The Food Safety Modernization Act (FSMA) has put food safety regulations at the forefront of the baking industry’s mind for a while now. In some ways, the law simply confirmed what the baking industry was already doing and made it law. In others, FSMA challenged the industry and changed the way the government and its agencies approach food security altogether.

Protecting food against contamination is one of those areas in which FSMA redefines how bakeries must approach security. Section 106, Protection Against Intentional Adulteration, deals with the threat of someone intentionally causing harm by attacking the U.S. food system. Under this section, bakeries and other food manufacturers are required to develop a food defense plan to prevent such attacks from happening.

“In today’s world, this is a huge problem that everyone needs to address,” said Greg Carr, project planner of baking and snack for The Austin Co. “We read every day about what people are trying to do. They want to cause panic and disruption, and all they have to do is contaminate some flour.”

Before writing off terrorism as something that will never happen to a facility, consider other threats that could become very real very quickly.

“It doesn’t have to be a terrorist,” said Len Heflich, president of Innovation for Success. “It could be a disgruntled employee or someone who wants to play a prank.”

Bakeries could be especially vulnerable because of the nature of the product.

“From our perspective, fresh products from a bakery are high risk because they are distributed daily,” Mr. Carr said. “That bread can be among millions of people, and some of them will be consumed within 24 hours of being produced.”

That leaves the window for recalls small and shrinking, as anyone who has ever conducted one for accidental adulteration knows.

This section of the law, due to go into effect for large companies July 26, 2019, requires bakeries to think beyond accidental adulteration and look at their plants’ weak points and address them. This doesn’t have to be overwhelming, though.

“The emphasis here needs to be on keeping it simple,” Mr. Heflich said. “Don’t overcomplicate this and think it means you need to install fences and cameras and security guards. It doesn’t require any of those things. It requires that you consider potential risks, and if you can do something about them, reduce or manage them, you do it.”

Shifting focus

“Under the old food safety rules, the Food and Drug Administration (F.D.A.) and U.S. Department of Agriculture (U.S.D.A.) had regulations to control the normal accidental contamination that would happen from insects or getting delivered the wrong product,” Mr. Carr said. “What FSMSA focuses on is preventing intentional contamination, so now you’re really into a different realm. Now you’re trying to stop people from trying to cause you harm.”

As the industry makes this shift, FSMA leaves much of the detail up to the bakery. While previous guidance from the F.D.A. has been more direct, like dictating the use of non-flaking paint, Section 106 only requires that bakeries be able to show that they have effective and reasonable controls, training and record-keeping.

“What’s reasonable and effective is very dependent on your situation, so it’s hard for the F.D.A. to determine that,” Mr. Heflich said about the vagueness of the law. “But it would be perfectly reasonable to expect that you would have some kind of program in place, that you’ve trained your employees, that you’ve got some documentation and you’ve got some controls and checks in place to detect failure. That’s what FSMA is asking for.”

With the exact details of their plans left up to each individual bakery, it can be intimidating to get started. For new bakeries, a conversation with a design and engineering firm about security can be enlightening.

“During the design development phase, once we get basic planning and programming in place, we’ll have the security conversation,” said John Koury, architect consultant for AM King. During this conversation, Mr. Koury discusses the bakery entrances for management, employees and visitors as well as how the plant will control access to various vulnerable places.

In existing bakeries, a risk assessment of the facility is a good place to start. When Bimbo Bakeries USA (B.B.U.) began looking at the security of its plants 10 years ago, the company started by evaluating its individual facilities. B.B.U recognized that each one’s needs would be different. “Based on the risk assessments, we have customized our plans and programs by bakery because each bakery is different,” explained Arturo Carrillo, director of food safety, B.B.U. “Once we defined the sensitive areas, we defined the procedures and actions necessary to make them secure.”

Often these susceptible places are centered around the facility itself or the people entering it.

The bakery’s property is the first line of defense against those who wish to cause harm. Fences are an obvious measure to keep threats out, but bakers shouldn’t just erect a fence and assume they have done their due diligence. The four walls and the roof of the bakery also can provide security or danger. Bakers should start their risk assessment by evaluating the outside and inside of their property for any vulnerabilities.

A simple walk around and through the bakery to look for places where someone could gain unauthorized access can be eye-opening. Mr. Heflich suggested including the plant’s maintenance, food safety and sanitation managers on this assessment.

“They’re usually very knowledgeable about the building, structure and who has access to what,” he said.

On the outside of the building, pay attention to places where people can enter restricted areas unnoticed. If the bakery has its own delivery trucks, are those locked? Can someone gain access to them unseen? And don’t forget the roof.

