Security Training For Select Agent Laboratories

1. Security Training For Select Agent Laboratories Applicable Regulations 42 CFR Part 73 (DHHS) 9 CFR 121 (APHIS) 7 CFR 331 (APHIS)

2. 73.11 Security Plan • Written Plan: • Individual clearance • Training • Inventory control & Record Keeping • Physical Security • Visitor Access Policies • Cyber Security • Notification and Reporting • suspicious events • compromised security • exposures, releases

3. Authorized individuals • DOJ registered “entity” personnel • Background check (FBI clearance) • restricted person criteria • Have direct access to Select Agents (SA’s) • Biohazard (BSL3) clearance from IBC • BL3/Biosafety/BBP/Chemical Safety Security/Shipping/Observation (work practices)

4. Authorized individuals • Notify EHS of: • updates in lab staff (new, exiting staff) • disgruntled employees in lab (those authorized or with access to SA areas) • Suspicious behaviour • restrict access/change locks

5. Visitor Access Policy to SA areas • Notify the EHS before bringing in guests • Training prior to entry • Escorted at all times in SA areas • Service work cleared before escorted entry • Record of entry/exit and escort name

6. SA Inventories (Log/checkbook) • For each SA: • Agent name, characteristics, source data • qty held on date of 1st inventory • qty acquired, source, date of acquisition • qty, volume or mass destroyed, and date of each action • qty used, date of use (toxins only) • qty transferred, transfer date, individuals involved • current qty held • Any SA lost, stolen, or unaccounted for • Written explanation of any discrepancies • Records maintained by PI and EHS

7. Lock boxes Locked freezers, incubators, animal cages, etc. Locked Door keycard access each entry/exit recorded Physical Security

8. Intrusion alarms glass break motion sensors alarm activated camera dead latch hinged pins High priority response areas Security & Police Physical Security

9. Cyber Security • Cyber Security Office • Firewalls • Passwords • Locked computer stations • Anti-virus programs • Prudent exchange of information

10. Notification & Reporting • Suspicious • people • activity • packages (in or out) • Immediately report to: • Local Police • Institutional Security • EHS Office

11. Notification & Reporting • Spills/releases • Loss of keys/ID’s • Theft or missing SA’s • Alteration of record • Immediately report to: • Local Police • Institutional Security • EHS Office

12. Notification of theft, loss, release • Theft/loss of SA • immediate notification to: • HHS Secretary (APHIS) by phone, fax, or email • State law enforcement authorities • Local law enforcement authorities • reported whether recovered or not, or responsible parties identified • Follow-up written report to HHS/APHIS w/in 7 days

13. Notification & Reporting • All Transfers • intra-facility • inter-facility • EHS, CDC, USDA approval • SA Form 2 • Final Destruction of SA’s • Provide notification to lead agency • May need to await federal approval

14. Records (maintained for 3 years) • For access to areas where SA’s used/stored • name of each person who has accessed area • date/time of entry - date/time individual left area • Records of all entries to space of non approved persons and the authorized users who accompanied them • RO’s inspection records of SA locations (at least annually), list of authorized workers • Safety, security, emergency response plans • Training, transfer records • Safety, security incident reports

15. Penalties and Fines • 73.19 Civil money penalites • $250,00 - $500,000 • 73.20 Criminal Penalties • 5 - 10 years in Prison