Food defense - IFS Food — RAG Documentaire

## **IFS Product and Food Defence Guideline**

Fragment 1 texte

IFS would like to thank all participants who contributed to the review process for the IFS Product and Food Defence Gui…

Fragment 5 texte

This guideline is a supporting document related to the topic of product defence. It is not a normative document, and it…

Fragment 6 texte

Food defence requirements are subject to different regulations in different countries and regions, which must be taken …

Fragment 7 texte

## **TABLE OF CONTENTS**

Fragment 8 texte

|**1**|**Introduction**|**3**| |---|---|---| |**2**|**Definitions and general aspects**|**5**| ||2.1 General aspects|6…

Fragment 9 texte

Product defence – including food defence – has become a relevant topic for many industries to counteract intentional ta…

Fragment 12 texte

The guideline addresses suppliers of food and non-food products (non-food products as detailed in the Standards IFS HPC…

Fragment 13 texte

There is currently no comprehensive or explicit regulation of product defence at EU level, but since the manufacturer i…

Fragment 14 texte

This guideline has been adapted to the product defence requirements of the current version of IFS Food – IFS Food versi…

Fragment 15 texte

Furthermore, a chapter on cybersecurity has been added, as all external threats related to product defence should be ad…

Fragment 16 texte

2 Definitions and general aspects

Fragment 17 texte

Product and food defence does not have an international harmonised definition but you can find some descriptions and de…

Fragment 19 texte

Product defence in this document comprises all measures by which a product can be protected against tampering or other …

Fragment 20 texte

The aim should be to “prevent food products from intentional adulteration from acts intended to cause wide-scale harm t…

Fragment 21 texte

## **IFS Definition of product and food defence**

Fragment 22 texte

Procedures implemented to assure the protection of food and non-food products and their supply chain from malicious and…

Fragment 23 texte

The purpose of a product defence procedure and plan is to identify, prevent or mitigate and monitor possible sources of…

Fragment 24 texte

## **2.1 General aspects**

Fragment 27 texte

As specified in the IFS Product Fraud Mitigation Guideline, product fraud mitigation and product defence have the same …

Fragment 28 texte

Nonetheless, similarities can be seen within the approach to address product/food defence and fraud (see Figure 3).

Fragment 29 texte

## **Food safety, food defence and food fraud – differences and common assessment method**

Fragment 31 texte

Source: TQCS International

Fragment 33 texte

## FIGURE 3 **Similarities within the approach of food fraud and food defence**

Fragment 34 texte

IFS recommends the TACCP method for product and food defence (while VACCP applies to food fraud mitigation). This appro…

Fragment 36 texte

Detailed explanations concerning IFS Food Fraud Requirements can be found in the IFS Product Fraud Mitigation Guideline.

Fragment 37 texte

**TACCP:** “Threat Assessment and Critical Control Points” analyses threats such as deliberate contamination of food, s…

Fragment 38 texte

**VACCP: “** Vulnerability Assessment and Critical Control Points” to identify vulnerabilities for a food business due …

Fragment 39 texte

## Example of a product defence assessment 3

Fragment 41 texte

## **3 EXAMPLE OF A PRODUCT DEFENCE ASSESSMENT**

Fragment 43 texte

IFS does not define what the product defence procedure and plan should entail. The company is free to develop its own t…

Fragment 44 texte

Figures 4–8 show the TACCP method **as an example** for a product/food defence assessment. (Adapted from Source: TACCP/…

Fragment 45 texte

FIGURE 4 **Approach of TACCP method**

Fragment 46 texte

**1. Who might Review current Define risk levels Develop and want to attack TACCP measures (normal/high/ evaluate your…

Fragment 51 texte

- **Audit and review**

Fragment 53 texte

FIGURE 5 **Examples for impact assessment criteria**

Fragment 55 texte

FIGURE 6 **Examples for likelihood assessment criteria**

Fragment 57 texte

FIGURE 7 **Example for risk scoring matrix for personnel**

Fragment 59 texte

FIGURE 8 **Example for development of mitigation measures for potential attackers**

Fragment 61 texte

Once the organisation identifies product/food defence threats and vulnerabilities, appropriate control measures shall b…

Fragment 64 texte

Records are evidence of effective implementation and provide information about the extent to which the product defence …

