Security Training For Select Agent Laboratories
Applicable Regulations42 CFR Part 73 (DHHS)9 CFR 121 (APHIS)7 CFR 331 (APHIS)
73.11 Security Plan Written Plan:
• Individual clearance• Training• Inventory control & Record Keeping• Physical Security• Visitor Access Policies• Cyber Security• Notification and Reporting
– suspicious events– compromised security– exposures, releases
Authorized individuals
DOJ registered “entity” personnel Background check (FBI clearance)
– restricted person criteria Have direct access to Select Agents
(SA’s) Biohazard (BSL3) clearance from IBC
• BL3/Biosafety/BBP/Chemical Safety Security/Shipping/Observation (work practices)
Authorized individuals Notify EHS of:
– updates in lab staff (new, exiting staff)– disgruntled employees in lab (those
authorized or with access to SA areas)– Suspicious behaviour– restrict access/change locks
Visitor Access Policy to SA areas Notify the EHS before
bringing in guests Training prior to entry Escorted at all times
in SA areas Service work cleared
before escorted entry Record of entry/exit
and escort name
SA Inventories (Log/checkbook) For each SA:
– Agent name, characteristics, source data– qty held on date of 1st inventory – qty acquired, source, date of acquisition– qty, volume or mass destroyed, and date of each
action– qty used, date of use (toxins only)– qty transferred, transfer date, individuals involved– current qty held
– Any SA lost, stolen, or unaccounted for• Written explanation of any discrepancies
– Records maintained by PI and EHS
Physical Security Lock boxes Locked freezers,
incubators, animal cages, etc.
Locked Door– keycard access– each entry/exit
recorded
Physical Security Intrusion alarms
– glass break– motion sensors– alarm activated
camera– dead latch– hinged pins
High priority response areas– Security & Police
Cyber Security Cyber Security
Office Firewalls Passwords Locked computer
stations Anti-virus programs Prudent exchange of
information
Notification & Reporting
Suspicious – people– activity– packages (in or out)
Immediately report to:– Local Police– Institutional Security– EHS Office
Notification & Reporting
Spills/releases Loss of keys/ID’s Theft or missing SA’s Alteration of record Immediately report
to:– Local Police– Institutional Security– EHS Office
Notification of theft, loss, release Theft/loss of SA
– immediate notification to:• HHS Secretary (APHIS) by phone, fax, or
email• State law enforcement authorities• Local law enforcement authorities
– reported whether recovered or not, or responsible parties identified
– Follow-up written report to HHS/APHIS w/in 7 days
Notification & Reporting
All Transfers – intra-facility – inter-facility– EHS, CDC, USDA approval– SA Form 2
Final Destruction of SA’s– Provide notification to lead
agency– May need to await federal
approval
Records (maintained for 3 years) For access to areas where SA’s
used/stored• name of each person who has accessed area• date/time of entry - date/time individual left area• Records of all entries to space of non approved
persons and the authorized users who accompanied them
– RO’s inspection records of SA locations (at least annually), list of authorized workers
– Safety, security, emergency response plans
– Training, transfer records– Safety, security incident reports
Penalties and Fines 73.19 Civil money
penalites– $250,00 - $500,000
73.20 Criminal Penalties – 5 - 10 years in Prison