by a cleaning cycle when the access hatch vulnerability assessment, conducted by 10. Verification must be open to complete the cleaning a qualified individual, that includes We proposed to define the term process, and would therefore not be able consideration of the following: (1) ‘‘verification’’ to mean those activities, to assess if the mitigation strategy was Potential public health impact (e.g., other than monitoring, that establish functioning as intended (i.e., properly severity and scale) if a contaminant that the system is operating according to locking the access hatch at the end of were added, (2) degree of physical the food defense plan. the cleaning cycle). Additionally, we access to the product, and (3) ability of (Comment 46) One comment suggests include the term ‘‘measurements’’ not an attacker to successfully contaminate ‘‘verification’’ be defined as ‘‘the only to align more so with definitions the product. The assessment must application of methods, procedures, from international standards, but also to consider the possibility of an inside tests and other evaluations, in addition reflect a facility’s flexibility to choose attacker. For further discussion of the to monitoring, to determine whether a the most appropriate mitigation strategy related changes made to the requirement focused mitigation strategy is or has and how to monitor that strategy. In in § 121.130 for a vulnerability been operating as intended.’’ assessment to identify significant many cases, a facility will observe that (Response 46) We have revised the vulnerabilities and actionable process a mitigation strategy is functioning as definition of food defense verification to steps, see section V.B. intended; however, there are some cases more closely align with the Codex where a facility may measure whether a 8. Significantly Minimize definition of verification. The term is strategy is functioning as intended. For We proposed to define the term now defined as the application of example, a facility may choose to ‘‘significantly minimize’’ to mean to methods, procedures, and other implement a mitigation strategy that is reduce to an acceptable level, including evaluations, in addition to food defense a thermal-kill step. It would then be to eliminate. monitoring, to determine whether a necessary for the facility to take We did not receive comments on the mitigation strategy or combination of measurements of the time and proposed definition for significantly mitigation strategies is or has been temperature to ensure the thermal-kill minimize and we are finalizing the operating as intended according to the step is functioning as intended. definition as proposed. food defense plan. ‘‘Methods, Additionally, we have deleted procedures, and other evaluations’’ ‘‘consistently applied’’ in the proposed 9. Small Business better describes the scope of verification definition and added ‘‘operating as We proposed to define the term than ‘‘activities’’ used in the proposal. intended’’ as this more closely aligns ‘‘small business’’ to mean a business Although the Codex definition includes with the ISO 22000:2005 and with a employing fewer than 500 persons. We ‘‘test’’ as a form of verification, we have similar change made in the PCHF final proposed to establish the same not included it because the rule does rule. Finally, we have removed ‘‘and to definition for small businesses as that not require verification testing. We produce an accurate record for use in which has been established by the U.S. believe changing ‘‘that establish the verification’’ from the proposed Small Business Administration under system is operating’’ to ‘‘to determine definition because the requirement for 13 CFR part 121 for most food whether a mitigation strategy is or has documenting monitoring records is manufacturers. We did not receive any been operating’’ more accurately established by the requirement for comments on this definition. We are describes the purpose of food defense monitoring, and not by the definition of finalizing the definition as proposed, verification. We have added ‘‘a monitor. As discussed in Response 89, with several changes for clarity. We are combination of mitigation strategies’’ to we have made several revisions to the using the term ‘‘500 full-time equivalent recognize that facilities may use more regulatory text, with associated editorial employees’’ rather than ‘‘500 persons.’’ than one mitigation strategy to changes, to clarify that monitoring In addition, we are adding a definition significantly minimize or prevent a records may not always be necessary. of ‘‘full-time equivalent employee’’ to significant vulnerability. The definition 7. Significant Vulnerability the definition section (§ 121.3). We have proposed by the comment limits made these changes because we will verification to mitigation strategies; it We proposed to define the term base the calculation on ‘‘full-time does not require verification of the food ‘‘significant vulnerability’’ to mean a equivalent employees’’ and use the defense plan. Verification of the food vulnerability for which a prudent same approach to calculating full-time defense plan reflects the fact that person knowledgeable about food equivalent employees for the purpose of verification is broader than just defense would employ food defense this rule as we used to calculate full- mitigation strategies; it includes, for measures because of the potential for time equivalent employees in the example, verification of food defense serious adverse health consequences or section 414 recordkeeping regulations monitoring and corrective actions.

VerDate Sep<11>2014 19:43 May 26, 2016 Jkt 238001 PO 00000 Frm 00024 Fmt 4701 Sfmt 4700 E:\FR\FM\27MYR4.SGM 27MYR4 mstockstill on DSK3G9T082PROD with RULES4 Federal Register / Vol. 81, No. 103 / Friday, May 27, 2016 / Rules and Regulations 34189

(Comment 47) Some comments because otherwise firms may be subject rules under FSMA they are required to suggest using the term ‘‘evaluation’’ to significant changes in status from comply with if the definitions of the instead of verification. These comments year to year. Those comments also ask size of business are not consistent suggest that evaluation be defined as us to clarify that the sales are to be throughout all FSMA rules. Some ‘‘those activities, in addition to evaluated retrospectively, not comments encourage us to establish a checking, that establish that the facility prospectively. Although we did not tiered system that clearly outlines is implementing a food defense plan.’’ receive similar comments to this rule, in coverage under all FSMA rules by (Response 47) We deny this request. an effort to be consistent with the PCHF business size, while others request that As discussed in response to Comment final rule, we have revised the we provide clear guidance to assist 46, we have revised the definition of definition of very small business to firms, especially small and very small food defense verification to include specify that it is based on average sales businesses, to identify which of the ‘‘evaluation’’ because evaluation is an during the 3-year period preceding the seven FSMA rules are applicable to appropriate verification activity. applicable calendar year. The applicable them. However, we disagree that completely calendar year is the year after the 3 (Response 49) We recognize that the different terminology (in this case, calendar years used to determine varying business size thresholds across ‘‘evaluation’’ rather than ‘‘verification’’) whether a facility is a very small the FSMA rules may be cause for is appropriate for a term that describes business. confusion. However, each of the rules the performance of similar activities for We also revised the definition to differs in scope and intent, which both food safety and food defense (see include the market value of human food compels us to establish requirements Responses 45 and 46). Verification is manufactured, processed, packed, or and exemptions that are specific to and conducted to perform a similar function held without sale (e.g., held for a fee). appropriate for each rule. To help small and in similar ways in both a food When there are no sales of human food, and very small businesses comply with defense and a food safety framework. In market value of the human food each rule, we plan to issue Small Entity both frameworks verification is manufactured, processed, packed, or Compliance Guides. conducted to determine whether control held without sale is a reasonable (Comment 50) One comment objected measures are operating as intended approach to calculating the dollar to exempting any facilities from the according to the food safety or food threshold for a very small business. rule, arguing that this would give defense plan, and these verification (Comment 48) One comment requests terrorists a ‘‘road map’’ to those activities are in addition to monitoring. that FDA change the definition of ‘‘very facilities not covered and make them At the same time, by using the term small business’’ to only apply to targets for intentional adulteration. The ‘‘food defense verification,’’ we make $10,000,000 in annual sales of food that comment recommends that FDA remove clear that verification as required by this is covered under the rule, and not to the exemptions for very small rule is not identical to verification total annual food sales. The comment businesses and qualified facilities required in the preventive controls asserts that basing the threshold on the completely. context. sale of food covered by the intentional (Response 50) We disagree with this adulteration rule, rather than all food, comment. Section 418(l)(2) of the FD&C 11. Very Small Business would be necessary to be consistent Act specifies that qualified facilities, We proposed to define the term ‘‘very with the fact that covered produce is which include very small businesses, small business’’ to mean a business that regulated under the produce rule. are not subject to the requirements in has less than $10,000,000 in total Specifically, the comment requests that sections 418(a) through (i) and (n). We annual sales for food, adjusted for we exclude the sale of animal foods note that section 418(l)(2) requires inflation. In the preamble of the from the calculation of annual food qualified facilities to submit one of two proposed rule we explained our sales because this rule exempts the types of documentation to the Secretary. rationale for defining ‘‘very small manufacturing, processing, packing, or The PCHF and PCAF rules have businesses’’ at the $10,000,000 holding of animal foods. The comment requirements reflecting this provision threshold because the purpose of this further argues that this approach is but this rule does not. Section rule is to protect the food supply against consistent with the statutory mandate 418(l)(2)(B)(i)(I) requires documentation individuals or organizations with the that FDA regulations be flexible in scale that demonstrates that the facility has intent to cause wide scale public health and supply chain appropriate and identified potential hazards and is harm. We tentatively conclude these provide special considerations for small implementing and monitoring the individuals or groups would likely and very small businesses. preventive controls. We have concluded target the product of relatively large (Response 48) We have revised the that very small businesses are at facilities, especially firms whose brand definition of very small businesses to reduced risk and therefore do not have is nationally or internationally include only the sale of human food significant vulnerabilities that require recognizable. Some comments agree plus the market value of human food mitigation strategies. Therefore, there is with our proposed definition while manufactured, processed, packed, or nothing for very small businesses to others disagree. Among the comments held without sale (e.g., held for a fee). document under this option. In contrast, that disagree with the definition, some Under this revised definition, firms that a human or animal food facility is not state that the $10,000,000 amount is too process both human and animal foods at lesser risk of a food safety problem high or too low, and several comments will not be required to include sale of solely because it is relatively small. suggest alternatives to using dollar animal food in their calculation to Section 418(l)(i)(II) is similarly amount as the threshold. We further determine whether they fall under the inapplicable for several reasons. That discuss these comments and our $10,000,000 threshold. section requires documentation that a response to them in this document. (Comment 49) Several comments facility is in compliance with State, Some comments submitted to the expressed confusion with the varying local, county, or other applicable non- PCHF proposed rule request that we business size thresholds across the Federal food safety law. First, food specify that the monetary threshold for seven FSMA rules and stated that it will safety is traditionally viewed as separate the definition be based on average sales be a significant challenge for the food from food defense. Second, no States during a 3-year period on a rolling basis industry to interpret and decide which currently require food defense

VerDate Sep<11>2014 19:43 May 26, 2016 Jkt 238001 PO 00000 Frm 00025 Fmt 4701 Sfmt 4700 E:\FR\FM\27MYR4.SGM 27MYR4 mstockstill on DSK3G9T082PROD with RULES4 34190 Federal Register / Vol. 81, No. 103 / Friday, May 27, 2016 / Rules and Regulations

measures, and States are unlikely to the food supply and in the government’s cause public health harm that was impose measures different from those in ability to ensure its safety and, perpetrated in a setting that would be this rule. Therefore, compliance with consequently, cause greater economic covered by this rule (i.e., all such ‘‘food safety law’’ as described in the disruption than a relatively unknown previous attacks have involved provision would be irrelevant. In brand that is distributed regionally. restaurant or donated food), it would contrast, all States have food safety (Comment 52) Several comments appear that the risk of any such attack laws. Further, regulations issued under argue that the $10,000,000 threshold is occurring is overall quite low, and that section 420 of the FD&C Act are to apply too high, is arbitrary and not risk-based, only the most attractive targets can to food for which there is a high risk of and excludes many suppliers and co- conceivably be considered ‘‘high’’ risk.’’ intentional contamination (section manufacturers to large food companies. (Response 53) We decline this 420(c)). Individuals or groups intending The comments state that suppliers who request. Although we agree that those to cause wide scale public health harm provide ingredients to larger firms intending to cause wide scale public are more likely to target the product of would not be covered under the rule health harm would more likely target relatively large facilities, especially for and therefore would pose a significant the larger well known food brands, we facilities whose brands are nationally or vulnerability to these large, nationally disagree that there is little benefit to be internationally recognizable, than to branded food manufacturers that have gained by imposing the requirements of target very small businesses. Covering large consumer exposure. They argue this rule on companies under a all facilities would be inconsistent with that this high threshold creates a major $50,000,000 or $1,000,000,000 the statutory requirement to limit hole in the industry that may be threshold. To identify which facilities to coverage to foods at high risk. The exploited, and they point out that we cover under this rule, we assessed risk $10,000,000 threshold for very small identified ‘‘ingredient handling’’ as a based on both the likelihood of being a businesses still covers 97–98 percent of key activity type having significant target and the potential impact to public the market share of manufactured vulnerabilities and therefore all health. If we were to increase the packaged foods (Ref. 14). In addition, ingredient manufacturers need to be threshold for a very small business to section 420(a)(1)(B) of the FD&C Act covered. $50,000,000 or $1,000,000,000, a large directs FDA to consider the risks, costs, (Response 52) The full name of the number of facilities producing large and benefits associated with protecting key activity type referenced is quantities of food, including some well- food against intentional adulteration. ‘‘secondary ingredient handling.’’ known brands, would not be covered. Imposing the full requirements of the Secondary ingredient handling refers to (Comment 54) Several comments state rule on all facilities, regardless of size, activity occurring in the production that using annual sales is not indicative would almost triple the current cost of facility where the ingredient is being of risk and offer alternative ways to the rule while only covering an added; it does not refer to a facility’s define which facilities are covered additional 2–3 percent of the market ingredient supply chain. The potential under the rule. The comments argue share of manufactured foods. for incoming ingredients to be that annual sales do not determine the (Comment 51) One comment intentionally adulterated is addressed potential consumer exposure as it recommends we apply the lower dollar by the rule’s applicability to ingredient relates to preventing wide scale public amount used to define ‘‘very small suppliers. As with finished food, not all health harm because more expensive businesses’’ in the PCHF proposed rule. ingredient suppliers are covered. The products could have higher annual sales Another comment recommends that the rule focuses on those foods at highest but lower consumer exposure. The threshold be lowered to $3,000,000 risk of intentional adulteration; it does comments point out that a manufacturer because smaller companies are less not eliminate all risk. of a premium chocolate bar would sell likely to implement food defense (Comment 53) Several comments fewer chocolate bars than a commodity measures unless mandated. argue that the $10,000,000 threshold is chocolate manufacturer with sales of the (Response 51) The higher threshold too low and recommend that we same dollar amount. Some comments for very small businesses in this rule as increase it to $50,000,000 or suggest alternatives to using annual compared to the PCHF rule reflects the $1,000,000,000 in annual sales. One sales, including units of a product sold difference in the nature of risk of comment states that for an intentional (e.g., 100,000 retail units), number of intentional adulteration as compared to adulteration event to happen, the brand servings, volume manufactured, and unintentional adulteration (i.e., or food must be one that a terrorist or distribution patterns of the product. traditional food safety). This rule a similarly ill-intentioned person is Other comments recommend using the protects food against intentional likely to target, which would encompass shelf life of products or the shelf adulteration caused by individuals or only the largest and most well-known stableness of product as alternatives. organizations whose goal is to maximize food brands. The comment goes on to (Response 54) We use sales and the public health harm. An attacker would argue that, ‘‘the top roughly 250 food market value of food manufactured, more likely target the product of brands in the Western world are owned processed, packed, or held without sale relatively large facilities, especially by only a handful companies having as a proxy for volume. We are aware firms whose brand is nationally or annual human food revenues from tens that dollar amounts can be skewed by internationally recognizable. An attack of billions of dollars to over 100 billion product values and, thus, sales are an on such a target would potentially dollars,’’ and therefore, if we are imperfect proxy for volume. However, provide the desired wide scale public focusing the rule on those at ‘‘high we are not aware of a more practical health consequences and the significant risk,’’ as specified under section 420 of way to identify a threshold based on public attention that would accompany the FD&C Act, then there is little benefit volume or amount of product that could an attack on a recognizable brand. Such to be gained by imposing the be applied across all product sectors, facilities are likely to have larger batch requirements of this rule on hundreds of and the comments provide no sizes, potentially resulting in greater thousands of companies whose products suggestions for how their human morbidity and mortality. are not likely to be targeted. The recommendations could be carried out. Further, an attack on a well-recognized, comment points out that because we are Shelf life and shelf stability are not trusted brand is likely to result in ‘‘unable to identify any previous act of necessarily good indicators of the speed greater loss of consumer confidence in intentional adulteration intended to at which a particular product moves

VerDate Sep<11>2014 19:43 May 26, 2016 Jkt 238001 PO 00000 Frm 00026 Fmt 4701 Sfmt 4700 E:\FR\FM\27MYR4.SGM 27MYR4 mstockstill on DSK3G9T082PROD with RULES4 Federal Register / Vol. 81, No. 103 / Friday, May 27, 2016 / Rules and Regulations 34191

through the distribution system because amount of food has more resources than year, 2,080 hours (i.e., 40 hours × 52 many products are sold and consumed the businesses being excluded, even if weeks). If the result is not a whole months, and even years, before their less than that threshold dollar amount number, round down to the next lowest shelf life expires. The risk of a product reflects sales to the United States. whole number. Because the calculation for intentional adulteration does not Likewise, a domestic business that sells for the number of employees affects the increase based solely on a short shelf more than the threshold dollar amount small business definition and extended life. Similarly, a product that has a of food has more resources than the compliance dates, we are establishing longer shelf life is not necessarily at businesses being excluded, even if that the definition of ‘‘full-time equivalent lower risk for intentional adulteration; it domestic business exports some of its employees’’ in the definitions for this could be an attractive target based on food and, as a result, less than that rule and modifying the definition of the potential to cause wide scale public threshold dollar amount reflects sales ‘‘small business’’ to use the term ‘‘500 health harm. within the United States. Further, this is full-time equivalent employees’’ rather (Comment 55) One comment suggests consistent with the PCHF final rule. than ‘‘500 persons.’’ that we base the very small business definition on the number of full-time 12. Vulnerability 4. Qualified Individual employees, similar to how we define We proposed to define the term In this final rule, we have defined the ‘‘small business.’’ The comment ‘‘vulnerability’’ to mean the term ‘‘qualified individual’’ to mean a recommends that we define ‘‘very small susceptibility of a point, step, or person who has the education, training, business’’ at 50 full-time employees. procedure in a facility’s food process to or experience (or a combination thereof) (Response 55) We deny this request. intentional adulteration. necessary to perform an activity The purpose of the definition of ‘‘very We did not receive comments on the required under subpart C, as appropriate small business’’ is to exempt the proposed definition of vulnerability and to the individual’s assigned duties. A smallest businesses from the we are finalizing the definition as qualified individual may be, but is not requirements of the rule because they proposed. required to be, an employee of the are less likely to be targeted by C. Additional Definitions To Clarify establishment. See section V.H. for a individuals or organizations intending Terms Not Defined in the Proposed Rule detailed discussion of the new to cause wide scale public health harm. requirements in § 121.4—Qualifications The consideration of sales is consistent 1. Adequate of Individuals Who Perform Activities with the other option for being a We have defined the term ‘‘adequate’’ Under Subpart C. qualified facility under section 418 of to mean that which is needed to 5. You the FD&C Act, which also considers accomplish the intended purpose in sales (section 418(l)(1)(C)). (As keeping with good public health In this final rule, we have defined the discussed in IV.E.1 of this rule, we have practices. See section V.E for a detailed term ‘‘you’’ for purposes of this part, to removed the term ‘‘qualified facility’’ discussion of the changes to the mean the owner, operator, or agent in from the exemption provided in requirement for food defense monitoring charge of a facility. We have made § 121.5(a) for simplicity because any in § 121.140, including the requirement conforming changes throughout the facility that would be a ‘‘qualified to monitor the mitigation strategies with regulatory text to replace ‘‘owner, facility’’ as proposed in § 121.5(a) will ‘‘adequate’’ frequency to provide operator, or agent in charge’’ with ‘‘you’’ also meet the definition for a ‘‘very assurances that they are consistently for simplicity and consistency with the small business.’’) performed. PCHF and PCAF regulations. In contrast, section 418(l) of the FD&C 2. Affiliate and Subsidiary D. Comments Asking FDA To Establish Act does not specify any particular Additional Definitions or Otherwise criterion (whether sales or number of We have defined the term ‘‘affiliate’’ Clarify Terms Not Defined in the Rule employees) for the definition of ‘‘small to mean any facility that controls, is business,’’ other than directing us to controlled by, or is under common 1. Correction consider the results of the Food control with another facility. We have (Comment 57) Some comments that Processing Sector Study. Basing the defined the term ‘‘subsidiary’’ to mean request the addition of corrections to the definition of ‘‘small business’’ on the any company which is owned or requirement related to corrective actions number of employees is consistent with controlled directly or indirectly by request we define ‘‘correction’’ to mean our approach to defining ‘‘small another company. These definitions the action to eliminate a non- business’’ in many other regulations incorporate the definitions in sections conformity. (see, e.g., the PCHF final rule, Produce 418(l)(4)(A) and (D) of the FD&C Act (Response 57) We decline this final rule, HACCP regulation for juice and would make the meanings of these request. Because we are not providing (§ 120.1(b)(1)), the section 414 terms clear when used in the definition for corrections and the term recordkeeping regulations (69 FR 71562, of ‘‘very small business.’’ ‘‘corrections’’ is not in the regulatory December 9, 2004), and our CGMP 3. Full-Time Equivalent Employee text, there is no need to define the term. regulation for manufacturing, packaging, labeling, or holding operations for We have established a definition for 2. Defensive Controls or Defensive dietary supplements (72 FR 34752, June ‘‘full-time equivalent employee’’ as a Control Point 25, 2007)). term used to represent the number of (Comment 58) One comment requests (Comment 56) Some comments employees of a business entity for the that FDA consider adoption of food request that we change the definition of purpose of determining whether the defense terminology that is ‘‘very small business’’ to only include business qualifies as a small business. complementary to food safety the total annual sales of food in the The number of full-time equivalent terminology used in the PCHF final rule, United States, adjusted for inflation, for employees is determined by dividing such as ‘‘defensive controls’’ or foreign facilities that export food to the the total number of hours of salary or ‘‘defense control point.’’ United States. wages paid directly to employees of the (Response 58) We decline the request (Response 56) A foreign business that business entity and of all of its affiliates to adopt the specific terms of ‘‘defense sells more than the threshold dollar by the number of hours of work in 1 controls’’ or ‘‘defense control point.’’

