A food defense plan is the written plan FDA's intentional adulteration rule, 21 CFR part 121, asks of food facilities: how someone could deliberately contaminate your food to cause wide-scale harm, and what you do to stop it. It holds a vulnerability assessment of each step, the mitigation strategies at the steps that need them, and how you monitor, correct and verify them. Few small makers have to write one: a very small business, averaging under $10,000,000 a year in human food sales over three years, adjusted for inflation, is exempt, and only has to keep documentation showing it qualifies for two years. So do others: holding food (except in liquid tanks), packing where the container touching the food stays intact, and produce farms under the produce rule. Small makers still write a short plan when a grocery chain's supplier questionnaire asks about food defense, or to know where their weak spots are. Below are the rule, what a plan holds, an example, and a free template with the exemption check, the assessment, the strategies and a monitoring log.
The short version
- A food defense plan covers deliberate contamination meant to cause wide-scale harm.
- It holds a vulnerability assessment, mitigation strategies, and monitoring, corrective action and verification.
- Very small businesses, under $10,000,000 a year in food sales averaged over 3 years, are exempt.
- An exempt business keeps documentation that it qualifies, for 2 years.
- Holding food, and packing where the food's container stays intact, are exempt too.
- The assessment weighs public health impact, physical access, and an attacker's ability, and considers an insider.
- Small makers often write a short plan anyway, for buyers' questionnaires.
- TaroStack keeps the batch records, lots and holds a plan points to. More below.
The rule
| Part | 21 CFR part 121 |
|---|---|
| Very small business | Under $10,000,000 in yearly human food sales plus food held without sale, adjusted for inflation, averaged over the 3 years before the calendar year (121.3) |
| The exemption | The rule doesn't apply, but the business shows documentation on request and keeps it 2 years (121.5) |
| Other exemptions | Holding food except in liquid storage tanks; packing or labeling where the food-contact container stays intact; produce farms; animal food (121.5) |
| The plan | Vulnerability assessment, mitigation strategies, monitoring, corrective action and verification procedures (121.126) |
| The assessment | Each step weighed on public health impact, physical access to the product, and an attacker's ability to contaminate it, with an inside attacker considered, and an explanation for every step (121.130) |
| Actionable process step | A step with a significant vulnerability where mitigation strategies are needed to prevent or significantly minimize it (121.3) |
The rule is 21 CFR part 121. How the rest of FDA's food rules fit is in what is FSMA, and the food safety plan, a different document, in what is a food safety plan. This is general information, not legal advice.
An example: an Appleton cookie plant
Fox River Cookie Co., the made-up cookie maker in Appleton, Wisconsin, I use in these examples, sells chocolate chip cookies to a regional grocery chain, and the chain's supplier questionnaire asks whether it has a food defense plan:
| Year | Food sales |
|---|---|
| 2023 | $310,000 |
| 2024 | $365,000 |
| 2025 | $402,000 |
| Average | $359,000: a very small business, exempt |
It answers the questionnaire with the exemption and a short voluntary plan. The assessment scores each step on the rule's three elements; mixing scores highest, open dough in a batch that becomes thousands of packs, and cooling next, open racks near the back door:
| Step | Impact | Access | Ability | Total | Actionable? |
|---|---|---|---|---|---|
| Receiving ingredients | 4 | 3 | 3 | 10 | No |
| Weighing and mixing | 8 | 7 | 7 | 22 | Yes |
| Cooling | 6 | 6 | 5 | 17 | No, but a strategy anyway |
| Packing | 5 | 5 | 4 | 14 | No |
| Strategy | Monitoring | Corrective action |
|---|---|---|
| Only trained staff in the mixing area; visitors escorted | The sign-in sheet, each shift | Hold the batch; review who entered |
| Mixer lid closed except when adding | Each addition | Hold the batch and investigate |
| Back door locked from outside | Start and end of shift | Lock it, check the racks, hold if tampered |
The scores and the cutoff are the template's own: the rule names the three elements, not numbers. The plant's food safety side is in food processing license.
Get the template
Download the food defense plan template. Four sheets: an exemption check that averages three years of food sales against the line; a vulnerability assessment that totals each step's scores and marks the actionable ones; mitigation strategies with monitoring, corrective action and verification; and a monitoring log where a missed check turns red. It's an ordinary Excel file with no macros, and it works in Google Sheets, LibreOffice and Numbers.
Where this stops working
A plan says "hold the batch". Holding it means knowing which lots it made, keeping them out of what ships, and finding any that already went out.
How TaroStack does it
TaroStack keeps the batch records, lots and holds a plan points to.
Checks on the batch record. Fields of your own on the batch record, tick boxes and initials, can hold the mixing area check and the lid check, with a sign-off.
Holds. A lot put on hold is kept out of what can be sold, so a batch under question can't ship while you look.
Where it went. Each order records the lots it got, so one recall report shows every customer a batch reached. TaroStack doesn't write or assess the plan itself.
| The job | Clipboard | In TaroStack |
|---|---|---|
| A check at mixing | A sheet on the wall | A field on the batch record |
| Holding a batch | A sign on the pallet | A hold on the lot |
| Which customers got a batch | Invoices | One recall report |
Batches, batch records with fields of your own, holds, lots and recalls are on every plan, from $49 a month. The first 30 days are free, with no credit card. If you'd like a hand setting up, ask, and we'll do it with you.