1

Federal Experts Security Advisory Panel

Recommendations Concerning the Select 

Agent Program

November 2, 2010

Revised December 20, 2010 and January 10, 2011
2

Contents

Chapter 1 Introduction ..............................................................................................................................3

Chapter 2 Tiering and Reduction of the Select Agent List.........................................................................4

Chapter 3 Personnel Reliability..................................................................................................................7

Chapter 4 Physical and Cyber Security ....................................................................................................12

Chapter 5 Ongoing Activities of the FESAP..............................................................................................15
3

Chapter 1 Introduction

The Federal Experts Security Advisory Panel (FESAP), created by Executive Order (E.O.) 13546, 

“Optimizing the Security of Biological Select Agents and Toxins in the United States,” was asked to 

provide consensus recommendations to the Secretaries of Health and Human Services (HHS) and 

Agriculture (USDA) and the Attorney General related to security of the biological select agents and 

toxins (BSAT) as defined in the Select Agent Regulations (42 CFR Part 73, 9 CFR Part 121, and 7 CFR Part 

331.) This document provides recommendations to the HHS and USDA Select Agent Programs (SAP) on 

the following issues identified in the E.O.:

1. the designation of Tier 1 BSAT;

2. reduction in the number of BSAT on the Select Agent List;

3. the establishment of appropriate practices to ensure reliability of personnel with access to Tier 1 

BSAT at registered facilities;

4. the establishment of appropriate practices for physical and cyber security for facilities that 

possess Tier 1 BSAT; and

5. other emerging policy issues relevant to the security of BSAT.

The FESAP consists of expert members from 15 Departments, Agencies, and Offices and is co-chaired by 

Dr. Gerald Parker, HHS, and Dr. Gregory Parham, USDA. *Revised 12/20/2010, Dr. George Korch has 

replaced Dr. Parker as the HHS co-chair.

In order to accomplish the goals listed above, the FESAP utilized appropriate federal subject matter 

experts (SMEs) from its members’ Departments to populate three Working Groups (WGs), which 

focused on tiering and reduction of the list of BSAT, personnel reliability, and physical and cyber 

security. In each case, the WG members deliberated extensively and proposed a set of 

recommendations to the FESAP for its consideration. The FESAP drew from the expertise of its

membership, information from presentations by several members of the regulated community, 

information from previous reports on the topic, and technical input from the Select Agent Program 

Directors to finalize recommendations which are designed to optimize security while recognizing that 

research on BSAT is crucial to the Nation’s biodefense and life sciences enterprises.

The recommendations presented in this report represent the consensus view of the members of the 

FESAP and not necessarily the views of their respective Departments, Agencies, or Offices.

According to the E.O., the recommendations herein which are accepted by the SAP and require 

modifications or additions to the Select Agent Regulations will be proposed as part of a rule-making 

process through the ongoing review of the Select Agent List and will include an opportunity for public 

comment.
4

Chapter 2 Tiering and Reduction of the Select Agent List

E.O. 13546 requires the designation of a “subset of the Select Agent List (Tier 1) that presents the 

greatest risk of deliberate misuse with most significant potential for mass casualties or devastating 

effects to the economy, critical infrastructure, or public confidence.” The E.O. also tasks the FESAP to 

identify BSAT that should be removed from the Select Agent list, where appropriate. In order to identify 

BSAT that are appropriate for inclusion in Tier 1 or removal from the Select Agent list, all 82 BSAT on the 