VerDate Sep<11>2014 19:43 May 26, 2016 Jkt 238001 PO 00000 Frm 00027 Fmt 4701 Sfmt 4700 E:\FR\FM\27MYR4.SGM 27MYR4 mstockstill on DSK3G9T082PROD with RULES4 34192 Federal Register / Vol. 81, No. 103 / Friday, May 27, 2016 / Rules and Regulations

Although the comment did not further such vulnerability to an acceptable 2. Proposed § 121.5(b)—Exemption explain what terms ‘‘defense controls’’ level, the definition for actionable Applicable to Holding of Food or ‘‘defense control point’’ would process step provides flexibility for a We proposed to exempt holding of replace, we believe ‘‘actionable process facility to determine what that level food, except the holding of food in steps’’ and ‘‘mitigation strategies’’ would be in a particular circumstance. liquid storage tanks. We received one appropriately differentiate these terms, We now use ‘‘person knowledgeable comment that disagrees with the related to intentional adulteration, from about food defense’’ without reference holding exemption, and have addressed analogous food safety terms used in the to ‘‘prudent’’ in the definitions of the comment in Response 34. After PCHF final rule. ‘‘significant vulnerability’’ and considering this comment, we are ‘‘mitigation strategies.’’ A person 3. Reasonably Foreseeable finalizing the exemption as proposed. knowledgeable about food defense (Comment 59) Some comments state would meet the requirements of being a 3. Proposed § 121.5(c)—Exemption FDA should clearly define what Qualified Individual (§ 121.4). Applicable To Packing, Re-Packing, constitutes a ‘‘reasonably foreseeable’’ Labeling, or Re-Labeling of Food Where threat as it relates to the risk of E. Proposed § 121.5—Exemptions the Container That Directly Contacts the intentional adulteration. We proposed to establish a series of Food Remains Intact (Response 59) We decline this exemptions from the intentional We proposed to exempt packing, re- request. The term ‘‘reasonably adulteration requirements. We also packing, labeling, or re-labeling of food foreseeable’’ is not used in the sought comments on whether we should where the container that directly regulatory text of this rule. exempt on-farm manufacturing, contacts the food remains intact. We did 4. Supply Chain processing, packing, or holding of the not receive comments on the proposed food identified as having low-risk exemption and we are finalizing the (Comment 60) One comment requests production practices identified in exemption as proposed. that FDA define ‘‘supply chain’’ as it Appendix 4 to the Draft Risk 4. Proposed § 121.5(d)—Exemption relates to food and provides a Assessment (further discussed in recommended definition to be included Applicable to Activities of a Facility section I.C). We discuss these in the That Are Subject to Section 419 of the in the rule. following sections. (Response 60) We decline this FD&C Act request. The term ‘‘supply chain’’ is not 1. Proposed § 121.5(a)—Exemption We proposed to exempt activities of a used in the regulatory text of this rule. Applicable to a Qualified Facility facility that are subject to section 419 of 5. Validation We proposed to exempt a qualified the FD&C Act (Standards for Produce Safety). We did not receive comments (Comment 61) One comment suggests facility, except that qualified facilities must, upon request, provide for official on the proposed exemption and we are we define ‘‘validation’’ as obtaining finalizing the exemption as proposed. evidence that a control measure or review documentation that was relied combination of control measures, if upon to demonstrate that the facility 5. Proposed § 121.5(e)—Exemption With properly implemented, is capable of meets this exemption. We also proposed Respect to Alcoholic Beverages controlling the hazard to a specified that such documentation must be Section 116 of FSMA (21 U.S.C. 2206) outcome. retained for 2 years. We proposed to (Alcohol-Related Facilities) provides a (Response 61) We decline this define qualified facility, in part, as a rule of construction for certain facilities request. The term ‘‘validation’’ is not facility that is (1) a very small business; engaged in the manufacturing, used in the regulatory text of this rule. or (2) a facility to which certain processing, packing, or holding of circumstances must apply. alcoholic beverages and other food. In 6. Miscellaneous We have removed the exemption the proposed rule, we discussed our (Comment 62) One comment requests applicable to a qualified facility and interpretation of section 116 of FSMA that FDA define certain terms or phrases replaced it with a very small business and requested comment on our that are used in some definitions and exemption. Revised § 121.5(a) provides interpretation. Based on our that the comment suggests will have a that this part does not apply to a very interpretation, we proposed that part wide range of interpretations. The small business, except that a very small 121 would not apply with respect to comment cites ‘‘acceptable level’’ (used business must, upon request, provide alcoholic beverages at facilities meeting in the definitions of ‘‘actionable process for official review documentation two specified conditions (78 FR 78014 step’’ and ‘‘significantly minimize’’), sufficient to show that the facility meets at 78037). We also proposed that part ‘‘reasonably appropriate measures’’ and the exemption and that such 121 would not apply with respect to ‘‘person knowledgeable about food documentation must be retained for 2 food other than alcoholic beverages at defense’’ (both used in the definition of years. We have removed the term facilities described in the exemption, ‘‘focused mitigation strategies’’), and ‘‘qualified facility’’ from the exemption provided such food is in prepackaged ‘‘prudent person knowledgeable about provided in § 121.5(a) to simplify the form that prevents direct human contact food defense’’ (used in the definition of provision and provide clarity as to the with the food and constitutes not more ‘‘significant vulnerability’’). applicability of the exemption. For than 5 percent of the overall sales of the (Response 62) The terms ‘‘acceptable purposes of this rule, any facility that facility. No comments disagreed with level’’ and ‘‘reasonably appropriate would be a ‘‘qualified facility’’ as the exemption of alcoholic beverages, measures’’ are meant to be flexible proposed in § 121.5(a) will also meet the but some comments requested changes standards. We do not need to define definition for a ‘‘very small business.’’ or clarifications to the proposed every term used in the definitions. By Further, section 418(l)(3) of the FD&C activities covered in the exemption. specifying that a point, step, or Act, which provides for withdrawal of After reviewing the comments, we are procedure in a food process at which an exemption from a ‘‘qualified finalizing this exemption as proposed. food defense measures can be applied facility,’’ is not relevant because we are (Comment 63) Two comments and are essential to prevent or eliminate also issuing these requirements under supported the exemption for alcoholic a significant vulnerability or reduce section 420 of the FD&C Act. beverages and FDA’s interpretation of

VerDate Sep<11>2014 19:43 May 26, 2016 Jkt 238001 PO 00000 Frm 00028 Fmt 4701 Sfmt 4700 E:\FR\FM\27MYR4.SGM 27MYR4 mstockstill on DSK3G9T082PROD with RULES4 Federal Register / Vol. 81, No. 103 / Friday, May 27, 2016 / Rules and Regulations 34193

section 116 of FSMA, but one comment a high risk for intentional contamination and lacks a significant potential for requests changing the language from just because our analysis shows that human morbidity and mortality. One ‘‘alcoholic beverages’’ to adulteration of animal food has minimal comment supports the exemption but ‘‘manufacturing, processing, packing potential for human morbidity and requests clarification that the exemption and holding of alcoholic beverages,’’ mortality which would lead to wide of animal feed includes the byproduct of stating that in reducing the words FDA scale public health harm. In considering manufactured human food regardless of may unintentionally limit the scope of whether to provide an exemption the small business exemption. the exemption to facilities holding related to animal food, we evaluated (Response 65) We conclude that finished beverage alcohol products. three types of possible attack scenarios: animal food, regardless of whether it is (Response 63) We agree with the (1) Incorporation of a contaminant into produced at a facility solely engaged in comments that support the exemption feed to be used for muscle meat- the production of animal food or at a as written. We do not believe it is producing animals; (2) incorporation of facility engaged in the production of necessary to list the activities in the a contaminant into feed to be used for both animal and human food, does not codified as requested by one comment. egg-producing or milk producing involve significant vulnerabilities that Under section 415 of the FD&C Act a animals; and (3) incorporation of a require mitigation strategies under facility is required to register as a contaminant into pet food. With regard section 418 of the FD&C Act, and is not facility because it is engaged in to the two former scenarios, we did not high risk under section 420 of the FD&C manufacturing, processing, packing, or identify any contaminants that could be Act. Therefore, we are not requiring a holding of one or more alcoholic incorporated into feed at levels that vulnerability assessment to determine beverages. Therefore, the language would lead to human morbidity or that there are no actionable process stating ‘‘alcoholic beverages at a mortality among consumers that steps present and no mitigation facility’’ encompasses facilities engaged subsequently eat the meat, eggs or milk strategies needed. Regarding the in the activities listed previously and without first showing noticeable clinical requested clarification, the exemption the regulatory text in § 121.5(e) clearly signs and/or mortality in the animals. applies to animal food regardless of covers the intended exemption for the While some contaminants can increase whether a facility is part of a small ‘‘manufacturing, processing, packing the risk of chronic disease, such as business. and holding of alcoholic beverages.’’ cancer, among consumers, such an (Comment 66) Some comments (Comment 64) One comment supports outcome is not consistent with our disagree with our conclusion that the exemption for alcoholic beverages understanding of the goals of terrorist animal feed would not be at high risk but requests that we further exempt craft organizations, which include a more for intentional contamination for several breweries from drying and packaging immediate impact. Regarding the third reasons. Some comments cite the 2007 incident of melamine in animal food requirements for disposal of spent attack scenario, adulterants could be grains as cattle feed to small farmers. that sickened and killed many animals incorporated into feed or pet food that (Response 64) The exemption as an example of previous intentional result in significant animal morbidity established under the rule of contamination suggesting that animal and mortality as well as lead to construction in section 116 of FSMA food is at high risk for intentional secondary infections of humans through applies to alcoholic beverages, not to contamination. Some comments state cross contamination, but this type of any other food (see section 116(c) of that in section 420(c) of the FD&C Act intentional adulteration of animal food FSMA (21 U.S.C. 2206(c)). The by- the intent of Congress was for poses a lower risk because secondary products described in this comment regulations to be issued that addressed human illness or death is not the appear to be products that would be hazards that would cause ‘‘serious used in food for animals rather than in primary goal of an attacker with the health consequences or death to humans human food, and we exempt these foods intent to cause wide scale public health or animals.’’ One comment asserts that in section § 121.5(f). Since this rule harm. As such, the proposed rule would pet food and human food supply chains exempts both alcoholic beverages at a not apply to the manufacturing, are interconnected, and therefore should facility, provided certain conditions are processing, packing, or holding of food be covered by this rule. One comment met, and food for animals, we believe for animals other than man. We believes that animal food comes into our this comment misunderstands the requested comment on our tentative homes as pet food therefore can harm exemptions. conclusions. Some comments agreed families via cross-contamination. One with our conclusions and support the comment asserts that the risk of Foot 6. Proposed § 121.5(f)—Exemption exemption as proposed. One comment and Mouth Disease has been the focus Applicable To Manufacturing, supported the exemption but requested of many exercises and discussions with Processing, Packing, or Holding of Food a clarification of exempted activities. respect to intentional adulteration and for Animals Other Than Man Some comments disagreed with our asserts that terrorists have attacked We proposed to exempt conclusions and assert that animal food livestock in the past. manufacturing, processing, packing, or is at high risk for intentional (Response 66) We disagree with these holding of food for animals other than adulteration because it has been comments and continue to believe that man. Section 418(m) of the FD&C Act intentionally contaminated in the past. animal food is not at high risk for authorizes FDA to exempt or modify the Some comments state that FDA should intentional adulteration within the requirements for compliance with protect against intentional adulteration context of this rule. While we agree that section 418 with regard to facilities that that leads to serious health some animal feed could be intentionally engage solely in the production of consequences or death to humans or contaminated, our analysis shows only animal food. Further, section 420(c) of animals. After reviewing the comments, minimal potential for human morbidity the FD&C Act requires that regulations we are finalizing the exemption as and mortality as a result of an attack that FDA issues under that section proposed. during, or associated with, animal food apply only to food for which there is a (Comment 65) Some comments production. We analyzed both human high risk of intentional contamination. support our tentative conclusions and and animal food using CARVER+Shock FDA tentatively concluded in the agree that animal food would not be at methodology. For human food, our proposed rule that animal food is not at high risk for intentional contamination analyses show the potential for

VerDate Sep<11>2014 19:43 May 26, 2016 Jkt 238001 PO 00000 Frm 00029 Fmt 4701 Sfmt 4700 E:\FR\FM\27MYR4.SGM 27MYR4 mstockstill on DSK3G9T082PROD with RULES4 34194 Federal Register / Vol. 81, No. 103 / Friday, May 27, 2016 / Rules and Regulations

significant human morbidity and target than human food, when the intent foods included in the draft RA mortality should intentional of the adulteration is to cause wide scale Appendix as being out of scope of the adulteration occur at certain points in a public health harm for humans. The final appendix because of the changes to food operation. In contrast, for animal event in 2007 involving contamination the definition of ‘‘farm’’ made by the food, our analysis shows only minimal of wheat flour and wheat gluten with PCHF rule, including some foods potential for human morbidity or melamine that resulted in pet illnesses determined to have low risk production mortality as a result of attacks at points and deaths did not affect human health practices in the draft appendix. in an animal food operation. and was motivated by economic gain. Finished foods that are produced using Significantly, our CARVER+Shock That form of intentional adulteration only activities that fall within the farm vulnerability assessments of animal (i.e., economically motivated definition (e.g., RACs such as fruits and food have had to focus entirely on adulteration) is addressed by the PCHF vegetables, grains, and unpasteurized economic consequences because of the and PCAF final rules. milk) are out of scope for the purposes lack of potential for human morbidity of this final appendix because this and mortality. As stated in the preamble 7. Exemption for Low-Risk Activities at Farm Mixed-Type Facilities evaluation focuses on the production to the proposed rule (78 FR 78014 at processes used to produce a finished 78037), in considering whether to As discussed in section I.D, we issued food and applies only to activities provide an exemption related to animal for public comment an ‘‘Appendix to outside the farm definition performed food, we evaluated three types of Draft Qualitative Risk Assessment of by facilities co-located on farms. possible attack scenarios: (1) Risk of Activity/Food Combinations for Accordingly, we have provided a new Incorporation of a contaminant into feed Activities (Outside the Farm Definition) exemption in the regulatory text in to be used for muscle meat-producing Conducted in a Facility Co-Located on § 121.5(g) that exempts on-farm animals; (2) incorporation of a a Farm’’ (the draft RA Appendix) (78 FR manufacturing, processing, packing, or contaminant into feed to be used for 78064, December 24, 2013). The draft holding of eggs (in-shell, other than egg-producing or milk producing RA Appendix was conducted to provide RACs, e.g., pasteurized), and game animals; and (3) incorporation of a a science-based risk analysis to meats (whole or cut, not ground or contaminant into pet food. With regard determine which foods’ production shredded, without secondary to the two former scenarios, we are not processes would be considered low risk ingredients) when conducted by a small aware of contaminants that could be with respect to the risk of intentional or very small business if such activities incorporated into feed at levels that adulteration. Based on the tentative are the only activities conducted by the conclusions of the draft RA Appendix, would not produce noticeable clinical business subject to section 418 of the we asked for comment in the proposed signs and/or mortality in animals but FD&C Act. This exemption is also rule on possible exemptions or modified would result in significant human appropriate under section 420 of the requirements for this final rule. In the morbidity or mortality among FD&C Act because such activities are draft RA Appendix we tentatively consumers that subsequently eat the not high risk under that provision. meat, eggs or milk. While such concluded that the production processes contaminants can increase the long-term for the following finished foods are low- The draft RA, considered fruits and risk of chronic disease, such as cancer, risk: Eggs (in-shell); fruits and vegetables other than pods, seeds for among consumers, such an outcome is vegetables other than pods, seeds for direct consumption, and hesperidia, and not consistent with our understanding direct consumption, and hesperidia determined them to be low risk. Because of the more-immediate goals of (fresh, intact); game meats (whole or cut, these foods are produced using only individuals or groups intending to cause not ground or shredded, without activities that fall within the modified wide scale public health harm. secondary ingredients); peanuts and tree farm definition, these finished foods are Regarding the third attack scenario, nuts (raw, in-shell); and sugarcane and now out of scope of the RA. incorporation of a contaminant into pet sugar beets (fresh, intact). We sought Additionally, peanuts, tree nuts (raw, in food, we are aware of contaminants that comment on whether we should exempt shell), sugarcane, and sugar beets were could be incorporated into feed or pet on-farm manufacturing, processing, also considered and determined to be food that could result in significant packing, or holding of the foods low risk in the draft RA. These foods animal (including pet) morbidity and identified as having low-risk production similarly are out of scope of the mortality, including some which could practices when conducted by a small or evaluation of risk because these foods result in secondary infectious spread of very small business if such activities are are produced using only activities that disease (because some infectious agents the only activities conducted by the fall within the modified farm definition. can be transmitted orally as well as business that are subject to section 418 The finished foods mentioned in this through aerosol). Such attacks could be of the FD&C Act. paragraph, when produced on farms, are significant from an economic and (Comment 67) Several comments exempt under § 121.5(d). societal standpoint. However, the risk agree with the conclusions of the draft that they pose with regard to targeting RA Appendix and state we should V. Subpart C: Comments on Food by individuals or groups intending to provide exemptions in the regulatory Defense Measures cause wide scale public health harm text for those on-farm manufacturing, A. Proposed § 121.126—Requirement for appears to be significantly lower than processing, packing, or holding a Food Defense Plan those involving human morbidity and activities identified as having low-risk mortality. production practices when conducted We proposed that the owner, operator, Foot and mouth disease, mentioned in by a small or very small business if such or agent in charge of a facility must one comment, can lead to animal death activities are the only activities prepare, or have prepared, and and economic consequences, but does conducted by the business subject to implement a written food defense plan not affect human morbidity or mortality. section 418 of the FD&C Act. which must include: (1) Written Because foot and mouth disease would (Response 67) We agree with these identification of actionable process not cause wide scale public health comments. In addition, we have steps; (2) written focused mitigation harm, it does not change our conclusion conducted a reanalysis of the risk strategies; (3) written procedures for that animal food is a less attractive assessment and have identified some monitoring; (4) written corrective action

VerDate Sep<11>2014 19:43 May 26, 2016 Jkt 238001 PO 00000 Frm 00030 Fmt 4701 Sfmt 4700 E:\FR\FM\27MYR4.SGM 27MYR4 mstockstill on DSK3G9T082PROD with RULES4 Federal Register / Vol. 81, No. 103 / Friday, May 27, 2016 / Rules and Regulations 34195

procedures; and (5) written verification existing food defense plans that are considering the comments, we have procedures. already in place and working properly. revised this section as follows: (1) Some comments agree with the These comments argue that existing Removing from the regulatory text the requirements for a food defense plan as food defense plans should be adequate option to identify actionable process proposed. In general, comments support to meet the requirements of this rule so steps by utilizing the four FDA- the proposed requirement that facilities long as they were thoughtfully identified key activity types, (2) adding develop and maintain food defense developed. to the regulatory text the factors that plans to protect food against intentional (Response 69) We recognize that some must be considered when conducting a adulteration. In the following facilities have already voluntarily vulnerability assessment, (3) adding to paragraphs, we discuss comments that developed and implemented food the regulatory text a requirement to disagree with, or suggest one or more defense plans. These facilities likely explain why each process step was or changes to, the proposed requirements. have a head start on compliance with was not identified as an actionable After considering these comments, we this rule. To the extent a food defense process step, (4) adding to the regulatory are finalizing the provisions as plan satisfies elements of this rule, a text a requirement that the vulnerability proposed, with editorial and conforming facility has less to do to meet these assessment must consider the changes as discussed in the other requirements. Further, in the final rule possibility of an inside attacker, and (5) applicable sections of this document. we have specified that existing records changing the title of this section to (Comment 68) Some comments state do not need to be duplicated if they ‘‘Vulnerability Assessment to Identify that facilities should be allowed to contain all of the required information Significant Vulnerabilities and develop food defense plans that are and satisfy the requirements of part 121, Actionable Process Steps.’’ tailored to and best meet the needs and subpart D (§ 121.330). (Comment 71) Some comments unique characteristics of the (Comment 70) Some comments recommend removing from the establishment. Other comments state express concern that it is too premature regulatory text the option for facilities to that the requirements should be to require that all foreign facilities use the key activity types as a method adequately broad and provide flexibility prepare and implement a food defense for identifying actionable process steps, so that companies can build on their plan. and instead, requiring all facilities to plans over time based on emerging (Response 70) All foreign facilities do conduct facility-specific vulnerability threats and new mitigation strategies. not have to prepare and implement a assessments. Some comments (Response 68) We agree with these food defense plan. For example, foreign recommend continuing to provide the comments and recognize that there facilities that are not required to register option to use key activity types but not needs to be flexibility within the are not subject to this rule. This specifically providing for it in the requirements for a facility to develop a includes a foreign facility, if food from regulatory text. Under this approach, food defense plan that meets its needs such a facility undergoes further key activity types would be considered and unique characteristics. In the final manufacturing/processing (including an ‘‘appropriate method’’ for identifying rule we have added flexibility for packaging) by another facility outside actionable process steps with the management components (see Comment the United States (21 CFR 1.226(a)). In specific key activity types identified in 88, Comment 92, Comment 93, and addition, the rule contains exemptions guidance. These comments express Comment 95 for a detailed discussion). applicable to domestic and foreign concern that identifying a particular Additionally, we agree that food defense facilities (§ 121.5). For example, very methodology (i.e., key activity types) in plans should change over time based on small businesses are only required to the codified indicates there is one emerging threats and identification of keep records documenting their status. ‘‘right’’ way to conduct vulnerability new mitigation strategies. The rule B. Proposed § 121.130—Identification of assessments. Furthermore, some (§ 121.157) requires a reanalysis of the comments express concern that the key Actionable Process Steps food defense plan as a whole or to the activity types may become the de facto applicable portion of the plan when any We proposed to require that the standard for the regulatory inspection of of the following circumstances occur: a owner, operator, or agent in charge of a actionable process steps, even if significant change made in the activities facility identify any actionable process facilities conduct facility-specific conducted at the facility creates a steps by either conducting a facility- vulnerability assessments. Some reasonable potential for a new specific vulnerability assessment or by comments express concerns that vulnerability or a significant increase in using the four key activity types we including key activity types in the a previously identified vulnerability; a identified. Recognizing that various codified would result in mitigation facility becomes aware of new methodologies may exist to conduct a strategies being required at key activity information about potential facility-specific vulnerability types regardless of the outcome of a vulnerabilities; a mitigation strategy, a assessment, and not wishing to preclude facility-specific vulnerability combination of mitigation strategies, or the benefits of future science in this assessment. the food defense plan as a whole is not area, we did not propose to require a (Response 71) The key activity types properly implemented; or whenever specific methodology for the facility- are based upon the results of over 50 FDA requires reanalysis to respond to specific vulnerability assessment. vulnerability assessments which reflect new vulnerabilities, credible threats to Further, we proposed that regardless of the activities and associated the food supply, or developments in the method chosen, the identification of vulnerabilities present in a wide array of scientific understanding. See section actionable process steps and the manufacturing settings. The V.G.2 for more detailed discussion of assessment leading to that identification vulnerability assessments included the reanalysis section. must be written. consideration of the three elements now (Comment 69) Some comments state Some comments agree with the required by § 121.130 to be evaluated in that many food facilities have already requirements as proposed. In the any vulnerability assessment: (1) The voluntarily developed and implemented following paragraphs, we discuss potential public health impact if a food defense plans. The comments comments that suggest one or more contaminant were added (e.g., severity express concern that FDA would require changes to, and/or disagree with the and scale); (2) the degree of physical companies to completely overhaul their proposed requirements. After access to product; and (3) the ability of

VerDate Sep<11>2014 19:43 May 26, 2016 Jkt 238001 PO 00000 Frm 00031 Fmt 4701 Sfmt 4700 E:\FR\FM\27MYR4.SGM 27MYR4 mstockstill on DSK3G9T082PROD with RULES4 34196 Federal Register / Vol. 81, No. 103 / Friday, May 27, 2016 / Rules and Regulations

an attacker to successfully contaminate tank would be significantly vulnerable, improvement would significantly the food. The four identified key activity then the facility would identify the minimize or eliminate access to product types are processes, steps, or procedures mixing tank as an actionable process in the dryer and thereby significantly that consistently ranked as the most step. The facility may then decide that minimize or prevent a significant vulnerable, regardless of the commodity the existing locks could serve as a vulnerability at this process step. The being assessed, and reflect significant mitigation strategy that reduces the implementation of this engineering vulnerabilities to intentional significant vulnerability of the mixing improvement would be detailed in the adulteration caused by acts intended to tank and evaluate if any other mitigation facility’s food defense plan and, upon cause wide scale public health harm. strategies are necessary. The food reanalysis, the facility may determine Therefore, using the key activity types is defense plan would then capture the that this processing step is no longer an an appropriate method to conduct a mixing tank step as an actionable actionable process step. vulnerability assessment. In addition, process step and the locks as the (Comment 73) Some comments using key activity types has the benefit mitigation strategy. As a mitigation recommend that vulnerability of allowing facilities with less technical strategy, the locks would be subject to assessments should consider expertise in conducting food defense mitigation strategy management downstream processing steps, the vulnerability assessments to leverage components (i.e., food defense volume of product, shelf life, their expertise in food processing to monitoring, corrective actions, and marketplace turnover, and consumption identify actionable process steps. verification). patterns and that additional details However, in response to comments, There are some instances where it is regarding vulnerability assessments we are no longer singling out key appropriate to consider existing food should be in the regulatory text. The activity types in the regulatory text. defense measures before the comments did not provide specifics or Importantly, using key activity types vulnerability assessment is completed. recommendations regarding what remains as one appropriate vulnerability For example, the owner of the same additional details about vulnerability assessment method. We intend to place facility may assess a second mixing tank assessments should be included. the key activity types in guidance, that is part of an entirely closed system, (Response 73) As previously stated, which will provide us with greater with no direct access points into the we are not prescribing a specific flexibility to update them in the future, system, such that an individual methodology that facilities must use to if necessary. The final rule provides attempting to access this mixing tank conduct vulnerability assessments to firms the flexibility to choose a likely would cause a major disruption to identify actionable process steps. In the vulnerability assessment methodology the line, foiling any attempted preamble to the proposed rule, we listed appropriate to their operations, intentional adulteration. Because this a number of elements to consider when provided that methodology includes the second mixing tank has specific closed conducting vulnerability assessments three fundamental elements required by properties designed into the system, that (78 FR 78014 at 78042) and did not § 121.130(a). We expect that some firms are inherent characteristics of the require particular elements in the will use key activity types, and some mixing tank, it would be appropriate for regulatory text. However, in light of firms will use other methods. the facility to consider these inherent comments requesting further (Comment 72) Some comments characteristics in the vulnerability vulnerability assessment details in the recommend that vulnerability assessment. Based on this assessment, regulatory text, and the removal of key assessments should consider the the facility may conclude that the activity types as a separately identified contribution of existing practices, inherent characteristics of this mixing option, we are specifying that three procedures, and programs that may tank, in this case its enclosed nature, elements must be considered in any already function to reduce vulnerability. renders the product inaccessible at this vulnerability assessment. These three (Response 72) When conducting step and, therefore would not identify elements are based on our extensive facility-specific vulnerability an actionable process step associated experience conducting vulnerability assessments, the role of existing with this mixing tank (in which case, assessments and collaborating with measures (e.g., security practices, there would also be no requirement to stakeholders to refine vulnerability procedures, or programs) should be implement a mitigation strategy at this assessment methodology and are critical determined on a case-by-case basis. In step). elements of an acceptable vulnerability general, existing measures that are Permanent equipment changes may assessment methodology. Specifically, applied to the process (e.g., locks, area reduce a significant vulnerability to we have revised § 121.130 to require access controls, peer or supervisory such an extent that a processing step that for each processing step under monitoring) and are not inherent would no longer be considered an evaluation, the facility must consider, at characteristics of a particular process actionable process step. For example, a a minimum: (1) The potential public step, should be considered after the facility might identify a rotating air health impact if a contaminant were vulnerability assessment is completed dryer as an actionable process step and added (e.g., severity and scale); (2) the and actionable process steps have been in the supporting rationale discuss the degree of physical access to product; identified, and should not be considered high degree of accessibility at the point and (3) the ability of an attacker to during the identification of significant where product is fed from a pneumatic successfully contaminate the product. vulnerabilities. For example, when conveyor into the top of the dryer. The a. Element 1: The potential public evaluating the vulnerability of a mixing facility later installs a permanent, clear health impact if a contaminant were tank, a facility would not conclude the plastic shield affixed to, and extending added (e.g., severity and scale). This tank does not represent a significant from, the discharge of the pneumatic factor includes, for each processing step, vulnerability because the mixing tank conveyor to the opening of the dryer. consideration of the volume of product lid and sampling ports are routinely The clear plastic shield enables workers impacted, the number of at risk servings locked. Instead, the vulnerability of the to supervise the product flow into the generated, and the number of potential mixing tank would be evaluated as if the dryer while serving as an effective exposures. As appropriate, and with existing measure (in this case the locks) barrier to an attacker wishing to sufficient scientific rigor, the facility were not in place. If, in the absence of introduce a contaminant into the may also consider other factors such as properly implemented locks, the mixing product at the dryer. This engineering food velocity (i.e., the speed at which a

