Salmonella That Waits: The Low-Moisture Food Controls Preventive Control Plans Keep Missing

By early September 2026, a Salmonella outbreak linked to pistachios had grown into one of the largest low-moisture food events Canada has seen in years. The Public Health Agency of Canada and the Canadian Food Inspection Agency (CFIA) tied 200 laboratory-confirmed illnesses across six provinces to pistachios imported from Iran and to products made with them, from nut mixes to Dubai-style chocolate, baklava and knafeh. Twenty-six people were hospitalised. Recalls kept expanding into September, and CFIA's temporary import restriction on pistachios from Iran remained in force.

For food safety professionals, the striking detail is not the size of the outbreak. It is the food. Pistachios are dry. Many Preventive Control Plans are built to stop bacteria from growing, and in a dry food nothing grows. That is exactly the trap. Salmonella does not need to grow in a low-moisture food to make people sick. It only needs to survive, and it survives in dry foods for months or even years. This article explains why, and sets out the preventive controls that food businesses handling nuts, seeds, flour, powders and other low-moisture products keep missing.

Executive Summary

Low-moisture foods have a water activity of 0.85 or below. Salmonella cannot grow at that level, but it can survive for very long periods.
As water activity falls, Salmonella becomes more heat resistant, so a roasting or drying step that would kill it in a moist food may not kill it in a dry one.
Preventive Control Plans that focus on preventing microbial growth miss the real hazard, which is survival and a very low infectious dose.
The 2026 pistachio outbreak involved multiple Salmonella serotypes tied to one imported ingredient, a classic signal of contamination at source rather than in the Canadian plant.
Under the Safe Food for Canadians Regulations, most licence holders need a written Preventive Control Plan that identifies this hazard and shows how it is controlled, monitored and verified.
The controls that matter most are a validated lethality step, supplier verification beyond a certificate of analysis, environmental monitoring of dry areas, dry sanitation, and recall readiness.

What Are Low-Moisture Foods, and Why Does Salmonella Survive in Them?

In short: a low-moisture food is one with a water activity of 0.85 or below. Bacteria need available water to multiply, so Salmonella cannot grow at that level. What it can do is persist. In dry nuts, seeds, flour, chocolate and powders, Salmonella can stay alive and infectious for months or years.

Water activity, written as aw, measures the water available to microorganisms, not the total water in the food. It runs from 0 to 1. Salmonella generally stops growing below an aw of about 0.94, and no meaningful growth occurs in low-moisture foods at or below 0.85. But growth and survival are different questions. A dormant Salmonella cell in a dry food is not dividing, yet it remains fully capable of causing illness once eaten. The table below shows the practical difference.

Water activity (aw)	What Salmonella does	Example foods
Above 0.85	Can grow when temperature and time allow	Fresh produce, deli salads, cooked ready-to-eat foods
0.60 to 0.85	Does not grow, but survives for weeks to months	Dried fruit, syrups, some jams and sauces
Below 0.60	Does not grow, survives for months to years, and is harder to kill by heat	Nuts, seeds, flour, cereal, chocolate, milk and protein powders

Two features make low-moisture Salmonella especially dangerous. First, it takes very few cells to cause illness in these foods, because the fat and sugar around the bacteria protect them as they pass through the stomach. Second, dryness makes Salmonella far more heat resistant. FDA and academic researchers have shown that the same organism needs much higher temperatures or much longer times to achieve a safe reduction in a dry food than in a wet one. A roasting profile that reliably kills Salmonella in a moist product can leave survivors in a dry one.

Why Growth-Based Controls Miss the Threat

In short: many Preventive Control Plans manage temperature, time and moisture to stop bacteria from multiplying. In a low-moisture food nothing multiplies anyway, so those controls give false comfort. The hazard is a single contamination event that then persists, undetected, all the way to the consumer.

This is why low-moisture products account for a large share of Salmonella recalls even though they look inherently safe. FDA has reported that Salmonella is responsible for the great majority of recalls of low water activity foods in the United States. The contamination is usually rare and patchy, hiding in a small fraction of a lot, which is exactly what makes it so hard to catch with a small grab sample. A Preventive Control Plan that assumes a dry food is low risk, and therefore tests lightly and monitors little, is building its safety case on the wrong hazard.

What the 2026 Pistachio Outbreak Teaches

In short: when many different Salmonella serotypes trace back to one ingredient, the contamination almost always sits at source. The pistachio outbreak is a case study in why supplier controls, not in-plant growth controls, decide the outcome for imported low-moisture ingredients.

