1 

# Federal Experts Security Advisory Panel

Recommendations Concerning the Select

Agent Program

November 2, 2010

Revised December 20, 2010 and January 10, 20112 

## Contents

Chapter 1 Introduction

................................ ................................ ................................ .............................. 3
Chapter 2 Tiering and Reduction of the Select Agent List

................................ ................................ ......... 4
Chapter 3 Personnel Reliability

................................ ................................ ................................ .................. 7

Ch apter 4 Physical and Cyber Security

................................ ................................ ................................ .... 12
Chapter 5 Ongoing Activities of the FESAP

................................ ................................ .............................. 153



## Chapter 1 Introduction

The Federal Experts Security Advisory Panel (FESAP), created by Executive Order (E.O

. ) 13546,

“ Optimizing the Security of Biological Select Agents and Toxins in the United States,” was asked to provide consensus recommendations to the Secretaries of Health and Human Services (HHS) and Agriculture (USDA) and the Attorney General related to security of the biological s elect a gent s and toxins (BSAT) as defined in the Select Agent Regulations (42 CFR Part 73, 9 CFR Part 121, and 7 CFR Part 331.) This document provides recommendations to the HHS and USDA Select Agent Programs (SAP) on the following issues identified in the E.O. :

1. the designation of Tier 1 BSAT ; 2. reductio n in the number of BSAT on the Select Agent List;
3. the establishment of appropriate practices to ensure reliability of personnel with access to Tier 1
BSAT at registered facilities;

4. the establishment of appropriate practices for physical and cyber security for facilities that possess Tier 1 BSAT ; and

5. other emerging policy issues relevant to the security of BSAT.

The FESAP consists of expert members from 15 Departments, Agencies, and Offices and is co

- chaired by Dr. Gerald Parker, HHS, and Dr. Gregory Parham, USDA. *Revised 1 2 / 20 /2010, Dr. George Korch has replaced Dr. Parker as the HHS co

- chair.

In order to accomplish the goals listed above, the FESAP utilized appropriate federal subject matter
experts (SMEs) from its members’ Departments to populate three Working Groups (WGs) , which focused on tiering an d reduction of the list of BSAT , personnel reliability, and physical and cyber security. In each case, the WG members deliberated extensively and proposed a set of
recommendations to the FESAP for its consi deration. The FESAP drew from the expertise of its membership , information from presentations by several members of the regulated community, information from previous reports on the topic, and technical input from the Select Agent Program
Directors to fin alize recommendations which are designed to optimize security while recogniz ing that
research on BSAT is crucial to the Nation’s biodefense and life sciences enterprise s

.
The recommendations presented in this report represent the consensus view of the memb ers of the FESAP and not necessarily the views of their respective Departments, Agencies, or Offices.

According to the E.O., the recommendations herein which are accepted by the SAP and require modifications or additions to the Select Agent Regulations wil l be proposed as part of a rule

- making process through the ongoing review of the Select Agent List and will include an opportunity for public

comment.4



## Chapter 2 Tiering and Reduction of the Select Agent List

E.O. 13546 requires the designation of a “subs et of the Select Agent List (Tier 1) that presents the greatest risk of deliberate misuse with most significant potential for mass casualtie s or devastating effects to the economy, critical infrastructure, or public confidence.” The E.O. also tasks the F ESAP to identify BSAT that should be removed from the Select Agent list, where appropriate. In order to identify
BSAT that are appropriate for inclusion in Tier 1 or removal from the Select Agent list

, all 82 BSAT on the Select Agent list were scored against 20 criteria by over 60 SMEs representing the federal life sciences, public health, law enforcement, security, and intelligence communities . Six subgroups were established to focus specifically on human and overlap viruses, human and o verlap bacteria and fungi, toxins, animal and overlap agents, plant agents, and intelligence/security/law enforcement. Additional deliberation of
the WG highlighted those criteria which generally describe BSAT recommended for Tier 1: ability to produce a mass casualty event or devastating effects to the economy, communicability, low infectious dose, and a history of or current interest in weaponization base d on threat reporting . Similarly, the general criteria for recommending removal of agents from the Select Agent list were low potential for causing mortality, endemicity in the United States, and difficulty in producing quantities necessary for a high consequence event. WG recommendations were presented for consideration by the FESAP, which
determined the final Select Agent list to be proposed for Tier 1 or to be removed from the Select Agent
List. BSAT that are not nominated for either Tier 1 or reduction from the list should remain on the list with current security measures to be continued except wh ere otherwise noted in this document.