Select Agent list were scored against 20 criteria by over 60 SMEs representing the federal life sciences, 

public health, law enforcement, security, and intelligence communities. Six subgroups were established 

to focus specifically on human and overlap viruses, human and overlap bacteria and fungi, toxins, animal 

and overlap agents, plant agents, and intelligence/security/law enforcement. Additional deliberation of 

the WG highlighted those criteria which generally describe BSAT recommended for Tier 1: ability to 

produce a mass casualty event or devastating effects to the economy, communicability, low infectious 

dose, and a history of or current interest in weaponization based on threat reporting. Similarly, the 

general criteria for recommending removal of agents from the Select Agent list were low potential for 

causing mortality, endemicity in the United States, and difficulty in producing quantities necessary for a 

high consequence event. WG recommendations were presented for consideration by the FESAP, which 

determined the final Select Agent list to be proposed for Tier 1 or to be removed from the Select Agent 

List. BSAT that are not nominated for either Tier 1 or reduction from the list should remain on the list 

with current security measures to be continued except where otherwise noted in this document.

Recommendations regarding the designation of Tier 1 agents and toxins

The following agents are recommended to comprise the list of Tier 1 BSAT:

Bacillus anthracis

Burkholderia mallei

Burkholderia pseudomallei

Ebola virus

Foot-and-mouth disease virus

Francisella tularensis

Marburg virus

Variola major virus

Variola minor virus

Yersinia pestis

At this time, the FESAP does not recommend inclusion of botulinum toxin and/or toxin-producing 

strains of Clostridium botulinum in Tier 1. HHS and USDA should solicit comments from the public 

and regulated entities regarding the potential inclusion of botulinum neurotoxin and/or botulinum 
5

toxin-producing strains of Clostridium botulinum on the list of Tier 1 BSAT through their rule-making 

process. The FESAP will continue to assess the scientific, public health, intelligence, national 

security, physical security, and economic evidence base for the inclusion of these in Tier 1 and will 

provide a revised recommendation to the SAP Directors prior to publication of the Proposed Rule.

REVISED 12/20/10: Upon further consideration and receipt of additional information from the 

intelligence community, the FESAP recommends that botulinum neurotoxin and botulinum toxinproducing species of Clostridium botulinum for inclusion on the list of Tier 1 BSAT. As part of 

continuing evaluation during the rule-making process, FESAP encourages the Select Agent Program 

to assess the economic and security consequences of all recommendations for Tier 1 BSAT.

Recommendations regarding the reduction in the number of agents on the current Select Agent list

The following agents are recommended for removal from the current Select Agent list:

Human and Overlap Agents

Cercophithecine herpesvirus 1 (Herpes B virus)

Coccidioides posadasii

Coccidioides immitis

Eastern Equine encephalitis virus, South American genotypes1

Flexal virus

Tick-borne encephalitis viruses, European subtypes1

Venezuelan Equine Encephalitis virus, Enzootic subtypes ID and IE1

Animal Agents

Akabane virus

Bluetongue virus

Bovine Spongiform Encephalitis

Camel Pox virus

Erlichia ruminantium

Goat Pox virus

Japanese Encephalitis virus

Malignant Catarrhal Fever virus

Menangle virus

Mycoplasma capricolum, subsp. capripneumoniae

Sheep Pox virus

Vesicular stomatitis virus

Recommendations regarding the reduction in the number of toxins on the current Select Agent list

 

1

All other genotypes and subtypes should remain on the list.
6

The following toxins are recommended for ultimate removal from the Select Agent list. Before 

these toxins are removed from the list, other regulatory controls over their possession should be 

identified and confirmed.

Clostridium perfringens epsilon toxin

Conotoxin

Diacetoxyscirpenol

Shiga toxin

Shiga-like ribosome inactivating proteins

T-2 toxin

*Revised 1/10/11: Recommendation regarding inclusion of Severe Acute Respiratory Syndrome 

(SARS) virus on the list of BSAT

The FESAP does not recommend inclusion of SARS on the list of BSAT.
7

Chapter 3 Personnel Reliability

During the deliberative process, the FESAP identified several recommendations for personnel suitability 

and reliability that should apply to all personnel with access or requesting access to BSAT and several 

recommendations that should only apply to individuals seeking access to Tier 1 BSAT. Each 

recommendation is presented with the assumption that statutory authority exists for the HHS, USDA

and/or the Department of Justice (DOJ) to implement it. If that assumption is incorrect, the SAP 

Directors should explore options to achieve the goal of the recommendation, including the provision of 

guidance on appropriate practices. Additionally, the FESAP recognizes that entities may have difficulty 

implementing new Rules based on these recommendations immediately upon their publication. The 

FESAP requests that the SAP clearly define timelines for implementation of all recommendations after a 

Final Rule is published.

