1. Food Defense Plan Builder

2. Food Defense Plan Builder
Software and program for the Plan Builder is found on the FDA website:
Click on the Food Defense Plan builder tab in the left side toolbar, then click the “Download” link in the center of the page.
Complete the information page on the web site and download the Food Defense Plan Builder software.

3. Food Defense Plan Builder Start-Up Page
Select “New” to start a new Food Defense Plan
Help button describes all categories within the plan builder

4. Company Information Page
FDA # here and add Date OPCO registered (DLATS Req)
Enter all pertinent data

5. Broad Mitigation Strategies
Answer questions using N/A, Currently Doing, or Gap. Write applicable comments. If Sample Plan Content narrative applies, click “Apply to Plan”. If it does not apply in whole or part, edit data as seen on next slide.

6. Editing Plan Content Data
To edit, click “Tools”, then Check “Edit Broad Mitigation Strategies”
Right click the question on left and click “edit question”

7. Edit Plan Content Data
All category boxes may be edited to make the response site specific. Edit the Sample Plan content to indicate what actions or conditions exist at your specific site. This cannot be a one size fits all response.

8. Editing Content
When not all criteria is met, use the “Gap” category to document the deficiency and the action plan. The action plan will populate under the “Action Plan” tab toward the end
Plan content was modified from the original response

9. Vulnerability Assessment

10. Vulnerability Assessment
Process of identifying and prioritizing the weaknesses in a food operation
Helps Identify:
Actionable Process Steps
Areas of an operation where Focused Mitigation Strategies should be applied
We will discuss Focused Mitigation Strategies during the next Exercise (Exercise C)

11. Accessibility
Measure of the ease with which an attacker can physically access the intended target to intentionally contaminate the food
Add question to slide
A target is accessible when an attacker can reach it to conduct the attack and leave undetected
Accessible = openness of the target to the threat

12. Accessibility Scale (Can I get to the target?)
CRITERIA
SCALE
Easily Accessible (e.g., target is outside building and no perimeter fence).
9 – 10
Accessible (e.g., target is inside building, but in unsecured part of facility).
7 – 8
Partially Accessible (e.g. inside building, but in a relatively unsecured, but busy, part of facility).
5 – 6
Hardly Accessible (e.g., inside building in a secured part of facility).
3 – 4
Not Accessible (e.g., there are physical barriers, alarms, and human observation to prevent reaching the target).
1 – 2
You will then judge each operation on the flowchart using (3) scoring scales.
The first is for “Accessibility,” can I get to the target. This scale primarily looks at the physical measures that might make it difficult to reach a target.
Keep in mind that the accessibility can be different for different people. An employee – even a disgruntled employee – will have more access than an outsider. So you could perform this exercise and get different scores depending on who the “bad guy” is. For today’s exercise we will presume the attacker is a fairly new employee working in a non-processing area like the warehouse. 12

13. Vulnerability
Measure of the ease with which a contaminant can be introduced in quantities sufficient to achieve the attacker’s purpose (once the target has been accessed)

14. Vulnerability Determined by the characteristics of the target
Volume appropriate to accommodate contaminant
Sufficient and uniform mixing after addition
Ability to work unobserved, e.g, poor supervision
Time available for introduction of agents
Downstream processing will not eliminate the contaminant
What mitigation strategies are already in place?

15. Vulnerability Scale (Once I get to the target, can I contaminate the product?)
CRITERIA
SCALE
Highly Vulnerable (e.g., product is openly exposed and there is lots of time to allow for easy introduction of contaminants without being seen).
9 – 10
Vulnerable (e.g., product has some open exposure and there is sufficient time to almost always allow for introduction of contaminants without being seen).
7 – 8
Somewhat Vulnerable (e.g., product has limited exposure points and limited times when contaminant can be added without being seen).
5 – 6
Barely Vulnerable (e.g., product has limited exposure points but is almost always under observation while in production).
3 – 4
Not Vulnerable (e.g., product is in sealed vessels/pipes with no practical exposure points or it is under full and controlled observation).
1 – 2
The second scoring criteria is “Vulnerability.” This presumes the attacker has reached the specific operation somehow, whether that was easy or difficult.
Now that the attacker has reached the operation, how easy is it to make a contamination – and to do it without being caught. Common factors that impact vulnerability is how open or closed the system is, and how well the area is kept under observation to detect any unusual activity.
(If you think it is appropriate to the audience you can point out that there are some extreme cases that make an operation less vulnerable depending on dilution and dose – for example a large water reservoir, while easy to contaminate, is NOT EASY to contaminate with a sufficient quantity of most agents to cause harm. And a minor ingredient, that is used in very small quantities, may need to be almost entirely replaced to cause harm.) 15

