The organization chooses a method for judging how significant threats are, carries out a threat assessment that identifies and evaluates potential threats and selects proportionate mitigation across its processes and products, writes the assessment, the mitigation and the verification procedures into a food defence plan, and implements that plan with effective training, communication and periodic review. Mitigations worth considering include building design against unauthorised entry, reference checks on people, keeping confidential information under control, securing production and storage areas, distribution and transport, and supplier and external provider assurance; Annex A lists examples.
The graph holds this control, the 0 it maps to, and the evidence behind each claim, over MCP and REST.