VerDate Sep<11>2014 19:43 May 26, 2016 Jkt 238001 PO 00000 Frm 00032 Fmt 4701 Sfmt 4700 E:\FR\FM\27MYR4.SGM 27MYR4 mstockstill on DSK3G9T082PROD with RULES4 Federal Register / Vol. 81, No. 103 / Friday, May 27, 2016 / Rules and Regulations 34197

particular product moves through the the openness of the processing step to process under evaluation, recognizing distribution system); potential agents of intentional adulteration, based on the that each processing step has some concern; the infectious or lethal dose of presence of physical barriers such as associated vulnerability (i.e., the agents of concern; and the morbidity/ gates, railings, doors, lids, seals, shields, susceptibility of a point, step, or mortality rate if the intentional and other barriers. This element is procedure in a facility’s food process to adulteration were successful. This required in the vulnerability assessment intentional adulteration). Second, the element is required in the vulnerability because it enables facilities to prioritize facility would identify which assessment because it enables facilities how easy or difficult it is to access vulnerabilities are significant to focus resources on processing steps product at each processing step, based vulnerabilities (by using the three with the highest degree of public health on the inherent characteristics of the required elements), and third, the impact if the intentional adulteration physical environment surrounding the facility would identify actionable were successful. step. process steps where significant We recognize that some facilities may c. Element 3: The ability of an vulnerabilities are present. We intend to not have the scientific knowledge to attacker to successfully contaminate the provide further guidance on conducting critically identify and evaluate product. This element includes, for each vulnerability assessments to satisfy individual agents of concern across their processing step, consideration of, at a these requirements. production process. The potential minimum, the ease of introducing an As noted previously, some comments public health impact can also be agent to the product; the ability for an suggested that vulnerability assessments determined through the consideration of agent to be uniformly mixed or evenly should consider downstream processing the volume of food at risk should an act applied; and the ability of an attacker to steps, the volume of product, shelf life, of intentional adulteration be successful work unobserved and have sufficient marketplace turnover, and consumption at each process step. This approach time to introduce the agent. As patterns. We have found that shelf life would serve to extrapolate the potential appropriate, and with sufficient is not necessarily a good indicator of the public health impact without the scientific rigor, the facility may also speed at which a particular product scientifically rigorous examination of consider: The amount of specific agent moves through the distribution system specific agents (e.g., consideration of required; whether downstream dilution (i.e., food velocity), because many infectious or lethal dose). For example, or concentration steps would affect the products are sold and consumed using this approach, a facility volume of agent required; whether months, if not years, before their shelf considering the potential public health downstream processing would or would life expires. Marketplace turnover and impact of the intentional adulteration of not neutralize the agent(s) under consumption patterns are captured its primary ingredient storage tank evaluation; and the ability of the within the concept of food velocity, would consider the volume of food in attacker to successfully introduce a which may be considered in a the tank and the servings generated from sufficient volume of agent to the food vulnerability assessment as a this volume. If the facility has a 50,000 without being detected or interdicted. component of Element 1, detailed gallon primary ingredient liquid storage This element is required in the previously in this document. Likewise, tank that would generate 800,000 one vulnerability assessment because it the potential effect of downstream cup servings (50,000*16), the facility enables facilities to understand whether processing can be considered as a would consider all of these 800,000 the amount of agent required at each component of Element 3, detailed servings as being at risk. Note that processing step is feasible and if previously in this document. potential servings at risk is not limited subsequent processing steps would (Comment 74) One comment suggests to the amount of food being processed successfully remove an agent if present. adding laboratory professionals to the at an actionable process step. This is Taken together, these three required list of possible vulnerability assessment illustrated by a process step that applies vulnerability assessment elements team members. a minor ingredient, such as a vitamin provide facilities appropriate tools to (Response 74) The list of potential mixture applied over toasted cereal as it adequately identify which members of the vulnerability assessment passes underneath spray nozzles. The vulnerabilities should be identified as team discussed in the preamble to the facility’s metering tank for application significant vulnerabilities (i.e., those proposed rule is not exhaustive (78 FR to the cereal is 10 gallons. However, vulnerabilities, if attacked, could 78014 at 78042). The original list these 10 gallons will be sprayed over reasonably be expected to cause wide included ‘‘personnel working in the 100,000 servings of cereal. The facility scale public health harm). If the step areas of security, food safety/quality would conclude that 100,000 servings under evaluation has significant assurance or control, human resources, are at risk if the intentional adulteration vulnerabilities associated with it and operations, maintenance, and other were successful at this point. requires the application of mitigation individuals deemed necessary to A number of other factors may also go strategies to prevent or eliminate a facilitate the formation of the into the calculations a facility uses to significant vulnerability or reduce such vulnerability assessment.’’ We agree that determine the potential public health vulnerability to an acceptable level, the laboratory professionals can provide impact. For example, if a facility has step would be categorized as an important contributions to the conducted market research and actionable process step. vulnerability assessment and can be concludes that each distribution unit of By utilizing these three required included as potential team members. 20 servings is typically consumed by elements when conducting a (Comment 75) A few comments seek four persons, the potential public health vulnerability assessment, regardless of clarification on what type of impact of that distribution unit could be the vulnerability assessment justification would be required in the considered four persons rather than 20. methodology utilized, facilities are instance where no significant b. Element 2: The degree of physical provided with a systematic approach vulnerabilities are identified through a access to product. This element that enables them to move in a logical, vulnerability assessment. includes consideration of, at a step-wise manner to identify actionable (Response 75) It has been our minimum, the ability of an attacker to process steps. First, a facility would experience that most facilities will conduct the attack at the particular develop a list or flow diagram of each identify one or more significant processing step under evaluation; and point, step, or procedure in the food vulnerabilities. For a facility to

VerDate Sep<11>2014 19:43 May 26, 2016 Jkt 238001 PO 00000 Frm 00033 Fmt 4701 Sfmt 4700 E:\FR\FM\27MYR4.SGM 27MYR4 mstockstill on DSK3G9T082PROD with RULES4 34198 Federal Register / Vol. 81, No. 103 / Friday, May 27, 2016 / Rules and Regulations

conclude that it has no significant we will consider these comments when methodological approach, such as vulnerabilities and therefore no developing guidance to support the use grouping different production areas or actionable process steps, the facility of key activity types as an appropriate processing steps. would need to determine that none of method to conduct a vulnerability (Response 79) Facilities have the its production steps present a significant assessment. flexibility to choose a vulnerability vulnerability for wide scale public (Comment 78) One comment suggests assessment methodology appropriate to health harm from intentional that the definition for ‘‘holding’’ used in their operations, provided that adulteration. In conducting its two key activity types should be methodology includes consideration of vulnerability assessment, the facility modified to account for activities that three fundamental elements (i.e., the would need to consider at each step of involve the safe and effective storage of evaluation of the potential public health its process: (1) The potential public raw agricultural commodities, other impact if a contaminant were added health impact if a contaminant were than fruits and vegetables, intended for (e.g., severity and scale), the degree of added (e.g., severity and scale); (2) the further distribution or processing, but physical access to the product, and the degree of physical access to the product; does not include activities that ability of an attacker to successfully and (3) the ability of an attacker to transform a raw agricultural commodity contaminate the product) and is successfully contaminate the product. into a processed food. The specific performed by an individual qualified by The written vulnerability assessment, example of mineral oil applied to raw training and/or experience to conduct including the accompanying rationale grains and oilseeds for dust control was vulnerability assessments. A facility supporting the decision not to identify provided. must conduct written vulnerability any significant vulnerabilities would be (Response 78) In response to the assessments for all of the foods that it important for determining if such a comment, we have conducted an manufactures/processes, packs, or facility had complied with § 121.130. analysis of this activity and believe that holds. We recognize there are instances (Comment 76) One comment suggests the storage of mineral oil and its where facilities are manufacturing very the term ‘‘vulnerability assessment’’ application onto raw, whole grains or similar products using either the same should be clearly defined in the rule. oilseeds in accordance with 21 CFR equipment and/or very similar (Response 76) We deny this request. 172.878 is not a significant vulnerability processes. In such instances, it is As discussed in Response 73, § 121.130 and facilities engaged in these specific appropriate for the facility to conduct has been revised to provide required practices are not required to evaluate vulnerability assessments of like elements the facility would need to these processing steps when conducting products by grouping these products consider at each step of its process vulnerability assessments (Ref. 15). into one or more processes and when conducting vulnerability Facilities storing and using mineral oil conducting vulnerability assessments on assessments: (1) The potential public on other food products, such as baked these process groupings. However, any health impact if a contaminant were goods, condiments, spices, or product or process-specific differences added (e.g., severity and scale); (2) the confectionery products, are required to must be carefully delineated and noted degree of physical access to the product; evaluate mineral oil storage and use in the vulnerability assessment, and the and (3) the ability of an attacker to when conducting vulnerability facility must clearly identify the specific successfully contaminate the product. assessments. products included in each vulnerability Additionally, the definition for Additionally, we are removing the key assessment. In some facilities with significant vulnerability has been activity types from the regulatory text, limited types of products, the written revised to include these three required as discussed previously, although the vulnerability assessment may contain a elements, which underscores the key activity types are one appropriate single set of process steps that addresses importance of the evaluation that leads method to conduct vulnerability all of the products produced. For to the identification of significant assessments to identify actionable example, a facility making fruit-flavored vulnerabilities, which in turn leads to process steps. Further, we are revising beverages may be able to conduct a the identification of actionable process the definition of ‘‘holding’’ in this final single vulnerability assessment for all of steps. rule, as discussed in section IV.A.3, by its beverages using a single set of We believe the combination of removing the distinction for farms and processing steps. required vulnerability assessment farm mixed-type facilities and adding In other facilities, there may not be a elements in § 121.130 and a revised that holding also includes activities practical way to group all products into definition for significant vulnerability performed incidental to storage of a a single set of process steps, and provides a high degree of specificity food, but does not include activities that vulnerability assessments may be regarding what constitutes a transform a RAC into a processed food needed for multiple groups of products. vulnerability assessment and will and we include additional examples of For example, a facility that makes both provide direction to facilities as they holding activities. However, the holding ready-to-eat (RTE) entrees and entrees select an appropriate vulnerability of food in liquid storage tanks remains that are not RTE may need to conduct assessment methodology. an activity subject to the rule under a vulnerability assessment of the RTE (Comment 77) One comment suggests § 121.5(b). entrees and conduct a separate that the term ‘‘secondary ingredient (Comment 79) Some comments state vulnerability assessment for the entrees handling’’ used in a key activity type is that when conducting vulnerability that are not RTE. confusing because it is not obvious assessments, facilities should take whether ‘‘secondary’’ describes different processing steps into d. Qualified Individual ‘‘ingredient’’ or ‘‘handling,’’ nor what is consideration, but facilities should not (Comment 80) Several comments meant by ‘‘secondary.’’ be expected to conduct vulnerability requested more information regarding (Response 77) We are removing the assessments based on product type. the requirement that vulnerability key activity types from the regulatory Rather, they should be able to conduct assessments must be conducted by text, although the key activity types are a tailored vulnerability assessment individual(s) qualified by experience one appropriate method to conduct based on the best methodology for each and/or training using appropriate vulnerability assessments to identify facility, either in its entirety or by any methods. Specifically, additional actionable process steps. Consequently, appropriate, locally determined clarification was requested regarding

VerDate Sep<11>2014 19:43 May 26, 2016 Jkt 238001 PO 00000 Frm 00034 Fmt 4701 Sfmt 4700 E:\FR\FM\27MYR4.SGM 27MYR4 mstockstill on DSK3G9T082PROD with RULES4 Federal Register / Vol. 81, No. 103 / Friday, May 27, 2016 / Rules and Regulations 34199

training such individuals must receive understanding and implementation for vulnerability assessment will differ (particularly in the absence of FDA the regulated industry. depending on the type of vulnerability standardized curriculum); the process As stated in the preamble to the assessment conducted. Using key and criteria by which relevant work proposed rule, we recognize that the activity types requires less technical experience may supplement or task of performing a vulnerability expertise and experience than other substitute for training; and the criteria assessment requires an individual with methodologies and this would be by which FDA will determine if the a specific skill set to properly assess and reflected in the necessary qualifications. prioritize the various points, steps, or individual is adequately qualified to C. Proposed § 121.135—Focused conduct vulnerability assessments. procedures in a food process to characterize their susceptibility to Mitigation Strategies for Actionable Additionally, several comments believe Process Steps there is confusion with the use of intentional adulteration, to identify qualified individuals in this rule significant vulnerabilities and to We proposed that the owner, operator, compared to other rules and believe the identify actionable process steps where or agent in charge of a facility must term should be defined. mitigation strategies are essential to identify and implement focused mitigation strategies at each actionable (Response 80) We agree that further significantly minimize or eliminate the process step to provide assurances that clarification is needed regarding a significant vulnerabilities. We also the significant vulnerability at each step definition for a qualified individual in believe that various activities required will be significantly minimized or the context of this rule and in particular, by this rule may require higher levels of training based on the difficulty and prevented and the food manufactured, how it relates to the qualifications intensity of the task. We believe that a processed, packed, or held by such necessary to conduct vulnerability standardized curriculum will be facility will not be adulterated under assessments. Consequently, in § 121.3 required to ensure clear and consistent section 402 of the FD&C Act (21 U.S.C. we have defined a qualified individual training is provided for this activity. 342). As discussed in section IV.B.3, in to mean ‘‘a person who has the The training developed for the purpose the final rule we use the term education, training, or experience (or a of conducting or overseeing a ‘‘mitigation strategies’’ and no longer combination thereof) necessary to vulnerability assessment will require an reference focused and broad mitigation perform an activity required under in-depth analysis of the functional and strategies. subpart C, as appropriate to the thought processes required to properly In addition, we have modified this individual’s assigned duties. A qualified characterize significant vulnerabilities provision to provide that for each individual may be, but is not required associated with a facility’s points, steps mitigation strategy or combination of to be, an employee of the or procedures and the identification of strategies implemented at each establishment.’’ We have further actionable process steps. The process of actionable process step, the facility must clarified the qualifications necessary for conducting a vulnerability assessment include a written explanation of how the conduct of a vulnerability may be new to much of the industry and the mitigation strategy(ies) sufficiently assessment by creating a new section the training must take this into minimizes or prevents the significant (§ 121.4, Qualifications of Individuals consideration. The standardized vulnerability associated with the Who Perform Activities Under Subpart curriculum for conducting a actionable process step. In the preamble C). In § 121.4 we state ‘‘each individual vulnerability assessment will need to be to the proposed rule, we stated that a responsible for . . . conducting or a comprehensive training that teaches justification for how the strategy overseeing a vulnerability assessment as an individual the required components significantly reduces or eliminates the required in § 121.130’’ must (1) have the of a vulnerability assessment and risk of intentional adulteration at that appropriate education, training, or provides enough information for an actionable process step(s) must be experience (or a combination thereof) individual to calibrate their decision documented (see 78 FR 78014 at 78048); necessary to properly perform the making based on the scientific analysis however, this was not explicitly activities; and (2) have successfully required by a vulnerability assessment. included in the regulatory text. We completed training for the specific We believe that the curriculum designed believe that providing additional function at least equivalent to that for this activity will require multiple flexibility in the nature of the mitigation received under a standardized days and may best be offered in person. strategies facilities may employ makes it curriculum recognized as adequate by (Comment 81) A few comments critical that facilities explain their FDA or be otherwise qualified through believe the key activity type option for rationale as to how the strategy(ies) are, job experience to conduct the activities. identifying actionable process steps in fact, protective of the actionable Job experience may qualify an should include a requirement that the process step. This explanation will individual to perform these functions if evaluation be performed by an include a facility’s rationale for such experience has provided an individual(s) qualified by experience selecting its mitigation strategies. This individual with knowledge at least and/or training using appropriate explanation can provide additional equivalent to that provided through the methods. benefits to the facility by assisting them standardized curriculum. This new (Response 81) We agree with the in the decision-making process for definition and qualifications section has comments and this is reflected in the identifying mitigation strategies as well provided more information on what revised requirements. As explained in as identifying the most appropriate would qualify an individual to perform Response 71, key activity types have mitigation strategies management a vulnerability assessment. We believe been removed from the regulatory text, components for the mitigation that our definition of ‘‘qualified but are still considered an appropriate strategy(ies). individual’’ as well as the qualifications method to conduct a vulnerability Based on our vulnerability required of those individuals have assessment. The rule requires that a assessments, we believe that adequate addressed this need and fulfill the vulnerability assessment, no matter mitigation strategies are designed to request of the comments. This new which methodology is used, must be minimize or eliminate the chances an approach is consistent with other FSMA conducted or overseen by a qualified attacker would be successful if an act of rules, including the PCHF final rule, individual. We note that the intentional adulteration were attempted which we believe allows for easier requirements to conduct or oversee a at the actionable process step by either

VerDate Sep<11>2014 19:43 May 26, 2016 Jkt 238001 PO 00000 Frm 00035 Fmt 4701 Sfmt 4700 E:\FR\FM\27MYR4.SGM 27MYR4 mstockstill on DSK3G9T082PROD with RULES4 34200 Federal Register / Vol. 81, No. 103 / Friday, May 27, 2016 / Rules and Regulations

(1) minimizing the accessibility of the mitigation strategy is achieving its also be highly beneficial in establishing product to an attacker (e.g., physically intended aim and, therefore, is properly common understanding and reducing access to the product by implemented. communication between the facility and locking storage tanks) or (2) reducing For example, for a facility that secures inspectors during inspections. the opportunity for an attacker to its liquid storage tank with a lock, a (Comment 82) Many comments successfully contaminate the product review of monitoring records may show support our proposed requirement that (e.g., increasing observation of the area that the lock is consistently in place and mitigation strategies be targeted at high through supervision or use of the buddy locked, therefore reducing accessibility vulnerability process steps instead of system), or a combination of both. and significantly reducing the setting requirements for general facility- Mitigation strategies found within vulnerability associated with the liquid level protections. Further, some FDA’s Mitigation Strategies Database, storage tank. By being consistently comments assert that significant generally, are designed to address one or implemented as intended, the lock is vulnerabilities by nature present both of these concepts. The content of achieving the aim as explained in the themselves at particular points in a the Mitigation Strategies Database is food defense plan to reduce access to process and that these individual derived from our experience conducting the liquid food held in the liquid storage points, steps, or procedures must be vulnerability assessments with industry tank. In this case, the facility can protected. These comments also state and can serve as a resource for facilities conclude that this mitigation strategy is that broad mitigation strategies would to identify adequate and appropriate properly implemented and is reducing a be far reaching and require significantly mitigation strategies. The explanation of significant vulnerability. more capital investment from industry, how the mitigation strategy sufficiently In contrast, consider a lock on a mixer while not directly protecting the most minimizes or prevents the significant that is not achieving its intended aim. vulnerable processes. vulnerability associated with the In this example, the worker at the mixer (Response 82) We agree with actionable process step would, must routinely open the mixer’s lid to comments supporting the direction of generally, address the mitigation determine if the product is being mitigation strategies to those areas strategy’s impact on one or both of these sufficiently mixed. The worker finds the where vulnerability is highest. As outcomes. lock to be interfering with his or her discussed previously, we now refer to For example, a facility seeking to responsibilities and frequently does not mitigation strategies, rather than broad protect its liquid storage tank’s access engage the lock after checking on the and focused mitigation strategies. hatch with a lock may conclude that the product, repeatedly leaving the mixer However, we continue to believe that to lock significantly reduces access to the unsecured. This deviation is be sufficient and appropriate mitigation liquid food stored in the tank by documented in monitoring records by strategies must be specifically tailored rendering the hatch inaccessible and the production supervisor. In this case, to the significant vulnerability and include this explanation in its food the facility’s explanation as to how the customized to the actionable process defense plan. As another example, a mitigation strategy would be protective step where they are applied rather than facility may elect to protect its liquid of the mixer included the rationale that applied to the entire facility (e.g., storage tank actionable process step the lock would reduce access to the locking exterior doors, or ensuring with a policy to require two or more product. A component of the facility’s employees and visitors have employees to be in the area at all times. corrective action procedure for this identification badges). We would not The facility’s explanation would mitigation strategy was to retrain the consider these two examples to be include the rationale that this ‘‘buddy employee on the importance of locking adequate to significantly reduce or system’’ reduces the opportunity and the mixer, but the employee continues prevent a significant vulnerability ability of an attacker to bring a to repeatedly leave the mixer unlocked because they do not address an inside contaminant into the vulnerable due to its interference with his or her attacker. production area and introduce the responsibilities. Since the mitigation However, we believe that many contaminant into the food without being strategy, as determined through a review policies or procedures that a facility detected by his or her co-workers. These of monitoring and corrective action currently has in place can be modified two examples show that the same records, was not consistently or altered to provide protection against actionable process step can be protected implemented, it is not achieving the aim acts of intentional adulteration without in a variety of ways. The explanation as specified in the mitigation strategy’s the facility incurring significant costs, or will clarify the facility’s thinking and explanation. Therefore, the mitigation requiring additional capital investment. rationale as to how a mitigation strategy strategy cannot be determined to be For example, consider a liquid food significantly minimizes or prevents a properly implemented and is not storage tank with an inward opening significant vulnerability. reducing significant vulnerabilities hatch. When the tank is full, the We believe that the explanation associated with the mixer. Since the pressure of the liquid prevents the hatch accompanying the mitigation facility has found that the mitigation from being opened, rendering the tank strategy(ies) will be highly beneficial to strategy is not properly implemented, inaccessible. However, when the tank is the facility in gauging the proper the facility must reanalyze this portion empty, the hatch may be opened and a implementation of the mitigation of the food defense plan under the contaminant added. It may be part of strategy during required verification requirements of § 121.157(b)(3) and then normal facility practice for a supervisor activities. In identifying and identify and implement a different to conduct a visual check of storage implementing appropriate mitigation mitigation strategy, or combination of tanks after a cleaning cycle to ensure the strategies, the facility will need to strategies, for the mixer that would cleaning has been conducted properly. reason through how and why the reduce the likelihood that an act of Rather than incur the cost of installing mitigation strategy(ies) will be intentional adulteration would be a lock or other access control on the protective of the respective actionable successful. hatch, the facility may elect to process step in question. This Additionally, we believe that the implement a food defense mitigation explanation and the monitoring of the explanation for how the mitigation strategy by altering its visual check mitigation strategy play key roles in strategy(ies) are suitable and intended to procedure so that the visual check by enabling the facility to determine if the reduce the significant vulnerability will the supervisor is conducted