For the purposes of implementing recommendations herein, suitability is defined:

Personnel with access to BSAT should be reliable, loyal, trustworthy, honest, free from 

emotional or mental instability, possess sound judgment, free of conflicting allegiances and 

potential for coercion, and possess a willingness to abide by regulations governing the 

possession, use, or transfer of select agents.

Recommendations regarding personnel reliability

1. Enhance and clarify the Security Risk Assessment (SRA) process to better assess disqualifiers, 

vet foreign nationals, explain information requested on the FD-961 and call for consistent 

statutory authority between the Secretaries of USDA and HHS.

A statutory or regulatory change should be made to provide the Criminal Justice Information 

Services Division-Bioterrorism Risk Assessment Group (CJIS-BRAG)CJIS-BRAG with authority to access 

the mental health component of the National Instant Criminal Background Check System (NICS)

database or a separate mental health database should be established to allow them to more reliably 

determine whether an individual is ineligible to have access to BSAT for mental health reasons based 

on the statutory prohibitors.

As previously recommended by the E.O. 13486 WG, statutory authority of the Secretaries of HHS 

and USDA should be made consistent by granting the Secretary of HHS similar authorities to those of 

the Secretary of USDA to determine appropriateness of BSAT access denials for certain cases, such 

as prior committal to a mental institution or a juvenile felony conviction. 

Add the definition of “mental defective” and “adjudicated as a mental defective” on form FD-961 as 

a footnote in support of question 12e. 
8

The Bureau of Alcohol, Tobacco, and Firearms Regulations (Title 27) provides a 

definition under Part 478: Commerce in Firearms and Ammunition. The text of the 

definition in 27 CFR 478.11 is as follows:

“Adjudicated as a mental defective.”

(a) A determination by a court, board, commission, or other lawful authority 

that a person, as a result of marked subnormal intelligence, or mental illness, 

incompetency, condition, or disease:

(1) Is a danger to himself or to others; or

(2) Lacks the mental capacity to contract or manage his/her own affairs.

(b) The term shall include—

(1) A finding of insanity by a court in a criminal case; and

(2) Those persons found incompetent to stand trial or found not guilty 

by reason of lack of mental responsibility pursuant to articles 50a and 

72b of the Uniform Code of Military Justice, 10 U.S.C. 850a, 876b.”

HHS and USDA counsel should identify current authority in statute or regulations to remove persons 

from access for national security concerns that do not meet the statutory definition of one of the

current prohibitors.

FBI, DHS, and other government agencies should continue to explore ways to strengthen the SRA 

verification processes.

For all foreign nationals2requesting access to BSAT:

CJIS-BRAG should shift from a periodic to a recurrent3vetting process against terrorist and 

immigration databases. SRA reviews of foreign nationals should be conducted more frequently than 

once every five years, as resources permit.

For all foreign nationals requesting access to Tier 1 BSAT:

DOJ should investigate the feasibility of obtaining a criminal background check on a foreign national, 

comparable to that achievable for U.S. citizens, by either 1) requesting that the person obtain and 

 

2

As used in this document, the term “foreign national” refers to an alien as defined in 18 U.S.C. 175 b.

3

Recurrent vetting compares an affected individual’s information against new and/or updated records as new 

and/or updated records become available, for as long as that person remains in a specific population.
9

submit a background check from their home country, or 2) collaborating with the Department of 

State to determine whether a criminal background check can be performed by the Regional Security 

Officer in the person’s home country.