Recommendations regarding the designation of Tier 1 agents and toxins

The following agents are recommended to comprise the list of Tier 1 BSAT:

Bacillus anthracis
Burkholderia mallei Burkholderia pseudomallei
Ebola virus
Foot

- and

- mouth disease virus
Francisella tularensis Marburg virus Variola major virus
Variola minor virus Yersinia pestis

At this time, the FESAP does not recommend inclusion of botulinum toxin and/or toxin

- producing
strains of Clostridium botulinu m in Tier 1. HHS and USDA should solicit comments from the public
and regulated entities regarding the potential inclusion of botulinum neuro toxin and/or botulinum5

toxin

- producing strains of Clostridium botulinum on the list of Tier 1 BSAT through their ru le

- making process. The FESAP will continue to assess the scientific, public health, intelligence, national security, physical security, and economic evidence base for the inclusion of th ese in Tier 1 and will provide a revised recommendation to the SAP Di rectors prior to publication of the Proposed Rule.

REVISED 12/20/10: Upon further consideration and receipt of additional information from the intelligence community, the FESAP recommends that botulinum neurotoxin and botulinum toxin

producing species of Clostridium botulinum for inclusion on the list of Tier 1 BSAT. As part of continuing evaluation during the rule

- making process, FESAP encourages the Select Agent Program to assess the economic and security consequences of all recommendations for Tier 1 BSAT



### .
Recommendations regarding the reduction in the number of agents on the current Select Agent list

The following agents are recommended for removal from the current Select Agent list :

Human and Overlap Agents Cercophithecine herpesvirus 1 (Herpes B vi rus) Coccidioides posadasii
Coccidioides immitis Eastern Equine encephalitis virus, South American genotypes 1

Flexal virus
Tick

- borne encephalitis viruses, European subtypes 1 Venezuelan Equine Encephalitis virus, Enzootic subtypes ID and IE 1

Animal Agents
Akabane virus
Blu e tongue virus Bovine Spongiform Encephalitis
Camel Pox virus
Erlichia ruminantium
Goat Pox virus Japanese Encephalitis v irus Malignant Catarrhal Fever virus
M e na n gle virus Mycoplasma capricolum , subsp

. capripneumoniae Sheep Pox virus
Vesi cular stomatitis virus

Recommendations regarding the reduction in the number of toxins on the current Select Agent list

1 All other genotypes and subtypes should remain on the list.6

The following toxins are recommended for ultimate removal from the Select Agent list . Before
these toxins are removed from the list, o ther regulatory controls over their possession should be
identified and confirmed.

Clostridium perfringens epsilon toxin
Conotoxin Diacetoxyscirpenol Shiga toxin Shiga

- like ribosome inactivating proteins

T

- 2 toxin

*Revised 1/10/11: Recommendation regarding inclusion of Severe Acute Respiratory Syndrome (SARS) virus on the list of BSAT

The FESAP does not recommend inclusion of SARS on the list of BSAT.7



## Chapter 3 Personnel Reliability

During the deliberative process, the FESAP identified several recommendations for personnel suitability
and reliability that should apply to all personnel with access or requesting access to BSAT and several recommendations that should only apply to individuals seeking access to Tier 1 BSAT. Each
recommendation is p resented with the assumption that statutory authority exists for the HHS
, USDA and/or the Department of Justice (DOJ) to implement it . If that assumption is incorrect, the SAP
Directors should explore options to achieve the goal of the recommendation

, inc luding the provision of guidance on appropriate practices. Additionally, the FESAP recognizes that entities may have difficulty implementing new Rules based on these recommendations immediately upon their publication. The FESAP requests that the SAP clea rly define timelines for implementation of all recommendations after a Final Rule is published.

For the purposes of implementing recommendations herein, suitability is defined:

Personnel with access to BSAT should be reliable, loyal, trustworthy, honest, f ree from emotional or mental instability, possess sound judgment, free of conflicting allegiances and potential for coercion, and possess a willingness to abide by regulations governing the possession, use, or transfer of select agents.

Recommendations re garding personnel reliability

1. Enhance and clarify the Security Risk Assessment (SRA) process to better assess disqualifiers, vet foreign nationals, explain information requested on the FD

- 961 and call for consistent statutory authority between the Secretar ies of USDA and HHS

.
A statutory or regulatory change should be made to provide t he Criminal Justice Information
Services Division

- Bioterrorism Risk Assessment Group (CJIS

- BRAG) CJIS

- BRAG with authority to access the mental health component of the National Instant Criminal Background Check System ( NIC S)
database or a separate mental health database should be established to allow them to more reliably determine whether an individual is ineligible to have access to BSAT for mental health reasons based
on the s tatutory prohibitors.