Investigators linked the illnesses to a range of Salmonella serotypes, all connected to pistachios from a single country of origin. A single processing mistake in Canada would usually produce one strain, not many. A spread of serotypes points to contaminated raw material entering from outside, then being distributed across many finished products and brands. That is the same pattern we described in the Salmonella jalapeno supplier cascade, where one grower fed dozens of brands. The lesson repeats: when you buy a low-moisture ingredient, you inherit its contamination history.

The response also shows how a low-moisture recall widens. Because the pistachios were an ingredient in chocolate, pastry and dessert products, one contaminated lot rippled across many manufacturers. Poor lot separation and weak traceability turn a contained problem into a national one. Companies that could show clean one-back, one-forward records could scope their recall tightly. Those that could not had to pull far more product.

Preventive Control Plan Requirements Under the SFCR

In short: under the Safe Food for Canadians Regulations, most licence holders must prepare and maintain a written Preventive Control Plan. It has to identify the biological hazards that are reasonably likely to occur, describe the controls, and show how those controls are monitored, verified and corrected when they fail.

The Safe Food for Canadians Regulations (SOR/2018-108) require a written Preventive Control Plan under sections 86 to 89, built on a hazard analysis that identifies the biological, chemical and physical hazards that present a risk of contamination of a food. For a low-moisture food business, that hazard analysis has to name Salmonella as a biological hazard that is reasonably likely to occur, even though the product is dry. If the analysis dismisses Salmonella because the food does not support growth, the plan has a defect that an inspector can cite and that represents a failure to control a known hazard. The regulations also require traceability, so that product can be traced one step back to the supplier and one step forward to the customer.

A defensible low-moisture Preventive Control Plan treats Salmonella the way a low-acid food plan treats Clostridium botulinum, as a named, specific hazard with a validated control. Our guide to preventive controls for low-acid and acidified foods sets out the same discipline of hazard identification, validated control and documented verification that low-moisture producers should apply to Salmonella.

Building Controls That Actually Work for Low-Moisture Foods

In short: the effective controls for a low-moisture food are a validated kill step, verified suppliers, environmental monitoring of dry areas, dry sanitation, and sampling plans sized for a rare and clustered contaminant. The table below pairs each control area with the gap we see most often.

Control area	What good looks like	Common gap
Lethality (kill step)	A scientifically validated treatment that achieves a defined reduction of Salmonella at the food's actual water activity	Assuming a roast or dry step that works in moist product achieves the same reduction when dry
Supplier verification	Verify the supplier's own controls, audit history and testing, and treat imported low-moisture ingredients as high risk	Accepting a certificate of analysis as proof of control
Environmental monitoring	Zone-based Salmonella swabbing of equipment, floors and dry processing areas, with trend analysis	No environmental monitoring because the area is dry
Sanitation	Dry cleaning methods and tight control of any water use to avoid creating wet harbourage points	Wet cleaning that leaves damp niches where Salmonella persists
Sampling and testing	Statistically meaningful sampling that reflects a low-prevalence, patchy contaminant, with defined actions on a positive	Small grab samples that are very likely to miss patchy contamination
Traceability and recall	Clean one-back, one-forward records, strong lot separation and rehearsed mock recalls	Poor lot control that forces a wide, costly recall

Environmental monitoring deserves special attention. Many dry-food producers skip it because there is no visible water, yet Salmonella persists in dust, floor cracks, and equipment niches for years. A zone-based programme, similar in logic to the environmental monitoring used to control Listeria in ready-to-eat plants, finds the organism in the plant before it finds its way into product. When a swab comes back positive, the plan needs a defined corrective action and root cause analysis, not just a re-clean.

Lessons From Past Low-Moisture Outbreaks

In short: the pistachio outbreak is not an isolated event. It is the latest in a long line of low-moisture food outbreaks that share the same root cause, which is a pathogen surviving in a dry product that everyone assumed was safe.

Salmonella outbreaks have been traced to peanut butter and peanut paste, wheat flour, dried coconut, tahini and sesame products, powdered infant formula, spices, and nuts of several kinds. One of the most severe was the peanut butter and peanut paste outbreak in 2008 and 2009 linked to a US processor, which caused illness across many jurisdictions and reshaped how the industry thinks about dry-processing sanitation. Flour has been linked to both Salmonella and E. coli outbreaks, including a Canadian flour recall for E. coli. In every case the food was dry, the pathogen could not grow, and it did not need to.

The pattern carries a clear corrective action and preventive action lesson. When a low-moisture product is implicated, the root cause investigation almost always lands on one of a handful of failures, which are an unvalidated or absent kill step, an environmental harbourage point that was never monitored, a supplier whose controls were never verified, or water introduced into a dry process. Each of these is preventable. A Preventive Control Plan that studies the history of low-moisture outbreaks, and designs controls against those specific failure modes, is far better placed than one that treats every new outbreak as a surprise.

