FSMA Intentional Adulteration (IA) Rule Guidance

What Food Defense Training Is Required by the FDA?

Written by Nima Saidi, FSPCA Lead Instructor

June 14, 2026

FDA food defense training requirements are tied to FDA’s Intentional Adulteration Rule, also called the IA Rule, which is found in 21 CFR Part 121.

The IA Rule is one of the regulations created under FSMA to help protect the food supply from intentional acts of adulteration where someone intends to cause wide-scale public health harm. This is different from traditional food safety that prevents accidental contamination. Food defense focuses on intentional harm caused by attackers.

Unlike some food safety training programs that are built around one main course, standardized food defense training for the IA Rule is more role-specific. The Food Safety Preventive Controls Alliance, or FSPCA, has developed a group of IA Rule training courses, and each course serves a different purpose. Some are free online courses for general awareness or rule overview, while others are fee-based FDA-recognized standardized curriculum courses for Food Defense Qualified Individual, or FDQI, activities.

One of the most important things to understand is that food defense training courses (like those offered by FSPCA) are typically role-based. The training needed by a front-line employee working at an actionable process step is not the same as the training needed by someone responsible for preparing the food defense plan. The right course ultimately depends on whether someone needs basic awareness training or training for a specific food defense plan responsibility.

This article breaks down all FSPCA's food defense courses, what each course is for, who should take each one, and which training is truly required under the IA Rule.

What Food Defense Training Courses Are Available for the IA Rule?

Different food defense trainings on the IA Rule are available depending on a person’s role and responsibilities. Some training is focused on general food defense awareness, while other training is focused on specific food defense plan responsibilities including:

Conducting a vulnerability assessment
Identifying actionable process steps
Identifying and explaining mitigation strategies
Conducting reanalysis and recordkeeping

Food defense awareness training is required for employees and supervisors assigned to Actionable Process Steps (21 CFR Part 121). This type of training helps employees understand basic food defense concepts, what to watch for, why food defense matters, and how their role supports the facility’s food defense efforts and plan implementation. FSPCA offers free Food Defense Awareness training online that facilities may use, unless they would like to develop their own—tailored to their product and process. As a good practice, facilities should provide food defense awareness training more broadly to other employees, even when it is not technically required for everyone. This will build general awareness across the facility, especially when the training is tailored to the facility’s own products, processes, and risks.

Food defense plan development training is different from general awareness training. This type of training is intended for individuals who are responsible for developing, managing, or supporting specific parts of the food defense plan. Since developing and maintaining a food defense plan involves a range of technical responsibilities, this type of training is often covered across more than one course. The FSPCA reflects this approach by offering standardized food defense courses (recognized by the FDA) for specific food defense plan responsibilities:

Under FDA’s Intentional Adulteration Rule (21 CFR Part 121), one or more qualified individuals must have the education, training, or experience necessary to perform or oversee the food defense plan development activities. In practice, many individuals meet this requirement through formal food defense trainings listed above, because direct education or experience with Intentional Adulteration Rule requirements is not as common in the industry as it is for other food-related areas.

Successful completion of any of the four standardized courses listed above helps qualify participants to serve as an FDQI for the specific activity covered in that course. This means a person may become an FDQI for one food defense plan activity, such as conducting a vulnerability assessment, or they may complete multiple courses and be qualified for several food defense plan responsibilities.

In other words, a facility may have one person complete all the above courses themselves, or it may have a food defense team where different people are qualified for different tasks and work together to develop and maintain the food defense plan.

This is different from standardized PCQI training for the Preventive Controls for Human Food Rule (21 CFR Part 117). PCQI training covers all the core responsibilities of a Preventive Controls Qualified Individual (PCQI) in one course. With food defense, FDA and FSPCA separate the responsibilities of the FDQI, into different training courses by task, rather than placing everything into one single course. Remember, while PCQI training focuses on the Preventive Controls for Human Food rule, FSPCA food defense training focuses on the Intentional Adulteration Rule.

All FSPCA Intentional Adulteration Courses Explained

FSPCA offers six Intentional Adulteration Rule training courses, and it helps to organize them into two broad categories.

The first category includes general IA Rule training courses: Food Defense Awareness training and the Overview of the IA Rule course. These courses are designed to build general understanding of food defense concepts, the IA Rule, and basic responsibilities under the regulation.

