The short answer
FDA’s Intentional Adulteration (IA) rule (21 CFR part 121) requires certain food facilities — domestic and foreign facilities registered with FDA — to have a written food defense plan that protects the most vulnerable points in their process from attacks meant to cause wide-scale public harm, such as acts of terrorism.
Most small exporters are exempt: a very small business — averaging less than $10 million a year in sales — only has to show documentation of its status if FDA asks. FDA estimates about 9,800 facilities are covered.
Is my facility covered?
| Business | Status under the IA rule | Compliance date |
|---|---|---|
| Larger business (500+ full-time equivalent employees) | Full food defense plan | July 26, 2019 |
| Small business (fewer than 500 FTE employees) | Full food defense plan | July 27, 2020 |
| Very small business (under $10 million average annual sales, inflation-adjusted) | Exempt — keep documentation and show it on request | July 26, 2021 |
| Holding of food (warehouses), except liquid storage tanks | Exempt | — |
| Farms | Exempt | — |
The rule is about attacks intended to cause wide-scale harm. Acts by disgruntled employees, consumers or competitors, and economically motivated adulteration (food fraud), generally fall outside it — food fraud is handled through your preventive controls hazard analysis instead.
What a food defense plan contains
- 1Vulnerability assessmentEach point, step or procedure in the process is assessed to find the actionable process steps where an attack could cause wide-scale harm.
- 2Mitigation strategiesMeasures at each actionable step — for example locks, restricted access, tamper-evident seals, two-person rules for ingredient addition.
- 3Monitoring, corrective actions and verificationProcedures to check the strategies work, fix failures and confirm the plan is followed.
- 4TrainingFood defense awareness training for staff at actionable steps and their supervisors; qualified individuals for the assessment and plan.
- 5RecordsThe written plan and records of monitoring, corrective actions, verification and training.
Example: a juice plant in Brazil and a spice mill in India
A large Brazilian orange juice concentrate plant with 900 employees ships bulk concentrate to the U.S. Its vulnerability assessment identifies the bulk storage tanks, blending and tanker loading as actionable steps, and it adds access controls, seals and monitoring logs. A family spice mill in India with $3 million in annual sales is a very small business: it keeps sales records showing it is under $10 million, ready to show FDA if asked.
FDA food facility registration with U.S. Agent from $300. FSVP program development from $400 per supplier. FSVP compliance audit and gap assessment $250.
🏢 No U.S. company to act as FSVP importer? Orionex offers an FSVP importer service for food and dietary supplements — from $80 per shipment, with the program and Qualified Individual included.
Frequently asked questions
Do foreign food facilities need a food defense plan?
Yes, if they are registered with FDA and not exempt. The rule covers domestic and foreign facilities.
Who is a very small business under the IA rule?
A business averaging less than $10 million a year in sales (inflation-adjusted). It is exempt from most requirements but must show documentation of its status if FDA requests it.
Are warehouses covered?
The holding of food is exempt, except holding in liquid storage tanks.
Does the IA rule cover food fraud?
Generally no. Economically motivated adulteration is addressed in the preventive controls rule’s hazard analysis.
Sources
- FDA — Protecting the food supply from intentional adulteration
- FDA — FSMA final rule for mitigation strategies to protect food against intentional adulteration
Requirements checked on November 12, 2026. This article is general information, not legal advice.