“Today, someone could fly in a little drone and throw something into an air intake, with no one the wiser,” Mr. Carr said.

When walking through the plant, put yourself into the mindset of someone trying to do harm. For example, chemicals used in sanitation pose a well-known risk. Evaluate chemical storage areas. Is access restricted? Is inventory control effective? A bakery must ensure that only authorized people have access to dangerous materials and that inventory is kept up-to-date to enable bakers know what exactly they are storing in what quantities.

“If a large amount of a chemical went missing, you would know it then,” Mr. Heflich said.

Once this assessment of building and layout is finished, the bakery team should look at what can be done to mitigate every possible risk. In a new facility, a central security system can be installed to restrict access to only those who are authorized.

Cameras are an easy and inexpensive way to do many of these tasks.

“They’re very inexpensive today, so we like to have a lot of ‘eyes’ covering all the doorways and openings to the building as well as up on the roof,” Mr. Carr said.

The trick with cameras, however, is that someone on staff must watch the monitors.

Granting access

By far, people pose the greatest threat. Controlled access is the best defense when it comes to managing people entering the facility and moving throughout it. Typically, bakeries must manage access for four kinds of people: employees, vendors, visitors and drivers. Each category should be assigned access authority.

The people with the most access are going to be the most difficult to defend against — namely, the disgruntled employee.

“This is probably the most difficult risk to minimize because they’re authorized to be in the plant, and they could easily bring a contaminant with them,” Mr. Carr said.

Keycards or biometric controls such as fingerprint scanners can identify who is in what part of the plant and, thus, can restrict access to specific areas. They also record how people move throughout the bakery. Some places need only a locked door. In other locations, turnstiles can help keep people entering the bakery in an orderly fashion and prevent outsiders from slipping in behind employees.

Employees also can be great allies when it comes to detecting threats from outsiders.

“People in your facility need to be vigilant for food defense,” Mr. Heflich said. “They should know that they have a responsibility to confront people on the premises who they don’t know.”

It gets tricky with vendors and contractors because they require some access to the facility but don’t need total access.

“Contractors are difficult to control because plant management doesn’t know who they are,” Mr. Carr said.

For example, technicians are granted access to work on the HVAC system, but they can be strangers moving throughout the plant.

Mr. Carr suggested the bakery supply temporary ID cards to outsiders with legitimate business at the plant. Many technicians and vendors will have IDs from their employers, but one issued by the bakery has the advantage of vetting by the bakery itself.

Another primary line of defense is the entryway. All entrances should be locked and monitored, but in the case of visitors, especially potential customers, how does a bakery maintain security while also feeling welcoming?

“When you’re visiting a bakery, sometimes there is just a vestibule and a phone to gain entry,” Mr. Koury said. “It’s a challenge, being secure but welcoming. Nothing beats putting a staffer in a chair at the reception area.”

This person can also serve as the point of contact not just for visitors and clients but also deliveries, vendors and service calls.

A particularly weak place in the bakery for security is shipping and receiving. Here, ingredients and supplies are dropped off and products shipped out. Employees interact with drivers at the front and back ends of the operation. While some companies manage the main entrance with just a vestibule and a phone, they need employees supervising shipping and receiving.

“If you don’t have someone checking deliveries, you’ll end up having delivery drivers or service techs just walking into the building through the shipping and receiving dock,” Mr. Koury said.

Drivers don’t need much access to the building. Mr. Carr suggested restricting their access as much as possible. Build isolated restrooms for drivers to use. Conduct the transaction through a pass-through window. Incorporate a quarantine area for inspecting non-bulk ingredients before taking them inside the plant. Ensure outside ingredient storage tanks and silos are visible from the inside by the bakery’s employees.

“You don’t want a driver somewhere on the back of the building, where no one can see him to know if he’s unloading ingredients properly,” he said.

And again, Mr. Carr expressed the importance of bakery-issued IDs.

“Thus, the outsiders don’t even get to unlock the cap from the truck unless they show the ID,” he said.

All of this may sound a bit complicated, but it’s important to remember that FSMA requires each bakery understand its risks and mitigate and manage them in a reasonable way for their specific operation. For an existing plant, that may require security cameras, training and documentation. For a brand new plant, that may mean a central security system, biometric locks, quarantined ingredient receiving and isolated areas for delivery drivers.

But, it’s all worth it to protect the end-user.

“We do this because we care about the consumer and our brands,” Mr. Carrillo said. “Because, at the end of the day, we are also consumers and so are our families.”