Guidance for Industry

Food Producers, Processors, and Transporters:
Food = Security=20 Preventive Measures Guidance

This guidance represents the Agency's current thinking on the = kinds of=20 measures that food establishments may take to minimize the risk that = food under=20 their control will be subject to tampering or other malicious, criminal, = or=20 terrorist actions. It does not create or confer any rights for or on any = person=20 and does not operate to bind FDA or the public.

Purpose and Scope:

This guidance is designed as an aid to operators of food = establishments=20 (firms that produce, process, store, repack, relabel, distribute, or = transport=20 food or food ingredients). This is a very diverse set of establishments, = which=20 includes both very large and very small entities.

This guidance identifies the kinds of preventive measures operators = of food=20 establishments may take to minimize the risk that food under their = control will=20 be subject to tampering or other malicious, criminal, or terrorist = actions. It=20 is relevant to all sectors of the food system, including farms, = aquaculture=20 facilities, fishing vessels, producers, transportation operations, = processing=20 facilities, packing facilities, and warehouses. It is not intended as = guidance=20 for retail food stores or food service establishments.

Operators of food establishments are encouraged to review their = current=20 procedures and controls in light of the potential for tampering or other = malicious, criminal, or terrorist actions and make appropriate = improvements. FDA=20 recommends that the review include consideration of the role that unit = and=20 distribution packaging might have in a food security program. This = guidance is=20 designed to focus operator's attention sequentially on each segment of = the=20 farm-to-table system that is within their control, to minimize the risk = of=20 tampering or other malicious, criminal, or terrorist action at each = segment. To=20 be successful, implementing enhanced preventive measures requires the = commitment=20 of management and staff. Accordingly, FDA recommends that both = management and=20 staff participate in the development and review of such measures.

Limitations:

Not all of the guidance contained in this document may be appropriate = or=20 practical for every food establishment, particularly smaller facilities = and=20 distributors. FDA recommends that operators review the guidance in each = section=20 that relates to a component of their operation, and assess which = preventive=20 measures are suitable. Example approaches are provided for many of the=20 preventive measures listed in this document. These examples should not = be=20 regarded as minimum standards. Nor should the examples provided be = considered an=20 inclusive list of all potential approaches to achieving the goal of the=20 preventive measure. FDA recommends that operators consider the goal of = the=20 preventive measure, assess whether the goal is relevant to their = operation, and,=20 if it is, design an approach that is both efficient and effective to = accomplish=20 the goal under their conditions of operation.

Structure:

This guidance is divided into five sections that relate to individual = components of a food establishment operation: management; human element = - staff;=20 human element - public; facility; and operations.

Related Guidance:

FDA has published a companion guidance document on food security = entitled,=20 "Importers and filers: Food security preventive measures guidance" to = cover the=20 farm-to-table spectrum of food production. This document is available = at: http://www.a= ccess.gpo.gov/su_docs/aces/aces140.html.=20

Additional Resources:*

A process called Operational Risk Management (ORM) may help = prioritize the=20 preventive measures that are most likely to have the greatest impact on = reducing=20 the risk of tampering or other malicious, criminal, or terrorist actions = against=20 food. Information on ORM is available in the Federal Aviation = Administration=20 (FAA) System Safety Handbook, U.S. Department of Transportation, FAA, = December=20 30, 2000, Chapter 15, Operational Risk Management. The handbook is = available at:=20 http://ww= w.asy.faa.gov/Risk/SSHandbook/Chap15_1200.PDF.=20

The U.S. Department of Transportation, Research and Special Programs=20 Administration has published an advisory notice of voluntary measures to = enhance=20 the security of hazardous materials shipments. It is available at http://frwebgate.access.gpo.gov/c= gi-bin/getdoc.cgi?dbname=3D2002_register&docid=3D02-3636-filed.pdf.=20 The notice provides guidance to shippers and carriers on personnel, = facility and=20 en route security issues.