As previously recommended by the E.O. 13486 WG , statutory authority of the Secretaries of HHS
and USDA should be made consistent by grant ing the Secretary of HHS similar authorities to those of the Secretary of USDA to determine appr opriateness of BSAT access denials for certain cases , such

as prior committal to a mental institution or a juvenile felony conviction.

Add the definition of “mental defective” and “adjudicated as a mental defective” on form FD

- 961 as a footnote in suppo rt of question 12e.8 The Bureau of Alcohol, Tobacco, and Firearms Regulations (Title 27) provides a
definition under Part 478: Commerce in Firearms and Ammunition. The text of the
definition in 27 CFR 478.11 is as follows:

“ Adjudicated as a mental defective.”

(a) A determination by a court, board, commission, or other lawful authority that a person, as a result of marked subnormal intelligence, or mental illness, incompetency, condition, or disease:

(1) Is a danger to himself or to others; or

(2) Lacks the mental capacity to contract or manage his/her own affairs.

(b) The term shall include

—
(1) A finding of insanity by a court in a criminal case; and

(2) Those persons found incompetent to stand trial or found not guilty by reason of lack of mental responsibility pursuant to articles 50a and 72b of the Uniform Code of Military Justice, 10 U.S.C. 850a, 876b.”

HHS and USDA counsel should identify current authority in statute or regulations to remove persons
from access for national s ecurity concerns that do not meet the statutory definition of one of the current prohibitors.

FBI, DHS, and other government agencies should continue to explore ways to strengthen the SRA
verification process es

.

For all foreign nationals 2 requesting access to BSAT:

CJIS

- BRAG should shift from a periodic to a recurrent 3 vetting process against terrorist and immigration databases. SRA reviews of foreign nationals should be conducted more frequently than once every five years, as resources p ermit.

For all foreign nationals requesting access to Tier 1 BSAT:

DOJ should investigate the feasibility of obtaining a criminal background check on a foreign national

, comparable to that achievable for U.S. citizens, by either 1) requesting that the pers on obtain and

2 As used in this document, the term “foreign national” refers to an alien as defined in 18 U.S.C. 175 b.

3 Recurrent vetting compares an affected individual’s information against new and/or updated records as new and/or updated records become available, fo r as long as that person remains in a specific population.9

submit a background check from their home country, or 2) collaborating with the Department of State to determine whether a criminal background check can be performed by the Regional Security Officer in the person’s home country.

DOJ should i nvestigate their statutory authority to utilize information collected during an entity’s

pre

- access check (see below) for a foreign national to support the SRA adjudication process

.

2. Provide guidance on pre - access suitability assessments of personnel to assist the entity in identifying qualities of suitability for being granted access to BSAT . It should be required that

a p rocess for pre

- access suitability assessment be required in the security plans of entities housing Tier 1 BSAT. As part of its continuing work, the FESAP will further explore the utility of behavioral assessments to identify indicators of potential for violent behaviors , criminal behaviors, or other behaviors that pose a national security risk.

For all entities p ossessing BSAT:

The SAP should provide guidance on best practices for assessing pre

- access suitability at the local
level , drawing on existing knowledge and resources from Departments involved in adjudicating suitability for access to classified material

. The guidance should provide a basis for utilizing rigorous, comprehensive interview/information gathering procedures which may include a credit check, professional and peer references, credential verification, criminal records check, history of violent o r subversive behaviors

, and history of adherence to administrative controls in biosafety or other job

related safety or security programs.

For all entities possessing Tier 1 BSAT:

The SAP should require that entities possessing Tier 1 BSAT include in their security plan a process for pre

- access suitability assessment at the local level.

To inform pre

- access suitability and ongoing reliability assessment s , all professionals involved in
BSAT safety and security at an entity should share relevant informatio n with the Responsible Official ( RO ) in order to collaborate on assessments of individuals requesting and retaining access to BSAT

, as appropriate . This coordination plan should be included in the security plan.

If possible under current statutory author ity, t he SAP should require credit checks to be performed by the entity to assess financial responsibility and should provide guidance on procedures for utilizing the information as part of a suitability assessment . For example, the utility of a credit

re port is not to assess how much debt an individual has, but whether they have been responsible with that debt (ie. paying bills on time, not repeatedly defaulting on loans.)10

Persons with access to Tier 1 BSAT should be required to be enrolled in an occupat ional health

program . The SAP should provide guidance on required components of occupational health programs to be included in the entities’ biosafety plan.