Fragment 65 texte

In some cases, a site registration is mandatory in different countries (e. g. Bioterrorism Act and the FDA registration…

Fragment 66 texte

While conducting the product defence assessment, different factors should be considered. These may include:

Fragment 67 texte

- **Accessibility to the production site:**

Fragment 68 texte

- Surroundings and construction/design of the production site

Fragment 69 texte

- Contract and temporary employees may be a major risk

Fragment 70 texte

- Accessibility to Information Technology (IT), Operational Technology (OT), (manipulability of production settings and…

Fragment 71 texte

- **The characteristics of some products and processes may make them more vulnerable to intentional adulteration than o…

Fragment 72 texte

- Production batch size

Fragment 73 texte

- Variety of products and processes

Fragment 74 texte

- Accessibility to the product.

Fragment 76 texte

- **Situational factors could increase the risk of intentional adulteration. Such factors include:**

Fragment 77 texte

- Disgruntled employees

Fragment 78 texte

- National, political, business, personal, or other differences

Fragment 79 texte

- Changes in organisational culture

Fragment 80 texte

- Economic disruption / financial gain

Fragment 81 texte

Tests of the effectiveness of the existing product defence measures can be performed internally or with the help of ext…

Fragment 83 texte

## **Checklist for internal use on site**

Fragment 84 texte

Are doors, windows and roof areas kept secure (e. g. security doors or access with chip cards in critical areas)?

Fragment 86 texte

- Is a perimeter fence or wall necessary? If a perimeter fence or wall exists, is it in good condition?

Fragment 87 texte

Is the access of people and vehicles controlled?

Fragment 88 texte

Are there backup sources of critical utilities, such as electrical, water, information technology (computer data), and …

Fragment 89 texte

How are bulk receiving and storage areas secured (a responsible person from the receiving party should be present durin…

Fragment 90 texte

Are surveillance methods utilised — such as cameras, staff supervision, or security services?

Fragment 92 texte

Are hazardous materials or controlled substances managed (e. g. chemicals like cleaning agents, acids, lye, flammable l…

Fragment 93 texte

Is staff access limited to appropriate work location, job function and working hours?

Fragment 94 texte

## **Shipping and Receiving**

Fragment 95 texte

Are transportation vessels sealed/locked properly and are seals traceable?

Fragment 96 texte

Do drivers provide appropriate credentials and documentation (e. g. plot number)?

Fragment 97 texte

Are transportation service providers part of the supplier approval program?

Fragment 98 texte

Are water, ice and steam sources secure and monitored?

Fragment 100 texte

Are all raw materials secured and monitored when not in use?

Fragment 101 texte

Are packaging materials and product labels and seals (if applicable) controlled?

Fragment 102 texte

Are personal background checks necessary or performed, if allowed by law?

Fragment 104 texte

Has the potential for retaliatory actions by terminated/previous employees been assessed?

Fragment 105 texte

Are personnel supervised? Are cameras allowed?

Fragment 106 texte

Are employees trained in food/product defence awareness and identifying/reporting unusual or suspicious behaviour?

Fragment 107 texte

Is there a policy addressing personal items/legal or illegal weapons and drugs?

Fragment 108 texte

Are cyberthreats continously identified?

Fragment 110 texte

Are these threats effectively controlled?

Fragment 111 texte

4 Food and product defence requirements in IFS Standards

Fragment 112 texte

## **4 FOOD AND PRODUCT DEFENCE REQUIREMENTS IN IFS STANDARDS**

Fragment 114 texte

## **4.1 Explanation of IFS Food Defence Requirements**

Fragment 115 texte

This chapter contains background information and suggestions for implementing certain requirements of the IFS Food Stan…

Fragment 116 texte

## **4.1.1 Responsibilities and training**

Fragment 117 texte

## **Requirement 4.21.1, IFS Food version 8**

Fragment 118 texte

The responsibilities for food defence shall be defined. The responsible person(s) shall have the appropriate specific k…

Fragment 119 texte

It is essential that the product/food defence team has a solid knowledge about potential threats in all areas and how t…

Fragment 122 texte

If applicable (if food defence is legally required in the production and destination countries of products), there shou…

Fragment 123 texte

“The responsible person(s)” could be a team or one person.