DOJ should investigate their statutory authority to utilize information collected during an entity’s 

pre-access check (see below) for a foreign national to support the SRA adjudication process.

2. Provide guidance on pre-access suitability assessments of personnel to assist the entity in 

identifying qualities of suitability for being granted access to BSAT. It should be required that 

a process for pre-access suitability assessment be required in the security plans of entities 

housing Tier 1 BSAT. As part of its continuing work, the FESAP will further explore the utility 

of behavioral assessments to identify indicators of potential for violent behaviors, criminal 

behaviors, or other behaviors that pose a national security risk.

For all entities possessing BSAT:

The SAP should provide guidance on best practices for assessing pre-access suitability at the local 

level, drawing on existing knowledge and resources from Departments involved in adjudicating 

suitability for access to classified material. The guidance should provide a basis for utilizing rigorous, 

comprehensive interview/information gathering procedures which may include a credit check, 

professional and peer references, credential verification, criminal records check, history of violent or 

subversive behaviors, and history of adherence to administrative controls in biosafety or other jobrelated safety or security programs.

For all entities possessing Tier 1 BSAT:

The SAP should require that entities possessing Tier 1 BSAT include in their security plan a process

for pre-access suitability assessment at the local level. 

To inform pre-access suitability and ongoing reliability assessments, all professionals involved in 

BSAT safety and security at an entity should share relevant information with the Responsible Official

(RO) in order to collaborate on assessments of individuals requesting and retaining access to BSAT, 

as appropriate. This coordination plan should be included in the security plan.

If possible under current statutory authority, the SAP should require credit checks to be performed 

by the entity to assess financial responsibility and should provide guidance on procedures for 

utilizing the information as part of a suitability assessment. For example, the utility of a credit 

report is not to assess how much debt an individual has, but whether they have been responsible 

with that debt (ie. paying bills on time, not repeatedly defaulting on loans.)
10

Persons with access to Tier 1 BSAT should be required to be enrolled in an occupational health 

program. The SAP should provide guidance on required components of occupational health 

programs to be included in the entities’ biosafety plan.

The FESAP will further assess the evidence-base for the type of behavioral assessment that has 

utility in the BSAT research context for assessing an individual’s potential to commit acts of violence 

or crimes, or acts that pose a national security risk involving BSAT. Any potential behavioral 

assessment tool must be evidence- based and verified for this particular use prior to inclusion in 

BSAT regulations or guidance.

3. After the granting of initial access to BSAT, ongoing monitoring of an employee’s reliability is 

critical. Elements of suitability that can change over time (such as credit and criminal status) 

will need to be periodically re-checked. The SAP should provide guidance to entities regarding 

self- and peer- reporting of circumstances, conditions, activities, actions, or behaviors that 

may be of a safety or security concern. In addition, the SAP should provide guidance to ensure 

that ROs have the tools necessary to assess reliability, remove personnel from access 

temporarily or permanently, and to contact the local FBI Weapons of Mass Destruction

Coordinator in the event of knowledge of a local threat to security.

For all entities possessing BSAT:

The SAP should utilize reports from the National Science Advisory Board for Biosecurity and 

other subject matter experts to provide guidance to entities on promoting a culture of 

responsibility among their employees.

Self- and Peer-Reporting: 

o The SAP should provide guidance to all entities regarding the development of self- and 

peer-reporting systems to include:

training on circumstances, conditions, activities, actions or behaviors that may 

indicate a safety or security concern; 

the method of reporting information to an appropriate member of the individual’s 

leadership; 

how that information will be passed and adjudicated; 

how the reporter will be protected from reprisal; and

a rebuttal process for the implicated individual. 

