Yes, it's part of TACCP or food defence risk. Have a look at PAS96 as they're far more detailed on this in the latest version (and move it up the priority list) than previously.
There are three main avenues to my mind, the extortionist, who may use food safety risk as a lever in a cyber attack (if you don't pay us the money we'll shut off all of your cooling systems), the industrial espionage element (we're going to steal your secret recipe of 11 herbs and spices), probably not so much of a food safety risk but a quality threat then the disgruntled individual who happens to use cyber (I'm going to get you back and do so in a way you might not know who done it). The latter is probably under appreciated. These people could span from the low level who might steal data or confidential information to use as an opportunity in the future (hell, I'm going to take a punt on this having been quite a few people and possibly more the norm than deleting everything confidential as you should) to the more malicious end of that behaviour is where someone does something to mess up the operations of an organisation. There are some quite interesting cases on this. Chemical systems being controlled remotely to over dose or ruin cleaning processes and BMS / building management (often refrigeration) systems being possibilities. If you consider lots of equipment nowadays is networked so your OEMs can access fault diagnostics, how well is that protected? How do your OEMs prevent staff who have left having access still?
Who should own the plan? Your TACCP / food defence team should at least have an input from cyber into it, if you don't integrate your plans fully. That doesn't mean that QFS people should "own" that risk. I don't actually think QFS people should even lead food defence teams if I'm honest. Whoever looks after employee engagement is far better placed to do this. That's because an internal attacker (whatever the kind of risk) is pretty damned likely. So I'd actually suggest the person who either directly manages the most people (i.e. operations) or who advises that person on employment (i.e. HR or personnel) are best placed followed by someone who contracts security and IT should be part of that team.
If you are looking at external attacks, which you should, it's not just about phishing emails but also consider a blended physical and cyber attack as where protections become more sophisticated, someone may choose to get access physically to get system access. The ultimate on this is the member of staff who joins the company of course and then we're back to internal attack anyway.
On recovery, that's a really interesting point and one people forget. If your systems are locked out, it's not just about locking them out having caused a food safety risk but the recovery may risk food safety. Most BCP plans I see consider this and it's worth thinking particularly about traceability systems and how they'll cope. Some have better plans than others. One idea is to think about what's the minimum range you can cope with producing, even if that's smaller than normal. But also think about other things controlled by automated systems, e.g. CIP, SCADA, weight management etc. Could you really, genuinely go back to basics and do you have hard copies of paperwork if you needed to move to manual systems. Remember if you are subject to a cyber attack, you will not be printing anything off any system for at least a day or two. Again, people forget this.
On team dynamics and management, my suggestions of who should lead it, that's all "ideal" of course. Ops people are busy, HR often don't see it as their job. I have enough of a struggle trying to get HR to give a crap about SEDEX and ethical auditing before they believe they should be leading a food defence plan. So in many organisations, I've become the pragmatist and led these teams but insisted on key representation from people who know about this stuff (and try to make it engaging and "win win" enough that they want to be involved), for example, HR, Ops, Security and Site Services, Engineering and IT.
It hasn't specifically come up in GFSI, food defence is always a topic of course, but I've always had it in a food defence / TACCP plan in any case, ever since it became an area to review. So it's never been raised as a gap because it's never been a gap. I would imagine an auditor could consider you've not thought of all of the potential business threats if you'd not considered it though. Whether that would be raised on GFSI or not? It certainly would be on most customer audits I see.