Low-Moisture Food Compliance Checklist

Name Salmonella as a biological hazard reasonably likely to occur in your hazard analysis, even for dry products.
Validate your lethality step at the product's real water activity, and keep the validation study on file.
Qualify and verify suppliers of low-moisture ingredients, and treat imported raw materials as higher risk.
Do not rely on a certificate of analysis as your only control on an incoming ingredient.
Run a zone-based environmental monitoring programme for Salmonella in dry processing areas, with trend analysis.
Use dry sanitation methods and control water use to avoid creating damp harbourage points.
Size sampling plans for a rare, patchy contaminant, and define what happens when a result is positive.
Keep one-back, one-forward traceability records and separate lots so a recall can be scoped tightly.
Rehearse a mock recall at least annually, and fix any gaps in traceability that it exposes.

Common Mistakes to Avoid

Treating dryness as safety. Low water activity stops growth, not survival. Salmonella can outlast the shelf life of the food.
Trusting a certificate of analysis. A certificate reflects one sample from one lot. For a patchy contaminant, it is not a control, it is a data point.
Reusing a wet-food kill step. Heat resistance rises as water activity falls. A validation done in a moist matrix does not carry over to a dry one.
Skipping environmental monitoring in dry plants. Salmonella harbours in dust and equipment niches. If you do not swab, you do not know.
Weak lot separation. Poor traceability turns a single contaminated lot into a recall that spans many products and brands.

Frequently Asked Questions

Why is Salmonella found in pistachios and nuts if they are dry?

Because dryness does not kill Salmonella, it only stops it from multiplying. Nuts can pick up Salmonella in the orchard, during hulling and drying, or through contaminated equipment and water, and the bacteria then survive in the dry kernel for a very long time. Since the infectious dose in a fatty food is low, even a small number of surviving cells can make people sick.

What water activity is considered low-moisture?

A low-moisture food generally has a water activity of 0.85 or below. Salmonella cannot grow at that level, but many low-moisture foods sit well below it, and Salmonella can survive for months to years across that whole range.

Is a supplier certificate of analysis enough for food safety compliance?

No. A certificate of analysis is one result from one sample and it cannot represent a rare, patchy contaminant spread unevenly through a lot. Under the Safe Food for Canadians Regulations you are expected to verify a supplier's controls, not just collect their paperwork. Treat a certificate as supporting information within a broader supplier verification programme, not as the control itself.

Does my dry-food plant need environmental monitoring?

Yes, if Salmonella is a hazard for your product, and for most low-moisture foods it is. Salmonella persists in dry environments, so a zone-based monitoring programme that swabs equipment, floors and processing areas is one of the most effective ways to find it before it reaches product. Positive results should trigger a defined corrective action and a search for the root cause.

Why do multiple Salmonella serotypes point to the raw material?

A single in-plant contamination event usually produces one strain. When investigators find several different serotypes tied to the same ingredient, it usually means the raw material was already contaminated with a mix of strains before it reached the plant. That is why the pistachio outbreak points to the imported ingredient and its supply chain rather than to any one Canadian manufacturer.

How can we reduce the size of a potential recall?

Strong lot separation and clean one-back, one-forward records let you scope a recall to the affected lots instead of an entire product line. Rehearsing a mock recall exposes traceability gaps before a real event does. Our guide to food recall jurisdiction in Canada explains who governs a recall and how the process runs, which helps you prepare in advance.

How MFLRC Can Help

MF License and Regulatory Consultants (MFLRC) helps food manufacturers, importers and repackers of low-moisture foods build Preventive Control Plans that control the real hazard. Our quality and food safety team runs PCP gap assessments, designs environmental monitoring programmes, sets up supplier qualification and verification, and reviews lethality validations so your kill step actually works at the water activity of your product.

We also carry out mock recalls, supplier audits and inspection-readiness assessments so that a contamination event stays contained and defensible. For a related example of how a preventive control failure drives a recall, see our analysis of a recall driven by a preventive control gap. If you handle nuts, seeds, flour, powders or dried goods, now is the time to test your plan against the low-moisture hazard.

Book a Preventive Control Plan Review

Conclusion

The 2026 pistachio outbreak is a reminder that dry does not mean safe. Salmonella waits in low-moisture foods, sometimes for years, and a Preventive Control Plan built to stop microbial growth will not stop it. The producers who avoid the next recall are the ones who name Salmonella as a hazard even in a dry product, validate a real kill step, verify their suppliers, monitor their dry environment, and keep traceability tight enough to contain a problem. Those controls are not exotic. They are simply aimed at the correct hazard, which is survival rather than growth. Build them in now, before an outbreak makes the case for you.