Security Training For Select Agent Laboratories Applicable Regulations 42 CFR Part 73 (DHHS) 9 CFR 121 (APHIS) 7 CFR 331 (APHIS)

Security Training For Select Agent Laboratories

Applicable Regulations

42 CFR Part 73 (DHHS)

9 CFR 121 (APHIS)

7 CFR 331 (APHIS)

73.11 Security Plan Written Plan:

• Individual clearance• Training• Inventory control & Record Keeping• Physical Security• Visitor Access Policies• Cyber Security• Notification and Reporting

– suspicious events– compromised security– exposures, releases

Authorized individuals

DOJ registered “entity” personnel Background check (FBI clearance)

– restricted person criteria Have direct access to Select Agents

(SA’s) Biohazard (BSL3) clearance from IBC

• BL3/Biosafety/BBP/Chemical Safety Security/Shipping/Observation (work practices)

Authorized individuals Notify EHS of:

– updates in lab staff (new, exiting staff)– disgruntled employees in lab (those

authorized or with access to SA areas)– Suspicious behaviour– restrict access/change locks

Visitor Access Policy to SA areas

Notify the EHS before bringing in guests

Training prior to entry Escorted at all times

in SA areas Service work cleared

before escorted entry Record of entry/exit

and escort name

SA Inventories (Log/checkbook) For each SA:

– Agent name, characteristics, source data– qty held on date of 1st inventory – qty acquired, source, date of acquisition– qty, volume or mass destroyed, and date of each

action– qty used, date of use (toxins only)– qty transferred, transfer date, individuals involved– current qty held

– Any SA lost, stolen, or unaccounted for• Written explanation of any discrepancies

– Records maintained by PI and EHS

Physical Security Lock boxes Locked freezers,

incubators, animal cages, etc.

Locked Door– keycard access– each entry/exit

recorded

Physical Security

Intrusion alarms– glass break– motion sensors– alarm activated

camera– dead latch– hinged pins

High priority response areas– Security & Police

Cyber Security Cyber Security

Office Firewalls Passwords Locked computer

stations Anti-virus programs Prudent exchange of

information

Notification & Reporting

Suspicious – people– activity– packages (in or out)

Immediately report to:– Local Police– Institutional Security– EHS Office

Notification & Reporting

Spills/releases Loss of keys/ID’s Theft or missing SA’s Alteration of record Immediately report

to:– Local Police– Institutional Security– EHS Office

Notification of theft, loss, release

Theft/loss of SA– immediate notification to:

• HHS Secretary (APHIS) by phone, fax, or email

• State law enforcement authorities• Local law enforcement authorities

– reported whether recovered or not, or responsible parties identified

– Follow-up written report to HHS/APHIS w/in 7 days

Notification & Reporting

All Transfers – intra-facility – inter-facility– EHS, CDC, USDA approval– SA Form 2

Final Destruction of SA’s– Provide notification to lead

agency– May need to await federal

approval

Records (maintained for 3 years) For access to areas where SA’s

used/stored• name of each person who has accessed area• date/time of entry - date/time individual left area• Records of all entries to space of non approved

persons and the authorized users who accompanied them

– RO’s inspection records of SA locations (at least annually), list of authorized workers

– Safety, security, emergency response plans

– Training, transfer records– Safety, security incident reports

Penalties and Fines 73.19 Civil money

penalites– $250,00 - $500,000

73.20 Criminal Penalties – 5 - 10 years in Prison