What the held sources require
No current numbered requirement Draft title plus held scheme obligation
The draft gives food defence its own subclause at 8.1.2; the draft wording is not held. The obligation below is the held FSSC 22000 Version 7 requirement at 2.5.3, which covers the same ground. People with suitable knowledge and competence prepare and keep current a food defence threat assessment and a food defence plan. The plan is implemented, backed by the management system, compliant with the law that applies, covers every product and process in scope, and is kept current. Where the scheme subcategory FII applies, suppliers must also operate their own food defence plan. BRCGS 4.3 requires a documented threat assessment and controls against intentional contamination.
ISO/DIS 22000:2026, 8.1.2 Food defence; held obligation: FSSC 22000 Version 7 2.5.3.
What the draft does
New in the draft; obligation from held FSSC 22000 v7 2.5.3: The public contents name 8.1.2 and the foreword lists food defence. The draft wording is not held. The obligation is the held FSSC 22000 Version 7 clause 2.5.3 requirement and BRCGS 4.3, stated in our own words and labelled as scheme requirements.
Source: public contents and foreword at 8.1.2, retrieved 2026-10-19.
Held obligation: FSSC 22000 Version 7 2.5.3, stated in our own words.
Why this clause matters
Food defence is deliberate harm: an insider, a visitor, a supplier or an attacker. Most sites have access control and CCTV for security reasons and no food safety assessment behind them. The held scheme requirement turns that into a threat assessment, a plan, implementation records and a review.
Suggested evidence to discuss with your auditor
For 8.1.2, these are the artefacts we suggest discussing with your auditor. The standard publishes no evidence list, so this is our reading, not a requirement.
- Food defence threat assessment and plan, with the author competence
- Implementation records: access control, monitoring, training
- Supplier food defence confirmation where subcategory FII applies
- A dated note of the food defence law in each market, or that none applies
Where systems usually fall short
- A consultant plan with no site knowledge, never updated
- Plan not integrated with the management system or the law
- Plan covers the site but not every product in scope
How to prepare
Walk the site with security and the food safety team: where could a person deliberately contaminate a product, and what stops them. Record the answers as a threat assessment, write one control per high risk, and test one control. Then check the law in each market you sell into.
Dates
Cross-references
Source
Clause 8.1.2. Current edition: ISO 22000:2018. Draft: ISO/DIS 22000:2026. Retrieved 2026-10-19. The full DIS text for 8.1.2 is sold by ISO and not held here; the sources page lists what is.
Not legal advice; does not certify; our words, not the standard's, and the planning date is an estimate.