The SAP should provide guidance to ROs for the removal of individuals from BSAT access if they 

display behaviors indicating they are at risk of doing harm to themselves or others, participate in 

criminal activities, or pose a risk to national security.
11

The SAP should ensure that procedures are included in the entity’s security plan for the RO to 

immediately notify the local FBI WMD coordinator in order to initiate a threat assessment 

process in the event that he/she becomes aware of suspicious activity related to the facility, its 

personnel, or BSAT.

For all entities possessing Tier 1 BSAT:

The SAP should require that entities possessing Tier 1 BSAT include in their security plan, a 

process to assess suitability of personnel on an ongoing basis and a plan for self- and peerreporting. Policies and procedures for reporting and for addressing any reports should be made 

clear to employees.
12

Chapter 4 Physical and Cyber Security

During the deliberative process, the FESAP identified several recommendations for physical and cyber 

security that should apply to all facilities housing BSAT and several recommendations that should only 

apply to facilities with Tier 1 BSAT. Each recommendation is presented with the assumption that 

statutory authority exists for implementation by HHS, USDA, and or DOJ. If that assumption is incorrect, 

the SAP Directors should explore options to achieve the goal of the recommendation, including the 

provision of guidance on appropriate practices. Additionally, the FESAP recognizes that entities may 

have difficulty implementing new Rules based on these recommendations immediately upon their 

publication. The FESAP requests that the SAP clearly define timelines for implementation of all 

recommendations after a Final Rule is published.

Physical and cyber security encompasses the application of operational and security equipment, 

personnel and procedures used to protect facilities, and information, documents or material for 

preventing or responding to theft, sabotage, diversion, or other terrorist or criminal acts. Practices for 

physical and cyber security of BSAT should be implemented based upon the risk of their misuse, theft, 

loss, and/or release. 

Recommendations regarding physical and cybersecurity

For all facilities housing BSAT:

Federal partners involved in BSAT security should develop a government-furnished risk 

management tool for all entities to use as part of their Site Specific Risk Assessment to ensure 

that facilities are consistently evaluating their vulnerability to particular threats, are 

implementing security measures appropriate to their level of risk, and to enable consistent 

inspections activities across multiple regulatory and oversight agencies. The SAP should

leverage the Department of Homeland Security’s ability to develop this tool. Facility owners and 

operators should participate in the generation of requirements for this tool. 

Once the tool is available, the SAP should amend the current regulations to require use of the 

tool for the Site Specific Risk Assessment currently called for in the regulations. Once 

developed, this tool should be used by all entities to assess their unique risk—Tier 1 facilities will 

be able to use this tool to ensure that they meet their additional performance standards as 

described in this document. 

The SAP should amend current regulations to include standards4for cybersecurity as follows:

 

4

For more information, see NIST Special Publication 800-30 “Risk Management Guidelines for Information 

Technology Systems,” and NIST Special Publication 800-53, “Recommended Security Controls for Federal 
13

o Ensure that all external connections to systems which control security of the facility are 

isolated or have controls that permit and monitor for only authorized and authenticated 

user access. Examples include biweekly network scanning to detect external network 

connections, appropriately configured and maintained firewalls, and explicit and 

enforced directions on appropriate system usage.

o Ensure that users are only granted access to BSAT-related information, files, equipment 

(e.g. servers or mass storage devices) and applications as necessary to fulfill their roles

and responsibilities, and that access is modified when the user’s roles and 

responsibilities change or when their access to BSAT is discontinued.

o Ensure that controls are in place to prevent malicious code from exploiting critical cyber 

systems, including a suite of virus protection software within the system/network, for 

which updates are downloaded and installed on a regular schedule to mitigate 

vulnerability to new malicious code exploits as they emerge.

o Establish robust configuration management practices for information systems, to 

include regular patching and updates made to operating systems and individual 

applications.

The SAP should amend current regulations to codify standards for shipping, receiving, and 

storage of BSAT as follows:

o Ensure that the entity has documented processes for securing and monitoring the 

shipment, receipt, and storage of BSAT that make it extremely unlikely that such 

materials would be made available to an unauthorized individual or an individual 

without a legitimate use for the material.