The U.S. Postal Service has prepared guidance for identifying and = handling=20 suspicious mail. It is available at: ht= tp://www.usps.com/news/2001/press/mailsecurity/postcard.htm.=20

The Federal Anti-Tampering Act (18 USC 1365) makes it a federal crime = to=20 tamper with or taint a consumer product, or to attempt, threaten or = conspire to=20 tamper with or taint a consumer product, or make a false statement about = having=20 tampered with or tainted a consumer product. Conviction can lead to = penalties of=20 up to $100,000 in fines and up to life imprisonment. The Act is = available at: http://www.fda.gov/o= pacom/laws/fedatact.htm.=20

The National Infrastructure Protection Center (NIPC) serves as the = federal=20 government's focal point for threat assessment, warning, investigation, = and=20 response for threats or attacks against U.S. critical infrastructure. = The NIPC=20 has identified the food system as one of the eight critical = infrastructures, and=20 has established a public-private partnership with the food industry, = called the=20 Food Industry Information and Analysis Center (Food Industry ISAC). The = NIPC=20 provides the Food Industry ISAC with access, information and analysis, = enabling=20 the food industry to report, identify, and reduce its vulnerabilities to = malicious attacks, and to recover from such attacks as quickly as = possible. In=20 particular, the NIPC identifies credible threats and crafts specific = warning=20 messages to the food industry. Further information is available at http://www.nipc.gov/ and http://www.foodisac.org/.

Finally, some trade associations have developed food security = guidance that=20 is appropriately focused for that specific industry. For example, the=20 International Dairy Food Association has developed a food security = guidance=20 document as an aid to the dairy industry.

FDA encourages other trade associations to evaluate the preventive = measures=20 contained in this FDA guidance document and adapt them to their specific = products and operations and to supplement this guidance with additional=20 preventive measures when appropriate. FDA welcomes dialogue on the = content of=20 sector specific guidance with appropriate trade associations.

Food Establishment Operations:

Management

FDA recommends that food establishment operators = consider:

Preparing for the possibility of tampering or other malicious, = criminal,=20 or terrorist actions
- assigning responsibility for security to knowledgeable = individual(s)=20
- conducting an initial assessment of food security procedures and = operations, which we recommend be kept confidential=20
- having a security management strategy to prepare for and respond = to=20 tampering and other malicious, criminal, or terrorist actions, both = threats=20 and actual events, including identifying, segregating and securing = affected=20 product=20
- planning for emergency evacuation, including preventing security = breaches during evacuation=20
- maintaining any floor or flow plan in a secure, off-site = location=20
- becoming familiar with the emergency response system in the = community=20
- making management aware of 24-hour contact information for = local, state,=20 and federal police/fire/rescue/health/homeland security agencies=20
- making staff aware of who in management they should alert about=20 potential security problems (24-hour contacts)=20
- promoting food security awareness to encourage all staff to be = alert to=20 any signs of tampering or other malicious, criminal, or terrorist = actions or=20 areas that may be vulnerable to such actions, and reporting any = findings to=20 identified management (for example, providing training, instituting = a system=20 of rewards, building security into job performance standards)=20
- having an internal communication system to inform and update = staff about=20 relevant security issues=20
- having a strategy for communicating with the public (for = example,=20 identifying a media spokesperson, preparing generic press statements = and=20 background information, and coordinating press statements with = appropriate=20 authorities)
Supervision
- providing an appropriate level of supervision to all staff, = including=20 cleaning and maintenance staff, contract workers, data entry and = computer=20 support staff, and especially, new staff
- conducting routine security checks of the premises, including = automated=20 manufacturing lines, utilities and critical computer data systems = (at a=20 frequency appropriate to the operation) for signs of tampering or = malicious,=20 criminal, or terrorist actions or areas that may be vulnerable to = such=20 actions
Recall strategy
- identifying the person responsible, and a backup person=20
- providing for proper handling and disposition of recalled = product=20
- identifying customer contacts, addresses and phone numbers =
Investigation of suspicious activity
- investigating threats or information about signs of tampering or = other=20 malicious, criminal, or terrorist actions=20
- alerting appropriate law enforcement and public health = authorities about=20 any threats of or suspected tampering or other malicious, criminal, = or=20 terrorist actions
Evaluation program
- evaluating the lessons learned from past tampering or other = malicious,=20 criminal, or terrorist actions and threats=20
- reviewing and verifying, at least annually, the effectiveness of = the=20 security management program (for example, using knowledgeable = in-house or=20 third party staff to conduct tampering or other malicious, criminal, = or=20 terrorist action exercises and mock recalls and to challenge = computer=20 security systems), revising the program accordingly, and keeping = this=20 information confidential=20
- performing random food security inspections of all appropriate = areas of=20 the facility (including receiving and warehousing, where applicable) = using=20 knowledgeable in-house or third party staff, and keeping this = information=20 confidential=20
- verifying that security contractors are doing an appropriate = job, when=20 applicable

