FSAP Security Risk Assessments FAQs
Guidance for entities registered with FSAP
Issued by: Centers for Disease Control and Prevention (CDC)
- What is a security risk assessment (SRA)?
An SRA is the electronic records check performed by the Federal Bureau of Investigation (FBI), Criminal Justice Information Service, Bioterrorism Risk Assessment Group (BRAG) to determine whether an entity or an individual who wishes to register to possess, use or transfer a select agent or toxin, or an individual who has been identified by a registered entity as having a legitimate need to access a select agent or toxin meets one of the statutory restrictors which would either prohibit registration or restrict access, respectively.
The results of an SRA will assist AgSAS or DSAT in its determination that the entity may possess, use, or transfer select agents or toxins; or that an individual may have access to biological select agents and toxins (BSAT).
- What are the prohibitors that would be identified in the SRA process?
Using the SRA process, the FBI will identify whether an individual or an entity is a restricted person as that term is defined by section 175b of Title 18, United States Code. The FBI will also use the SRA process to determine whether an individual has committed a crime set forth in section 2332b(g)(5) of title 18, United States Code; is knowingly involved with any organization that engages in domestic or international terrorism (as defined in section 2331 of title 18, United States Code or any other organization that engages in intentional acts of violence; or is an agent of a foreign power (as defined in section 1801 of title 50, United States Code.
The term "restricted person" means an individual who--
- Is under indictment for a crime punishable by imprisonment for a term exceeding 1 year;
- Has been convicted in any court of a crime punishable by imprisonment for a term exceeding 1 year;
- Is a fugitive from justice;
- Is an unlawful user of any controlled substance (as defined in section 102 of the Controlled Substances Act (21 U.S.C. 802));
- Is an alien illegally or unlawfully in the United States;
- Has been adjudicated as a mental defective or has been committed to any mental institution;
- Is an alien (other than an alien lawfully admitted for permanent residence) who is a national of a country as to which the Secretary of State, pursuant to section 6(j) of the Export Administration Act of 1979 (50 U.S.C. App. 2405(j)), section 620A of chapter 1 of part M of the Foreign Assistance Act of 1961 (22 U.S.C. 2371), or section 40(d) of chapter 3 of the Arms Export Control Act (22 U.S.C. 2780(d)), has made a determination (that remains in effect) that such country has repeatedly provided support for acts of international terrorism; or
- Has been discharged from the Armed Services of the United States under dishonorable conditions.
- Who must undergo an SRA?
- The Responsible Official (RO),
- The Alternate Responsible Official (ARO),
- All individuals who will have access to BSAT, and
- Each individual who owns or controls an entity as defined below:
- For private academic institutions, any individual that is an officer, trustee, member of the board, or owner of the academic institution, and is in a managerial or executive capacity with regard to BSAT possessed, used, or transferred by the entity;
- For entities other than private academic institutions, any individual that is a partner, officer, director, holder or owner of 50 percent or more of its voting stock and is in a managerial or executive capacity with regard to BSAT possessed, used, or transferred by the entity.
- Currently, we only store BSAT. Do we have to obtain SRA approval for individuals with access to the freezers containing select agents and toxins?
Yes. A registered entity may not provide an individual access to BSAT until the individual is approved by AgSAS or DSAT, following an SRA.
An individual will be deemed as having access at any point in time the individual has possession of (e.g., ability to carry, use, or manipulate) or the ability to gain possession of a BSAT.
- Would an individual (e.g., facilities management staff, escorted visitors) who has access to space where Tier 1 select agents or toxins are used or stored, but does not regularly work in the area, need to undergo a security risk assessment and be enrolled in the entity’s suitability assessment program?
The entity needs to determine if the individual will have access to a select agent or toxin. An individual will be deemed as having access at any point in time the individual has possession of (e.g., ability to carry, use, or manipulate) or the ability to gain possession of a select agent or toxin.