HHS and USDA should collaborate with the Healthcare and Public Health Coordinating Council

and the Agriculture and Food Government Coordinating Council to establish an informationsharing protocol for communication of threat and risk information and corresponding protective 

measures to covered entities, leveraging current DHS/FBI information-sharing relationships with 

critical infrastructure owners and operators.

For facilities housing Tier 1 BSAT:

The SAP should require an entity to describe in their security plan a security management 

system, including a documented security awareness training program for all employees and 

 

Information Systems, ” and NIST Special Publication 800-53A (rev. 1) “Guide for Assessing the security controls in 

Federal Information Systems and Organizations, building effective Security Assessment Plans.”
14

regular insider threat awareness briefings on how to identify and report suspicious behaviors. 

The RO can coordinate this responsibility with a security officer/director, or a combination of 

existing security personnel.

The SAP should establish or refine standards in regulation for Tier 1 BSAT to allow for layered 

protection of assets as follows: 

Security Barriers The entity has a robust security and monitoring system that enables the facility to 

thwart adversary penetrations.

Intrusion Detection 

and Monitoring

The entity can demonstrate a reasonable probability that unauthorized adversary 

actions would be detected and access would be denied, and that unauthorized 

actions by individuals with authorized access would be detected.

Delay/ Response 

Force

The entity is able to detect and initiate a response to intruders resulting in the 

intruders being interdicted before they reach a restricted area. 

Access Control The entity can demonstrate a reasonable probability of detecting and preventing 

fraudulent entry and has a system for the timely reporting of such attempts to law 

enforcement.

Cybersecurity The entity provide backup power and energy sources to power lighting, networks 

and integrated access controls during emergencies.

The FESAP recognizes that there are unique facilities such as diagnostic, public health, animal 

health, and environmental laboratories, such as the laboratories of the Laboratory Response 

Network, which perform a vital national security function and may require different methods of 

implementation of the recommended standards. In these instances, the FESAP encourages the 

Select Agent Program, through their authority in Section 4 of E.O. 13546, to “explore options for 

graded protection of Tier 1 agents and toxins... to permit tailored risk management practices 

based upon relevant contextual factors”. 
15

Chapter 5 Ongoing Activities of the FESAP

The FESAP is currently chartered through July 2, 2014, with a potential for renewal, and will continue to 

provide technical advice concerning the SAP on request. To supplement the current recommendations, 

the FESAP will continue to address the following issues:

1) The FESAP will continue to assess the scientific, public health, intelligence, national security, 

physical security, and economic evidence base for the inclusion of botulinum neurotoxin and/or 

neurotoxin-producing strains of Clostridium botulinum in Tier 1 and will provide a revised 

recommendation to the SAP Directors prior to publication of the Proposed Rule. *Complete 

12/20/2010

2) The FESAP will identify and review any existing regulatory controls over toxins, particularly those 

recommended for removal from the list, and may provide a revised recommendation to the SAP 

Directors prior to publication of a Proposed Rule.

3) The FESAP will further assess the evidence-base for the type of behavioral assessment that may 

have utility in the BSAT research context for assessing an individual’s potential to commit acts of 

violence or crimes, or acts that pose a national security risk involving BSAT. Any potential 

behavioral assessment tool must be evidence- based and verified for this particular use prior to 

inclusion in BSAT regulations or guidance.

4) The FESAP will assist the SAP in the provision of guidance on pre-access and ongoing suitability 

assessments and self-and peer reporting by analyzing and assessing the utility of existing 

guidance in the federal government.

5) As was also identified in previous assessments of the SAP, the use of the term “mental 

defective” is antiquated and unhelpful as part of the list of disqualifiers for the SRA. The FESAP 

will work with SMEs, including those from the Substances Abuse and Mental Health 

Administration (SAMHSA), to identify options for revising that language in existing statute.