The second category includes FSPCA standardized curriculum courses for specific Food Defense Qualified Individual, or FDQI, activities. These courses are connected to specific food defense plan development responsibilities, such as conducting vulnerability assessments and identifying mitigation strategies.

Below is a clear breakdown of each course, what it covers, and who it is generally intended for. For a more detailed breakdown download the IA Rule Training Course Information Packet.

1. FSPCA Food Defense Awareness Training

FSPCA’s self-paced online Food Defense Awareness course helps meet the food defense awareness training requirement.

This course is intended for employees assigned to APSs and supervisors of those employees. These may include front-line production employees, operators, sanitation employees, receiving employees, or others who work at a point in the process where a significant vulnerability has been identified.

The purpose of this course is not to teach someone how to write the full food defense plan. It is awareness-level training. It helps employees understand what food defense is, why intentional adulteration matters, what their role is, and why unusual or suspicious activity should be reported.

A facility can use the FSPCA Food Defense Awareness course, or it can develop its own awareness training. In many cases, a facility-specific version may be more effective because it can connect the training to the actual products, process steps, equipment, restricted areas, and reporting procedures used at that facility.

For example, a facility-specific food defense awareness training may explain what food defense means, what an actionable process step is, what mitigation strategies are used at the site, what unusual activity could look like, and who employees should contact if something seems wrong.

Who should take it: Employees assigned to actionable process steps and supervisors of those employees.

Is it required: The specific FSPCA Food Defense Awareness course is not required. However, employees assigned to actionable process steps and their supervisors must receive food defense awareness training of some kind. The FSPCA course is one free available option that facilities can use to help meet this requirement.

Main purpose: To give employees and supervisors awareness of food defense principles and satisify the IA rule training requirement for food defense awareness training.

2. Overview of the IA Rule

The self-paced online Overview of the IA Rule course is a general introduction to FDA’s Intentional Adulteration Rule.

This course is useful for anyone who wants to understand the basic structure of the regulation. It can help explain who may be covered, who may be exempt, what modified requirements may apply, and how the IA Rule is organized.

However, this course is not associated with a specific IA Rule training requirement. That means it can be useful for general understanding, but it does not replace Food Defense Awareness training for employees at actionable process steps. It also does not qualify someone to conduct vulnerability assessments, identify mitigation strategies, prepare the food defense plan, or conduct reanalysis.

Who should take it: Managers, QA employees, food safety team members, consultants, corporate personnel, or anyone who wants a general understanding of the IA Rule.

Is it required: No, this course is optional and not tied to a specific IA Rule training requirement.

Main purpose: To provide a general overview of the IA Rule and how it is organized.

3. Conducting Vulnerability Assessments Using Key Activity Types

The self-paced online Conducting Vulnerability Assessments Using Key Activity Types course is part of the FSPCA IA Rule standardized curriculum recognized by FDA.

This course is for food professionals who will conduct a vulnerability assessment using FDA’s Key Activity Types method, often called the KAT method. The KAT method is a specific method used to identify actionable process steps based on activity types that FDA identified as commonly associated with higher vulnerability.

This course is for the KAT method only. It is not the same as the one-day Conducting Vulnerability Assessments course that uses the three fundamental elements approach.

FSPCA also strongly recommends taking the KAT course before taking the one-day Conducting Vulnerability Assessments course. This is because the KAT method may still be discussed as part of the broader vulnerability assessment training.

Who should take it: Food professionals who will conduct vulnerability assessments using the KAT method.

Is it required: Not for everyone. It applies when someone wants to be qualified for conducting a vulnerability assessment using the KAT method. A person may also be qualified through education, experience, or a combination.

Main purpose: To become qualified as an FDQI to conduct a vulnerability assessment using the Key Activity Types (KAT) method.

4. Conducting Vulnerability Assessments Using the Three Elements

The one-day live virtual Conducting Vulnerability Assessments course focuses on conducting vulnerability assessments using the three fundamental elements approach (not the KAT method).

The three fundamental elements are:

Potential public health impact
Degree of physical access to the product
Ability of an attacker to successfully contaminate the product

This course helps participants understand how to use those elements to evaluate points, steps, or procedures in a food operation. The goal is to determine which points are significantly vulnerable and should be identified as actionable process steps.