The FESAP will further assess the evidence

- base for the type of behavioral assessment that has utility in the BSAT research context for assessing an individual’s potential to commit acts of violence

or crimes
, or acts that pose a national security risk involving BSAT. Any potential behavioral
assessment tool must be evidence

- based and verified for this particular use prior to inclusion in BSAT regulations or guidance.

3. After the granting of initial access to BSAT, ongoing monitori ng of an employee’s r eliability is critical. Elements of suitability that can change over time (such as credit and criminal status) will need to be periodically re

- checked. The SAP should provide guidance to entities regarding
self

- and peer

- reporting of circumstances, conditions, ac tivities, actions, or behaviors that may be of a safety or security concern. In addition, the SAP should provide guidance to en sure that ROs have the tools necessary to assess reliability, remove personnel from access temporarily or permanently, and to co ntact the local FBI W eapons of M ass D estruction Coordinator in the event of knowledge of a local threat to security.

For all entities possessing BSAT:

The SAP should utilize reports from the N ational S cience A dvisory B oard for B iosecurity and
other subje ct matter experts to provide guidance to entities on promoting a culture of responsibility among their employees.

Self

- and Peer

- Reporting:

o The SAP should provide guidance to all entities regarding the development of self

- and

peer

- reporting system s to i nclude: training on circumstances, conditions, activities, actions or behaviors that may
indicate a safety or security concern; the method of reporting information to an appropriate member of the individual’s leadership ; how that information will be pass ed and adjudicated; how the reporter will be protected from reprisal; and a rebuttal process for the implicated individual.

The SAP should provide guidance to ROs for the removal of individuals from BSAT access if they display behaviors indicating they are at risk of doing harm to themselves or others , participate in criminal activities, or pose a risk to national security.11

The SAP should ensure that procedures are included in the entity’s security plan for the RO to immediately notify the local FBI WM D coordinator in order to initiate a threat assessment process in the event that he/she becomes aware of suspicious activity related to the facility, its personnel, or BSAT.

For all entities possessing Tier 1 BSAT:

The SAP should require that entities possessing Tier 1 BSAT include in their security plan, a

process to assess suitability of personnel on an ongoing basis and a plan for self

- and peer

reporting. Policies and procedures for reporting and for addressing any reports should be made clear to employees.12



## Chapter 4 Physical and Cyber Security

During the deliberative process, the FESAP identified several recommendations for physical and cyber security that should apply to all facilities housing BSAT and sever al recommendations that should only apply to facilities with Tier 1 BSAT. Each recommendation is presented with the assumption that statutory authority exists for implementation by HHS, USDA, and or DOJ . If that assumption is incorrect,
the SAP Directors should explore options to achieve the goal of the recommendation

, including the provision of guidance on appropriate practices. Additionally, the FESAP recognizes that entities may have difficulty implementing new Rules based on these recommendations imm ediately upon their publication. The FESAP requests that the SAP clearly define timelines for implementation of all recommendations after a Final Rule is published.

Physical and cyber security encompasses the application of operational and security equipm ent, personnel and procedures used to protect facilities, and information, documents or material for preventing or responding to theft, sabotage, diversion, or other terrorist or criminal acts. Practices for

p hysical and cyber security of BSAT should be i mplemented based upon the risk of their misuse, theft, loss, and/or release.

Recommendations regarding physical and cybersecurity

For all facilities housing BSAT:

Federal partners involved in BSAT security should develop a government

- furnished risk

mana gement tool for all entities to use as part of their Site Specific Risk Assessment to ensure
that facilities are consistently evaluating their vulnerability to particular threats, are implementing security measures appropriate to their level of risk, and t o enable consistent inspections activities across multiple regu latory and oversight agencies. The SAP should leverage the Department of Homeland Security’s ability to develop this tool. Facility owners and operators should participate in the generation o f requirements for this tool.

Once the tool is available, t he SAP should amend the current regulations to require use of the
tool for the Site Specific Risk Assessment currently called for in the regulations

. Once developed, this tool should be used by all entities to assess their unique risk

— Tier 1 facilities will
be able to use this tool to ensure that they meet their additional performance standards as
described in this document.