Fragment 126 texte

In the case of a team, this team should include cross functional employees from all levels within the organisation. The…

Fragment 127 texte

## **Requirement 3.3.4, IFS Food Version 8**

Fragment 129 texte

The contents of training and/or instruction shall be reviewed and updated when necessary. Special consideration shall b…

Fragment 130 texte

- product authenticity, including food fraud

Fragment 132 texte

- food related legal requirements

Fragment 135 texte

- product/process modifications

Fragment 136 texte

- feedback from the previous documented training/instruction programs.

Fragment 137 texte

If specific food defence legislation is applicable in the production and destination countries of products, there shoul…

Fragment 138 texte

## **Questions that the auditor should ask and the company should be able to provide an answer to:**

Fragment 140 texte

- **1** Who is accountable for the food defence procedure and plan?

Fragment 141 texte

- **2** What are the competence and qualifications demonstrated by the person(s) responsible for the food defence proce…

Fragment 142 texte

- **3** Was this communicated to the members of the company? How?

Fragment 143 texte

- **4** Is food defence included in trainings and instructions?

Fragment 144 texte

## **4.1.2 Food defence procedure and plan**

Fragment 145 texte

## **Requirement 4.21.2, IFS Food version 8**

Fragment 146 texte

A food defence procedure and plan shall be documented, implemented and maintained to identify potential threats and def…

Fragment 147 texte

- identification of critical areas and/or practices and policy of access by employees

Fragment 149 texte

- visitors and contractors

Fragment 150 texte

- how to manage external inspections and regulatory visits

Fragment 151 texte

- any other appropriate control measures.

Fragment 152 texte

It is essential to gain a broad overview of all applicable threats to develop an effective food defence procedure and p…

Fragment 155 texte

All measures should aim to control the identified threats to minimise the probability of adverse effects to the product…

Fragment 156 texte

## **HOW / WHAT THREATS?**

Fragment 158 texte

The following four step approach can be considered the backbone of a structured threat analysis:

Fragment 159 texte

- **1** threat identification,

Fragment 160 texte

- **2** threat characterisation,

Fragment 161 texte

- **3** exposure assessment, and

Fragment 162 texte

- **4** characterisation of occurrence probability.

Fragment 163 texte

All threats should be compared with historical and anticipated events, to evaluate the forementioned four iterative ste…

Fragment 164 texte

It is recommended to use checklists and/or software to map the threats and determine the level of risk for each threat.…

Fragment 165 texte

- People who oversee processes, packaging, transportation and warehousing, and therefore **gain access to critical info…

Fragment 166 texte

- People who have access to the premises and are able to **adulterate the product without being discovered** . If there…

Fragment 167 texte

## **Questions that the auditor should ask and the company should be able to provide an answer to:**

Fragment 169 texte

- **1** What legal/customer food defence requirements are applicable to the company?

Fragment 170 texte

- **2** How can the company demonstrate compliance with such requirements?

Fragment 171 texte

- **3** How are external visits managed?

Fragment 172 texte

- **4** Which details were recorded during the last official visit?

Fragment 173 texte

## **4.1.3 Site security**

Fragment 175 texte

There are many ways to manage threats and many types of situations that create a risk of unauthorised access. Examples …

Fragment 176 texte

Specific attention should be paid to easily accessible raw materials, intermediate and finished products, chemicals (cl…

Fragment 177 texte

Controls for incoming and outgoing goods such as seals and labels can provide additional security. The seals should be …

Fragment 178 texte

According to requirement 4.21.2 the **identification of critical areas/practices, access policies for employees, visito…

Fragment 179 texte

## **Questions that the auditor should ask and the company should be able to provide an answer to:**

Fragment 181 texte

- **1** Based on the food defence procedure and plan, what areas have been identified as critical?

Fragment 182 texte

- **2** What control measures are in place in order to control access to those areas and other premises?

Fragment 183 texte

- **3** Does the policy of access include the following people?

Fragment 184 texte

- Temporary employees

Fragment 185 texte

- 4 Are records available which provide evidence that all visitors and contractors have received the necessary introdu…

Fragment 190 texte

## **4.1.4 Review and test of effectiveness**

Fragment 191 texte

## **Requirement 4.21.3, IFS Food Version 8**

Fragment 192 texte

The food defence plan shall be tested for effectiveness and reviewed at least once within a 12-month period or whenever…

Fragment 193 texte

Due to the nature of products and the high volatility of potential threats, it is essential to review the food defence …

Fragment 196 texte

A food defence plan for the implementation of the identified control measures will help the organisation in defining th…

Fragment 197 texte

The food defence plan should be an established part of the internal audit process.