VerDate Sep<11>2014 19:43 May 26, 2016 Jkt 238001 PO 00000 Frm 00036 Fmt 4701 Sfmt 4700 E:\FR\FM\27MYR4.SGM 27MYR4 mstockstill on DSK3G9T082PROD with RULES4 Federal Register / Vol. 81, No. 103 / Friday, May 27, 2016 / Rules and Regulations 34201

immediately prior to food being added that mitigation strategies implemented secondary ingredient handling area. To to the storage tank so that the tank is at actionable process steps that are implement the second mitigation observed after the tank has been empty customized to the processing step at strategy (use of most trusted employees), and accessible for an extended period of which they are applied, tailored to the facility could utilize either senior time. Alternatively, the facility could existing facility practices and and/or long-term employees who had elect to secure the tank’s hatch with a procedures, and consider the actionable earned their trust over time, or the tamper-evident seal or tape after the process step’s vulnerability to an insider facility could conduct a more detailed visual inspection. This slight attack are sufficient to protect the background check on specific modification of an existing facility actionable process step. An insider employees. practice could be implemented with attack must be considered because an Much the same way the Federal little, if any, cost to the facility and attacker who has achieved access to the government assigns more sensitive tasks serve to protect the actionable process facility will have already circumvented to Federal workers based on a multi- step—in this case the storage tank— the facility’s general facility-level layered classification and security from an attacker adding a contaminant protections. During the course of our clearance process, the facility could to the tank while it is empty and vulnerability assessments, we require basic level pre-employment accessible after it been cleaned and determined that if an actionable process screening for most employees, but for visually inspected. step was sufficiently protected against those employees working at actionable (Comment 83) Some comments state an attack perpetrated by an insider with process steps, a mitigation strategy that those strategies previously termed legitimate access to the facility, it would could be to require a more detailed level as broad mitigation strategies should be be similarly protected against the of background check. The facility would considered as being among appropriate actions of an outside attacker who has also conduct periodic review of the mitigation strategies for compliance circumvented perimeter protections. background check, as appropriate. By with the requirements, with the majority Facility-wide security measures can applying a more targeted approach to of those comments indicating that FDA support or compliment the mitigation establishing trust for the employee should not distinguish between focused strategy(ies) the facility implements; working in the secondary ingredient and broad mitigation strategies in the however the significant vulnerability handing area, the facility leveraged what final rule. Some comments disagree associated with the actionable process was previously described in the with FDA’s statement in the proposed step must be significantly reduced or proposal as a ‘‘broad’’ mitigation rule that the implementation of focused prevented. strategy in a much more directed and mitigation strategies at actionable For example, if a facility implements targeted way such that it was process steps in a food operation is a strategy to restrict access at an specifically addressing the significant necessary to minimize or prevent the actionable process step to only those vulnerability associated with the significant vulnerabilities that are authorized individuals who work in the secondary ingredient staging area. This identified in a vulnerability assessment area, and the facility leverages example shows how what were ‘‘broad’’ regardless of the existence of broad identification badges to enforce this and ‘‘focused’’ mitigation strategies can mitigation strategies. These comments strategy, then the strategy becomes work together to protect an actionable contend that mitigation strategies much more targeted. In this case, the process step. (whether broad or focused) can work in strategy is simply not about identifying We caution against using background concert with one another and play an personnel who work anywhere in the checks as the sole mitigation strategy to important role in a facility’s food facility, but rather, restricting access to reduce significant vulnerabilities at an defense approach. Additionally, some a specifically vulnerable area. In this actionable process step because a comments state that broad mitigation case, the pre-existing badging process background check may not identify all strategies can sometimes achieve the the facility had in place to positively indicators of an insider threat. same results as focused mitigation identify employees and visitors serves Additionally, information within a strategies and some comments state that as the foundation upon which the more background check may be outdated or the differentiation between the two tailored mitigation strategy is built. missing more recent key information types of strategies is confusing and However, the badging process itself is that could be indicators of an insider subjective. not a mitigation strategy sufficient to threat. Background checks should be (Response 83) We believe this significantly reduce or prevent a used in concert with other mitigation comment is largely addressed by significant vulnerability at the strategies to counter the risk of an changing the regulatory text to refer to actionable process step because the insider attack. In this example, the only mitigation strategies in this final badging process alone does not restrict facility also mitigated vulnerability at rule. We agree with comments that access to the actionable process step. the secondary ingredient staging area by mitigation strategies exist across a Another example to illustrate how reducing the staging time of ingredients spectrum from those that are very broad different practices can work in concert and increasing observation of the area. and facility-wide in nature to those that with each other to achieve protection is Similarly, some other mitigation are very specific and tailored to unique that of vetting employees. In the strategies may not be adequate when processing steps and areas. If proposal we described a hypothetical used in isolation. For example, ensuring implemented in a directed manner, a scenario where a facility’s secondary adequate lighting around an actionable strategy that may tend to be thought of ingredient handling area was identified process step would generally be a as ‘‘broad’’ can be effective at reducing as significantly vulnerable and was, mitigation strategy that must be used in vulnerability associated with a specific therefore, identified as an actionable concert with other strategies to actionable process step and could process step. In the scenario, the facility significantly reduce the likelihood of, or sufficiently minimize the likelihood of a elected to mitigate this vulnerability by prevent, successful acts of intentional successful act of intentional (1) reducing the time ingredients were adulteration at an actionable process adulteration at the actionable process open and accessible, (2) entrusting the step. The increased lighting can support step. handling of secondary ingredients to other mitigation strategies (i.e., Based on the results of our one of the most trusted employees, and increased supervision of an actionable vulnerability assessments, we believe (3) increasing observation over the process step) but, generally, increased

VerDate Sep<11>2014 19:43 May 26, 2016 Jkt 238001 PO 00000 Frm 00037 Fmt 4701 Sfmt 4700 E:\FR\FM\27MYR4.SGM 27MYR4 mstockstill on DSK3G9T082PROD with RULES4 34202 Federal Register / Vol. 81, No. 103 / Friday, May 27, 2016 / Rules and Regulations

lighting would not by itself be sufficient significant vulnerability they are particular, these comments suggest the to address the significant vulnerability addressing and customized to the C–TPAT program has proved successful associated with the actionable process actionable process step where they are in requiring that broad mitigation step. applied, while taking into account strategies be implemented, including (Comment 84) Some comments state existing facility practices and physical security, personnel security, that existing facility practices and procedures. We disagree with the ingredient storage and inventory facility-level measures should be comment’s assertion that strategies procedures, and crisis management considered when a facility is identifying previously termed as ‘‘focused planning. appropriate mitigation strategies. mitigation strategies’’ are questionable (Response 87) As discussed in section (Response 84) We agree. As discussed or of unproven efficacy. Indeed, we III.D, we believe that participation in previously, mitigation strategies should conclude as determined through our other security programs, such as C– be tailored to existing facility practices vulnerability assessments that TPAT or CFATS for example, raises the and procedures, and take into account mitigation strategies specifically overall security posture for a facility and the nature of the actionable process designed to protect the most vulnerable can be beneficial along with the step’s significant vulnerability. points in a food operation are the most requirements of the final rule. In certain Mitigation strategies can be effective at reducing the likelihood that circumstances, security measures complemented by or built on top of an act of intentional adulteration would implemented under other security existing practices or facility-level be successful. General facility-level programs may also prove to be effective measures. For example, a facility might security measures have questionable mitigation strategies once actionable prepare secondary ingredients in an area value in protecting actionable process steps are identified. These near the process step where they will be processing steps from significant security measures should be evaluated added to the product line. The facility vulnerabilities, especially those on a case-by-case basis to determine if weighs and measures ingredients the significant vulnerabilities associated they significantly reduce or prevent night before use so they are ready for with attackers with legitimate access to significant vulnerabilities at actionable introduction into the product line in the the facility. However, this comment process steps. If so, the facility may morning. To identify a suitable and illustrates why we are changing the consider these protections as mitigation appropriate mitigation strategy, the codified to refer to only ‘‘mitigation strategies under § 121.135 and facility would consider its normal strategies.’’ We would consider the document them in the food defense practice of staging ingredients the night efforts described by this comment to be plan. However, FDA will not consider a before and any other relevant practices focused mitigation strategies as we used facility’s participation with other the facility engages in regarding its that term in the proposed rule. We agree security programs as de facto handling of secondary ingredients in that ‘‘bulk foods prior to and at process compliance with this rule. this area. The facility might conclude steps that may disperse contamination that staging ingredients the night before in a large volume of finished food’’ D. Final § 121.138—Mitigation is unnecessary and elect to implement would most likely be significantly Strategies Management Components the mitigation strategy that ingredients vulnerable and thus require appropriate We have added a new § 121.138 will only be handled immediately mitigation strategies. (Mitigation Strategies Management before their introduction into the (Comment 86) Some comments state Components) to establish that mitigation product line to prevent them from being that some of the mitigation strategies strategies required under § 121.135 are open and accessible for extended identified in the preamble of the subject to the following mitigation periods of time. Alternatively, if the proposed rule may not be appropriate or strategies management components as facility concludes that their operating suitable in certain circumstances. For appropriate to ensure the proper practices prevent this approach, it could example, some comments mention that implementation of the mitigation implement the mitigation strategy to one-way sample ports as a mitigation strategies, taking into account the nature place the ingredients in tamper evident strategy may not be appropriate for of each such mitigation strategy and its storage containers overnight to prevent products that require aseptic sampling. role in the facility’s food defense an attacker from being able to introduce Some comments contend that making system: (1) Food defense monitoring in an agent without indications of engineering enhancements to equipment accordance with § 121.140; (2) Food tampering with the ingredients. The or repositioning equipment to increase defense corrective actions in accordance facility would implement the most visual observation may be prohibitively with § 121.145; and (3) Food defense appropriate mitigation strategy taking costly. verification in accordance with into consideration its existing practices (Response 86) We agree that certain § 121.150. We have created this new and procedures. mitigation strategies may not be section to provide clarity and (Comment 85) One comment asserts appropriate or suitable in some understanding regarding the application broad mitigation strategies offer situations. Therefore, we are not of the three management components to significant protections to the food requiring any specific mitigation the mitigation strategies as required by supply and that focused mitigation strategies in this rule. A facility may § 121.135. strategies are of questionable or at least identify the most appropriate and unproved efficacy. This comment goes suitable mitigation strategies for its E. Proposed § 121.140—Monitoring on to request that FDA focus facility, the food being processed, the 1. Proposed § 121.140(a)–(b) requirements only on broad mitigation actionable process step being protected, Requirement for Written Procedures for strategies that limit access to bulk foods and the nature of the significant and Frequency of Monitoring prior to and at process steps that may vulnerability being mitigated. disperse contamination in a large (Comment 87) Some comments urge We proposed that you must establish volume of finished food. FDA to permit requirements that are and implement written procedures, (Response 85) During the course of already in place by other government including the frequency with which our vulnerability assessments, we found agencies to count as mitigation they are to be performed, for monitoring that appropriate mitigation strategies strategies, when appropriate based on a the mitigation strategies, and you must must be specifically tailored to the thoughtful vulnerability assessment. In monitor the mitigation strategies with

VerDate Sep<11>2014 19:43 May 26, 2016 Jkt 238001 PO 00000 Frm 00038 Fmt 4701 Sfmt 4700 E:\FR\FM\27MYR4.SGM 27MYR4 mstockstill on DSK3G9T082PROD with RULES4 Federal Register / Vol. 81, No. 103 / Friday, May 27, 2016 / Rules and Regulations 34203

sufficient frequency to provide mitigation strategies; it does not indicate (i.e., suitable for a particular purpose assurance that they are consistently that each mitigation strategy must be and capable of being applied) because it applied. monitored, and it does not specify the allows for the assessment or observation Some comments support the proposed frequency at which monitoring must that the ingredient staging time is being requirements. In the following occur. However, the comments agree reduced. When establishing the paragraphs, we discuss comments that that facilities should assess whether monitoring procedure, the facility disagree with the proposed mitigation strategies are in place and are considered the nature of the mitigation requirements, ask us to clarify the fully implemented. The comments agree strategy (i.e., an observation would proposed requirements, or suggest one that facilities should have written determine if reducing the staging time or more changes to the proposed procedures regarding how, and the was being consistently performed) and requirements. Some comments request frequency at which, observations take its role in the facility’s food defense that we provide more flexibility than a place, but also indicate that these system (i.e., the facility deemed it traditional HACCP framework, with procedures and frequencies should be necessary to conduct the monitoring for specific requests for flexibility in the less rigorous than procedures and the mitigation strategy because the management components, including frequencies for preventive controls. reducing the staging time significantly monitoring. (Response 88) We agree that facilities minimized the significant vulnerability After considering these comments, we must assess whether mitigation associated with the ingredient are making three revisions to the strategies are in place. We also agree containers). Additionally, the facility requirements for monitoring in that facilities must provide written reasoned that monitoring the staging § 121.140. First, we are adding the procedures regarding how, and the area immediately prior to the addition qualification ‘‘as appropriate to the frequency at which, monitoring occurs. of the ingredients to the hopper met the nature of the mitigation strategy and its This rule implements section 103 of requirement for monitoring to be role in the facility’s food defense FSMA, and therefore includes conducted on an adequate frequency system,’’ to the beginning of the components for monitoring (section because this frequency meets the provision. Second, we are changing 418(d) of the FD&C Act). We agree that definition of adequate (i.e., that which is ‘‘sufficient’’ to ‘‘adequate’’ in monitoring in the intentional needed to accomplish the intended § 121.140(b), which now states that adulteration regulatory framework purpose in keeping with good public ‘‘you must monitor the mitigation should be more flexible than monitoring health practice) in that monitoring prior strategies with adequate frequency to as described in the National Advisory to ingredient addition to the hopper provide assurances that they are Committee on Microbiological Criteria ensures that employees will properly consistently performed.’’ We are for Foods’ HACCP Principles and implement the reduced staging time and substituting the term ‘‘adequate’’ for the Application Guidelines. Therefore, we reduce the significant vulnerability. term ‘‘sufficient’’ to be consistent with have modified the requirement for the PCHF final rule definition for monitoring in the regulatory text to 2. Proposed § 121.140(c)—Requirement monitoring. We conclude that there is include ‘‘as appropriate to ensure the for Records no meaningful difference between proper implementation of the mitigation We proposed that all monitoring of ‘‘adequate’’ and ‘‘sufficient’’ for the strategies, taking into account the nature focused mitigation strategies in purposes of part 121. We have also of each such mitigation strategy and its accordance with this section must be added a definition for the term role in the facility’s food defense documented in records that are subject ‘‘adequate’’ in the regulatory text to system’’ (see §§ 121.138, 121.140) and to to verification in accordance with mean that which is needed to provide for the use of exception records proposed § 121.150(a) and records accomplish the intended purpose in (see § 121.140(c)(2)). These changes review in accordance with proposed keeping with good public health allow a facility to select the appropriate § 121.150(c). practice. We also conclude that the rigor and frequency of its monitoring In the following paragraphs, we regulations will be clearer if we use the based on its particular circumstances discuss comments that disagree with the single term ‘‘adequate’’ throughout the and are similar to those made in the proposed requirements, ask us to clarify regulations. Third, we are changing PCHF final rule regulatory text for the proposed requirements, or suggest ‘‘applied’’ to ‘‘performed’’ to address monitoring in the preventive controls one or more changes to the proposed comments that state the language was management components. requirements. After considering these unclear. Section 121.140(b) now states For example, a facility stages comments, we have revised the that ‘‘you must monitor the mitigation ingredients overnight so the first shift regulatory text to provide that exception strategies with adequate frequency to can immediately begin adding records may be adequate in some provide assurances that they are ingredients to a hopper. The facility circumstances (see § 121.140(c)(2)). consistently performed.’’ identifies staged ingredient containers (Comment 89) Some comments state (Comment 88) Some comments argue as an actionable process step because that a facility will be much more likely that the language of section 418(d) of the the overnight staging makes the to document a deviation from an FD&C Act is ambiguous, and state that ingredient containers significantly established mitigation strategy (i.e., a monitoring in section 418(d) does not vulnerable. The facility then identifies a light is broken or turned off) rather than require that facilities conduct mitigation strategy of reducing a confirmation that the light was monitoring as described in the National ingredient staging time. The facility working properly each day. These Advisory Committee on Microbiological establishes and implements food comments seem to indicate that this Criteria for Foods’ HACCP Principles defense monitoring procedures to could be a potential area where greater and Application Guidelines. These include observations of the staging area flexibility is needed regarding how comments state that the statute sets a to ensure the ingredients are staged monitoring is documented. standard for facilities to ‘‘monitor the immediately prior to addition into the (Response 89) New § 121.140(c)(2) effectiveness of the preventive hopper rather than overnight. This provides for exception records and controls.’’ The comments state that the monitoring procedure is tailored to the states records may be affirmative statute does not indicate how facilities facility’s circumstances and is records demonstrating the mitigation are to monitor the effectiveness of the appropriate to the mitigation strategy strategy is functioning as intended and

VerDate Sep<11>2014 19:43 May 26, 2016 Jkt 238001 PO 00000 Frm 00039 Fmt 4701 Sfmt 4700 E:\FR\FM\27MYR4.SGM 27MYR4 mstockstill on DSK3G9T082PROD with RULES4 34204 Federal Register / Vol. 81, No. 103 / Friday, May 27, 2016 / Rules and Regulations

that exception records demonstrating procedures that must be taken if the ‘‘appropriate action is taken’’ in the mitigation strategy is not mitigation strategy is not properly § 121.145(a)(2)(ii). functioning as intended may be implemented. The corrective action (Comment 90) A few comments state adequate in some circumstances. This procedures must describe the steps to be that greater flexibility is needed to revision to the regulatory text was made taken to ensure that appropriate action reflect the differences between to clarify that exception records, in is taken to identify and correct a mitigation strategies and preventive certain circumstances, are acceptable. problem with implementation of a controls and that corrective actions is We understand exception reporting as a mitigation strategy to reduce the one potential area in which to increase structure where automated systems are likelihood that the problem will recur. flexibility. While comments agree that a designed to alert operators and facility should take action when a Some comments support the proposed management on an exception basis—i.e., mitigation strategy is not properly or requirements. In the following only when a deviation from food safety fully implemented, these comments paragraphs, we discuss comments that parameter limits are observed by the further state that detailed, written disagree with the proposed system. corrective action procedures should not Exception reporting would be an requirements, ask us to clarify the be required to address every possible acceptable monitoring system in some proposed requirements, or suggest one deviation for each mitigation strategy. In circumstances. A facility must be able to or more changes to the proposed addition, comments state that facility verify that food defense monitoring is requirements. Some comments request employees should make corrections, being conducted (§ 121.150(a)(1)). This that the intentional adulteration rather than take corrective actions, in is straightforward with affirmative requirements provide more flexibility some circumstances. These comments monitoring records but can be more than a traditional HACCP framework, provide an example of corrections difficult or impossible with exception with specific requests for flexibility in where a door is simply closed, and the records. The following example the management components, including action is not documented, in response to provides an instance where a facility corrective actions. After considering a single, isolated event where a door is may choose exception records when these comments, we are making several propped open. monitoring a mitigation strategy. A revisions to the proposed requirements (Response 90) As described facility identifies an ingredient storage for corrective actions. First, we are previously, we have modified the area as an actionable process step, and adding the qualification ‘‘as appropriate provision to provide that corrective identifies and implements a restricted to the nature of the actionable process action procedures are established and access system that uses electronic step and the nature of the mitigation implemented based on the nature of the swipe/key cards to limit access to the strategy’’ to the beginning of the actionable process step in addition to area. The restricted access system is provision in § 121.145(a). Second, we the nature of the mitigation strategy (see designed to allow authorized personnel are separating the requirements to take § 121.145(a)). The rule allows for a to open a door to the area, while also appropriate action to identify and facility’s corrective action procedures to alerting management when the door is correct a problem that has occurred reflect the extent of the deviation. For left unlocked. While the system would from the requirement to take example, a facility’s monitoring not need to produce a record for every appropriate action, when necessary, to indicates that a peer monitoring authorized access to the area, the system reduce the likelihood that the problem mitigation strategy is not implemented as intended because one of the would produce a record for each will recur. The separated requirements employees does not accompany the instance that the door is left unlocked are now included in the regulatory text other employee at the actionable process and alert operators to those instances. In as § 121.145(a)(2)(i) and step. A component of the facility’s this example, the facility would § 121.145(a)(2)(ii), respectively. Similar written corrective action is to retrain the periodically verify that the restricted changes were made to the PCHF final employee on the importance of access system is working properly, in rule regulatory text for corrective accompanying the other employee while part, by leaving the door unlocked, and actions, as comments related to that rule at the actionable process step. We ensuring the system alerts the operator asserted the proposed corrective action expect, in most cases, that food defense by generating a record that documents regulatory text could have been corrective action procedures will be the door being unlocked. Exception misunderstood as a requirement to simple and easy to undertake. Further, records are not always appropriate. For establish a new preventive control after we agree that written corrective action example, it would not be appropriate to implementing a corrective action procedures need not address every create a record that indicates adequate procedure. These comments also possible deviation, and the rule does not lighting is not functioning as intended, asserted that it would be inappropriate require this. Written corrective action rather than documenting adequate to assume that corrective action procedures should address lighting is functioning as intended, procedures always correct a problem circumstances where deviations are unless the facility devised an approach with the implementation of a new or likely to occur. The reason to have that would allow it to verify that food additional preventive control. We have corrective action procedures is to defense monitoring was being addressed these comments to the consider the likely scenarios in advance, conducted as required. requirement to identify and correct a rather than react to these scenarios on F. Proposed § 121.145—Corrective problem by adding ‘‘that has occurred’’ an ad hoc basis. Actions after ‘‘correct a problem’’ in We do not agree that certain situations § 121.145(a)(2)(i). We have also are more appropriate for corrections 1. Proposed § 121.145(a)(1)–(2) addressed these comments by qualifying rather than corrective actions. A Requirement To Establish and the requirement that the corrective ‘‘correction’’ does not include, among Implement Corrective Action action procedures must describe the other things, actions to reduce the Procedures That Must Describe Steps To steps to be taken to ensure that likelihood that the problem will recur. Be Taken appropriate action is taken to reduce the The comment describes a situation We proposed that you must establish likelihood that the problem will recur where a facility is locking the door to and implement written corrective action by inserting ‘‘when necessary’’ after serve as the mitigation strategy, and the

VerDate Sep<11>2014 19:43 May 26, 2016 Jkt 238001 PO 00000 Frm 00040 Fmt 4701 Sfmt 4700 E:\FR\FM\27MYR4.SGM 27MYR4 mstockstill on DSK3G9T082PROD with RULES4 Federal Register / Vol. 81, No. 103 / Friday, May 27, 2016 / Rules and Regulations 34205

monitoring of the mitigation strategy failure to implement the mitigation clarification specifically related to indicates the strategy is not performing strategy. Further, without implementation and effectiveness. One as intended (i.e., the door is not locked, documentation, it may not be known comment requests that we provide for and it is propped open). Because whether it was a one-time event or the other activities appropriate for monitoring has indicated the mitigation door was propped up more regularly. verification of implementation and strategy is not properly implemented, a Documentation of the corrective actions effectiveness. After considering these corrective action is required and review of the documentation to comments, we are making several (§ 121.145(a)(1)). While the example verify proper implementation of changes to the requirements for includes a corrective action that is quite mitigation strategies is necessary to verification. simplistic and easy to undertake, it is identify trends and patterns of First, we are adding text to important that a corrective action, and implementation of mitigation strategies § 121.150(a) (Food defense verification) not a correction, be taken because the over time, and is also necessary to to reflect that verification procedures corrective action includes actions to ensure appropriate decisions about are established and implemented based reduce the likelihood that the problem corrective actions are being made. After on the nature of the mitigation strategy will recur, while the correction does considering the comment, we are and its role in the facility’s food defense not. An unlocked door leaves the finalizing these requirements as system. Second, we made edits to reflect significant vulnerability unmitigated, proposed. new § 121.138. We have changed and therefore, this seemingly isolated proposed § 121.150(a) to final G. Proposed § 121.150—Verification problem directly impacts product § 121.150(a)(1), which now states vulnerability. We proposed to require verification of ‘‘Verification that food defense Furthermore, corrections, such as monitoring, verification of corrective monitoring is being conducted as those discussed in the PCHF final rule actions, verification of implementation required by § 121.138 (and in (e.g., facility observes food residue on and effectiveness, reanalysis, and accordance with § 121.140).’’ We have ‘‘clean’’ equipment prior to production documentation of all verification changed proposed § 121.150(b) to final of food, and then cleans the equipment), activities. Specifically regarding § 121.150(a)(2), which now states are appropriate for minor and isolated verification of implementation and ‘‘Verification that appropriate decisions problems that do not directly impact effectiveness, (proposed § 121.150(c)), about food defense corrective actions product safety. An analogous situation we proposed that you must verify that are being made as required by § 121.138 does not exist in the context of the focused mitigation strategies are (and in accordance with § 121.145).’’ We intentional adulteration where consistently implemented and are have changed proposed § 121.150(c) to requirements of this rule are designed to effectively and significantly minimizing final § 121.150(a)(3) which requires reduce significant vulnerabilities or preventing the significant verification that mitigation strategies are associated with an insider attack. vulnerabilities. We proposed that this properly implemented and significantly Additionally, food defense corrective must include, as appropriate to the minimizing the significant action requirements are less rigorous facility and the food, review of the vulnerabilities. and resource-intensive than corrective monitoring and corrective actions Third, we have removed the actions for food safety purposes. Food records within appropriate timeframes requirement to verify that mitigation defense corrective actions do not to ensure that the records are complete, strategies are effectively significantly include requirements to evaluate all the activities reflected in the records minimizing or preventing significant affected food for safety, prevent affected occurred in accordance with the food vulnerabilities in § 121.150(c) because it food from entering commerce, or defense plan, the focused mitigation is more appropriate to verify mitigation include requirements for unanticipated strategies are effective, and appropriate strategies are being properly problems. decisions were made about corrective implemented, in accordance with the actions. We also requested comment on food defense plan, rather than verifying 2. Proposed § 121.145(a)(3)— whether we should specify the these strategies are effective. In the food Documentation verification activities that must be safety context, verification of We proposed that all corrective conducted for verification of monitoring effectiveness is mainly accomplished actions taken in accordance with this and for verification of corrective actions via validation and testing, which are not section must be documented in records and, if so, what verification activities required in this final rule due to the that are subject to verification in should be required. nature of mitigation strategies. Fourth, accordance with proposed § 121.150(b) we are adding a new section 1. Verification of Monitoring, Corrective and records review in accordance with § 121.150(a)(3)(ii) to provide for ‘‘other Actions and Implementation and proposed § 121.150(c). activities appropriate for verification of Some comments support the proposed Effectiveness proper implementation’’ to allow for requirements without change. One Some comments support the proposed increased flexibility in verifying comment states that documentation requirements. In the following mitigation strategies are properly would not be needed in a single, paragraphs, we discuss comments that implemented beyond what is included isolated event, such as where a door is disagree with the proposed in § 121.150(a)(3)(i). Fifth, we added a propped open, and the corrective action requirements, ask us to clarify the requirement (§ 121.150(b)), to establish would simply result in the door being proposed requirements, or suggest one and implement written procedures, closed. While the example includes a or more changes to the proposed including the frequency for which they corrective action that is simple and easy requirements. Some comments request are performed, for verification activities. to undertake, it is necessary that it be that the intentional adulteration This requirement was added because documented. Without such requirements provide more flexibility the flexibility, provided in documentation, verification of proper than a traditional HACCP framework, § 121.150(a)(3)(ii), is significant but not implementation of the mitigation with specific requests for flexibility in unbounded. Written procedures are strategy, as required in § 121.150(a)(3), the management components, including essential to ensure these activities are may not be possible because there are verification. Most of the comments occurring in accordance with the food no records to review which reflect addressing verification activities request defense plan. Sixth, we moved the more