16. Vulnerability Assessment
Click the + sign to create the first process name

17. Vulnerability Assessment
Begin assessment by identifying all processes that impact food defense.
Identify major process categories and the steps within that process. These are areas where food products may be accessible and vulnerable to intentional tampering
After clicking the + sign, this box appears. Enter your process title
Due to a glitch in the software, you must check the yellow “+” sign when entering a process name or it will not save

18. Listing a Process and Process Steps
Process: Product Delivery (example)
Process Steps
Product leaves OPCO in trailer
Product delivered to customer (partial product removal from trailer with remainder of product left onboard)
Product driven between customer locations
Undelivered product returned to OPCO

19. Process Step Scoring
Utilizing two portions of the CARVER assessment tool (Accessibility and Vulnerability), you will assign a rating describing how accessible the food product is for someone to tamper with it in the step you have described. This includes outsiders and employees. A product may be very accessible to many employees, but may not be vulnerable due to various protective measures taken. (example – numerous employees can physically get to the product but due to supervisory over-watch, CCTV systems, no personal bags allowed, etc., there is a low vulnerability of being contaminated).

20. Accessibility

21. Vulnerability

22. Assigned Risk Score for Process Step
Each step in the process will have a risk score. Any step identified as actionable will have an action plan associated with it to reduce that risk

23. Vulnerability Assessment Process Examples

24. Focused Mitigation Strategies
Targeted efforts implemented at a process step to minimize or prevent intentional contamination
Vulnerability A  Mitigation A
Vulnerability B  Mitigation B

25. Mitigation Strategies Mitigation Strategies
Examples
Broad
Mitigation Strategies
Focused
Mitigation Strategies
Require visitors be escorted
Ensure adequate lighting throughout facility
Conduct background checks
Restrict personal items in production areas
Install locks on all liquid storage tanks
Require peer monitoring in sensitive areas
Inspect ingredient staging bins prior to use
Employ automated ingredient addition technology

26. Focused Mitigation Strategies
Each step identified as actionable will populate on the Focused Mitigation Strategies tab. Click cursor under mitigation strategies and type in a strategy you have in place to reduce the accessibility and vulnerability risks to your products.
If no mitigation strategies can be developed or thought of, click on the “Search” tab on the right side (must have internet access). This will take you to the FDA sight where you can do a search for the topic in question and receive a list of pre-formatted mitigation strategies considered “industry best practices”. Simply select from the list and it will populate onto your screen.

27. Examples of FDA Listed Focused Mitigation Strategies

28. Emergency Contacts
Use “+” sign to add additional emergency contacts

29. Action Plan
Any Step identified as Actionable that had mitigation strategies entered, will populate on the Action Plan page. Additional steps and comments may be added, as well as dates for start and completion

30. Completed Food Defense Plan
Plan is created from data entered on previous screens. Any item with an action plan is so noted
When file is saved, it will save in the Plan Builder program and must be opened in that program.

31. Saving Files
To export file as a Word Doc, Excel, or PDF, click on the disc icon at the top and select format to be exported in.

32. At any tab in the plan builder, the files can be exported in pdf, word or excel, as individual sections or as a complete document. The Food Defense Plan tab is the only section that has the “export” icon in the toolbar allowing you to export the entire document without having to go through the “File” menu.
If you have a need to export a single portion, such as, just the action plan, or mitigation strategies, use the “File” tab, scroll down to “Export” and all of the individual categories will populate. Select the one you desire and click it. That portion will appear. Click on the “Export” disc icon to export it in the format you need.

33. Supporting Documents
Any supporting documents you wish to attach to the Food Defense Plan may be included using the Supporting Documents tab. Click on the yellow + tab and add a document.
Insert documents: “Continuous Improvement Commitment” and “Management Commitment Letter” (DLATS requirement )