This is the only FSPCA Intentional Adulteration course that is instructor-led; the other FSPCA IA courses are self-paced online courses. The instructor-led format is important because conducting a vulnerability assessment using the three fundamental elements requires judgment and can be more complex than simply learning the basic requirements of the rule. Participants have the opportunity to ask questions, work through the material more interactively, and better understand how the three elements apply to real products, equipment, process flows, and facility situations. The course is delivered by FSPCA Vulnerability Assessment Lead Instructors and is intended for food professionals who conduct vulnerability assessments using the three fundamental elements approach.

Who should take it: QA managers, food safety managers, food defense team members, regulatory staff, consultants, and anyone responsible for conducting or overseeing a vulnerability assessment using the three fundamental elements approach.

Is it required: Not for every employee. It applies when someone wants to be qualified for conducting or overseeing the vulnerability assessment using this approach and needs to be qualified for that function. A person may also be qualified through education, experience, or a combination.

Main purpose: To become qualified as an FDQI to conduct a vulnerability assessment using the 3 fundamental elements approach.

5. Identification and Explanation of Mitigation Strategies

The self-paced online Identification and Explanation of Mitigation Strategies course is another FSPCA IA Rule standardized curriculum course recognized by FDA.

This course is for people responsible for identifying mitigation strategies to implement at actionable process steps.

This comes after the vulnerability assessment. First, the facility identifies significant vulnerabilities and actionable process steps. Then, the facility needs to determine which mitigation strategies will significantly minimize or prevent those vulnerabilities.

A mitigation strategy is not just a general security measure. It should be connected to the actionable process step and the specific vulnerability identified at that point. For example, the right mitigation strategy may involve limiting access, securing equipment, controlling entry to a specific area, inspecting a vulnerable point before use, or other measures appropriate to that facility and process.

This course is not for general employee awareness. It is for the person or team responsible for deciding what mitigation strategies make sense and explaining how they address the vulnerability.

Who should take it: Food defense team members, QA managers, food safety managers, operations managers, consultants, or anyone responsible for identifying and explaining mitigation strategies.

Is it required: Not for everyone. It applies when someone wants to be qualified for identifying and explaining mitigation strategies. A person may also be qualified through education, experience, or a combination.

Main purpose: To become qualified as an FDQI to identify and explain mitigation strategies for actionable process steps.

6. Food Defense Plan Preparation and Reanalysis

The self-paced online Food Defense Plan Preparation and Reanalysis course is for individuals who prepare the food defense plan or conduct reanalysis.

A food defense plan is more than the vulnerability assessment. Depending on the facility and the outcome of the assessment, the food defense plan may include the vulnerability assessment, actionable process steps, mitigation strategies, monitoring procedures, corrective action procedures, verification procedures, records, and reanalysis documentation.

Reanalysis is important because the plan cannot just be written once and forgotten. The facility may need to reanalyze the food defense plan at least every three years or when certain changes, new information, improper implementation, or FDA requirements trigger reanalysis.

This course is not intended to qualify someone to conduct the vulnerability assessment or identify mitigation strategies by itself. It is focused on preparing the food defense plan and conducting reanalysis.

Who should take it: Individuals responsible for preparing, maintaining, updating, or reanalyzing the food defense plan.

Is it required: Not for everyone. It applies when someone wants to be qualified to prepare the food defense plan or conducts reanalysis. A person may also be qualified through education, experience, or a combination.

Main purpose: To become qualified as an FDQI for food defense plan preparation and reanalysis.

What Food Defense Training Is Required?

The most direct training requirement under the IA Rule is Food Defense Awareness training for employees assigned to Actionable Process Steps (APSs) and supervisors of those employees. An APS is a point, step, or procedure in the process where a significant vulnerability has been identified and where a mitigation strategy is needed. In simpler words, it is a significantly vulnerable point in the process that requires extra protection. Employees working at APSs require food defense awareness because they are directly involved in an area where the facility has identified a significant vulnerability. They need to understand what food defense means, why their step matters, how to follow the mitigation strategy, and when to report unusual or suspicious activity. Supervisors of those employees also need food defense awareness training because they oversee the people and activities at those actionable process steps.

