Publishing and copyright information

The BSI copyright notice displayed in this document indicates when the document was last issued.

No copying without BSI permission except as permitted by copyright law.

Publication history

First published March 2008

Second edition March 2010

Third edition October 2014

Fourth (current) edition November 2017

Foreword

This PAS was sponsored by the Department for Environment, Food & Rural Affairs (Defra) and the Food Standards Agency (FSA). Its development was facilitated by BSI Standards Limited and it was published under licence from The British Standards Institution. It came into effect on 16 November 2017.

Acknowledgement is given to the following organizations that were involved in the development of this PAS as members of the steering group:

•	Agrico UK Limited
•	British Frozen Food Federation (BFFF)
•	Campden BRI
•	Crowe Clark Whitehill LLP
•	Danone
•	Department for Environment, Food & Rural Affairs (Defra)
•	Food Standards Agency
•	GIST Limited
•	McDonald’s Europe
•	National Cyber Security Centre (NCSC)
•	Sodexo Limited
•	Tesco UK
•	Tulip Limited
•	University College London
•	Willis Towers Watson

Acknowledgement is also given to the members of a wider review panel who were consulted in the development of this PAS.

The British Standards Institution retains ownership and copyright of this PAS. BSI Standards Limited as the publisher of the PAS reserves the right to withdraw or amend this PAS on receipt of authoritative advice that it is appropriate to do so. This PAS will be reviewed at intervals not exceeding two years, and any amendments arising from the review will be published as an amended PAS and publicized in Update Standards.

This PAS is not to be regarded as a British Standard. It will be withdrawn upon publication of its content in, or as, a British Standard.

The PAS process enables a guide to be rapidly developed in order to fulfil an immediate need in industry. A PAS can be considered for further development as a British Standard, or constitute part of the UK input into the development of a European or International Standard.

Supersession

This PAS supersedes PAS 96:2014, which is withdrawn.

Information about this document

This is a full revision of the PAS 96:2014, and introduces the following principal changes:

•	normative and informative references have been updated;
•	subclause 3.7 Cyber-crime has been revised;
•	subclause 6.2.4 added to cover vulnerabilities related to cyber-attacks;
•	two new fictional case studies have been added as subclauses A.5 and A.6 to illustrate cyber security issues;
•	Annex B updated;
•	Annex D added covering 10 steps to cyber security;
•	some editorial amendments have been undertaken.

Use of this document

As a guide, this PAS takes the form of guidance and recommendations. It should not be quoted as if it were a specification or a code of practice and claims of compliance cannot be made to it.

Presentational conventions

The guidance in this standard is presented in roman (i.e. upright) type. Any recommendations are expressed in sentences in which the principal auxiliary verb is “should”.

Commentary, explanation and general informative material is presented in smaller italic type, and does not constitute a normative element.

Contractual and legal considerations

This publication does not purport to include all the necessary provisions of a contract. Users are responsible for its correct application.

Compliance with a PAS cannot confer immunity from legal obligations.

Introduction

The food industry sees the safety of its products as its main concern. Over the years, industry and regulators have developed food safety management systems which mean that major outbreaks of food poisoning are now quite unusual in many countries. These systems typically use Hazard Analysis Critical Control Point (HACCP) principles which are accepted globally.1) HACCP has proven to be effective against accidental contamination.

HACCP principles however have not been routinely used to detect or mitigate deliberate attacks on a system or process. Such attacks include deliberate contamination, electronic intrusion, and fraud. Deliberate acts may have food safety implications but can harm organizations in other ways, such as damaging business reputation or extorting money.

The common factor behind all such deliberate acts is people. These people may be within a food business, may be employees of a supplier to the food business, or may be complete outsiders with no connection to the food business. The key issue being their motivation, they may aim to cause harm to human health, business reputation, or make financial gains at the expense of the business. In any of these situations it is in the interests of the food business to protect itself from such attacks.

The purpose of PAS 96 is to guide food business managers through approaches and procedures to improve the resilience of supply chains to fraud or other forms of attack. It aims to assure the authenticity and safety of food by minimizing the chance of an attack and mitigating the consequences of a successful attack.

PAS 96 describes Threat Assessment Critical Control Points (TACCP), a risk management methodology, which aligns with HACCP, but has a different focus, that may need input from employees from different disciplines, such as human resources, procurement, security and information technology.

It explains the TACCP process, outlines steps that can deter an attacker or give early detection of an attack, and uses fictitious case studies (see Annex A) to show its application. Broadly, TACCP places food business managers in the position of an attacker to anticipate their motivation, capability and opportunity to carry out an attack, and then helps them devise protection. It also provides other sources of information and intelligence that may help identify emerging threats (see Annex B).

The TACCP process assumes and builds on a business’ existing effective operation of HACCP, as many precautions taken to assure the safety of food are likely to also deter or detect deliberate acts. It also complements existing business risk management and incident management processes.

The focus of this PAS is on protecting the integrity and wholesomeness of food and food supply. Any intending attacker, whether from within a food business or its supply chain or external to both, is likely to attempt to elude or avoid routine management processes. It should help food businesses mitigate each of these threats, but the approach may also be used for other business threats.

No process can guarantee that food and food supply are not the target of criminal activity, but the use of PAS 96 can make it less likely. It is intended to be a practical and easily used guide and so is written in everyday language and is to be used in a commonsense rather than legalistic way.

1 Scope

This PAS provides guidance on the avoidance and mitigation of threats to food and food supply. It describes a risk management methodology, Threat Assessment Critical Control Points (TACCP), which can be adapted by food businesses of all sizes and at all points in food supply chains. While concerns for the safety and integrity of food and drink are paramount and much of the PAS is focussed on them, it needs to be stressed that its scope covers ‘All Threats’ and protection of all elements of food supply. This includes the viability of businesses within the supply chain.

It is intended to be of use to all organizations, but is of particular use to managers of small and medium sized food enterprises without easy access to specialist advice.

2 Terms and definitions

3 Types of threat

3.1 General

3.2 Economically motivated adulteration (EMA)

3.3 Malicious contamination

3.4 Extortion

3.5 Espionage

3.6 Counterfeiting

3.7 Cyber crime

4 Understanding the attacker

4.1 General

4.2 The extortionist

4.3 The opportunist

4.4 The extremist

4.5 The irrational individual

4.6 The disgruntled individual

4.7 Cyber criminals and other malicious digital actors

4.8 The professional criminal

5 Threat Assessment Critical Control Point (TACCP)

5.1 Broad themes

5.2 TACCP process

6 Assessment

6.1 Evaluating threats

6.2 Identifying vulnerabilities

6.3 Assessment of risk

6.4 TACCP reporting

7 Critical controls

7.1 Controlling access

7.2 Tamper detection

7.3 Assuring personnel security

8 Response to an incident

8.1 Management of a food protection crisis

8.2 Management of a cyber-attack

8.3 Contingency planning for recovery from attack

9 Review of food protection arrangements

Bibliography

PAS 96:2017

Guide to protecting and defending food and drink from deliberate attack

Current

Published:

16 Nov 2017