VerDate Sep<11>2014 19:43 May 26, 2016 Jkt 238001 PO 00000 Frm 00041 Fmt 4701 Sfmt 4700 E:\FR\FM\27MYR4.SGM 27MYR4 mstockstill on DSK3G9T082PROD with RULES4 34206 Federal Register / Vol. 81, No. 103 / Friday, May 27, 2016 / Rules and Regulations

extensive section for reanalysis step, or procedure, or directly reduce defense system. Review of monitoring (proposed § 121.150(d)) to a new section the ability of an attacker to contaminate records is necessary to determine (final § 121.157) to improve readability the food at a point, step, or procedure, whether mitigation strategies are and clarity. As a result, we created a and in doing so, indirectly reduce the implemented as intended and are new § 121.150(a)(4) (‘‘Verification of potential public health impact if a therefore significantly minimizing Reanalysis in accordance with contaminant were added at a point, significant vulnerabilities. For example, § 121.157’’) to include in § 121.150 the step, or procedure. review of monitoring records for a requirement to verify that reanalysis has As a facility reasons through its mitigation strategy of using a lock to been conducted. Some of these changes explanation of how the mitigation secure an access hatch on top of a silo are similar to those made in the PCHF strategy significantly minimizes or could indicate that the lock is final rule regulatory text for verification prevents the significant vulnerability functioning as intended because the and preventive controls management (§ 121.135(a)), the facility’s explanation securing mechanism is fully engaged, components. will most likely include the rationale for and the hatch cannot be accessed (Comment 91) Some comments how the mitigation strategy reduces, to without a key to the lock. The request clarification and elaboration for an acceptable level, either the degree of significant vulnerability has been verification activities related to unauthorized access to the actionable significantly minimized because the implementation and effectiveness of process step or the ability of an attacker food in the silo is no longer accessible. mitigation strategies (proposed to successfully contaminate the product The facility determines the mitigation § 121.150(c)). at the actionable process step. When the strategy is properly implemented (Response 91) As mentioned facility reviews the monitoring and because it is functioning as intended previously, we have removed the corrective action records to ensure that and minimizes the significant requirement to verify the effectiveness activities reflected in the records occur vulnerability. of mitigation strategies. As part of food as envisioned by the food defense plan Review of corrective action records is defense verification, a facility must (§ 121.135(a)) and are consistently necessary to determine whether determine if each mitigation strategy is implemented (§ 121.150(a)(3)), the appropriate decisions are being made to properly implemented and significantly facility can then determine whether the identify and correct any problems with minimizing or preventing significant mitigation strategy is properly the implementation of a mitigation vulnerabilities. To do this, a facility implemented and is significantly strategy and whether actions are being would determine whether the mitigation minimizing the significant vulnerability taken to reduce the likelihood that a strategies are consistently implemented at the actionable process step. problem would recur. To continue with and functioning as intended. Part of this (Comment 92) One comment states the example, if the review of monitoring determination would be based on that verification methods other than records indicated that the lock was not review of monitoring and corrective those required by proposed § 121.150(c) properly implemented due to employee action records. In addition, as may be appropriate, and provides error, the facility implements the mentioned in section V.D, facilities may suggestions of such methods, including corrective action, which consists of use, but are not limited to, two direct observation of monitoring, such engaging the securing mechanism of the important factors to determine the as a supervisor observing monitoring lock on the access hatch, and retraining proper implementation of mitigation conducted by an employee, and review the employee assigned to this step in strategies to significantly minimize or of monitoring and corrective actions how to properly use the securing prevent significant vulnerabilities: (1) activities during team meetings. mechanism. During the review of the The degree of physical access to the (Response 92) We agree that the rule corrective action records, the facility product at the actionable process step should provide flexibility for additional determines that appropriate decisions and (2) the ability of an attacker to activities related to verification of about corrective actions were made successfully contaminate the product at properly implemented mitigation because the problem was identified that the actionable process step. strategies, and have revised the specific the lock was not properly implemented For example, if a mitigation strategy is requirements to provide for other due to employee error, the problem was significantly minimizing the degree of activities appropriate for verification of corrected because the facility engaged physical access to the product at an proper implementation of mitigation the securing mechanism of the lock to actionable process step, and the strategy strategies in § 121.150(a)(3)(ii). lock the access hatch, and actions were is consistently implemented as Providing specific requirements for taken to reduce the likelihood the determined by record review, the verification of implementation problem would recur by training the strategy can be considered properly (§ 121.150(a)(3)(i)), but allowing for employee on how to successfully engage implemented. Likewise, if the other activities appropriate for the securing mechanism of the lock in mitigation strategy is significantly verification of implementation order to lock the access hatch. minimizing the ability of an attacker to (§ 121.150(a)(3)(ii)), addresses, in part, Further, FDA has provided a flexible successfully contaminate the product at comment requests that mitigation time period for review, allowing review the actionable process step, and the strategies management components of monitoring and corrective action strategy is consistently implemented as need to provide more flexibility. records to take place in an ‘‘appropriate determined by record review, the (Comment 93) One comment timeframe.’’ For example, a facility strategy can be considered properly disagrees with the requirement that, as chooses to use several mitigation implemented. These factors are the part of verification, monitoring and strategies, including adequate lighting, same as two of the factors required to be corrective action records must be at the bulk truck unloading bay to evaluated in a vulnerability assessment reviewed and further states that the protect the actionable process step, and (§ 121.130(a)(2) and (3)). proposed requirement is too the lighting may be monitored each time We are not including the third factor prescriptive and not applicable to food a shipment is received or on a weekly (the potential for public health impact defense. basis depending on the facility’s (§ 121.130(a)(1)) because it has been our (Response 93) Review of monitoring determination of the frequency of the experience that mitigation strategies and corrective action records is a key monitoring procedures. The review of either directly reduce access to a point, component of verification in a food these monitoring records may occur on

VerDate Sep<11>2014 19:43 May 26, 2016 Jkt 238001 PO 00000 Frm 00042 Fmt 4701 Sfmt 4700 E:\FR\FM\27MYR4.SGM 27MYR4 mstockstill on DSK3G9T082PROD with RULES4 Federal Register / Vol. 81, No. 103 / Friday, May 27, 2016 / Rules and Regulations 34207

a weekly or monthly basis, depending prevents the significant vulnerability for when the reanalysis requires a on the frequency of the monitoring associated with an actionable process revision to the food defense plan (e.g., procedures and the role this mitigation step, a facility may choose a mitigation the proposed language stated a revision strategy plays in a facility’s food defense strategy that it believes provides to the food defense plan is required system. We disagree that this maximum benefit, regardless of when a significant change is made, and requirement is too prescriptive. availability or convenience, if it the text was edited to state that a (Comment 94) Some comments assert complies with the requirement to revision to the food defense plan is that industry cannot be held to a significantly minimize, or prevent, the required when a significant change in standard of absolute prevention of significant vulnerability. activities conducted at your facility intentional adulteration, and given this creates a reasonable potential for a new 2. Proposed § 121.150(d)—Reanalysis assertion, one of these comments further significant vulnerability or a significant (Final § 121.157) states that effectiveness of mitigation increase in a previously identified strategies should be interpreted We proposed that you must conduct vulnerability). Also, the new reanalysis reasonably by both FDA and industry. a reanalysis of the food defense plan (1) section provides more flexibility in the The comment agrees that facilities At least once every 3 years; (2) timeframe for when a reanalysis must be should be expected to take reasonably Whenever a significant change in the completed, and clarifies when a appropriate measures to mitigate activities conducted at your facility reanalysis requires a revision to the food vulnerabilities and also states that creates a reasonable potential for a new defense plan. facilities should have discretion to vulnerability or a significant increase in In the following paragraphs, we determine how mitigation strategies are a previously identified vulnerability; (3) discuss comments that suggest one or effective. This comment goes on to state Whenever you become aware of new more changes to the proposed that facilities should not be expected to information about potential requirements. employ a certain measure just because vulnerabilities associated with the food (Comment 95) Some comments state the measure is available, particularly operation or facility; (4) Whenever you that greater flexibility is needed to when the added benefit might be find that a focused mitigation strategy is reflect the differences between minimal. Finally, the comment states ineffective; and (5) Whenever FDA mitigation strategies and preventive that, in the context of interpreting requires reanalysis to respond to new controls and that verification is one effectiveness of mitigation strategies in vulnerabilities and developments in potential area in which to increase a reasonable manner, FDA should be scientific understanding including, as flexibility. These comments believe that mindful of the extremely low likelihood appropriate, results from the the oversight burden and the records of an intentional adulteration event that Department of Homeland Security burden associated with verification may cause massive public health harm biological, chemical, radiological, or could be lessened by adding more or economic disruption. other terrorism risk assessments. These flexibility. (Response 94) We acknowledged the requirements for reanalysis of the food (Response 95) We interpreted these low probability of an intentional defense plan were proposed within comments to include reanalysis in the adulteration event that may cause wide § 121.150 Verification. verification activities mentioned. We scale public health harm in the Many comments responded to agree that the overall regulatory proposed rule (78 FR 78014 at 78024). § 121.150 (Verification) as a whole, framework for this rule should provide The rule does not create a standard of without specifically referring to more flexibility than that of a traditional absolute prevention at every identified reanalysis as an area needing edits. HACCP approach and have described actionable process step. Mitigation However, some comments regarding our general thinking in Comment 1 and strategies are, among other things, ‘‘risk- verification potentially apply to Comment 2 of this document. To align based’’ and ‘‘reasonably appropriate reanalysis, and these are addressed in with this thinking we have made measures.’’ They are employed to this section. Some comments support specific changes to the reanalysis ‘‘significantly minimize or prevent’’ the proposed requirements without requirements. We removed reanalysis significant vulnerabilities. change and some support the proposed from § 121.150 and created a new Furthermore, each facility has some provisions but ask for more flexibility section § 121.157 devoted entirely to degree of discretion in determining and suggest alternative regulatory text. requirements for reanalysis to help how, and whether, each mitigation After considering these comments, to clarify activities for the purpose of strategy is properly implemented, as improve clarity and readability and to verification versus activities specific to part of the facility’s written explanation be consistent with the PCHF final rule reanalysis. Within this section we of how the mitigation strategy with respect to the regulatory text for provide for reanalysis of an applicable sufficiently minimizes or prevents the reanalysis, we have removed reanalysis portion of the food defense plan (rather significant vulnerability associated with from § 121.150 and created a new than the complete food defense plan) in the actionable process step. section § 121.157 devoted entirely to specified circumstances. We have Additionally, facilities are not requirements for reanalysis. We have revised the regulatory text to state that required to employ measures just revised the regulatory text within this when reanalysis is conducted for any because they are available or section to clarify which portions of the reason other than § 121.157(a) (every 3 convenient. Rather, facilities are food defense plan will need reanalysis years), the food defense plan as a whole required to identify and implement and how often (e.g., the whole plan may need to be reanalyzed, or just the mitigation strategies that reflect the needs reanalysis at least every 3 years, applicable portion of the food defense specific circumstances of the actionable and the whole plan or the applicable plan that may be affected by the process step and the facility. Because portions of the plan need reanalysis for proposed change or the new information the facility considers these all other reasons required in the text), to (see § 121.157(a) and 121.157(b)). In the circumstances when identifying and expand the scope of situations that proposed rule, the portions of the plan implementing an appropriate mitigation trigger a reanalysis (e.g., added a that required reanalysis were not strategy, and provides a written reanalysis requirement when required detailed, and the implication was that explanation of how the mitigation by FDA based on credible threats to the the entire plan must be reanalyzed in all strategy sufficiently minimizes or food supply), and we increased clarity cases. Our clarification of this language

VerDate Sep<11>2014 19:43 May 26, 2016 Jkt 238001 PO 00000 Frm 00043 Fmt 4701 Sfmt 4700 E:\FR\FM\27MYR4.SGM 27MYR4 mstockstill on DSK3G9T082PROD with RULES4 34208 Federal Register / Vol. 81, No. 103 / Friday, May 27, 2016 / Rules and Regulations

allows flexibility for the facility to option to conclude that a revision to the section, § 121.4 (Qualifications of determine the extent of the required food defense plan is not needed as long Individuals Who Perform Activities reanalysis based on the nature of the as the basis for that conclusion has been Under Subpart C), which replaces reanalysis trigger. In addition, we made documented. § 121.160 and defining the term associated editorial changes for the Many of the changes we made to the ‘‘qualified individual’’ in § 121.3. In intentional adulteration reanalysis reanalysis provisions are similar to summary, the final rule requires all requirements to improve the readability changes made in the PCHF final rule, individuals who perform activities of the requirement to conduct reanalysis and we believe this consistency will under Subpart C to be qualified through ‘‘whenever a mitigation strategy, a assist with overall understanding and training or job experience or a combination of mitigation strategies, or implementation of these rules. combination thereof. Individuals and the food defense plan as a whole, is not (Comment 96) Some comments ask us their supervisors at actionable process properly implemented’’ (see to recognize other terminologies steps are required to take food defense § 121.157(b)(3)). In the proposed rule suggesting reanalysis could be referred awareness training and individuals who this requirement applied only to the to as ‘‘reassessment.’’ prepare the food defense plan, conduct ineffective nature of a mitigation (Response 96) We decline this a vulnerability assessment, identify and strategy and did not take into account request. We have acknowledged that the explain mitigation strategies and other areas of the food defense plan that terminology used in relation to the perform reanalysis must have may be contributing to an ineffective concept of ‘‘reanalysis’’ varies in current successfully completed training for the food defense plan. We also added new regulations and guidelines for systems specific activity at least equivalent to text to the reanalysis requirement to such as HACCP (78 FR 3646 at 3759). that received under a standardized allow FDA to require a reanalysis A facility may choose to use a term such curriculum recognized as adequate by ‘‘when credible threats are made to the as ‘‘reassessment’’ in its records—e.g., if FDA or be otherwise qualified through food supply’’, as discussed more fully in it relies on existing records that use the job experience to conduct the activities. term ‘‘reassessment’’ to satisfy some or section III.C. Section 121.4 requires that Further, additional flexibility has all of the requirements of this rule for individuals performing activities under been provided with respect to reanalysis. However, the rule will use a Subpart C have certain qualifications timeframes associated with completing single term to minimize the potential for that vary based on the activity reanalysis. The proposed rule required confusion about whether different terms performed. Section 121.4(a) requires that reanalysis be completed ‘‘before the have a different meaning for the change in activities at the facility were purposes of the rule. that you ensure that each individual operative’’ or ‘‘when necessary, during who performs activities required under H. Proposed § 121.160—Training (Final Subpart C is a qualified individual. A the first 6 weeks of production.’’ The § 121.4) new requirement states that the qualified individual is ‘‘a person who reanalysis must be complete ‘‘before any We proposed in § 121.160 to require has the education, training, or changes in activities (including any that (1) Personnel and supervisors experience (or a combination thereof) change in mitigation strategy) at the assigned to actionable process steps necessary to perform an activity facility is operative,’’ or ‘‘when must receive appropriate training in required under Subpart C, as necessary, within 90 days of food defense awareness and their appropriate to the individual’s assigned production’’ or ‘‘within a reasonable respective responsibilities in duties. A qualified individual may be, timeframe, providing a written implementing focused mitigation but is not required to be, an employee justification is prepared for a timeframe strategies and (2) All required training of the establishment’’ (§ 121.3). See that exceeds 90 days after production of must be documented in records. We section IV.C.4 for further discussion of the applicable food first begins.’’ This asked for comment on several questions this definition. Section 121.4(b) requires flexibility in timeframes lessens the related to training, including whether that each individual assigned to an burden on the facility. We believe the we should require that basic food actionable process step (including 90-day timeframe is sufficient for defense awareness training be temporary and seasonal personnel) or in completing the reanalysis but recognize completed by all employees and the supervision thereof must (1) be a that there may be instances where the whether we should require training to qualified individual and (2) receive 90-day timeframe is exceeded and this be repeated periodically. We also training in food defense awareness. is allowed with sufficient written requested comment on the adequacy of Section 121.4(c) requires that each justification. FDA’s Food Defense 101 training individual assigned to (1) the We lessened the documentation materials and whether additional FDA preparation of the food defense plan, (2) burden by only requiring a revision to training materials are needed. Finally, the conduct of a vulnerability the food defense plan ‘‘if a significant we requested comment on the feasibility assessment, (3) the identification and change in the activities conducted at of the proposed training requirements, explanation of the mitigation strategies, your facility creates a reasonable in light of the current state of food or (4) the reanalysis of the food defense potential for a new significant defense awareness in the industry and plan must be a qualified individual and vulnerability or a significant increase in available training resources. have successfully completed training for a previously identified vulnerability.’’ No comments disagree with the need the specific activity at least equivalent The proposed rule required a revision to for training for facilities to be able to to that received under a standardized the food defense plan if ‘‘a significant properly implement this rule, and many curriculum recognized as adequate by change was made.’’ By stating comments acknowledge that training is FDA or be otherwise qualified through specifically that revisions are only crucial to creating an effective food job experience to conduct the activities. required if a change is made in activities defense environment in a facility. Some Job experience may qualify an that affect vulnerabilities, we eliminate comments agree with our proposed individual to perform any of the the revision requirements for changes training approach, and other comments activities listed previously if such that are not directly related to the risk request changes. After considering the experience has provided an individual of intentional adulteration. Both the comments, we have changed the with knowledge at least equivalent to proposed and final rules provide for the training requirements by creating a new that provided through the standardized

VerDate Sep<11>2014 19:43 May 26, 2016 Jkt 238001 PO 00000 Frm 00044 Fmt 4701 Sfmt 4700 E:\FR\FM\27MYR4.SGM 27MYR4 mstockstill on DSK3G9T082PROD with RULES4 Federal Register / Vol. 81, No. 103 / Friday, May 27, 2016 / Rules and Regulations 34209

curriculum. Section 121.4(d) requires believe it is the best use of resources to combination thereof) necessary to that responsibility for ensuring train individuals at actionable process properly perform their assigned compliance by individuals with the steps in food defense awareness because activities and have successfully requirements be clearly assigned to that is where intentional adulteration, completed training at least equivalent to supervisory personnel with adequate when intended to cause wide scale that received under a standardized qualifications to supervise the activities. public health harm, is most likely to curriculum recognized as adequate by Section 121.4(e) requires that the occur. Our food defense guidance FDA or be otherwise qualified through training required by § 121.4(b) and (c) includes options for increasing general job experience to conduct the activities. must be documented in records that awareness of food defense throughout a Job experience may qualify an include the date of the training, the type facility by incorporating the importance individual to perform these functions if of training, and the person trained, and of food defense procedures into routine such experience has provided an must be established and maintained in facility communications, such as individual with knowledge at least accordance with the requirements of brochures, staff meetings, or payroll equivalent to that provided through the subpart D. stuffers. We recommend that facilities standardized curriculum. We believe In the following paragraphs, we encourage all employees to report the activities listed previously require discuss comments that respond to our unusual or suspicious individuals or an additional level of expertise and request for comment regarding the activities to management. training than other activities required proposed training requirement and In addition to requiring food defense under subpart C and, therefore, FDA is comments that request changes to the awareness training for certain establishing a standardized curriculum training requirement as proposed. individuals, the rule requires that each for training which individuals (Comment 97) Some comments assert individual who performs activities performing these activities must that FDA should require facilities to required by subpart C be a qualified successfully complete (or be otherwise conduct food defense awareness individual as that term is defined in qualified through job experience). This training for all employees and not just § 121.3. In addition, the rule requires approach is consistent with the PCHF for employees and supervisors who individuals performing certain final rule, where additional food safety work at actionable process steps. Some activities, including the preparation of training is required for individuals who comments indicate that, since food the food defense plan or the conduct of prepare or oversee preparation of the defense is a new area of regulation, that a vulnerability assessment, to have food safety plan, including conducting training to increase general awareness successfully completed training for the the hazard analysis (21 CFR by all employees would be a useful specific activity at least equivalent to 117.126(a)(2)). requirement in gaining familiarity with that received under a standardized We anticipate that the standardized the risk and mitigation of intentional curriculum recognized as adequate by curriculum for activities other than the adulteration. Some comments state that FDA or be otherwise qualified through conduct of a vulnerability assessment food defense awareness training for all job experience to conduct the activities. will be an approximately 4-hour employees is fundamental for creating a (Comment 98) Some comments training that will cover food defense food defense culture at a facility and express a need for advanced food awareness and food defense planning may be the critical element for defense training requirements for components such as preparing, preventing a successful attack. individuals conducting higher level implementing, and reanalysis of a food Alternatively, some comments state that food defense activities such as food defense plan and selecting and expanding the food defense awareness defense coordinators, individuals who explaining mitigation strategies. We training requirement to all employees prepare, monitor, verify, or conduct plan for the training to be available will not advance food defense and could corrective actions associated with food online. create a generalized approach that may defense plans, managers or quality The training for conducting or diminish the ability of the facility to control personnel or personnel who overseeing a vulnerability assessment effectively train personnel who have would be responsible for identification will require in-depth analysis of the significant roles in implementing food of appropriate mitigation strategies. functional and thought processes defense requirements. Some comments Some comments assert that these food required to properly characterize state that the cost of requiring training defense activities require specialized significant vulnerabilities associated of all employees would be overly knowledge that would not be covered in with a facility’s points, steps, or burdensome. food safety training and that qualified procedures and the identification of (Response 97) Although we agree that individuals should perform these higher actionable process steps. The process of food defense awareness training would level functions. conducting a vulnerability assessment be useful for all employees, we believe (Response 98) We agree with these may be new to much of the industry and that the best use of training resources for comments and are requiring that each the training will take this into industry would be to focus the individual engaged in activities in consideration. The standardized requirement for food defense awareness subpart C must be a qualified individual curriculum for conducting a training on personnel who are assigned with the appropriate education, vulnerability assessment will need to to an actionable process step. We do not training, or experience (or a cover each required component of the believe it is necessary to require that combination thereof) to perform the vulnerability assessment and provide facilities provide all employees with activity. Further, the rule requires enough information for an individual to awareness training to significantly increased qualifications for individuals calibrate their decision making based on minimize or prevent significant responsible for higher level activities, the scientific analysis required by a vulnerabilities. Although we disagree such as preparation of the food defense vulnerability assessment. We believe that training all employees could plan, conducting a vulnerability that the curriculum designed for this diminish the ability of a facility to assessment, identifying and explaining activity will require multiple days and effectively train personnel, we agree that mitigation strategies, and reanalysis may be best offered in person. Based on concentrating awareness training on (§ 121.4(c)). These individuals must the vulnerability assessment method certain individuals is less burdensome have the appropriate education, chosen, the length of the standardized than a general training requirement. We training, or experience (or a curriculum may vary, for example if a