Human element - staff

Under Federal law, food establishment operators are required to = verify the=20 employment eligibility of all new hires, in accordance with the = requirements of=20 the Immigration and Nationality Act, by completing the INS Employment=20 Eligibility Verification Form (INS Form I-9). Completion of Form I-9 for = new=20 hires is required by 8 USC 1324a and nondiscrimination provisions = governing the=20 verification process are set forth at 8 USC 1324b.

FDA recommends that food establishment operators consider:

Screening (pre-hiring, at hiring, post-hiring)
- examining the background of all staff (including seasonal, = temporary,=20 contract, and volunteer staff, whether hired directly or through a=20 recruitment firm) as appropriate to their position, considering = candidates'=20 access to sensitive areas of the facility and the degree to which = they will=20 be supervised and other relevant factors (for example, obtaining and = verifying work references, addresses, and phone numbers, = participating in=20 one of the pilot programs managed by the Immigration and = Naturalization=20 Service and the Social Security Administration [These programs = provide=20 electronic confirmation of employment eligibility for newly hired = employees.=20 For more information call the INS SAVE Program toll free at = 1-888-464-4218,=20 fax a request for information to (202) 514-9981, or write to US/INS, = SAVE=20 Program, 425 I Street, NW, ULLICO-4th Floor, Washington, DC 20536. = These=20 pilot programs may not be available in all states], having a = criminal=20 background check performed by local law enforcement or by a contract = service=20 provider [Remember to first consult any state or local laws that may = apply=20 to the performance of such checks])
Note: screening procedures should be applied equally to all staff,=20 regardless of race, national origin, religion, and citizenship or = immigration=20 status.
Daily work assignments
- knowing who is and who should be on premises, and where they = should be=20 located, for each shift=20
- keeping information updated
Identification
- establishing a system of positive identification and recognition = that is=20 appropriate to the nature of the workforce (for example, issuing = uniforms,=20 name tags, or photo identification badges with individual control = numbers,=20 color coded by area of authorized access), when appropriate=20
- collecting the uniforms, name tag, or identification badge when = a staff=20 member is no longer associated with the establishment
Restricted access
- identifying staff that require unlimited access to all areas of = the=20 facility=20
- reassessing levels of access for all staff periodically=20
- limiting access so staff enter only those areas necessary for = their job=20 functions and only during appropriate work hours (for example, using = key=20 cards or keyed or cipher locks for entry to sensitive areas, color = coded=20 uniforms [remember to consult any relevant federal, state or local = fire or=20 occupational safety codes before making any changes])=20
- changing combinations, rekeying locks and/or collecting the = retired key=20 card when a staff member who is in possession of these is no longer=20 associated with the establishment, and additionally as needed to = maintain=20 security
Personal items
- restricting the type of personal items allowed in establishment=20
- allowing in the establishment only those personal use medicines = that are=20 necessary for the health of staff and ensuring that these personal = use=20 medicines are properly labeled and stored away from food handling or = storage=20 areas=20
- preventing staff from bringing personal items (for example, = lunch=20 containers, purses) into food handling or storage areas=20
- providing for regular inspection of contents of staff lockers = (for=20 example, providing metal mesh lockers, company issued locks), bags,=20 packages, and vehicles when on company property (Remember to first = consult=20 any federal, state, or local laws that may relate to such = inspections)=20
Training in food security procedures
- incorporating food security awareness, including information on = how to=20 prevent, detect, and respond to tampering or other malicious, = criminal, or=20 terrorist actions or threats, into training programs for staff, = including=20 seasonal, temporary, contract, and volunteer staff=20
- providing periodic reminders of the importance of security = procedures=20 (for example, scheduling meetings, providing brochures or payroll = stuffers)=20
- encouraging staff support (for example, involving staff in food = security=20 planning and the food security awareness program, demonstrating the=20 importance of security procedures to the staff)
Unusual behavior
- watching for unusual or suspicious behavior by staff (for = example, staff=20 who, without an identifiable purpose, stay unusually late after the = end of=20 their shift, arrive unusually early, access files/information/areas = of the=20 facility outside of the areas of their responsibility; remove = documents from=20 the facility; ask questions on sensitive subjects; bring cameras to=20 work)
Staff health
- being alert for atypical staff health conditions that staff may=20 voluntarily report and absences that could be an early indicator of=20 tampering or other malicious, criminal, or terrorist actions (for = example,=20 an unusual number of staff who work in the same part of the facility = reporting similar symptoms within a short time frame), and reporting = such=20 conditions to local health authorities

