I am somewhere over Greenland on my way home.

On Friday, Dr. Donna Garren, who directs the Office of Produce Safety at FDA, sent her stakeholder list a short email with four FDA links on this summer’s Cyclospora outbreaks, and asked readers to look at one in particular: a list of ten things FDA commits to doing before the 2027 growing and harvesting season. She wrote that she wants stakeholders to know the agency’s attention to Cyclospora will continue and that FDA will stay “open and transparent” about the work. Donna Garren is the best FDA has on produce. I take her at her word, and as far as I can find, this is the first numbered list of commitments the agency has put in writing on this outbreak.

Cyclospora cayetanensis is a parasite that reaches food through water or hands contaminated with human feces. It cannot be reliably washed off produce, it cannot be cultured in a laboratory, and it shows up in this country every summer, mostly on fresh produce.

The outbreak the list is answering

It was the largest cyclosporiasis outbreak on record: 12,883 confirmed illnesses in 21 states, 570 hospitalizations and two deaths, both in Michigan, tied to iceberg lettuce from Taylor Farms de Mexico and served, among other places, at Taco Bell. CDC declared it over on September 11. FDA says its own investigation continues, and as of the agency’s September 11 update the samples its inspectors collected at the growers and the processing plant in Mexico were still pending analysis. The last weekly national count CDC published, on September 15, was 19,883 laboratory-confirmed domestic cases between May 1 and August 31, which leaves roughly 7,000 confirmed cases this summer with no food named. FDA’s own outbreak table still carries four Cyclospora investigations with no source, as I wrote this morning.

The ten items

Here is what FDA says it is committed to doing before next season, in my words rather than the agency’s. The full text is on the post-outbreak response page.

1. An Outbreak Investigation Report summarizing the investigation, the factors that may have contributed to contamination of the imported, shredded iceberg lettuce, and recommendations to prevent the next one.
2. More surveillance of the commodities historically associated with Cyclospora, and of how they are produced, to understand contamination levels and which sampling strategies work.
3. More outreach, at home and abroad, on current and prospective food safety requirements, naming the Produce Safety Rule, the Preventive Controls rule and the Food Traceability Rule.
4. Laboratory capacity in Mexico to collect, analyze and process Cyclospora samples in-country, to cut the time to a final result.
5. New data sources and tools, including weather events, to monitor the environmental conditions that may spread Cyclospora.
6. Education and training for Mexico’s fresh produce industry, with Mexico’s Ministry of Agriculture, COFEPRIS and SENASICA.
7. Expert panels on worker health and hygiene, on water and wastewater monitoring, and on the gaps in growing and processing practices for certain produce.
8. A single, replicable Cyclospora genotyping standard, developed with CDC, for the federal government, partner nations and industry.
9. More Foreign Supplier Verification Program inspections, so that importers treat Cyclospora as a hazard in their hazard analyses and supplier verification.
10. Lessons from the investigation and any root cause analysis folded into an updated Cyclospora Prevention, Response and Research Action Plan.

What is good about it

A fair amount. The investigation report, item one, is the document that will say what the inspectors found in those fields and in that plant, and it is the one I will be waiting for. Item four addresses a real problem: FDA’s own wording is that in-country laboratory capacity would reduce the time needed to get final analyses, which tells you that time was lost this summer between a field in Mexico and a laboratory result. Item eight matters because genotyping did real work this summer: on August 20 CDC said the parasites from sick people were genetically related to one another, and a shared, replicable method is what lets the next outbreak be tied together in weeks rather than months.

Item nine is the one with teeth. A Foreign Supplier Verification Program inspection is an inspection of the importer whose name is on the entry, and an importer that fails it can be placed on import alert. It is the only item on the list where somebody gets inspected rather than educated, surveyed or convened, and it is an authority Congress left alone. The action plan in item ten dates to 2021 and has been updated at least twice since; a third update is welcome, but a plan is not what was missing this summer.

Now read item three

FDA says it will do more outreach on current and prospective food safety requirements, and it names three: the Produce Safety Rule, the Preventive Controls rule and the Food Traceability Rule. Two of those are current. The third is prospective for a reason that has nothing to do with Dr. Garren’s office. The Food Traceability Rule was finished in November 2022 with a compliance date of January 20, 2026. In March 2025 the administration pushed compliance to July 20, 2028, and in November 2025 Congress wrote the delay into law: Section 780 of the bill that ended the shutdown bars FDA from spending appropriated money to administer or enforce the rule before that date. Leafy greens, fresh and fresh-cut, are on the Food Traceability List. Shredded iceberg lettuce is exactly the product the rule was written for.

I have written the history of that rule and will not repeat all of it. The short version is that FDA’s traceback did not converge on a single supplier until July 17, more than a month after the first illness onset CDC later counted, and the recall drew a line around a company rather than around the product in front of a shopper. The rule that requires a shipper to produce lot-level records within twenty-four hours is the rule that shortens that interval. It is the one rule on Dr. Garren’s list that her office may teach but may not enforce. Outreach is what the appropriations rider leaves the agency free to spend on.

That is not a criticism of the Office of Produce Safety. It is the rider showing up in the office’s to-do list, and the people who wrote item three know it better than I do.

What is not on the list

No item carries a date beyond “prior to the 2027 growing season.” Nothing names the growers in Mexico whose fields FDA inspected, which is the subject of the citizen petition STOP Foodborne Illness has pending before the agency. Nothing addresses the roughly 7,000 confirmed cases this summer with no food named, or the four clusters FDA still lists without a source. And nothing says when the samples collected in Mexico will be reported. Item one is where those answers belong, and it is the item I will hold the agency to.

Two things I would say

To the Office of Produce Safety: thank you for writing it down. A numbered list with a season attached is something a stakeholder can hold up a year from now and check, and that is what open and transparent looks like in practice. When the investigation report comes, say what the water looked like and what the samples showed, even if the answer is that nothing was found.

To Congress: members sent more than a dozen letters this summer asking FDA, CDC and HHS what went wrong. One answer is sitting in your own appropriations bill. Eleven consumer and food safety organizations asked you in August not to delay the traceability rule any further. The people who wrote item three cannot enforce the rule that would have found this lettuce faster, because you told them they could not. If you want the Office of Produce Safety to do more than educate before the 2027 season, give it back the authority to enforce the Food Traceability Rule, and fund it.