We are doing FSMA Food Defense gap analysis, and the guideline says below:
You do not need to evaluate points, steps, and procedures that are not part of your food operation. For example, you would not consider mail handling procedures, human resources procedures, utilities and processing aids that do not come into contact with or that are not incorporated into the food, facility emergency evacuation procedures, and other business processes.
It looks like FSMA only cares about Food Defense at processing steps. They want us to use a HACCP approach to analyze each process step, but do not care about the "traditional" facility defense part (visitor control, mail handling etc).
Am I misunderstanding it?