Human element -- public

FDA recommends that food establishment operators consider:

Visitors (for example, contractors, supplier representatives, = delivery=20 drivers, customers, couriers, pest control representatives, = third-party=20 auditors, regulators, reporters, tours)
- inspecting incoming and outgoing vehicles, packages and = briefcases for=20 suspicious, inappropriate or unusual items or activity, to the = extent=20 practical=20
- restricting entry to the establishment (for example, checking = visitors=20 in and out at security or reception, requiring proof of identity, = issuing=20 visitors badges that are collected upon departure, accompanying = visitors)=20
- ensuring that there is a valid reason for the visit before = providing=20 access to the facility - beware of unsolicited visitors=20
- verifying the identity of unknown visitors=20
- restricting access to food handling and storage areas (for = example,=20 accompanying visitors, unless they are otherwise specifically = authorized)=20
- restricting access to locker room =

Facility=20

FDA recommends that food establishment operators consider:

Physical security
- protecting perimeter access with fencing or other deterrent, = when=20 appropriate=20
- securing doors (including freight loading doors, when not in use = and not=20 being monitored, and emergency exits), windows, roof = openings/hatches, vent=20 openings, ventilation systems, utility rooms, ice manufacturing and = storage=20 rooms, loft areas, trailer bodies, tanker trucks, railcars, and bulk = storage=20 tanks for liquids, solids, and compressed gases, to the extent = possible (for=20 example, using locks, "jimmy plates," seals, alarms, intrusion = detection=20 sensors, guards, monitored video surveillance [remember to consult = any=20 relevant federal, state or local fire or occupational safety codes = before=20 making any changes])=20
- using metal or metal-clad exterior doors to the extent possible = when the=20 facility is not in operation, except where visibility from public=20 thoroughfares is an intended deterrent (remember to consult any = relevant=20 federal, state or local fire or occupational safety codes before = making any=20 changes)=20
- minimizing the number of entrances to restricted areas (remember = to=20 consult any relevant federal, state or local fire or occupational = safety=20 codes before making any changes)=20
- securing bulk unloading equipment (for example, augers, pipes, = conveyor=20 belts, and hoses) when not in use and inspecting the equipment = before use=20
- accounting for all keys to establishment (for example, assigning = responsibility for issuing, tracking, and retrieving keys)=20
- monitoring the security of the premises using appropriate = methods (for=20 example, using security patrols [uniformed and/or plain-clothed], = video=20 surveillance)=20
- minimizing, to the extent practical, places that can be used to=20 temporarily hide intentional contaminants (for example, minimizing = nooks and=20 crannies, false ceilings)=20
- providing adequate interior and exterior lighting, including = emergency=20 lighting, where appropriate, to facilitate detection of suspicious = or=20 unusual activities=20
- implementing a system of controlling vehicles authorized to park = on the=20 premises (for example, using placards, decals, key cards, keyed or = cipher=20 locks, issuing passes for specific areas and times to visitors' = vehicles)=20
- keeping parking areas separated from entrances to food storage = and=20 processing areas and utilities, where practical
Laboratory safety
- restricting access to the laboratory (for example, using key = cards or=20 keyed or cipher locks [remember to consult any relevant federal, = state or=20 local fire or occupational safety codes before making any changes])=20
- restricting laboratory materials to the laboratory, except as = needed for=20 sampling or other appropriate activities=20
- restricting access (for example, using locks, seals, alarms, key = cards,=20 keyed or cipher locks) to sensitive materials (for example, reagents = and=20 bacterial, drug, and toxin positive controls)=20
- assigning responsibility for integrity of positive controls to a = qualified individual=20
- knowing what reagents and positive controls should be on the = premises=20 and keeping track of them=20
- investigating missing reagents or positive controls or other=20 irregularities outside a normal range of variability immediately, = and=20 alerting appropriate law enforcement and public health authorities = about=20 unresolved problems, when appropriate=20
- disposing of unneeded reagents and positive controls in a manner = that=20 minimizes the risk that they can be used as a contaminant
Storage and use of poisonous and toxic chemicals (for example, = cleaning=20 and sanitizing agents, pesticides)
- limiting poisonous and toxic chemicals in the establishment to = those=20 that are required for the operation and maintenance of the facility = and=20 those that are being held for sale=20
- storing poisonous and toxic chemicals as far away from food = handling and=20 storage areas as practical=20
- limiting access to and securing storage areas for poisonous and = toxic=20 chemicals that are not being held for sale (for example, using keyed = or=20 cipher locks, key cards, seals, alarms, intrusion detection sensors, = guards,=20 monitored video surveillance [remember to consult any relevant = federal,=20 state or local fire codes that may apply before making any changes]) =
- ensuring that poisonous and toxic chemicals are properly labeled =
- using pesticides in accordance with the Federal Insecticide, = Fungicide,=20 and Rodenticide Act (for example, maintaining rodent bait that is in = use in=20 covered, tamper-resistant bait stations)=20
- knowing what poisonous and toxic chemicals should be on the = premises and=20 keeping track of them=20
- investigating missing stock or other irregularities outside a = normal=20 range of variation and alerting appropriate law enforcement and = public=20 health authorities about unresolved problems, when appropriate=20

