Any business that introduces food into the commercial food supply chain can ultimately fall under the jurisdiction of the FDA, Food and Drug Administration and need to be compliant with the FSMA, Food Safety Modernization Act.
A hazard analysis that identifies and evaluates the known and reasonably foreseeable risks for a coffee processing, roasting and packaging facility.
Preventative controls must be identified and implemented in response to any risks identified in the hazard analysis to prevent or significantly minimize said risks.
Monitoring procedures must occur, be overseen and documented.
Verification activities must occur to ensure that preventative controls are effective.
Numbers 1 and 2 are what is refered to as a HACCP Plan, (Hazard Analysis and Critical Control Points). Numbers 3 and 4 are part of GMP, (Good Manufacturing Procedures). Number 5 is required for FDA and USDA.
Here is a link to the FDA's law, rules and guidance. This 2-Day course will help you be able to provide for the bulleted points above and not be intimidated by the link in the previous sentence.
Course credits to Firedancer Coffee Consultants and the Academy of Coffee Excellence.