Templates and records · FSSC 22000 · Clause 2.5.3

FSSC 22000 food defense plan

Protecting the product from intentional contamination: who might want to do it, where and what stops them.

In one sentence

The FSSC 22000 food defense plan starts from a documented threat assessment — who could intentionally contaminate the product, at which points and with what consequences — and sets the mitigation measures, their verification and their periodic review, as the scheme's additional requirements in clause 2.5.3 require.

Content reviewed on 17 October 2026

Where the standard requires it: FSSC 22000 · Clause 2.5.3 Clauses beginning with 2.5 are additional requirements in Part 2 of FSSC 22000 Version 6; those of ISO 22000:2018 are explained in their own templates.
Type of information: Mandatory record Documented assessment and plan (FSSC 22000 v6, 2.5.3)
Who fills it in: Multidisciplinary food defense team With senior management, security, HR, production and quality
When: At implementation and periodically At least annually and whenever premises, staff or threats change
How long it is kept: Set by the organisation ISO 22000 requires documented information to be retained without setting a period. It is sensible to cover the shelf life of the product with a margin, the applicable law and the three-year certification cycle.

What the standard requires

What FSSC 22000 demands and what it leaves to your judgement

FSSC requires a documented procedure to assess threats, identify potential ones and develop prioritised control measures against them. The assessment covers in-house staff, contractors, visitors and access to materials and product.

The plan sets out the mitigation measures — access control, tamper seals, supervision, staff screening — and is integrated into the management system: it is verified, reviewed and staff are trained on it.

Food defense deals with intentional contamination; food fraud with adulteration for economic gain. They are separate assessments and FSSC requires both.

Read it in context: Improvement and additional requirements, in the FSSC 22000 Academy

Structure

Fields the template should include

Team and scope
Access points and vulnerable areas
Threats identified: internal, external, visitors
Likelihood and consequences
Mitigation measures and owner
Verification of the measures
Staff training
Review date

Example

Example: assessment at a fictitious beverage plant

Company, people and figures are fictitious: the example only shows what a properly completed record looks like.

Field	Content
Vulnerable area	Syrup room with open tanks
Threat	An outsider or disgruntled employee adding a contaminant
Risk	Low likelihood · very serious consequences
Measures	Access by authorised card only · tanks lidded and sealed · camera on the door
Visitors	Always escorted · sign-in and sign-out record
Verification	Monthly review of the room's access log
Review	January 2026 · next in January 2027

At the audit

Mistakes auditors commonly flag

A generic plan with no specific vulnerable points.
Contractors and hauliers left out of the assessment.
Measures that exist on paper: shared cards, seals nobody checks.
It is confused with the fraud assessment.
No review and no verification.

In Kimobox

How this record is kept in Kimobox

1Access control authorises entry by area and blocks anyone whose training or documentation has expired.
2The access history by area, person and date is consulted during verification.
3Visitors and subcontractor staff are managed with a temporary credential and a record.
4The annual review of the plan is scheduled with a reminder and its measures are tracked as actions.

Frequently asked questions

What people ask us before getting started

What is the difference between food defense and food fraud?

Food defense protects against intentional contamination meant to cause harm. Food fraud deals with adulteration or substitution for economic gain. FSSC requires an assessment and a plan for each.

What is TACCP?

A threat assessment method frequently used for food defense. FSSC does not impose any particular method.

Do we need cameras?

They are not mandatory. Measures are chosen according to the assessment: often access control, supervision and seals are enough.

Keep your FSSC 22000 records without loose templates

We'll show you the module running with data similar to yours.

Request a demo

Keep exploring

Sources

Where each figure comes from

References to the official text in force. If a standard is revised, this page is updated and the review date says so.

FSSC 22000 Version 6 — Scheme requirements (Part 2, additional requirements) Foundation FSSC · Published 31 March 2023
ISO 22000:2018 — Food safety management systems ISO · 2018 ed.