The IA Rule also requires that one or more Food Defense Qualified Individuals, or FDQIs, prepare or oversee the preparation of the food defense plan. This qualification works differently from Food Defense Awareness training. A person may be qualified for their assigned food defense plan activity through education, training, experience, or a combination of these. In practice, formal FDQI training is often the clearest way to document qualification, especially when someone does not already have direct education or experience with IA Rule requirements, vulnerability assessments, mitigation strategies, food defense plan preparation, or reanalysis.

Overall, Food Defense Awareness training is required for employees and supervisors assigned to APSs, regardless of prior education or experience. FDQI training works differently. It is not specifically required by name, but one or more FDQIs must be qualified to prepare or oversee preparation of the food defense plan. Formal training is commonly used to document that qualification, but education or experience may also satisfy the requirement.

Which FSPCA Food Defense Course Should You Take?

The easiest way to choose the right course is to start with the person’s role.

If the person works at an actionable process step or supervises employees at an actionable process step, they need Food Defense Awareness training.

If the person only wants to understand the IA Rule at a general level, the Overview of the IA Rule course may be helpful.

If the person conducts a vulnerability assessment using the KAT method only, the Conducting Vulnerability Assessments Using Key Activity Types course applies.

If the person conducts a vulnerability assessment using the three fundamental elements approach, the one-day Conducting Vulnerability Assessments course applies.

If the person identifies and explains mitigation strategies, the Identification and Explanation of Mitigation Strategies course applies.

If the person prepares the food defense plan or conducts reanalysis, the Food Defense Plan Preparation and Reanalysis course applies.

This is why a facility may have one person take several FSPCA food defense courses, or it may use a team approach where different people complete different courses based on their responsibilities.

Do You Need to Take Every FSPCA Food Defense Course?

Not always.

One person may take multiple courses and oversee several food defense activities. Another company may use a team approach. For example, one person may conduct or oversee the vulnerability assessment, another may help identify mitigation strategies, and another may prepare or reanalyze the food defense plan.

Both approaches can work. The important part is making sure each person is qualified for the specific activity they perform or oversee.

That is why it is not enough to say someone is “food defense trained” without knowing what they were trained to do. Food defense training may mean awareness training, IA Rule overview training, vulnerability assessment training, mitigation strategy training, food defense plan preparation training, reanalysis training, or a combination of these.

Is Formal Training the Only Way to Become Qualified?

No. For food defense plan activities, a person may be qualified through education, training, experience, or a combination.

However, formal FSPCA training is often the clearest and most practical way to show that someone completed training aligned with the FDA-recognized standardized curriculum for that specific function.

This matters because many facilities do not have years of internal experience with the IA Rule. Formal training can give the food defense team a stronger foundation and help reduce confusion about which person is qualified for which activity.

Are Food Defense Training Records Required?

Yes. Required food defense training should be documented.

Training records should show who was trained, what training was completed, and when the training occurred. Records help demonstrate that the facility trained the right people for the right responsibilities.

Final Summary: What Is Considered FDA Food Defense Training?

FDA food defense training refers to the FSPCA Intentional Adulteration Rule training courses developed to support 21 CFR Part 121.

Food Defense Awareness is the course most directly tied to a specific training requirement. It is required for employees assigned to actionable process steps and supervisors of those employees.

The Overview of the IA Rule course is optional and helps people understand the regulation.

The Conducting Vulnerability Assessments Using Key Activity Types course is for people conducting vulnerability assessments using the KAT method.

The one-day Conducting Vulnerability Assessments course is for people conducting vulnerability assessments using the three fundamental elements approach. FIC offers this FSPCA course in a live virtual format for food professionals who want a clear instructor-led explanation and the ability to ask questions.

The Identification and Explanation of Mitigation Strategies course is for people identifying and explaining mitigation strategies at actionable process steps.

The Food Defense Plan Preparation and Reanalysis course is for people preparing the food defense plan or conducting reanalysis.

All FSPCA Intentional Adulteration courses are recommended for individuals involved in food defense responsibilities. The right combination of courses depends on the activities the person will perform. Food Defense Awareness is intended for employees and supervisors at actionable process steps, while the other FSPCA IA courses support specific food defense plan activities, including vulnerability assessments, mitigation strategies, food defense plan preparation, and reanalysis.