21 CFR §121.130

1. (a)Requirement for a vulnerability assessment. You must conduct or have conducted a vulnerability assessment for each type of food manufactured, processed, packed, or held at your facility using appropriate methods to evaluate each point, step, or procedure in your food operation to identify significant vulnerabilities and actionable process steps. Appropriate methods must include, at a minimum, an evaluation of:
   1. (1)The potential public health impact (e.g., severity and scale) if a contaminant were added;
   2. (2)The degree of physical access to the product; and
   3. (3)The ability of an attacker to successfully contaminate the product.
2. (b)Inside attacker. The assessment must consider the possibility of an inside attacker.
3. (c)Written vulnerability assessment. Regardless of the outcome, the vulnerability assessment must be written and must include an explanation as to why each point, step, or procedure either was or was not identified as an actionable process step.