Fragment 200 texte

Once the plan is implemented, identified vulnerabilities controlled and deficiencies rectified, it is time for the revi…

Fragment 201 texte

Tests of effectiveness can be performed internally or with an external service provider. FDA provides the Food Related …

Fragment 202 texte

**The exercise process as a P-D-C-A cycle (plan – do – check – act)**

Fragment 204 texte

## **Questions that the auditor should ask and the company should be able to provide an answer to:**

Fragment 208 texte

- **1** How often is a review of the food defence plan performed?

Fragment 209 texte

- **2** What criteria does the company consider when determining the frequency of the assessment of threats and their l…

Fragment 210 texte

- **3** When was the last test of effectiveness carried out? Internally or externally?

Fragment 211 texte

- **4** Has any incident or attack taken place since the last audit? How was it managed?

Fragment 212 texte

- **5** How is recurrence prevented?

Fragment 213 texte

## **4.1.5 Commitment of the senior management**

Fragment 214 texte

## **Requirement 1.2.5, IFS Food Version 8**

Fragment 215 texte

The senior management shall maintain a system to ensure that the company is kept informed of all relevant legislation, …

Fragment 216 texte

## **Requirement 1.3.1, IFS Food Version 8**

Fragment 217 texte

The senior management shall ensure that the food safety and quality management system is reviewed. This activity shall …

Fragment 218 texte

- a review of objectives and policies including elements of food safety culture

Fragment 219 texte

- results of audits and site inspections

Fragment 220 texte

- positive and negative customer feedback

Fragment 221 texte

- food fraud assessment outcome

Fragment 223 texte

- food defence assessment outcome

Fragment 224 texte

- status of corrections and corrective actions

Fragment 226 texte

- notifications from authorities.

Fragment 227 texte

The senior management is committed to include product defence into the existing management system because product defen…

Fragment 230 texte

The company should be kept up to date with the current risks in the area of product defence at all times. Furthermore, …

Fragment 233 texte

## **Questions that the auditor should ask and the company should be able to provide an answer to:**

Fragment 234 texte

- **1** How is the company kept up to date with regard to product defence risks?

Fragment 235 texte

- **2** Did the last management review identify a need for investment in product defence?

Fragment 236 texte

## **4.2 Explanations of the IFS HPC Product Defence Requirements**

Fragment 237 texte

In this chapter the IFS HPC Product Defence Requirements are explained. The interpretation is exemplarily and can be tr…

Fragment 238 texte

## **4.2.1 Responsibilities**

Fragment 239 texte

## **Requirement 4.18.2, IFS HPC version 3**

Fragment 240 texte

The responsibilities for product defence shall be defined. The responsible person(s) shall have full commitment from th…

Fragment 241 texte

A product defence team (it could be a person or a team) shall be established, which is accountable to the facility mana…

Fragment 242 texte

The team should be interdisciplinary within the organisation (if applicable). The members/person should have appropriat…

Fragment 243 texte

It is recommended to include the review of the product defence plan in the annual senior management review.

Fragment 244 texte

**Questions that the auditor should ask and the company should be able to provide an answer to:**

Fragment 247 texte

- **1** Who is accountable for the product defence procedure and plan?

Fragment 248 texte

- **2** What competences and qualifications are demonstrated by the person(s) responsible for product defence?

Fragment 249 texte

- **3** What is the position of the person(s) responsible for product defence with respect to the senior management tea…

Fragment 250 texte

- **4** How does senior management support the person(s) responsible for product defence?

Fragment 251 texte

- **5** Where are the responsibilities clearly defined?

Fragment 252 texte

- **6** Was this communicated to the members of the company? How?

