Phase 1
Vulnerability Assessment
1Assign qualified individuals
One or more qualified individuals prepare or oversee the assessment, strategy selection, and reanalysis.
21 CFR 121.4
↓
2Evaluate each food type and process point
Every point, step, or procedure in the process reviewed for each type of food the facility makes or handles.
21 CFR 121.130(a)
↓
3Assess the three assessment elements
Potential public health impact, degree of physical access, and ability of an attacker to contaminate, including an inside attacker.
21 CFR 121.130(a) · (b)
↓
4Identify actionable process steps
Steps with a significant vulnerability identified, with a written explanation for each step identified or not identified.
21 CFR 121.130(c)
Phase 2
Mitigation Strategies
Is there a significant vulnerability at this step?
YES → Actionable step, apply a strategy
NO → Document the reasoning
↓
5Identify and implement mitigation strategies
Strategies chosen and put in place at each actionable step to significantly minimize or prevent the vulnerability.
21 CFR 121.135(a)
↓
6Explain how each strategy works
A written explanation shows how each strategy addresses the vulnerability at its step.
21 CFR 121.135(b)
↓
7Establish management components
Monitoring, corrective action, and verification procedures, with frequencies, defined for each strategy as appropriate.
21 CFR 121.138
Phase 3
Plan and Implementation
8Write and sign the food defense plan
Assessment, strategies, monitoring, corrective action, and verification procedures compiled and signed and dated by the owner, operator, or agent in charge.
21 CFR 121.126 · 121.310
↓
9Train personnel
Qualified individuals and staff assigned to actionable steps, including temporary and seasonal workers, trained and the training documented.
21 CFR 121.4
↓
10Monitor strategies and correct deviations
Monitoring performed at the stated frequency, with corrective action when a strategy is not properly implemented.
21 CFR 121.140 · 121.145
Phase 4
Verification and Reanalysis
11Verify implementation and effectiveness
Verification confirms monitoring and corrective action are carried out, and that the strategies are properly implemented and effective.
21 CFR 121.150
↓
12Review and retain records
Monitoring, corrective action, and verification records reviewed and kept at the facility for at least 2 years.
21 CFR 121.150(a) · 121.315
↓
13Reanalyze the plan
Plan reanalyzed at least every 3 years, and sooner after a significant change, new information, or a strategy failure.
21 CFR 121.157
Vulnerability Assessment Elements (Overview)
Potential Public Health Impact
The severity and the scale of the harm if the product were intentionally contaminated at that point.
21 CFR 121.130(a)
Degree of Physical Access
How easily a person could reach the product at that point, considering locks, barriers, supervision, and who is authorized to be there.
21 CFR 121.130(a)
Ability to Contaminate
Whether an attacker could contaminate the product in a quantity and manner that would cause harm, considering an inside attacker.
21 CFR 121.130(a) · (b)
Mitigation Strategy Design (Overview)
Control access
Restrict who can reach the actionable step through locks, badges, escorts, and clear authorization.
Protect the product
Secure ingredients, tanks, and product with seals, covers, and locked storage, and detect tampering.
Add observation
Supervision, two-person rules, and monitoring make unusual activity visible at vulnerable steps.
Reduce the scale
Limit batch size or segregate production where practical, so any single event would affect fewer consumers.
Key Food Defense Outputs (Overview)
Vulnerability assessment
Written results for each food type, whether or not actionable steps were found, with reasoning.
Food defense plan
Strategies and explanations plus monitoring, corrective action, and verification procedures, signed and dated.
Monitoring and corrective action records
Evidence that each strategy was performed as written and deviations were handled.
Training and reanalysis records
Documented qualifications, awareness training, and the review of the plan over time.