date:May 30, 2016
); however, the use of the KATs is still permissible to conduct a vulnerability assessment and will be further discussed in guidance.
We specified three elements that must be evaluated when conducting a vulnerability assessment: (1) The potential public health impact (e.g., severity and scale) if a contaminant were added; (2) the degree of physical access to the product; and (3) the ability of an attacker to successfully contaminate the product.
We specified that the vulnerability