Fragment 253 texte

## **4.2.2 Product defence procedure and plan and review**

Fragment 254 texte

## **Requirement 4.18.1, IFS HPC version 3**

Fragment 255 texte

A product defence procedure and plan shall be implemented in relation to assessed threats. This shall encompass a minim…

Fragment 256 texte

- identification of critical areas and/or practices and policy of access by employees, visitors and contractors,

Fragment 257 texte

- transport vehicles,

Fragment 258 texte

- legal requirements, if applicable,

Fragment 260 texte

- any other appropriate control measure.

Fragment 261 texte

The product defence plan shall be well known and established in the company and shall be reviewed annually and upon cha…

Fragment 262 texte

The company shall perform an assessment of the relevant threats and implement a product defence procedure and plan, wit…

Fragment 263 texte

IFS does not define what kind of assessment/procedure should be chosen. The company is free to develop its own tools/pr…

Fragment 264 texte

Regardless of the applied procedure and plan, all relevant security aspects of the location shall be taken into account…

Fragment 265 texte

As a result of this product defence assessment with regard to threats and their likelihood, the conditions under which …

Fragment 266 texte

Furthermore, it is important that the senior management has identified which personnel have access to certain areas and…

Fragment 267 texte

Reviewing and verifying, at least annually or upon changes is necessary to ensure the effectiveness of the site securit…

Fragment 268 texte

The procedure and plan should be revised accordingly and detailed information should be kept confidential.

Fragment 269 texte

## **Questions that the auditor should ask and the company should be able to provide an answer to:**

Fragment 271 texte

- **1** Based on the product defence assessment of threats and their likelihood, what areas have been identified as cri…

Fragment 272 texte

- **2** What control measures are in place to control access to those areas?

Fragment 273 texte

- **3** How does the company maintain control over who enters the premises and critical areas?

Fragment 274 texte

- **4** What access controls are applicable to the following groups of people?

Fragment 275 texte

- Temporary employees

Fragment 276 texte

- **5** Are visitors and contractors informed of the product defence rules and their scope while on company premises?

Fragment 281 texte

- **6** Does the company have the defined means to ensure that contractors who will spend a long time inside the plant …

Fragment 282 texte

- **7** Are there controls to ensure that truck drivers who load or unload products/materials are restricted to defined…

Fragment 283 texte

- **8** If contractors and visitors are provided with access keys, are those keys programmed to limit access to specifi…

Fragment 284 texte

- **9** Are access controls updated at the time of termination of an employee or when work is finished on the part of a…

Fragment 285 texte

- **10** What legal/customer product defence requirements are applicable to the company?

Fragment 286 texte

- **11** When was the last review, what was checked and what had to be adapted?

Fragment 287 texte

## **4.3 Overview on product defence in further IFS Standards and Programs**

Fragment 289 texte

The requirements for product defence are most comprehensively addressed in IFS Food due to the handling of open product…

Fragment 290 texte

The requirements for product defence in IFS Logistics are similar to those of IFS Food version 8. The focus of product …

Fragment 293 texte

The IFS Broker Standard has very basic requirements related to product defence since there is no physical handling of t…

Fragment 296 texte

## **IFS Wholesale/Cash & Carry**

Fragment 298 texte

The IFS Wholesale/Cash & Carry version 2 also relates to food processing and handling.

Fragment 299 texte

The requirements are therefore similar to those in the IFS Food Standard and the interpretation can be transferred.

Fragment 300 texte

## **// Overview on product defence in further IFS Standards and Programs**

Fragment 301 texte

The requirements for product defence in IFS PACsecure version 3 are similar to IFS HPC and the interpretation can be tr…

Fragment 304 texte

## **IFS Progress Food**

Fragment 306 texte

The IFS Progress Food Program helps food suppliers to gradually establish comprehensive processes for food safety and q…

Fragment 307 texte

Please find an overview of the detailed product defence requirements of IFS Standards in annex.