The SAP should amend current regulations to include standards 4 for cybersecurity as follows:

4 For more information, see NIST Special Publication 800

- 30 “Risk Management Guidelines for Information Technology Systems,” and NIST Special Publication 800

- 53, “Recommended Security Controls for Federal13 o Ensure that all external connections to systems which control security of the facility are isolated or have controls that permit and monitor for only authorized and authenticated user access. Examples include biweekly network sc anning to detect external network connections, appropriately configured and maintained firewalls, and explicit and enforced directions on appropriate system usage.

o Ensure that users are only granted access to BSAT

- related information, files , equipment ( e. g. servers or mass storage devices) and applications as necessary to fulfill their role s and responsibilities, and that access is modified when the user’s roles and responsibilities change or when their access to BSAT is discontinued

.

o Ensure that controls are in place to prevent malicious code from exploiting critical cyber systems, including a suite of virus protection software within the system/network, for which updates are downloaded and installed on a regular schedule to mitigate vulnerability to new malicious code exploits as they emerge.

o Establish robust configuration management practices for information systems, to include regular patching and updates made to operating systems and individual applications.

The SAP should amend current regulations to codify standards for shipping, receiving, and storage of BSAT as follows:

o Ensure that the entity has documented processes for securing and monitoring the shipment, receipt, and storage of BSAT that make it extremely unlikely that such
materials would be made available to an unauthorized individual or an individual without a legitimate use for the material.

HHS and USDA should collaborate with the Healthcare and Public Health Coordinating Council
and the Agriculture and Food Government Coordinating Cou ncil to establish an information

sharing protocol for communication of threat and risk information and corresponding protective measures to covered entities, leveraging current DHS/FBI information

- sharing relationships with
critical infrastructure owners a nd operators.

For facilities housing Tier 1 BSAT:

The SAP should require an entity to describe in their security plan a security management system, including a documented security awareness training program for all employees and

Information Systems, ” and NIST Special Publication 800

- 53A (rev. 1) “Guide for Assessing the security controls in Federal Information Systems and Organizations, building effective Security Assessment Plans.”14

regular insider threat awa reness briefings on how to identify and report suspicious behaviors. The RO can coordinate this responsibility with a security officer/director, or a combination of existing security personnel.

The SAP should establish or refine standards in regulation f or Tier 1 BSAT to allow for layered protection of assets as follows:

Security Barriers The entity has a robust security and monitoring system that enables the facility to

thwart adversary penetrations.
Intrusion Detection and Monitoring The entity can demonstrate a reasonable probability that unauthorized adversary

actions would be detected and access would be denied, and that unauthorized actions by individuals with authorized access would be detected. Delay/ Response
Force The entity is able to detec t and initiate a response to intruders resulting in the

intruders being interdicted before they reach a restricted area. Access Control The entity can demonstrate a reasonable probability of detecting and preventing

fraudulent entry and has a system for the timely reporting of such attempts to law enforcement. Cybersecurity The entity provide backup power and energy sources to power lighting, networks

and integrated access controls during emergencies.

The FESAP recognizes that there are unique facilit ies such as diagnostic, public health, animal health, and environmental laboratories, such as the laboratories of the Laboratory Response Network, which perform a vital national security function and may require different methods of implementation of the recommended standards. In these instances, the FESAP encourages the Select Agent Program, through their authority in Section 4 of E.O. 13546, to “explore options for graded protection of Tier 1 agent s and toxins... to permit tailored risk management practices based upon relevant contextual factors”.15



## Chapter 5 Ongoing Activities of the FESAP

The FESAP is currently chartered through July 2, 2014, with a potential for renewal, and will continue to provide technical advice concerning the SAP on request. To supplement the current recommendations, the FESAP will continue to address the following issue s:

1) The FESAP will continue to assess the scientific, public health, intelligence, national security, physical security, and economic evidence base for the inclusion of botulinum neurotoxin and/or
neurotoxin

- producing strains of Clostridium botulinum in Ti er 1 and will provide a revised recommendation to the SAP Directors prior to publication of the Proposed Rule. *Complete 12/20/2010

2) The FESAP will identify and review any existing regulatory controls over toxins, particularly those
recommended for removal from the list, and may provide a revised recommendation to the SAP Directors prior to publication of a Proposed Rule.

3) The FESAP will further assess the evidence

- base for the type of behavioral assessment that may have utility in the BSAT research context for assessing an individual’s potential to commit acts of
violence or crimes
, or acts that pose a national security risk involving BSAT. Any potential
behavioral assessment tool must be evidence

- based and verified for this particular use prior to
inclusi on in BSAT regulations or guidance.

4) The FESAP will assist the SAP in the provision of guidance on pre

- access and ongoing suitability
assessments and self

- and peer reporting by analyzing and assessing the utility of existing guidance in the federal governme nt.

5) As was also identified in previous assessments of the SAP, the use of the term “mental defective” is antiquated and unhelpful as part of the list of disqualifiers for the SRA. The FESAP will work with SMEs, including those from the Substances Abuse an d Mental Health Administration (SAMHSA), to identify options for revising that language in existing statute.