United States
Hong KongFood defense: protecting food from deliberate harm
Food defense protects food from deliberate contamination, as distinct from food safety, which addresses accidental contamination. The FDA ALERT framework covers assure, look, employees, reports and threat, and forms the basis of a simple plan.
One word separates the two disciplines: intent.
Food safety addresses contamination that happens by accident or negligence. Food defense addresses contamination somebody meant to cause. The controls overlap, and the mindset does not.
ALERT
| Letter | Question |
|---|---|
| Assure | Are supplies and ingredients from safe, known sources? |
| Look | How do you monitor the security of products and ingredients? |
| Employees | Who has access, and do you know who is in the building? |
| Reports | Can you account for what comes in, what goes out, and what is on hand? |
| Threat | What do you do if a threat or an incident occurs? |
Five questions, and a manager who can answer them has a food defense plan whether or not it is written down. Writing it down is better. Write it down.
What it looks like in practice
- Deliveries received by a named person, and checked against the order.
- Back doors closed and not propped, which is also the pest rule.
- Chemicals stored securely rather than merely separately.
- Non-essential staff and visitors kept out of preparation areas.
- Employees who know to report anything unusual, including from a colleague.
- Inventory records that would reveal something missing.
Almost every item on that list is already required for another reason, which is the practical point. Food defense in a restaurant is mostly doing existing controls properly rather than adding new ones.
The blueprint has one question on monitoring foot traffic of non-essential staff in preparation areas. It sits under contamination, and it is also the clearest food defense provision in the Code.
The disgruntled employee
It is uncomfortable and it is the most realistic threat model for a food establishment. Someone with legitimate access, knowledge of the operation, and a grievance. That is the threat.
Which is why access control, supervision, and a culture where staff report concerns matter more than perimeter security. A locked back door does nothing about a person who works there.
If something happens
Treat it as an imminent health hazard: cease operations, notify the regulatory authority, preserve the evidence rather than cleaning it away, and involve law enforcement.
The instinct to tidy up is exactly wrong, for the same reason it is wrong during a suspected outbreak.
Common questions
What is the difference between food safety and food defense?
Intent. Food safety addresses accidental or negligent contamination; food defense addresses deliberate contamination. The controls overlap considerably, but the threat model differs.
What does ALERT stand for?
Assure, Look, Employees, Reports, Threat - the FDA framework for food defense. Assure safe sources, look at how products are monitored, control who has access, keep records that reveal anomalies, and plan a response.
Does a restaurant need a written food defense plan?
It is not universally required, but it is good practice and largely consists of documenting controls that already exist for other reasons - access control, secure chemical storage, receiving procedures.
What is the most realistic food defense threat?
Someone with legitimate access and a grievance. That is why access control, supervision and a culture where staff report concerns matter more than perimeter security.
What do you do if intentional contamination is suspected?
Treat it as an imminent health hazard - cease operations, notify the regulatory authority, preserve the evidence rather than cleaning it away, and involve law enforcement.