VerDate Sep<11>2014 19:43 May 26, 2016 Jkt 238001 PO 00000 Frm 00045 Fmt 4701 Sfmt 4700 E:\FR\FM\27MYR4.SGM 27MYR4 mstockstill on DSK3G9T082PROD with RULES4 34210 Federal Register / Vol. 81, No. 103 / Friday, May 27, 2016 / Rules and Regulations

facility is using the key activity types individual’’ in terms of an ability to varying based on the difficulty and skill the training could be shorter. perform assigned responsibilities we level of the activity being performed, Finally, with regard to comments that have provided the flexibility for firms to with the vulnerability assessment suggest that individuals who prepare, consider relevant factors in determining training module being the most in-depth monitor, verify, or conduct corrective how often to perform training. and lengthy (See Comment 80 and actions associated with food defense Individuals conducting activities under Comment 81). plans receive specialized training, we subpart C must be qualified to The training for individuals and agree that individuals responsible for successfully implement the food supervisors assigned to actionable these activities should be qualified defense measures contained in the food process steps may require facility- individuals and may need training to defense plan. If the food defense plan specific information for proper perform such activities. However, we changes, because of a production change implementation of the mitigation are not standardizing a curriculum for resulting in a mitigation strategy change, strategy or strategies and, therefore, will such training and realize that for example, employees and supervisors need to be developed and administered individuals may be qualified through may need retraining if their on the job and will not be developed by education or experience to do these responsibilities under subpart C change. FDA. activities because these concepts are not Also, retraining may be needed as a We will continue to provide food completely unique to food defense component of corrective action. For defense training and other materials in planning and analogous food safety example, if during the course of as many formats as resources allow, concepts have been in routine practice monitoring a facility determines that such as online, DVD, and hard copy. in many food facilities for the purpose certain mitigations strategies are not FDA currently has some food defense of food safety plans and/or HACCP being implemented consistently or materials in languages other than approaches. appropriately, a component of the English, but will work as we are able (Comment 99) Some comments state corrective action may be to retrain the towards translating more materials in that food defense awareness training responsible staff and their supervisors. other languages to reach a broader should be recognized as a beneficial To ensure that employees remain audience. mitigation strategy within food defense qualified to perform their duties under In response to the development of a plans to create heightened awareness subpart C, facilities will need to retrain ‘‘train the trainer’’ course to assist and that this training can be used to employees when the food defense plan management with meeting the training address intentional contamination changes and when a problem has been requirements of this rule, we interpret including insider threats. Other identified that training would address. this comment to mean that we should comments state that the only (Comment 101) Some comments offer materials so that companies can requirement for food defense should be commend FDA on the development of a deliver their own food defense training and that any requirements broad range of free training materials awareness training. Since the beyond this approach are not necessary. that will be efficient and useful to meet requirement for awareness training has (Response 99) We agree that food training requirements. Some comments inherent flexibility, facilities can deliver defense awareness training for suggest updating and expanding these their own food defense awareness employees and supervisors assigned to trainings to include options for free, trainings. We believe the training tools actionable process steps would increase downloadable, and customizable and resources that we intend to update, awareness and could assist with materials to reach a broad range of based on the requirements of this rule, recognizing or thwarting an insider cultural and language groups, and to will assist facility management with threat; however, the training alone will include information on how to protect gaining knowledge necessary for not protect the food at that actionable food defense-related documents. One delivering food defense awareness process step. It is the properly comment recommends that FDA update training, and we intend to explore the implemented mitigation strategies, all of its food defense resources to development of a ‘‘train the trainer’’ in which are designed to reduce the reflect the requirements ultimately consultation with the alliance to meet significant vulnerability at that step, included in this final rule. One the needs of the standardized which would protect the food against comment suggests that FDA develop a curriculum requirements. intentional adulteration. ‘‘train-the-trainer’’ course that could be (Comment 102) Some comments (Comment 100) Some comments effectively utilized by industry to equip request that FDA support the recommend that FDA set a requirement management of food companies with the development and distribution of for periodic retraining, and some training materials needed to comply educational and training resources to comments suggest the training with the training requirements. assist very small facilities exempt from requirement should specify training (Response 101) We agree that many of the rule with voluntary compliance. intervals such as during an employee our trainings and other resources will Some comments request that FDA ‘‘onboarding’’ process and periodically assist industry in complying with this clarify how it will work with retail thereafter or when significant changes rule. However, we recognize that many stakeholders to strengthen education are made to the food defense plan. One of our existing materials will need to be and training for retail facilities that want comment did not request a requirement updated to reflect the provisions of the to take voluntary food defense risk for retraining but stated that it should be rule and new training materials will reduction measures. understood that education and training need to be developed. We intend to (Response 102) FDA offers free tools are not a one-time occurrence. One update our training materials to provide and food defense awareness training, as comment asked for flexibility for an option to comply with the food well as guidance, that we intend to training and retraining frequencies so a defense awareness training requirement, update based on the final requirements facility can take into account facility and we will be developing a which should assist non-covered size, environment, seasonality of standardized curriculum for training in entities, such as those at the retail level, employees, and other circumstances. accordance with the requirements of who wish to voluntarily comply with (Response 100) We agree that training § 121.4(c). We anticipate the the final provisions of this rule. should not be a one-time occurrence standardized content of the training will (Comment 103) Some comments and believe that by defining ‘‘qualified be modular, with certain modules support the food defense awareness

VerDate Sep<11>2014 19:43 May 26, 2016 Jkt 238001 PO 00000 Frm 00046 Fmt 4701 Sfmt 4700 E:\FR\FM\27MYR4.SGM 27MYR4 mstockstill on DSK3G9T082PROD with RULES4 Federal Register / Vol. 81, No. 103 / Friday, May 27, 2016 / Rules and Regulations 34211

training requirement but ask that FDA general, FDA is still in the process of deploy an effective implementation keep the requirement flexible and make assessing its training needs for plan. clear that online training or other non- inspection and enforcement of this rule. (Response 108) It is unclear what is FDA developed trainings are acceptable. (Comment 105) Some comments state meant by training and compliance One comment asked us to state whether that Alliances have been successfully incentives, but we have established the ‘‘Food Defense 101’’ training used to support implementation of other extended compliance dates to allow released in 2013 by FDA is the preferred national requirements, including other facilities the time necessary to comply resource for employee awareness FSMA rules, using a partnership model. with this training requirement. See training. Some comments state that it These comments recommend that FDA section VIII for information on might not be possible to provide the consider formation of an Alliance compliance dates. same type of training to all staff at structure for the area of food defense as (Comment 109) One comment various levels, and that it should be up well. Comments state that Alliances, suggests that FDA should mandate to the facility to determine which made up of State and local public health training on a ‘‘code of ethics’’ to prevent training to provide to which staff, based professionals, State and local public economically motivated adulteration. on their food defense responsibilities. health associations, and industry can (Response 109) Acts of intentional (Response 103) We agree with the play an important role in information adulteration for the purpose of need to avoid rigid requirements with sharing and outreach and a formal economic gain, i.e., economically respect to training content for food Alliance for food defense is the best way motivated adulteration, are outside the defense awareness. We recognize that to accomplish the development of scope of the rule and are addressed in many food defense awareness trainings standardized food defense training the preventive controls for human food exist and may already be utilized at content and effective training tools and rule (80 FR 55907 at 56028–56029) and facilities, and mandating specific resources. the preventive controls for animal food content in trainings may lead to (Response 105) We agree with these final rule (80 FR 56170 at 56244–56246). redundancy and additional cost. We comments and have funded the intend to update our ‘‘Food Defense establishment of an Intentional VI. Subpart D: Comments on 101, Food Defense Awareness for the Adulteration Subcommittee under the Requirements Applying to Records Front-line Employee’’ training such that existing Food Safety Preventive Controls That Must Be Established and it would satisfy the requirement for food Alliance. We intend to leverage the Maintained defense awareness training; however, it expertise of State and local public We proposed to establish in subpart D is not the only acceptable training. In health professionals, State and local requirements that would apply to all addition, we believe that there are public health associations, and industry records that would be required by the several existing trainings that would be associations to develop the standardized various provisions of proposed part 121, acceptable for other activities that may curriculum needed to meet the training including general requirements related require training such as food defense requirement. to the content and form of records, monitoring, food defense corrective (Comment 106) Some comments additional requirements specific to the actions, and food defense verification. suggest that FDA establish a technical food defense plan, requirements for (Comment 104) Some comments assistance office based out of the Center record retention, requirements for recommend that, because food defense for Food Safety and Applied Nutrition official review of records by FDA, and is a new and evolving area, and because (CFSAN) that can answer queries, public disclosure. this regulation will be the first of its provide guidance, and release Some comments generally support kind worldwide, training and education information consistently to both requiring records to demonstrate that a need to occur at many levels to regulators and the covered industry to food defense plan has been created, is effectively implement this rule. These assist with educating industry and functioning, and is being monitored. comments state that FDA must provide regulators. However, many comments disagreed significant outreach and education to (Response 106) FDA has established a with some of the specific requirements both industry and State regulatory FSMA Technical Assistance Network that we proposed. In the following Agencies with jurisdiction over the (TAN) to provide technical assistance to paragraphs, we discuss comments that production of human food. These industry, regulators, academia, ask us to clarify the proposed comments emphasize that FDA and consumers, and others regarding FSMA requirements, disagree with, or suggest State and local inspection personnel implementation. Inquiries are answered one or more changes to the proposed will need significant training in by FDA Information Specialists or requirements. conducting food defense inspections Subject Matter Experts, based on the and that training developed for FDA complexity of the question. To find out A. Proposed § 121.301—Records Subject investigators should be extended to more about the FSMA TAN please visit to the Requirements of This Subpart D State and local governments as well as http://www.fda.gov/food/guidance We proposed that all records required industry to help food facilities regulation/fsma/ucm459719.htm. by proposed subpart C (Food Defense understand what is expected and how (Comment 107) Some comments Measures) are subject to all compliance will be determined. request funding from FDA for the requirements of this subpart except that (Response 104) We appreciate these training of State, local, tribal, and the requirements of § 121.310 apply comments regarding consistency of territorial regulators. only to the written food defense plan. training between industry and Federal, (Response 107) Funding associated We received no comments on this State, local and tribal regulators, and we with training State, local, tribal, and section and are finalizing as proposed. agree that this is a novel area of territorial regulators is outside the scope regulation that could benefit from of this rule. B. Proposed § 121.305—General alignment of training between the (Comment 108) One comment asserts Requirements Applying to Records regulated industry and its regulators. that training and compliance incentives We proposed that the records must (1) We have addressed the issue of training must be available at the same time the be kept as original records, true copies, for the purposes of inspection and final regulation is released to give or electronic records (and that electronic compliance in section III.D, but in facilities time to learn about, build, and records must be kept in accordance with

VerDate Sep<11>2014 19:43 May 26, 2016 Jkt 238001 PO 00000 Frm 00047 Fmt 4701 Sfmt 4700 E:\FR\FM\27MYR4.SGM 27MYR4 mstockstill on DSK3G9T082PROD with RULES4 34212 Federal Register / Vol. 81, No. 103 / Friday, May 27, 2016 / Rules and Regulations

part 11 (21 CFR part 11)); (2) contain the approving. The comment requests that (Comment 113) Some comments actual values and observations obtained we provide for the creation of records express concern that we will require during monitoring; (3) be accurate, ‘‘in a timely manner following records to be kept in English. These indelible, and legible; (4) be created performance of the activity,’’ rather than comments ask us to limit the documents concurrently with performance of the ‘‘concurrently with performance of the that must be written in English to activity documented; (5) be as detailed activity.’’ reduce translation and records as necessary to provide history of work (Response 111) We decline this duplication. These comments ask that performed; and (6) include the name request. The comment did not provide records related to verification and and location of the plant or facility, the any specific examples of activities monitoring should be allowed to be date and time of the activity where concurrent record creation would written in languages other than English. documented, the signature or initials of prove difficult, and we are not aware of (Response 113) The rule does not the person performing the activity, and, any such circumstance. For example, we require that any records be kept in where appropriate, the identity of the are not aware of any difficulty English. product and the production code, if any. complying with longstanding similar (Comment 114) One comment seeks In the following paragraphs, we discuss requirements associated with our clarification on whether the use of comments that ask us to clarify the HACCP regulations for seafood and checklist-type forms to document proposed requirements or that disagree juice (see §§ 123.9(a)(4) and monitoring observations would satisfy with, or suggest one or more changes to, 120.12(b)(4), respectively). the requirement in § 121.305(b) that records contain actual values and the proposed requirements. (Comment 112) Some comments observations obtained during (Comment 110) Several comments assert that for certain production and monitoring. The comment argues that express concern over the proposed associated activities documenting the properly developed checklists will requirement that all electronic records time of activity is not necessary. allow monitoring records to be accurate, be kept in accordance with part 11 and Specific examples cited include indelible, and legible as required in request that FDA exempt electronic equipment setup, verification of § 121.305(c) and will lessen the records under part 121 from compliance equipment setup, charging an ingredient with part 11. Comments argue that recordkeeping burden. For example, into a blender, and weighing material while some of the larger companies may monitoring a mitigation strategy such as for process yield and reconciliation have the technologies in place to adequate lighting at the truck unloading purposes. These comments ask us to comply with part 11, many of the bay could be recorded as a ‘‘yes’’ or modify the proposed requirements so covered facilities do not. These ‘‘no’’ by checking the appropriate box that the records would only be required comments assert that compliance with on a checklist. to include the time of the activity where part 11 would create the need to (Response 114) Although monitoring appropriate for food defense. redesign and recreate existing systems, records must contain the actual values thus leading to considerable cost, which (Response 112) The recordkeeping and observations obtained during was not taken into account in the cost requirements in the rule only apply to monitoring, facilities have flexibility to analysis in the preliminary regulatory records required by subpart C (Food tailor the amount of detail to the nature analysis for the proposed rule. The defense measures). It is not clear that all of the record (§ 121.305(e)). Monitoring comments go on to point out that we do of the activities specified by the for adequate lighting at the truck not impose these requirements for comments relate to food defense unloading bay could be recorded as recordkeeping requirements imposed measures and therefore are subject to ‘‘yes’’ or ‘‘no’’ in either a narrative or under section 414 of the FD&C Act, and the recordkeeping requirements in the checklist format. However, in the case of that this requirement is an added rule. For records that are required, we an improperly implemented mitigation burden and expense that does not have agree that documenting the time of the strategy, we would recommend that the any added benefit to public health. activity is not always necessary. The facility also document the extent to (Response 110) The final rule does not rule requires that records must contain which the strategy was incorrectly require compliance with part 11 ‘‘when appropriate, the time of the applied, because this information would (§ 121.305 (a)). Similar to the PCHF final activity documented’’ (§ 121.305(f)(2)). support the identification of previously rule, we are making a conforming Monitoring records are an example of written corrective actions that could be change in part 11 to specify in new when documenting the time of the used to remedy the situation, as well as § 11.1(o) that part 11 does not apply to activity is appropriate because provide context as to why the mitigation records required to be established or monitoring records are used to strategy failed in this instance, which maintained under part 121, and that determine if a particular mitigation would be beneficial information for records that satisfy the requirements of strategy is properly implemented. verification activities. For example, if part 121, but that also are required Without documenting the time the lighting in the bulk unloading bay was under other applicable statutory monitoring was conducted, a facility insufficient, the monitoring document provisions or regulations, remain cannot identify patterns over time as to may record this instance as ‘‘no’’ in a subject to part 11. Although we are not the mitigation strategy’s implementation checklist and also may note that half of specifying that part 11 applies, facilities and whether appropriate corrective the lights were inoperative due to a should take appropriate measures to actions were being made. For circuit-breaker that failed. This ensure that records are trustworthy, mitigations strategies that are not time- information would be helpful to facility reliable, and generally equivalent to dependent (e.g., permanent equipment management to determine whether the paper records and handwritten changes to reduce access to the product, mitigation strategy is consistently signatures executed on paper. such as permanently affixing a shield to applied and appropriate to the (Comment 111) One comment asserts the rotating air drying to prevent access actionable process step in question. In that while it is common for certain to the food at the point where product this case, a faulty circuit breaker would records to be created concurrently with is introduced into the dryer from the be replaced, thereby correcting the performance of the activity, some pneumatic conveyance), facilities are deviation in the mitigation strategy. The records may require more time for not required to document the time the mitigation strategy could still be writing, reviewing, editing, or activity was performed. determined to be achieving its aim with

VerDate Sep<11>2014 19:43 May 26, 2016 Jkt 238001 PO 00000 Frm 00048 Fmt 4701 Sfmt 4700 E:\FR\FM\27MYR4.SGM 27MYR4 mstockstill on DSK3G9T082PROD with RULES4 Federal Register / Vol. 81, No. 103 / Friday, May 27, 2016 / Rules and Regulations 34213

this corrective action. Alternatively, if retention requirements for the purpose provided onsite within 24 hours would monitoring records document that the of tracking potentially contaminated be sufficient. lighting was turned off by an employee, food than to record retention (Response 117) We have revised the a different corrective action may be requirements for the purpose of provisions to provide for offsite storage required, such as retraining of the evaluating compliance with this rule. of all records (except the food defense employee on the importance of Finally, 2 years is the same retention plan), provided that the records can be maintaining adequate lighting in the period as required by the PCHF final retrieved and made available to us area. We note in Response 83 that rule. within 24 hours of a request for official ensuring adequate lighting around an (Comment 116) Some comments ask review. We expect that many records actionable process step would generally us to exercise flexibility regarding the 2- will be electronic records that are be a mitigation strategy that must be year record retention requirement accessible from an onsite location and, used in concert with other strategies to because the unique nature of food thus, would be classified as being onsite significantly reduce the likelihood of, or defense activities and the technologies (see § 121.315(c)). As a companion prevent, successful acts of intentional used in protecting the food supply change, we have revised the proposed adulteration at an actionable process against intentional adulteration do not provision directed to the special step. typically allow for record retention for circumstance of storing records when a such a long period of time. For example, facility is closed for prolonged periods C. Proposed § 121.310—Additional several comments explain that records of time so that it only relates to the Requirements Applying to the Food related to video surveillance cannot be offsite storage of the food defense plan Defense Plan kept for 2 years because it is in such circumstances (see We proposed that the food defense impractical; industry practice is § 121.315(d)). Further, we require plan must be signed and dated by the typically to keep video records for 30 records that a facility relies on during owner, operator, or agent in charge of days or less. Comments argue that the 3-year period preceding the the facility upon initial completion and requiring 2-year retention of video applicable calendar year to support its upon any modification. We did not records would be very difficult and status as exempt as a very small receive any comments related to this costly, and that FDA likely did not business must be retained at the facility section, and we are finalizing as include calculations for those added as long as necessary to support the proposed. costs in our preliminary regulatory status of a facility as a very small D. Proposed § 121.315—Requirements impact analysis for the proposed rule. business during the applicable calendar (Response 116) The assertion that it is for Record Retention year (see § 121.315(a)(2)). impractical for food defense records (Comment 118) One comment states We proposed that (1) All required cannot be kept for 2 years seems to that records and documentation should records must be retained at the facility reflect a misunderstanding of the rule. not increase costs for farm-based for at least 2 years after the date they The rule does not require maintaining operations, most of whom operate as were prepared; (2) The food defense video surveillance footage for 2 years. small businesses. They argue that these plan must be retained at the facility for Video surveillance used as part of a businesses already maintain a variety of at least 2 years after its use is mitigation strategy is not a monitoring records but some do not have the discontinued; (3) Except for the food record. If the video is being sent to a technical or financial resources defense plan, offsite storage of records is security office for observation, the available to maintain an electronic permitted after 6 months following the monitoring record could be a log system for records. The comment date that the records were made if such affirming that a security officer requests that FDA accept records in records can be retrieved and provided reviewed the video and detected no formats that are not electronic. onsite within 24 hours of request for abnormal activities. If the video is being (Response 118) To clarify, we did not official review; and (4) If the facility is watched by a security officer in real propose to require that any records must closed for a prolonged period, the time, the monitoring record could be the be kept in electronic format. In addition, records may be transferred to some timesheets of the security officer this rule does not apply to farms. other reasonably accessible location but showing he was in the security office must be returned to the plant or facility performing his duties in observing the E. Proposed § 121.320—Requirements within 24 hours for official review upon video feed. for Official Review request. (Comment 117) Some comments ask We proposed that all records required (Comment 115) One comment asserts us to specify our expectations for record by this part must be made promptly that a 2-year retention period for availability and allow companies the available to a duly authorized monitoring, corrective actions, and flexibility in using technology to meet representative of the Secretary of Health verification records for a product with a those expectations. The comments and Human Services upon oral or short shelf life is unnecessary. The explain that many companies keep written request. In the following comment argues that industry has been important records such as food defense paragraphs, we discuss comments that following record retention requirements plans at their corporate headquarters or ask us to clarify the proposed in the Seafood HACCP regulation which other central locations and not at requirements or that disagree with, or requires 1 year records retention for individual facilities but that the suggest one or more changes to, the refrigerated products and 2 years facilities can easily access those records proposed requirements. records retention for frozen, preserved, electronically if needed. The comments (Comment 119) Some comments or shelf-stable products and requests also assert that 6-month onsite record assert that FDA investigators should that we use the same requirements in retention requirement is arbitrary and only review food defense plans on site this rule. that FDA should establish a workable and that we should not copy, (Response 115) We decline this requirement that provides for the photograph, transmit, or take possession request. The 2-year record retention efficient storage and retrieval of records of food defense plans. These comments period is explicitly provided for by in a timely manner. Some comments ask assert that onsite review of records section 418(g) of the FD&C Act. Further, us to revise the requirement so that allows facility staff that is familiar with shelf life is more relevant to record records that can be retrieved and the documents and recordkeeping

VerDate Sep<11>2014 19:43 May 26, 2016 Jkt 238001 PO 00000 Frm 00049 Fmt 4701 Sfmt 4700 E:\FR\FM\27MYR4.SGM 27MYR4 mstockstill on DSK3G9T082PROD with RULES4 34214 Federal Register / Vol. 81, No. 103 / Friday, May 27, 2016 / Rules and Regulations

practices to answer any questions or protecting food defense records from authority to copy food defense plans or provide clarification to the investigator. disclosure. records. Some comments state that we should (Comment 121) One comment asserts (Response 122) As we described in make it clear that any State investigators that section 106 of FSMA does not give the seafood HACCP rule (60 FR 65096 must follow the same policy and not FDA express access to review food at 65101, December 18, 1995), to copy, photograph, transmit, or take defense plans and that FSMA indicates effectuate the broad purposes of the possession of food defense plans. Other a Congressional intent to limit the FD&C Act, there may be some comments assert that we should only distribution of certain materials related circumstances in which access to the take possession of food defense plans to food defense. records would be meaningless without for compliance reasons or in the event (Response 121) The provisions in the opportunity to copy them, and of an emergency or a credible threat. section 106 of FSMA concerning limited therefore copying records is necessary (Response 119) Some of the issues distribution relate to the ability of the for the efficient enforcement of the raised by these comments are similar to Secretary of HHS (and by delegation, FD&C Act. For further discussion of issues raised by comments on the PCHF FDA) to limit the distribution of certain copying records, see response to rule (see the discussion at 80 FR 55908 information already in the Agency’s Comment 121. at 56091) and seafood HACCP rule (see possession. Specifically, section F. Proposed § 121.325—Public the discussion at 60 FR 65096 at 65137– 420(a)(2) of the FD&C Act authorizes Disclosure 65140, December 18, 1995). During an FDA to determine the time, manner, and We proposed that records required by inspection, we expect that FDA form in which a vulnerability this part will be protected from public investigators will determine whether to assessment is made publically available. disclosure to the extent allowable under copy records on a case-by-case basis as Further, section 420(b)(3) provides for part 20 of this chapter. We received necessary and appropriate. It may be FDA to determine the time, manner, and numerous comments expressing necessary to copy records when, for form in which certain guidance example, our investigators need concern with protecting food defense documents are made public. The plans and records from public assistance in reviewing a certain record provisions do not limit FDA’s authority from relevant experts in headquarters. If disclosure, especially due to the to access information in a facility’s sensitive nature of the content within a we are unable to copy records, we possession, such as a food defense plan. would have to rely solely on our food defense plan. One comment fully Further, the ability of FDA to review investigators’ notes and reports when supports our proposal and believes food defense plans is necessary for the drawing conclusions. In addition, there is sufficient precedent and need to efficient enforcement of the FD&C Act. copying records will facilitate follow-up protect the sensitive documents from The rule requires a food defense plan regulatory actions. The public public disclosure. In the following consisting of a written vulnerability availability of any records that FDA paragraphs, we discuss comments that assessment, mitigation strategies, and would possess as a result of copying ask us to clarify the proposed procedures for food defense monitoring, during an inspection would be governed requirements or that disagree with, or corrective actions, and verification. by section 301(j) of the FD&C Act and suggest one or more changes to, the Access to food defense plans is by the Freedom of Information Act proposed requirements. (FOIA) and regulations issued pursuant necessary for FDA to assess the (Comment 123) Some comments to it by the Department of Health and adequacy of each of these documents assert that food defense plans include Human Services (DHHS) and FDA. and determine compliance with the information that is commercial Section 301(j) of the FD&C Act expressly rule. For example, to assess compliance confidential or trade secret and, prohibits FDA from disclosing trade with § 121.130(a), FDA must review a therefore, should be exempt from secret information obtained during the facility’s vulnerability assessment to disclosure under FOIA. The comments course of an inspection. FDA’s determine whether it includes an argue that food defense plans may disclosure regulations also provide that evaluation of the potential public health include information on a facility’s food FDA will not divulge either trade secret impact if a contaminant were added, the defense-related measures and that or confidential commercial information. degree of physical access to the product, disclosure of one facility’s food defense See section VI.F. for a further discussion and the ability of an attacker to plan may adversely affect other facilities of protecting food defense records from successfully contaminated the product. and companies that may process similar disclosure. In addition to section 420 (added to foods or have similar processing (Comment 120) Some comments the FD&C Act by section 106 of FSMA), procedures. assert that FDA investigators should not FDA is issuing this rule under the (Response 123) FDA protects records include details of food defense plans in authority of section 418 of the FD&C from disclosure under Exemption 4 of the Establishment Inspection Reports Act. Section 418 explicitly provides FOIA to the extent they contain ‘‘trade (EIR) Form 483 and that food defense authority for FDA access to certain secrets’’ or ‘‘commercial or financial information should be kept separate documents. Under section 418, the information obtained from a person and from food safety information on FDA required ‘‘written plan, together with privileged or confidential.’’ The reports. The comments argue that if the documentation of [monitoring, questions raised in these comments are investigators include food defense- instances of nonconformance, the similar to some of the questions raised related noncompliance on an official results of testing and other appropriate during the rulemaking to establish our report, that report could become public means of verification, instances where HACCP regulation for seafood (see the and could increase the risk to public corrective actions were implemented, discussion at 60 FR 65096 at 65137– health by disclosing weak points in a and the efficacy of preventive controls 65140). Our experience in conducting facility’s food defense plan. and corrective actions] shall be made CGMP inspections in processing plants, (Response 120) As we do now, FDA promptly available to [FDA] upon oral our experience with enforcing our would redact any protected information or written request.’’ HACCP regulations for seafood and in an EIR or other document before (Comment 122) One comment asserts juice, and our understanding from the publically releasing the document. See that neither section 103 nor 106 of Regulatory Impact Analysis for this rule section VI.F for further discussion of FSMA expressly provide FDA with the make it clear that food defense plans