Operations=20

FDA recommends that food establishment operators consider:

Incoming materials and contract operations:
- using only known, appropriately licensed or permitted (where = applicable)=20 contract manufacturing and packaging operators and sources for all = incoming=20 materials, including ingredients, compressed gas, packaging, labels, = and=20 materials for research and development=20
- taking reasonable steps to ensure that suppliers, contract = operators and=20 transporters practice appropriate food security measures (for = example,=20 auditing, where practical, for compliance with food security = measures that=20 are contained in purchase and shipping contracts or letters of = credit, or=20 using a vendor approval program)=20
- authenticating labeling and packaging configuration and product=20 coding/expiration dating systems (where applicable) for incoming = materials=20 in advance of receipt of shipment, especially for new products=20
- requesting locked and/or sealed vehicles/containers/railcars, = and, if=20 sealed, obtaining the seal number from the supplier and verifying = upon=20 receipt, making arrangements to maintain the chain of custody when a = seal is=20 broken for inspection by a governmental agency or as a result of = multiple=20 deliveries=20
- requesting that the transporter have the capability to verify = the=20 location of the load at any time, when practical=20
- establishing delivery schedules, not accepting unexplained, = unscheduled=20 deliveries or drivers, and investigating delayed or missed shipments =
- supervising off-loading of incoming materials, including off = hour=20 deliveries=20
- reconciling the product and amount received with the product and = amount=20 ordered and the product and amount listed on the invoice and = shipping=20 documents, taking into account any sampling performed prior to = receipt=20
- investigating shipping documents with suspicious alterations=20
- inspecting incoming materials, including ingredients, compressed = gas,=20 packaging, labels, product returns, and materials for research and=20 development, for signs of tampering, contamination or damage (for = example,=20 abnormal powders, liquids, stains, or odors, evidence of resealing,=20 compromised tamper-evident packaging) or "counterfeiting" (for = example,=20 inappropriate or mismatched product identity, labeling, product lot = coding=20 or specifications, absence of tamper-evident packaging when the = label=20 contains a tamper-evident notice), when appropriate=20
- evaluating the utility of testing incoming ingredients, = compressed gas,=20 packaging, labels, product returns, and materials for research and=20 development for detecting tampering or other malicious, criminal, or = terrorist action=20
- rejecting suspect food=20
- alerting appropriate law enforcement and public health = authorities about=20 evidence of tampering, "counterfeiting" or other malicious, = criminal, or=20 terrorist action
Storage
- having a system for receiving, storing, and handling distressed, = damaged, returned, and rework products that minimizes their = potential for=20 being compromised or to compromise the security of other products = (for=20 example, destroying products that are unfit for human or animal = consumption,=20 products with illegible codes, products of questionable origin, and = products=20 returned by consumers to retail stores)=20
- keeping track of incoming materials and materials in use, = including=20 ingredients, compressed gas, packaging, labels, salvage products, = rework=20 products, and product returns=20
- investigating missing or extra stock or other irregularities = outside a=20 normal range of variability and reporting unresolved problems to = appropriate=20 law enforcement and public health authorities, when appropriate=20
- storing product labels in a secure location and destroying = outdated or=20 discarded product labels=20
- minimizing reuse of containers, shipping packages, cartons, etc., = where=20 practical
Security of water and utilities
- limiting, to the extent practical, access to controls for = airflow,=20 water, electricity, and refrigeration=20