Fragment 308 texte

Cybersecurity and 5 product defence

Fragment 309 texte

## **5 CYBERSECURITY AND PRODUCT DEFENCE**

Fragment 311 texte

## **5.1 Introduction**

Fragment 312 texte

Given the tendency of food companies to introduce digital technologies throughout the food supply chain and the importa…

Fragment 313 texte

In the EU, Directive (EU) 2022/2555, also called NIS2 Directive, takes account of the fact that a common cybersecurity …

Fragment 314 texte

Also, ISO 22000 gives cybersecurity relevance within the food/product safety management system. According to this gener…

Fragment 315 texte

**Industry 4.0 refers to the intelligent networking of machines and processes for industry with the help of information…

Fragment 316 texte

Due to the ever-increasing importance of IT/ICT solutions and the complicated geopolitical situation that increases the…

Fragment 317 texte

- What should be protected? (5.3)

Fragment 319 texte

- What are the dangers and possible risks? (5.4)

Fragment 320 texte

- Implementation of Incident Response Management (5.5)

Fragment 321 texte

- Role of the product safety management (5.6)

Fragment 322 texte

The chapter “Cybersecurity and product defence” is intended to provide basic knowledge on the topic and is aimed both a…

Fragment 324 texte

## **5.2 Definitions**

Fragment 326 texte

The term cybersecurity is defined in this chapter as follows: “Cybersecurity is the stable environment that ensures and…

Fragment 327 texte

The aim is to raise awareness and help companies integrate cybersecurity measures, for example through incident respons…

Fragment 328 texte

- **Cybersecurity:** Preservation of confidentiality, integrity, and availability of information in the cyberspace. (IS…

Fragment 329 texte

- The ISO 27001 defines cybersecurity as the art to protect networks, devices, and data from unauthorised access or cri…

Fragment 330 texte

(Source: CISA – American Cybersecurity and Infrastructure Security Agency).

Fragment 331 texte

- **Information technology (IT)** focuses on data and communication. IT comprises the use of hardware and software to m…

Fragment 332 texte

(Source: GARTNER DEUTSCHLAND GMBH [online]: Operational Technology. 2022).

Fragment 333 texte

- **Operational technology (OT)** focuses on the management and control of physical devices existing and operating in t…

Fragment 334 texte

- **Information and communication technology (ICT)** is defined as a diverse set of technological tools and resources u…

Fragment 335 texte

(Source: (UNESCO’s International Institute for Educational Planning, learningportal.iiep.unesco.org, 2009)

Fragment 336 texte

## **5.3 What should be protected?**

Fragment 337 texte

This question is crucial as the relevance and sensitivity of the data and what it should be protected against must be c…

Fragment 338 texte

To have an overview, it is recommended to develop an up-to-date list of all assets, including details on device connect…

Fragment 339 texte

After completing the inventory and identifying the assets, a risk assessment can be performed for specific assets to id…

Fragment 340 texte

Applying current standards like ISO 27001, ISO 22301 and IEC 62443 (IEC – International Electrotechnical Commission) he…

Fragment 341 texte

## **5.4 What are the dangers and possible risks?**

Fragment 342 texte

With increasing possibilities and growing technical dependency on digital networks, the number of cyberattacks is also …

Fragment 343 texte

Convergence (merging) of IT and OT networks can make it more difficult to control them efficiently and can lead to majo…

Fragment 344 texte

Although external threats to OT are rare, internal threats should not be neglected. Food and non-food product safety ca…

Fragment 346 texte

FIGURE 10 **Connection of IT, OT, IoT, IIoT and the respective devices**

Fragment 347 texte

Industry-safe and -secure cybersecurity respects the differences between IT and OT environments, and thus the use of pr…

Fragment 349 texte

European Union Agency for Cybersecurity (ENISA) has sorted threats into eight groups (Source: ENISA, October 2022). The…

Fragment 350 texte

- Social engineering / Phishing

Fragment 353 texte

- Threats against data

Fragment 354 texte

- Threats against availability

Fragment 355 texte

- Disinformation – misinformation (AI-enabled disinformation, deepfakes and disinformation-as-a-service)

Fragment 356 texte

- Supply chain targeting (third-party incidents)

Fragment 357 texte

While the company’s internal cybersecurity system is crucial for the first 5 threats, the key actions against disinform…

Fragment 358 texte

To complete the list of possible threats, Paragraph 79 of Directive (EU) 2022/2555 recommends “to protect network and i…

Fragment 359 texte

## **5.5 Implementation of Incident Response Management**

Fragment 360 texte

Incident Response Management is one of the most effective ways to minimise the damage of a cyberattack. It not only pre…

Fragment 361 texte

In addition, conducting exercises and tests (e. g. security tests, attack scenarios) is of great importance, as further…