VerDate Sep<11>2014 19:43 May 26, 2016 Jkt 238001 PO 00000 Frm 00050 Fmt 4701 Sfmt 4700 E:\FR\FM\27MYR4.SGM 27MYR4 mstockstill on DSK3G9T082PROD with RULES4 Federal Register / Vol. 81, No. 103 / Friday, May 27, 2016 / Rules and Regulations 34215

will take each facility time and money and to help plan and execute an attack disclosure are not aligned with the to develop. involving intentional adulteration. public disclosure provisions of our There is value in a plan to a company (Comment 125) Some comments state HACCP regulations for seafood and that produces it for no other reason than that food defense plans could be juice. Our regulations in part 20 that it took work to write. The equity in classified under Executive Order 13526 regarding public information apply to such a product is not readily given away because their unauthorized disclosure all Agency records, regardless of to competitors. We expect that plant could reasonably be expected to cause whether a particular recordkeeping configurations will be unique to identifiable or describable damage to requirement says so. In the public individual processors, or at least have national security and because food disclosure provisions for our HACCP unique features, as was the case in the defense plans pertain to ‘‘vulnerabilities regulations for seafood and juice, we seafood industry (Ref. 16). While or capabilities of systems, installations, provided specific details about how generic plans will have great utility in infrastructures, projects, plans, or particular provisions in part 20 (i.e., many circumstances, they will serve protection services relating to national § 20.61 (Trade secrets and commercial primarily as starting points for facilities security.’’ These comments or financial information which is to develop their own plans. Facilities acknowledge that classifying food privileged or confidential) and § 20.81 will still need to expend time and defense plans would be cumbersome (Data and information previously money to tailor a generic food defense and access to the classified documents disclosed to the public)) would apply to plan to their individual circumstances. would be extremely restricted and the applicable records, because we Thus, we conclude that food defense therefore, they recommend that FDA recognized that such details were of plans generally will meet the definition implement a policy that FDA particular interest to the regulated of trade secret, including the court’s investigators not copy, photograph, or industries and such recordkeeping definition in Public Citizen Health transmit any food defense plan records requirements were relatively new. In Research Group v. FDA, 704 F.2d 1280 or make detailed notes about the food this rule, we framed the provisions (D.C. Cir. 1983). defense plans in the Establishment regarding public disclosure more (Comment 124) Some comments ask Inspection Reports that could reveal broadly by referring to all the us to provide assurances that food sensitive information. requirements of part 20, consistent with defense plans and related records will (Response 125) See response to our more recent approach to public not be made public and assert that Comment 124 for a discussion of FDA disclosure provisions in regulations (see protecting these documents from handling of food defense plans. We note e.g., 21 CFR 112.167, 117.325). disclosure to the extent allowable under that FDA cannot classify food defense (Comment 128) Some comments part 20 may not be sufficient. They plans under Executive Order 13526. assert that FDA should develop argue that food defense plans are more That executive order provides that guidance and training for industry on sensitive than food safety plans because information may be originally classified how to protect food defense-related food defense plans contain specifics on only if several conditions are met, documents because industry is a facility’s vulnerabilities and how they including that the information is owned developing these documents to meet an protect those vulnerabilities, and as by, produced by or for, or is under the FDA requirement and has a potential to such, could provide a ‘‘road map’’ for control of the U.S. Government. A food increase the risk to public health. individuals intending to cause harm. defense plan that is developed by (Response 128) Our implementation These comments state that FDA should industry for use by industry is not of this rule will involve a broad, be more protective of food defense plans owned by, produced by or for, or under collaborative effort to foster awareness and argue that due to the sensitivity of the control of, the U.S. Government. and compliance through guidance, information contained in food defense (Comment 126) One comment education, and technical assistance. We plans, it is too risky to rely on FOIA suggests that FDA only allow agree that protection of food defense exemptions alone. investigators who have the appropriate plans—by FDA and by industry—is (Response 124) We agree that food national security credentials (e.g., important; we plan on including defense plans contains information that background checks, security clearances) information within guidance for presents sensitivities not likely to be to review the content of a food defense industry on best practices for how to present in food safety plans. Exemption plan. The comment asserts that this will protect food defense plans. 7(F) of FOIA allows Agencies to help prevent the risk of a sophisticated withhold ‘‘records or information G. Proposed § 121.330—Use of Existing insider attack by a potential wrongdoer Records compiled for law enforcement purposes who has infiltrated the Agency. . . . to the extent that production of (Response 126) All FDA investigators We are adding new section § 121.330 such law enforcement records or and contracted State investigators are (Use of Existing Records) to the final information . . . could reasonably be required to undergo background checks rule to increase recordkeeping expected to endanger the life or physical by the Federal government prior to flexibility. Section 121.330 specifies safety of any individual.’’ Food defense employment and periodically thereafter. that existing records (e.g., records that plans are likely to meet the criteria to Food defense plans are not classified, are kept to comply with other Federal, withhold them from disclosure under and therefore FDA investigators would State, or local regulations) do not need exemption 7(F). Food defense plans in not need national security clearances. to be duplicated if they contain all of FDA’s possession would be compiled (Comment 127) Some comments state the required information and satisfy the for law enforcement purposes because that FDA should, at a minimum, be requirements of subpart D. Section they would be collected as part of aligned with and apply the same 121.330 also provides that existing compliance efforts. Further, production protection for food defense plans and records may be supplemented as of such records could reasonably be records required under this part as necessary to include all of the required expected to endanger life or physical HACCP seafood and juice regulations information. Further, § 121.330 clarifies safety. Specifically, a food defense plan (see §§ 123.9(d) and 120.12(f), that the information required does not is likely to contain information that respectively). need to be kept in one set of records; if could be used to identify weaknesses in (Response 127) We disagree that the existing records contain some of the a facility’s security, to choose targets, proposed provisions governing public required information, any new

VerDate Sep<11>2014 19:43 May 26, 2016 Jkt 238001 PO 00000 Frm 00051 Fmt 4701 Sfmt 4700 E:\FR\FM\27MYR4.SGM 27MYR4 mstockstill on DSK3G9T082PROD with RULES4 34216 Federal Register / Vol. 81, No. 103 / Friday, May 27, 2016 / Rules and Regulations

information required may be kept either have 3 years after the effective date to The Small Business Regulatory separately or combined with the comply with part 121. Small businesses Enforcement Fairness Act of 1996 (Pub. existing records. (i.e., those employing fewer than 500 L. 104–121) defines a major rule for the full-time equivalent employees) have 4 purpose of congressional review as VII. Subpart E: Comments on years after the effective date to comply having caused or being likely to cause Compliance—Proposed § 121.401 with part 121. Very small businesses one or more of the following: An annual 1. Proposed § 121.401(a)—Failure To (i.e., businesses that have less than effect on the economy of $100 million Comply With Section 418 of the FD&C $10,000,000, adjusted for inflation, per or more; a major increase in costs or Act year, during the 3-year period preceding prices; significant adverse effects on competition, employment, productivity, We proposed that the operation of a the applicable calendar year in both or innovation; or significant adverse facility that manufactures, processes, sales of human food plus the market effects on the ability of U.S.-based packs, or holds food for sale in the value of human food manufactured, enterprises to compete with foreign- United States if the owner, operator, or processed, packed, or held without sale) based enterprises in domestic or export agent in charge of such facility is have 5 years after the effective date to comply with § 121.5(a). markets. In accordance with the Small required to comply with, and is not in Business Regulatory Enforcement compliance with, section 418 of the IX. Executive Order 13175 Fairness Act, the Office of Management FD&C Act or subparts C or D of this part and Budget (OMB) has determined that is a prohibited act under section 301(uu) In accordance with Executive Order 13175, FDA has consulted with tribal this rule is a major rule for the purpose of the FD&C Act. of Congressional review. We did not receive any comments on government officials. A Tribal Summary Impact Statement has been prepared The Unfunded Mandates Reform Act this provision, and we are finalizing as of 1995 (section 202(a)) requires us to proposed. that includes a summary of Tribal officials’ concerns and how FDA has prepare a written statement, which 2. Proposed § 121.401(b)—Failure To addressed them (Ref. 17). Persons with includes an assessment of anticipated Comply With Section 420 of the FD&C access to the Internet may obtain the costs and benefits, before proposing Act Tribal Summary Impact Statement at ‘‘any rule that includes any Federal http://www.fda.gov/Food/Guidance mandate that may result in the We proposed that the failure to expenditure by State, local, and tribal comply with section 420 of the FD&C Regulation/FSMA/ucm378628 or at http://www.regulations.gov. Copies of governments, in the aggregate, or by the Act or subparts C or D of this part is a private sector, of $100,000,000 or more prohibited act under section 301(ww) of the Tribal Summary Impact Statement also may be obtained by contacting the (adjusted annually for inflation) in any the FD&C Act. one year.’’ The current threshold after person listed under FOR FURTHER We did not receive any comments on adjustment for inflation is $144 million, INFORMATION CONTACT. this provision, and we are finalizing as using the most current (2014) Implicit proposed. X. Final Regulatory Impact Analysis Price Deflator for the Gross Domestic Product. This final rule may result in a VIII. Effective and Compliance Dates We have examined the impacts of the 1-year expenditure that would meet or final rule under Executive Order 12866, We proposed the effective date would exceed this amount. be 60 days after this final rule is Executive Order 13563, the Regulatory published. However, we proposed for a Flexibility Act (5 U.S.C. 601–612), and XI. Paperwork Reduction Act of 1995 longer timeline for facilities to come the Unfunded Mandates Reform Act of This rule contains information into compliance. As proposed, facilities, 1995 (Pub. L. 104–4). Executive Orders collection requirements that are subject other than small and very small 12866 and 13563 direct Agencies to to review by the OMB under the businesses, would have 1 year after the assess all costs and benefits of available Paperwork Reduction Act of 1995 (PRA) effective date to comply with part 121. regulatory alternatives and, when (44 U.S.C. 3501–3521). A description of Small businesses (i.e., those employing regulation is necessary, to select these provisions is given in this section fewer than 500 persons) would have 2 regulatory approaches that maximize with an estimate of the annual reporting years after the effective date to comply net benefits (including potential and recordkeeping burden; there is no with part 121. Very small businesses economic, environmental, public health third-party disclosure burden associated (i.e., businesses that have less than and safety, and other advantages; with the information collection. $10,000,000 in total annual sales of distributive impacts; and equity). We Included in the estimate is the time for food, adjusted for inflation) would have have developed a comprehensive reviewing instructions, searching 3 years after the effective date to comply Economic Analysis of Impacts that existing data sources, gathering and with § 121.5(a). assesses the impacts of the final rule. maintaining the data needed, and Some comments express concern that We believe that this final rule is a completing and reviewing each facilities will not have the time or significant regulatory action under collection of information. resources to implement requirements for Executive Order 12866. Title: Mitigation Strategies to Protect the intentional adulteration rule at the The Regulatory Flexibility Act Food Against Intentional Adulteration same time they must comply with other requires us to analyze regulatory options Description: The Food and Drug FSMA rules. Some comments also state that would minimize any significant Administration (FDA or we) is requiring that more time is necessary to comply impact of a rule on small entities. The domestic and foreign food facilities that with this rule because food defense is annualized costs per entity due to this are required to register under the different from current requirements for rule are about $13,000 for a one-facility Federal Food, Drug, and Cosmetic Act to food safety. These comments request firm with 100 employees, and there are address hazards that may be introduced additional time for compliance. about 4,100 small businesses that would with the intention to cause wide scale We agree with the comments and are be affected by the rule, so we tentatively public health harm. These food facilities providing more time for facilities to conclude that the final rule could have are required to identify and implement come into compliance. Facilities, other a significant economic impact on a mitigation strategies that significantly than small and very small businesses, substantial number of small entities. minimize or prevent significant

VerDate Sep<11>2014 19:43 May 26, 2016 Jkt 238001 PO 00000 Frm 00052 Fmt 4701 Sfmt 4700 E:\FR\FM\27MYR4.SGM 27MYR4 mstockstill on DSK3G9T082PROD with RULES4 Federal Register / Vol. 81, No. 103 / Friday, May 27, 2016 / Rules and Regulations 34217

vulnerabilities identified at actionable show documentation of their exemption very small business’’ is required to process steps in a food operation. FDA status under the rule, upon request. provide for official review, upon is promulgating these requirements as In the Federal Register of December request, documentation that was relied part of our implementation of the FDA 24, 2013, FDA published a proposed upon to demonstrate that the facility Food Safety Modernization Act (FSMA). rule including a PRA analysis of the meets this exemption. At this time we We expect the rule to help protect food information collection provisions found estimate there are 18,080 firms with less from acts of intentional adulteration in the regulations. While FDA did not than $10 million in annual sales, intended to cause wide scale public receive specific comments in response exempting them from the rule. However, to the four information collection topics health harm. these facilities must show solicited, comments in response to the documentation upon request to verify Description of Respondents: rule are addressed elsewhere in this their exempt status under the Respondents to the collection are food document. Comments filed in response production facilities with more than $10 to the rulemaking are filed under Docket regulations (§ 121.5(a)). We estimate million in annual sales. We estimate No. FDA–2013–N–1425. preparing and updating relevant files there are 9,759 such facilities owned by We estimate the burden for this will require an average of 30 minutes 3,247 firms. We estimate there are information collection as follows: per respondent for a total annual burden 18,080 facilities with less than $10 Reporting: The rule does not apply to of 9,040 hours (30 minutes × 18,080), as million in annual sales that will need to very small businesses, except that ‘‘a reflected in table 4.

TABLE 4—ESTIMATED ANNUAL REPORTING BURDEN 1

Number of 21 CFR Section; activity Number of responses per Total annual Average burden per Total hours respondents respondent responses response

§ 121.5; Exemption for food from very small businesses 18,080 1 1 0.50 (30 minutes) 9,040 1 There are no capital costs, or operating and maintenance costs associated with this collection.

Recordkeeping: Under the rule, the defense monitoring; written procedures 409,486 annual responses. This is a owner, operator, or agent in charge of a for food defense corrective actions; and revision from our previous estimate, facility must prepare, or have prepared, written procedures for food defense reflecting a slight decrease in burden and implement a written food defense verification. Table 5 shows the hours as a result of finalizing regulatory plan, including a written vulnerability estimated recordkeeping burden requirements from the proposed rule assessment; written mitigation associated with these activities, totaling and revising the number of estimated strategies; written procedures for 2,515,258 annual burden hours and respondents.

TABLE 5—ESTIMATED ANNUAL RECORDKEEPING BURDEN 1

Number of Average 21 CFR Section; activity Number of records per Total annual burden per Total hours recordkeepers recordkeeper records recordkeeping

Food Defense Plan; § 121.126 ...... 3,247 1 3,247 23 hrs ...... 74,681 Vulnerability Assessment; § 121.130 ...... 9,759 1 9,759 20 hrs ...... 195,180 Mitigation Strategies; § 121.135(b) ...... 9,759 1 9,759 20 hrs ...... 195,180 Monitoring, Corrective Actions, Verification; 9,759 1 9,759 175 hrs...... 1,707,825 § 121.140(a), § 121.145(a)(1), § 121.150(b). Training; § 121.4 ...... 367,203 1 367,203 0.67 hrs. (40 minutes) 244,802 Records; § 121.305, § 121.310 ...... 9,759 1 9,759 10 hrs ...... 97,590

Total ...... 409,486 ...... 2,515,258 1 Costs of compliance are discussed in the Final Regulatory Impact Analysis to this final rule.

We estimate 3,247 firms will need to manager will need 20 hours for this minimized or prevented, ensuring that create a food defense plan under activity, as reflected in table 5, row 2. the food manufactured, processed, § 121.126, that a one-time burden of 50 At the same time we note that this is a packed, or held by the facility will not hours will be needed to create such a one-time burden we expect will have be adulterated. The rule does not plan, and that a burden of 10 hours will been realized upon implementation of specify a specific number or set of be required to update the plan. We the rule by the affected facilities. In our mitigation strategies to be implemented. annualize this estimate by dividing the subsequent evaluation of the burden Some of the covered facilities are total number of burden hours (70 hours) associated with this information already implementing mitigation over a 3-year period, as reflected in table collection provision, we will adjust our strategies. We estimate it will require an 5, row 1. estimate accordingly. average of 20 hours per facility to satisfy Under § 121.130, each of the Under § 121.135(b), each of the the recordkeeping burden associated estimated 9,759 food production estimated 9,759 facilities must identify with these activities for a total of facilities will identify and specify and implement mitigation strategies for 195,180 hours, as reflected in table 5, actionable process steps for its food each actionable process step to provide row 3. defense plan. We estimate that an assurances that any significant We estimate that the recordkeeping individual at the level of an operations vulnerability at each step is significantly activities associated with monitoring,

VerDate Sep<11>2014 19:43 May 26, 2016 Jkt 238001 PO 00000 Frm 00053 Fmt 4701 Sfmt 4700 E:\FR\FM\27MYR4.SGM 27MYR4 mstockstill on DSK3G9T082PROD with RULES4 34218 Federal Register / Vol. 81, No. 103 / Friday, May 27, 2016 / Rules and Regulations

documenting mitigation strategies, XIV. References gfsifiles/information-kit/GFSI_Guidance_ implementing necessary corrective Document.pdf), 2012. actions, and verification activities will The following references are on 11. Safe Quality Food Institute. ‘‘SQF Code: require first-line supervisors or others display in the Division of Dockets A HACCP-Based Supplier Assurance Code for the Food Industry, Edition 7.1’’ responsible for quality control an Management (HFA–305), Food and Drug Administration, 5630 Fishers Lane, Rm. April 2013. average of 175 hours for each 12. International Featured Standards. ‘‘IFS recordkeeper, and that these provisions 1061, Rockville, MD 20852, and are available for viewing by interested Food: Standard for Auditing Quality and apply to each of the 9,759 facilities. This Food Safety of Food Products, Version results in a total of 1,707,825 annual persons between 9 a.m. and 4 p.m., 6.’’ (http://www.ifscertification.com/ burden hours, as reflected in table 5, Monday through Friday; they are also images/ifs_standards/ifs6/IFS_Food_V6_ row 4. available electronically at http:// en.pdf) January 2012. Accessed www.regulations.gov. FDA has verified We estimate that recordkeeping November 10, 2015. the Web site addresses, as of the date 13. Hamilton, P.J., ‘‘Center for Food Safety, activities associated with training under this document publishes in the Federal et al. v. Margaret A. Hamburg, M.D. § 121.4 total 244,802 annual burden Register, but Web sites are subject to Order Granting Injunctive Relief.’’ hours, as reflected in table 5, row 5. change over time. United States District Court Northern This figure assumes that there are an District of California. http://www.center estimated 1.2 million employees 1. FDA Memorandum. ‘‘FDA Memorandum forfoodsafety.org/files/fsma-remedy- working at the regulated facilities and to Dockets on Records of Outreach. See order_52466.pdf, June 21, 2013. that 30 percent of them (367,203) will Reference 7 to the 2014 supplemental 14. FDA. ‘‘Mitigation Strategies to Protect human preventive controls notice,’’ Food Against Intentional Adulteration: require training. This figure also 2013. assumes that the average burden for the Regulatory Impact Analysis, Regulatory 2. FDA Memorandum. ‘‘Memoranda of Flexibility Analysis, and Unfunded associated recordkeeping activity is Outreach,’’ 2015. Mandates Reform Act Analysis,’’ 2016. approximately 40 minutes (or 0.67 3. FDA. ‘‘Appendix 3 to the Final Qualitative 15. FDA Memorandum. ‘‘Memo Detailing an hours) per record. Risk Assessment: Risk of Activity/Food Evaluation of the Potential For Wide- Finally, we expect each of the Combinations for Activities (Outside the Scale Public Health Harm Resulting estimated 9,759 firms will fulfill the Farm Definition) Conducted in a Facility From Intentional Adulteration Of recordkeeping requirements under Co-Located on a Farm,’’ 2016. Mineral oil When Used as a Dust Control 4. Avel, D., ‘‘ISIS Calls for Poisoning and Agent During Storage and Handling Raw § 121.305 and § 121.310, and that it will Running Down Westerners.’’ The require the equivalent of an operations Grain,’’ November 16, 2015. Algemeiner (http://www.algemeiner. 16. FDA. ‘‘CPG Sec. 555.300 Foods, Except manager and a legal analyst an average com/2014/11/28/isis-calls-for-poisoning- Dairy Products—Adulteration With of 5 hours each (10 hours) per record, and-running-down-westerners/#), Salmonella,’’ March 1995. as reflected in table 5, row 6. November 28, 2014. Accessed December 17. FDA. ‘‘Tribal Summary Impact 15, 2015. XII. Analysis of Environmental Impact Statement,’’ 2016. 5. Norton, R.A., ‘‘Food Defense in the Age of 18. FDA. ‘‘Memorandum to the File: We previously considered the Domestic Terrorism.’’ Food Safety Environmental Analysis Related to the environmental effects of this rule, as Magazine (http://www.foodsafety Final Rule on Mitigation Strategies to magazine.com/enewsletter/food-defense- stated in the proposed rule (78 FR Protect Food Against Intentional in-the-age-of-domestic-terrorism/, Adulteration.’’ February 2016. 78014). We stated that we had December 15, 2015. Accessed December determined under 21 CFR 25.30(h) and 15, 2015. List of Subjects 21 CFR 25.30(j) that this action is of a 6. Valdmanis, R., ‘‘Boston Bomb Suspect type that does not individually or Influenced by Al Qaeda: Expert 21 CFR Part 11 cumulatively have a significant effect on Witness.’’ Reuters (http://www.reuters. Administrative practice and the human environment such that com/article/us-boston-bombings-trial- procedure, Computer technology, neither an environmental assessment idUSKBN0MJ0Z620150323), March 23, Reporting and recordkeeping nor an environmental impact statement 2015. Accessed December 15, 2015. requirements. 7. Faiola, A., and S. Mekhennet, ‘‘Paris is required. We have not received any Attacks Were Carried Out by Three 21 CFR Part 121 new information or comments that Groups Tied to Islamic State, Official would affect our previous determination Says.’’ The Washington Post (https:// Food packaging, Foods. (Ref. 18). www.washingtonpost.com/world/string- Therefore, under the Federal Food, of-paris-terrorist-attacks-leaves-over-120- Drug, and Cosmetic Act and under XIII. Federalism dead/2015/11/14/066df55c-8a73-11e5- authority delegated to the Commissioner FDA has analyzed this final rule in bd91-d385b244482f_story.html), of Food and Drugs, 21 CFR Chapter 1 is accordance with the principles set forth November 15, 2015. Accessed December amended as follows: in Executive Order 13132. FDA has 15, 2015. 8. ‘‘Toxins Tie Suspect to Poisonings.’’ The determined that the rule does not PART 11—ELECTRONIC RECORDS; Japan Times (http://www.japantimes.co. ELECTRONIC SIGNATURES contain policies that have substantial jp/news/2014/01/26/national/crime- direct effects on the States, on the legal/toxins-tie-suspect-to-poisonings/#. ■ 1. The authority citation for part 11 relationship between the National VvBCLnn2ZD9) January 26, 2014. Government and the States, or on the Accessed December 14, 2015. continues to read as follows: distribution of power and 9. ‘‘Toshiki Abe Arrested for Poisoning Authority: 21 U.S.C. 321–393; 42 U.S.C. responsibilities among the various Frozen Food in Japan.’’ news.com.au 262. (http://www.news.com.au/world/toshiki- levels of government. Accordingly, the ■ 2. In § 11.1, add paragraph (o) to read Agency has concluded that the rule does abe-arrested-for-poisoning-frozen-in- japan/story-fndir2ev-1226810502913) as follows: not contain policies that have January 25, 2014. Accessed December 15, § 11.1 Scope. federalism implications as defined in 2015. the Executive order and, consequently, 10. Global Food Safety Initiative. ‘‘GFSI * * * * * a federalism summary impact statement Guidance Document Version 6.3.’’ (o) This part does not apply to records is not required. (http://www.mygfsi.com/images/mygfsi/ required to be established or maintained