- securing non-municipal water wells, hydrants, storage, and = handling=20 facilities=20
- ensuring that water systems and trucks are equipped with = backflow=20 prevention=20
- chlorinating water systems and monitoring chlorination = equipment, where=20 practical, and especially for non-municipal water systems=20
- testing non-municipal sources for potability regularly, as well = as=20 randomly, and being alert to changes in the profile of the results=20
- staying attentive to the potential for media alerts about public = water=20 provider problems, when applicable=20
- identifying alternate sources of potable water for use during = emergency=20 situations where normal water systems have been compromised (for = example,=20 trucking from an approved source, treating on-site or maintaining = on-site=20 storage)
Finished products
- ensuring that public storage warehousing and shipping operations = (vehicles and vessels) practice appropriate security measures (for = example,=20 auditing, where practical, for compliance with food security = measures that=20 are contained in contracts or letters of guarantee)=20
- performing random inspection of storage facilities, vehicles, = and=20 vessels=20
- evaluating the utility of finished product testing for detecting = tampering or other malicious, criminal, or terrorist actions=20
- requesting locked and/or sealed vehicles/containers/railcars and = providing the seal number to the consignee=20
- requesting that the transporter have the capability to verify = the=20 location of the load at any time=20
- establishing scheduled pickups, and not accepting unexplained,=20 unscheduled pickups=20
- keeping track of finished products=20
- investigating missing or extra stock or other irregularities = outside a=20 normal range of variation and alerting appropriate law enforcement = and=20 public health authorities about unresolved problems, when = appropriate=20
- advising sales staff to be on the lookout for counterfeit = products and=20 to alert management if any problems are detected
Mail/packages
- implementing procedures to ensure the security of incoming mail = and=20 packages (for example, locating the mailroom away from food = processing and=20 storage areas, securing mailroom, visual or x-ray mail/package = screening,=20 following U.S. Postal Service guidance)
Access to computer systems
- restricting access to computer process control systems and = critical data=20 systems to those with appropriate clearance (for example, using = passwords,=20 firewalls)=20
- eliminating computer access when a staff member is no longer = associated=20 with the establishment=20
- establishing a system of traceability of computer transactions=20
- reviewing the adequacy of virus protection systems and = procedures for=20 backing up critical computer based data systems=20
- validating the computer security system

Emergency Point of Contact:

U.S. Food and Drug Administration
5600 Fishers Lane
Rockville, = MD=20 20857
301-443-1240

If a food establishment operator suspects that any of his/her = products that=20 are regulated by the FDA have been subject to tampering, = "counterfeiting," or=20 other malicious, criminal, or terrorist action, FDA recommends that = he/she=20 notify the FDA 24-hour emergency number at 301-443-1240 or call their = local FDA=20 District Office. FDA District Office telephone numbers are listed at: http://www= .fda.gov/ora/inspect_ref/iom/iomoradir.html.=20 FDA recommends that the operator also notify appropriate law enforcement = and=20 public health authorities.

^*Reference to these documents is = provided for=20 informational purposes only. These documents are not incorporated by = reference=20 into this guidance and should not be considered to be FDA guidance.=20

Guidance=20 Documents | Food Defense and=20 Terrorism

FDA/Center for Food Safety & Applied Nutrition
Hypertext = updated by las/dav/dms/rog = June 19,=20 2006

Guidance for Industry

Food Producers, Processors, and Transporters:Food = Security=20 Preventive Measures Guidance

Food Producers, Processors, and Transporters:
Food = Security=20 Preventive Measures Guidance