Fragment 363 texte

FIGURE 11 **Approach of Incident Response Management**

Fragment 364 texte

- **1 PREPARATION 2 IDENTIFICATION 3 CONTAINMENT 4 EXTINCTION 5 POST-INCIDENT** • List of all assets Origin and target …

Fragment 369 texte

Source: based on BOSCH CyberCompare Whitepaper: Schnell und entschieden auf Cyberattacken reagieren: So gelingt das Inc…

Fragment 370 texte

The application of common risk management practices is useful to identify the weakness in product safety related system…

Fragment 371 texte

## **5.6 Role of the product safety management**

Fragment 372 texte

The responsibility for implementing an effective cybersecurity system does not lie primarily with the product safety ma…

Fragment 373 texte

1. Identify IT intensive, vulnerable systems

Fragment 374 texte

2. Identify possible hazards linked to product safety and communicate them to the IT department.

Fragment 375 texte

3. Continuously review the cyberthreats, and the response from the IT department, to assure compliance with the product…

Fragment 376 texte

Conducting IT/cybersecurity assessments or managing those systems is not the task of the product safety management. Rat…

Fragment 377 texte

## **5.7 Conclusions**

Fragment 378 texte

Cyberthreats are becoming more of a challenge and may affect all areas of production and food safety. Implementing an I…

Fragment 379 texte

The objectives here should be:

Fragment 380 texte

- To bring IT security up to a state of the art standard, for which sufficient resources are provided

Fragment 381 texte

- Create an inventory of assets to be protected

Fragment 382 texte

- Exercises and security tests

Fragment 383 texte

- Take into account recommendations from national authorities (e. g. BSI in Germany) on IT-OT separation

Fragment 385 texte

- Identify interfaces

Fragment 386 texte

- Develop and manage further measures.

Fragment 387 texte

## **Questions to be asked:**

Fragment 390 texte

- Is cybersecurity addressed as a risk in the management system next to product safety, product defence and product fra…

Fragment 391 texte

- Which vulnerable points have been identified in the process flow, where cyberattacks are possible and which could lea…

Fragment 392 texte

- How is it ensured that cyberthreats, which could lead to compromised product safety or quality, are under control?

Fragment 393 texte

- Are staff trained on cyberthreats?

Fragment 394 texte

- Is traceability according to legal and, if applicable, customer requirements, ensured at any time, also in case of a …

Fragment 395 texte

- In the event of changes in the process flow; is the risk assessment updated with regard to cybersecurity and product …

Fragment 396 texte

- What cyber incidents have been registered (recorded) in the organisation recently? How were they dealt with?

Fragment 397 texte

## **Product Defence Requirements in IFS Standards**

Fragment 402 texte

**IFS Food 8, IFS HPC 3, IFS Logistics 3, IFS Broker 3.2, IFS Cash & Carry 2, IFS PACsecure 3, IFS Progress Food 3**

Fragment 403 texte

food fraud assessment outcome • product fraud assessment • food defence assessment outcome outcome • compliance i…

Fragment 405 legende_image

**// Product Defence Requirements in IFS Food 8, IFS HPC 3, IFS Logistics 3, IFS Broker 3.1, IFS Progress Food 3, IFS C…

Fragment 408 texte

control • visitors and contractors measures measure. • how external inspections and The product defence plan shal…

Fragment 410 legende_image

appropriate for effectiveness. control measures. 6.1.1.2 If legislation makes registration 4.21.3 A product defen…

Fragment 412 legende_image

The IFS publishes information, opinions and bulletins to its best knowledge, but cannot take any responsibility for any…

Fragment 413 texte

The owner of the present document is:

Fragment 414 texte

**IFS Management GmbH Am Weidendamm 1 A 10117 Berlin Germany**

Fragment 415 texte

Managing Director: Stephan Tromp AG Charlottenburg HRB 136333 B VAT-N°: DE278799213

Fragment 416 texte

Bank: Berliner Sparkasse IBAN number: DE96 1005 0000 0190 0297 65 BIC- / Swift-Code: BE LA DE BE

Fragment 417 texte

Fragment 419 texte

No translation may be made without official permission by the document owner.

Fragment 420 texte

The English version is the original and reference document.

Fragment 421 texte

**The IFS Documents are available online via: www.ifs-certification.com**

Fragment 422 texte

## **ifs-certification.com**

Fragment 423 texte