VerDate Sep<11>2014 19:43 May 26, 2016 Jkt 238001 PO 00000 Frm 00054 Fmt 4701 Sfmt 4700 E:\FR\FM\27MYR4.SGM 27MYR4 mstockstill on DSK3G9T082PROD with RULES4 Federal Register / Vol. 81, No. 103 / Friday, May 27, 2016 / Rules and Regulations 34219

by part 121 of this chapter. Records that applicable to such terms when used in whole number, round down to the next satisfy the requirements of part 121 of this part. The following definitions also lowest whole number. this chapter, but that also are required apply: Holding means storage of food and under other applicable statutory Actionable process step means a also includes activities performed provisions or regulations, remain point, step, or procedure in a food incidental to storage of food (e.g., subject to this part. process where a significant vulnerability activities performed for the safe or ■ 3. Add part 121 to read as follows: exists and at which mitigation strategies effective storage of that food, such as can be applied and are essential to fumigating food during storage, and PART 121—MITIGATION STRATEGIES significantly minimize or prevent the drying/dehydrating raw agricultural TO PROTECT FOOD AGAINST significant vulnerability. commodities when the drying/ INTENTIONAL ADULTERATION Adequate means that which is needed dehydrating does not create a distinct to accomplish the intended purpose in commodity (such as drying/dehydrating Sec. keeping with good public health hay or alfalfa)). Holding also includes Subpart A—General Provisions practices. activities performed as a practical 121.1 Applicability. Affiliate means any facility that necessity for the distribution of that 121.3 Definitions. controls, is controlled by, or is under food (such as blending of the same raw 121.4 Qualifications of individuals who common control with another facility. agricultural commodity and breaking perform activities under subpart C of this Calendar day means every day as down pallets), but does not include part. shown on the calendar. activities that transform a raw 121.5 Exemptions. Contaminant means, for purposes of agricultural commodity into a processed Subpart B—Reserved this part, any biological, chemical, food as defined in section 201(gg) of the physical, or radiological agent that may Federal Food, Drug, and Cosmetic Act. Subpart C—Food Defense Measures be added to food to intentionally cause Holding facilities could include 121.126 Food defense plan. illness, injury, or death. warehouses, cold storage facilities, 121.130 Vulnerability assessment to Facility means a domestic facility or storage silos, grain elevators, and liquid identify significant vulnerabilities and a foreign facility that is required to storage tanks. actionable process steps. register under section 415 of the Federal Manufacturing/processing means 121.135 Mitigation strategies for actionable Food, Drug, and Cosmetic Act, in making food from one or more process steps. accordance with the requirements of ingredients, or synthesizing, preparing, 121.138 Mitigation strategies management components. part 1, subpart H of this chapter. treating, modifying or manipulating 121.140 Food defense monitoring. Farm means farm as defined in food, including food crops or 121.145 Food defense corrective actions. § 1.227 of this chapter. ingredients. Examples of 121.150 Food defense verification. FDA means the Food and Drug manufacturing/processing activities 121.157 Reanalysis. Administration. include: Baking, boiling, bottling, Food means food as defined in section Subpart D—Requirements Applying to canning, cooking, cooling, cutting, Records That Must Be Established and 201(f) of the Federal Food, Drug, and distilling, drying/dehydrating raw Maintained Cosmetic Act and includes raw agricultural commodities to create a materials and ingredients. distinct commodity (such as drying/ 121.301 Records subject to the requirements Food defense means, for purposes of of this subpart. dehydrating grapes to produce raisins), 121.305 General requirements applying to this part, the effort to protect food from evaporating, eviscerating, extracting records. intentional acts of adulteration where juice, formulating, freezing, grinding, 121.310 Additional requirements applying there is an intent to cause wide scale homogenizing, irradiating, labeling, to the food defense plan. public health harm. milling, mixing, packaging (including 121.315 Requirements for record retention. Food defense monitoring means to modified atmosphere packaging), 121.320 Requirements for official review. conduct a planned sequence of pasteurizing, peeling, rendering, treating 121.325 Public disclosure. observations or measurements to assess to manipulate ripening, trimming, 121.330 Use of existing records. whether mitigation strategies are washing, or waxing. For farms and farm Subpart E—Compliance operating as intended. mixed-type facilities, manufacturing/ 121.401 Compliance. Food defense verification means the processing does not include activities application of methods, procedures, and that are part of harvesting, packing, or Authority: 21 U.S.C. 331, 342, 350g, other evaluations, in addition to food holding. 350(i), 371, 374. defense monitoring, to determine Mitigation strategies mean those risk- Subpart A—General Provisions whether a mitigation strategy or based, reasonably appropriate measures combination of mitigation strategies is that a person knowledgeable about food § 121.1 Applicability. or has been operating as intended defense would employ to significantly This part applies to the owner, according to the food defense plan. minimize or prevent significant operator or agent in charge of a domestic Full-time equivalent employee is a vulnerabilities identified at actionable or foreign food facility that term used to represent the number of process steps, and that are consistent manufactures/processes, packs, or holds employees of a business entity for the with the current scientific food for consumption in the United purpose of determining whether the understanding of food defense at the States and is required to register under business qualifies as a small business. time of the analysis. section 415 of the Federal Food, Drug, The number of full-time equivalent Mixed-type facility means an and Cosmetic Act, unless one of the employees is determined by dividing establishment that engages in both exemptions in § 121.5 applies. the total number of hours of salary or activities that are exempt from wages paid directly to employees of the registration under section 415 of the § 121.3 Definitions. business entity and of all of its affiliates Federal Food, Drug, and Cosmetic Act The definitions and interpretations of and subsidiaries by the number of hours and activities that require the terms in section 201 of the Federal of work in 1 year, 2,080 hours (i.e., 40 establishment to be registered. An Food, Drug, and Cosmetic Act are hours × 52 weeks). If the result is not a example of such a facility is a ‘‘farm

VerDate Sep<11>2014 19:43 May 26, 2016 Jkt 238001 PO 00000 Frm 00055 Fmt 4701 Sfmt 4700 E:\FR\FM\27MYR4.SGM 27MYR4 mstockstill on DSK3G9T082PROD with RULES4 34220 Federal Register / Vol. 81, No. 103 / Friday, May 27, 2016 / Rules and Regulations

mixed-type facility,’’ which is an facility’s food process to intentional for ensuring compliance by individuals establishment that is a farm, but also adulteration. with the requirements of this part must conducts activities outside the farm You means, for purposes of this part, be clearly assigned to supervisory definition that require the establishment the owner, operator, or agent in charge personnel with a combination of to be registered. of a facility. education, training, and experience Packing means placing food into a necessary to supervise the activities § 121.4 Qualifications of individuals who under this subpart. container other than packaging the food perform activities under subpart C of this and also includes re-packing and part. (e) Records. Training required by activities performed incidental to paragraphs (b)(2) and (c)(2) of this (a) Applicability. You must ensure packing or re-packing a food (e.g., section must be documented in records, that each individual who performs activities performed for the safe or and must: activities required under subpart C of effective packing or re-packing of that (1) Include the date of training, the this part is a qualified individual as that food (such as sorting, culling, grading, type of training, and the persons term is defined in § 121.3. and weighing or conveying incidental to trained; and (b) Qualifications of individuals packing or re-packing)), but does not (2) Be established and maintained in assigned to an actionable process step. include activities that transform a raw accordance with the requirements of Each individual assigned to an agricultural commodity into a processed subpart D of this part. actionable process step (including food as defined in section 201(gg) of the temporary and seasonal personnel) or in § 121.5 Exemptions. Federal Food, Drug, and Cosmetic Act. the supervision thereof must: (a) This part does not apply to a very Qualified individual means a person (1) Be a qualified individual as that small business, except that a very small who has the education, training, or term is defined in § 121.3—i.e., have the business must, upon request, provide experience (or a combination thereof) appropriate education, training, or for official review documentation necessary to perform an activity experience (or a combination thereof) sufficient to show that the facility meets required under subpart C of this part, as necessary to properly implement the this exemption. Such documentation appropriate to the individual’s assigned mitigation strategy or combination of must be retained for 2 years. duties. A qualified individual may be, mitigation strategies at the actionable (b) This part does not apply to the but is not required to be, an employee process step; and holding of food, except the holding of of the establishment. (2) Receive training in food defense food in liquid storage tanks. Significant vulnerability means a awareness. (c) This part does not apply to the vulnerability that, if exploited, could (c) Qualifications of individuals for packing, re-packing, labeling, or re- reasonably be expected to cause wide certain activities described in paragraph labeling of food where the container that scale public health harm. A significant (c)(3) of this section. Each individual directly contacts the food remains vulnerability is identified by a assigned to certain activities described intact. vulnerability assessment conducted by a in paragraph (c)(3) of this section must: (d) This part does not apply to qualified individual, that includes (1) Be a qualified individual as that activities of a farm that are subject to consideration of the following: (1) term is defined in § 121.3—i.e., have the section 419 of the Federal Food, Drug, Potential public health impact (e.g., appropriate education, training, or and Cosmetic Act (Standards for severity and scale) if a contaminant experience (or a combination thereof) Produce Safety). were added, (2) degree of physical necessary to properly perform the (e)(1) This part does not apply with access to the product, and (3) ability of activities; and respect to alcoholic beverages at a an attacker to successfully contaminate (2) Have successfully completed facility that meets the following two the product. The assessment must training for the specific function at least conditions: consider the possibility of an inside equivalent to that received under a (i) Under the Federal Alcohol attacker. standardized curriculum recognized as Administration Act (27 U.S.C. 201 et Significantly minimize means to adequate by FDA or be otherwise seq.) or chapter 51 of subtitle E of the reduce to an acceptable level, including qualified through job experience to Internal Revenue Code of 1986 (26 to eliminate. conduct the activities. Job experience U.S.C. 5001 et seq.) the facility is Small business means, for purposes of may qualify an individual to perform required to obtain a permit from, this part, a business (including any these functions if such experience has register with, or obtain approval of a subsidiaries and affiliates) employing provided an individual with knowledge notice or application from the Secretary fewer than 500 full-time equivalent at least equivalent to that provided of the Treasury as a condition of doing employees. through the standardized curriculum. business in the United States, or is a Subsidiary means any company This individual may be, but is not foreign facility of a type that would which is owned or controlled directly or required to be, an employee of the require such a permit, registration, or indirectly by another company. facility. approval if it were a domestic facility; Very small business means, for (3) One or more qualified individuals and purposes of this part, a business must do or oversee: (ii) Under section 415 of the Federal (including any subsidiaries and (i) The preparation of the food defense Food, Drug, and Cosmetic Act the affiliates) averaging less than plan as required in § 121.126; facility is required to register as a $10,000,000, adjusted for inflation, per (ii) The conduct of a vulnerability facility because it is engaged in year, during the 3-year period preceding assessment as required in § 121.130; manufacturing, processing, packing, or the applicable calendar year in sales of (iii) The identification and holding one or more alcoholic human food plus the market value of explanation of the mitigation strategies beverages. human food manufactured, processed, as required in § 121.135; and (2) This part does not apply with packed, or held without sale (e.g., held (iv) Reanalysis as required in respect to food that is not an alcoholic for a fee). § 121.157. beverage at a facility described in Vulnerability means the susceptibility (d) Additional qualifications of paragraph (e)(1) of this section, of a point, step, or procedure in a supervisory personnel. Responsibility provided such food:

VerDate Sep<11>2014 19:43 May 26, 2016 Jkt 238001 PO 00000 Frm 00056 Fmt 4701 Sfmt 4700 E:\FR\FM\27MYR4.SGM 27MYR4 mstockstill on DSK3G9T082PROD with RULES4 Federal Register / Vol. 81, No. 103 / Friday, May 27, 2016 / Rules and Regulations 34221

(i) Is in prepackaged form that processed, packed, or held at your § 121.140 Food defense monitoring. prevents any direct human contact with facility using appropriate methods to As appropriate to the nature of the such food; and evaluate each point, step, or procedure mitigation strategy and its role in the (ii) Constitutes not more than 5 in your food operation to identify facility’s food defense system: percent of the overall sales of the significant vulnerabilities and (a) Written procedures. You must facility, as determined by the Secretary actionable process steps. Appropriate establish and implement written of the Treasury. methods must include, at a minimum, procedures, including the frequency (f) This part does not apply to the an evaluation of: with which they are to be performed, for manufacturing, processing, packing, or (1) The potential public health impact food defense monitoring of the holding of food for animals other than (e.g., severity and scale) if a mitigation strategies. (b) Food defense monitoring. You man. contaminant were added; (g) This part does not apply to on- must monitor the mitigation strategies (2) The degree of physical access to farm manufacturing, processing, with adequate frequency to provide the product; and packing, or holding of the following assurances that they are consistently foods on a farm mixed-type facility, (3) The ability of an attacker to performed. when conducted by a small or very successfully contaminate the product. (c) Records—(1) Requirement to small business if such activities are the (b) Inside attacker. The assessment document food defense monitoring. You only activities conducted by the must consider the possibility of an must document the monitoring of business subject to section 418 of the inside attacker. mitigation strategies in accordance with this section in records that are subject Federal Food, Drug, and Cosmetic Act. (c) Written vulnerability assessment. (1) Eggs (in-shell, other than raw to verification in accordance with Regardless of the outcome, the § 121.150(a)(1) and records review in agricultural commodities, e.g., vulnerability assessment must be pasteurized); and accordance with § 121.150(a)(3)(i). written and must include an (2) Exception records. Records may be (2) Game meats (whole or cut, not explanation as to why each point, step, affirmative records demonstrating the ground or shredded, without secondary or procedure either was or was not mitigation strategy is functioning as ingredients). identified as an actionable process step. intended. Exception records Subpart B—Reserved § 121.135 Mitigation strategies for demonstrating the mitigation strategy is actionable process steps. not functioning as intended may be Subpart C—Food Defense Measures adequate in some circumstances. (a) You must identify and implement § 121.126 Food defense plan. mitigation strategies at each actionable § 121.145 Food defense corrective actions. (a) Requirement for a food defense process step to provide assurances that (a) Food defense corrective action plan. You must prepare, or have the significant vulnerability at each step procedures. As appropriate to the nature of the actionable process step and the prepared, and implement a written food will be significantly minimized or nature of the mitigation strategy: defense plan. prevented and the food manufactured, processed, packed, or held by your (1) You must establish and implement (b) Contents of a food defense plan. written food defense corrective action The written food defense plan must facility will not be adulterated under section 402 of the Federal Food, Drug, procedures that must be taken if include: mitigation strategies are not properly (1) The written vulnerability and Cosmetic Act. For each mitigation strategy implemented at each actionable implemented. assessment, including required (2) The food defense corrective action explanations, to identify significant process step, you must include a written explanation of how the mitigation procedures must describe the steps to be vulnerabilities and actionable process taken to ensure that: steps as required by § 121.130(c); strategy sufficiently minimizes or prevents the significant vulnerability (i) Appropriate action is taken to (2) The written mitigation strategies, identify and correct a problem that has including required explanations, as associated with the actionable process step. occurred with implementation of a required by § 121.135(b); mitigation strategy; and (3) The written procedures for the (b) Mitigation strategies and (ii) Appropriate action is taken, when food defense monitoring of the accompanying explanations must be necessary, to reduce the likelihood that implementation of the mitigation written. the problem will recur. strategies as required by § 121.140(a); (b) Records. All food defense § 121.138 Mitigation strategies (4) The written procedures for food management components. corrective actions taken in accordance defense corrective actions as required by with this section must be documented § 121.145(a)(1); and Mitigation strategies required in records that are subject to food (5) The written procedures for food under§ 121.135 are subject to the defense verification in accordance with defense verification as required by following mitigation strategies § 121.150(a)(2) and records review in § 121.150(b). management components as appropriate accordance with § 121.150(a)(3)(i). (c) Records. The food defense plan to ensure the proper implementation of required by this section is a record that the mitigation strategies, taking into § 121.150 Food defense verification. is subject to the requirements of subpart account the nature of each such (a) Food defense verification D of this part. mitigation strategy and its role in the activities. Food defense verification facility’s food defense system: activities must include, as appropriate § 121.130 Vulnerability assessment to to the nature of the mitigation strategy identify significant vulnerabilities and (a) Food defense monitoring in accordance with § 121.140; and its role in the facility’s food defense actionable process steps. system: (a) Requirement for a vulnerability (b) Food defense corrective actions in (1) Verification that food defense assessment. You must conduct or have accordance with § 121.145; and monitoring is being conducted as conducted a vulnerability assessment (c) Food defense verification in required by § 121.138 (and in for each type of food manufactured, accordance with § 121.150. accordance with § 121.140);

VerDate Sep<11>2014 19:43 May 26, 2016 Jkt 238001 PO 00000 Frm 00057 Fmt 4701 Sfmt 4700 E:\FR\FM\27MYR4.SGM 27MYR4 mstockstill on DSK3G9T082PROD with RULES4 34222 Federal Register / Vol. 81, No. 103 / Friday, May 27, 2016 / Rules and Regulations

(2) Verification that appropriate understanding including, as (g) Records that are established or decisions about food defense corrective appropriate, results from the maintained to satisfy the requirements actions are being made as required by Department of Homeland Security of this part and that meet the definition § 121.138 (and in accordance with biological, chemical, radiological, or of electronic records in § 11.3(b)(6) of § 121.145); other terrorism risk assessment. this chapter are exempt from the (3) Verification that mitigation (c) You must complete such requirements of part 11 of this chapter. strategies are properly implemented and reanalysis required by paragraphs (a) Records that satisfy the requirements of are significantly minimizing or and (b) of this section and implement this part, but that also are required preventing the significant any additional mitigation strategies under other applicable statutory vulnerabilities. To do so, you must needed to address the significant provisions or regulations, remain conduct activities that include the vulnerabilities identified, if any: subject to part 11 of this chapter. following, as appropriate to the facility, (1) Before any change in activities the food, and the nature of the (including any change in mitigation § 121.310 Additional requirements applying to the food defense plan. mitigation strategy and its role in the strategy) at the facility is operative; facility’s food defense system: (2) When necessary within 90- The owner, operator, or agent in (i) Review of the food defense calendar days after production; and charge of the facility must sign and date monitoring and food defense corrective (3) Within a reasonable timeframe, the food defense plan: actions records within appropriate providing a written justification is (a) Upon initial completion; and timeframes to ensure that the records prepared for a timeframe that exceeds (b) Upon any modification. are complete, the activities reflected in 90 days after production of the the records occurred in accordance with applicable food first begins. § 121.315 Requirements for record the food defense plan, the mitigation (d) You must revise the written food retention. strategies are properly implemented, defense plan if a significant change in the activities conducted at your facility (a)(1) All records required by this part and appropriate decisions were made must be retained at the facility for at about food defense corrective actions; creates a reasonable potential for a new vulnerability or a significant increase in least 2 years after the date they were and prepared. (ii) Other activities appropriate for a previously identified vulnerability or verification of proper implementation of document the basis for the conclusion (2) Records that a facility relies on mitigation strategies; and that no revisions are needed. during the 3-year period preceding the (4) Verification of reanalysis in applicable calendar year to support its accordance with § 121.157. Subpart D—Requirements Applying to status as exempt as a very small (b) Written procedures. You must Records That Must Be Established and business must be retained at the facility establish and implement written Maintained as long as necessary to support the procedures, including the frequency for status of a facility as a very small § 121.301 Records subject to the business during the applicable calendar which they are to be performed, for requirements of this subpart. year. verification activities conducted (a) Except as provided by paragraph according to § 121.150(a)(3)(ii). (b) of this section, all records required (b) The food defense plan must be (c) Documentation. All verification by subpart C of this part are subject to retained for at least 2 years after its use activities conducted in accordance with all requirements of this subpart. is discontinued. this section must be documented in (b) The requirements of § 121.310 (c) Except for the food defense plan, records. apply only to the written food defense offsite storage of records is permitted if § 121.157 Reanalysis. plan. such records can be retrieved and provided onsite within 24 hours of (a) You must conduct a reanalysis of § 121.305 General requirements applying request for official review. The food the food defense plan, as a whole at to records. defense plan must remain onsite. least once every 3 years; Records must: Electronic records are considered to be (b) You must conduct a reanalysis of (a) Be kept as original records, true onsite if they are accessible from an the food defense plan as a whole, or the copies (such as photocopies, pictures, onsite location. applicable portion of the food defense scanned copies, microfilm, microfiche, (d) If the facility is closed for a plan: or other accurate reproductions of the prolonged period, the food defense plan (1) Whenever a significant change original records), or electronic records; made in the activities conducted at your (b) Contain the actual values and may be transferred to some other facility creates a reasonable potential for observations obtained during food reasonably accessible location but must a new vulnerability or a significant defense monitoring; be returned to the facility within 24 increase in a previously identified (c) Be accurate, indelible, and legible; hours for official review upon request. vulnerability; (d) Be created concurrently with § 121.320 Requirements for official review. (2) Whenever you become aware of performance of the activity documented; new information about potential (e) Be as detailed as necessary to All records required by this part must vulnerabilities associated with the food provide history of work performed; and be made promptly available to a duly operation or facility; (f) Include: authorized representative of the (3) Whenever you find that a (1) Information adequate to identify Secretary of Health and Human Services mitigation strategy, a combination of the facility (e.g., the name, and when for official review and copying upon mitigation strategies, or the food defense necessary, the location of the facility); oral or written request. plan as a whole is not properly (2) The date and, when appropriate, § 121.325 Public disclosure. implemented; and the time of the activity documented; (4) Whenever FDA requires reanalysis (3) The signature or initials of the Records required by this part will be to respond to new vulnerabilities, person performing the activity; and protected from public disclosure to the credible threats to the food supply, and (4) Where appropriate, the identity of extent allowable under part 20 of this developments in scientific the product and the lot code, if any. chapter.

VerDate Sep<11>2014 19:43 May 26, 2016 Jkt 238001 PO 00000 Frm 00058 Fmt 4701 Sfmt 4700 E:\FR\FM\27MYR4.SGM 27MYR4 mstockstill on DSK3G9T082PROD with RULES4 Federal Register / Vol. 81, No. 103 / Friday, May 27, 2016 / Rules and Regulations 34223

§ 121.330 Use of existing records. some of the required information, any part is a prohibited act under section (a) Existing records (e.g., records that new information required by this part 301(uu) of the Federal Food, Drug, and are kept to comply with other Federal, may be kept either separately or Cosmetic Act. State, or local regulations, or for any combined with the existing records. (b) The failure to comply with section other reason) do not need to be Subpart E—Compliance 420 of the Federal Food, Drug, and duplicated if they contain all of the Cosmetic Act or subparts C or D of this required information and satisfy the § 121.401 Compliance. part is a prohibited act under section requirements of this subpart. Existing (a) The operation of a facility that 301(ww) of the Federal Food, Drug, and records may be supplemented as manufactures, processes, packs, or holds Cosmetic Act. necessary to include all of the required food for sale in the United States if the Dated: May 20, 2016. information and satisfy the owner, operator, or agent in charge of requirements of this subpart. such facility is required to comply with, Leslie Kux, (b) The information required by this and is not in compliance with, section Associate Commissioner for Policy. part does not need to be kept in one set 418 of the Federal Food, Drug, and [FR Doc. 2016–12373 Filed 5–26–16; 8:45 am] of records. If existing records contain Cosmetic Act or subparts C or D of this BILLING CODE 4164–01–P

VerDate Sep<11>2014 19:43 May 26, 2016 Jkt 238001 PO 00000 Frm 00059 Fmt 4701 Sfmt 9990 E:\FR\FM\27MYR4.SGM 27MYR4 mstockstill on DSK3G9T082PROD with RULES4