What is a food defense plan under the FSMA Intentional Adulteration rule?

A written plan required of covered facilities by 21 CFR part 121. It must identify vulnerabilities and actionable process steps through a vulnerability assessment, set mitigation strategies at those steps, and lay down procedures for food defense monitoring, corrective actions and verification. It must be reanalysed every three years or when certain conditions are met.

Does the Intentional Adulteration rule cover economically motivated adulteration?

No. The rule is aimed at acts intended to cause wide-scale public health harm, such as terrorism targeting the food supply. Economically motivated adulteration is addressed as a hazard in the preventive controls rules for human and animal food, 21 CFR parts 117 and 507.

Early access How it works

Mitigation Strategies to Protect Food Against Intentional Adulteration

The Intentional Adulteration rule, 21 CFR part 121, is the food defense rule rather than a food safety one: it requires larger registered facilities to hold a written food defense plan that identifies where a process could be deliberately contaminated to cause wide-scale public harm and what mitigates that risk.

What it is: FSMA final rule
Where it lives: 21 CFR part 121
Final rule: May 2016
Docket: FDA-2013-N-1425
Published by: U.S. Food and Drug Administration

Who it covers

Domestic and foreign facilities that have to register with the FDA, with exemptions designed so that the rule falls on large companies whose products reach many people. The FDA's own estimate is 3,400 covered firms operating 9,800 facilities. Farms are not covered.

The rule is aimed at acts intended to cause wide-scale harm, including terrorism. Economically motivated adulteration, and the disgruntled employee, are addressed elsewhere: the preventive controls rules cover economic adulteration as a hazard.

What it requires

A written food defense plan, built the way a HACCP plan is built. A vulnerability assessment identifies the actionable process steps where an attacker could introduce a contaminant with wide-scale effect. Mitigation strategies are applied at those steps. Procedures for food defense monitoring, corrective actions and verification follow, with training for the people at the actionable steps and records of all of it. The plan must be reanalysed at least every three years, or sooner when circumstances change.

It is the first time United States law has required a food defense plan, and the FDA gave the longest compliance runway of any FSMA rule because of it.

In the FDA’s words

“This rule is designed to primarily cover large companies whose products reach many people, exempting smaller companies. There are 3,400 covered firms that operate 9,800 food facilities. It does not cover farms.”

U.S. Food and Drug Administration, FSMA Final Rule for Mitigation Strategies to Protect Food Against Intentional Adulteration, updated 2022-03-11. Read 2026-09-16.

The FDA's own count of who is in scope, which is a fraction of the facilities under the preventive controls rule.

“This written plan must identify vulnerabilities and actionable process steps, mitigation strategies, and procedures for food defense monitoring, corrective actions and verification.”

U.S. Food and Drug Administration, FSMA Final Rule for Mitigation Strategies to Protect Food Against Intentional Adulteration, updated 2022-03-11. Read 2026-09-16.

The same skeleton as a HACCP plan, which the FDA says was deliberate, applied to an attacker rather than to a hazard.

Compliance dates

Who	Date
Businesses other than small and very small	Three years after publication of the final rule
Small businesses, fewer than 500 persons	Four years after publication of the final rule
Very small businesses, under $10,000,000 a year in human food sales adjusted for inflation: modified requirements	Five years after publication of the final rule

The final rule was published in May 2016, so all three dates have passed.

The dates are the FDA’s, as stated on FSMA Final Rule for Mitigation Strategies to Protect Food Against Intentional Adulteration, updated 2022-03-11, read 2026-09-16. Compliance dates have been extended before; check that page before planning against any of them.

Exemptions

A very small business is exempt, though it must document its size on request. Also exempt: holding food, except in liquid storage tanks; packing, repacking, labelling or relabelling where the container in contact with the food stays intact; activities within the definition of a farm; manufacturing, packing or holding food for animals; alcoholic beverages under certain conditions; and on-farm handling by small and very small businesses of certain low-risk foods, where that is all they do.

Where it is in 21 CFR

The rule is codified at 21 CFR part 121, Mitigation Strategies to Protect Food Against Intentional Adulteration. Title 21 is a work of the United States government and in the public domain, so the regulation is reproduced in full on this site. These are the sections a reader of this page most often needs.

What goes wrong in practice

A rule describes the controls; the FDA’s recall records are what happened where a control was missing. These are the hazards and the kinds of food whose records this rule is most often written against.

Questions

What is a food defense plan under the FSMA Intentional Adulteration rule?: A written plan required of covered facilities by 21 CFR part 121. It must identify vulnerabilities and actionable process steps through a vulnerability assessment, set mitigation strategies at those steps, and lay down procedures for food defense monitoring, corrective actions and verification. It must be reanalysed every three years or when certain conditions are met.
Does the Intentional Adulteration rule cover economically motivated adulteration?: No. The rule is aimed at acts intended to cause wide-scale public health harm, such as terrorism targeting the food supply. Economically motivated adulteration is addressed as a hazard in the preventive controls rules for human and animal food, 21 CFR parts 117 and 507.

The other FSMA rules

FSMA is enforced as 10 rules, and a single business frequently sits under several. The Act itself, and how the rules fit together.

An inspection under this rule asks for the records behind each requirement, and finding them is the work. Krolda maps supplier documents to the clause they satisfy in FSSC 22000, IFS Food and 21 CFR 117, and routes the corrective action when the evidence is missing.

Early access

Recall records come from the openFDA food enforcement API, published by the U.S. Food and Drug Administration in the public domain. Krolda adds the hazard classification and the clause mapping; neither is an FDA determination. Always check the FDA notice before acting on a recall.