If the individual entering into the registered space is able to access the select agent or toxin, the individual would need to undergo a security risk assessment and receive access approval from the Federal Select Agent Program. The individual would also need to be enrolled in the entity’s suitability assessment program. However, if the individual's duties are limited that they will never be able to access the select agent or toxin, then the individual would not need to undergo a security risk assessment or be part of the entity’s suitability assessment program. In this circumstance, the individual should be escorted by a person with a security risk assessment and who is enrolled in the entities’ suitability assessment program.
- How are unique identifying numbers (UIN) assigned to individuals at entities registered with the Federal Select Agent Program?
Unique Identifying Numbers (UIN), also known as DOJ Numbers, are generated within eFSAP and assigned to individuals. DOJ numbers are specific to the individual, not the entity. Once assigned, an individual’s UIN will not change, even if the person moves to another entity.
If an individual being added to an entity’s registration already has a UIN, the Responsible Official obtains the individual’s previously assigned UIN number from FSAP and enters the information into eFSAP.
- Is a maintenance worker who has not been approved to access select agents and toxins allowed to enter a laboratory storing select agents or toxins to perform maintenance on biological safety cabinet?
Yes, provisions for cleaning, maintenance, and repair personnel are as follows: When cleaning, maintenance, or repair personnel (either in-house staff or contracted workers) need access to select agent areas (including storage areas), an entity should either 1) use only SRA-approved individuals; or 2) provide an SRA-approved individual as an escort at all times for the non-SRA-approved personnel while the non-SRA-approved personnel are in, or have access to, a select agent area; or 3) if the non-SRA-approved individual will not be escorted, install additional security countermeasures (beyond the basic locked freezer/refrigerator/incubator or lock boxes) to prohibit access to the select agents or toxins by non-SRA-approved individuals; or 4) move the select agents or toxins to a different area that is appropriately registered. Additional countermeasures may include, but are not limited to, an additional lock and key, cipher lock, or tamper alarms interfaced with the facility intrusion detection system. Section 17 (Records) requires that select agent area access logs must be in place to record the name, date, and time of entry into the select agent activity area, including the name of an escort, if applicable.
Note: An entity also must provide biosafety information and training to each individual regardless of whether the individual has SRA approval before he/she works in or visits registered areas. The training should be tailored to address the risks posed by the select agents and toxins present as well as any particular needs of the individual or the work required.
- Is a new employee who has not been approved to access select agents and toxins allowed to observe a researcher who is monitoring select agent infected animals in micro-isolator cages?
Yes, non-approved individuals will be allowed access to areas where select agents are accessible only if they are continuously escorted by an approved individual and the non-approved individual will not have access to a select agent or toxin. An individual will be deemed as having access at any point in time the individual has possession of (e.g., ability to carry, use, or manipulate) or the ability to gain possession of a select agent or toxin.
It is the intent of the regulations that the escort will have the means and ability to prevent the non-approved individual from obtaining or making use of any accessible select agent or toxin in that area. Please note that section 17; (2) (Records) requires that select agent area access logs must be in place to record the name and date/ time of entry into the select agent activity area, including the name of an escort, if applicable. In addition, an entity also must provide biosafety information and training to each individual regardless of whether the individual has SRA approval before he/she works in or visits registered areas. The training should be tailored to address the risks posed by the select agents and toxins present as well as any particular needs of the individual or the work required.
- Can a person without security risk assessment (SRA) approval accept a package containing a select agent?
It depends on the circumstances under which package was received. Under the select agent regulations, the package containing select agents and toxins is not considered "received" by the entity until the intended recipient (person that opens the package) takes possession of the package. The intended recipient, or his/her designee, must be an individual who is approved by the Federal Select Agent Program for access to select agents and toxins.
Obtaining an SRA
- What is the process for obtaining access approval?
The individual must undergo an SRA for access approval. The entity's RO submits a request for the individual to have approval to access select agents or toxins through eFSAP. The RO selects the “Generate new DOJ number” button if the individual does not already have a DOJ number. The RO notifies the individual of his/her UIN/DOJ number and instructs the individual to complete the FD-961 form and return it to the RO.
The individual completes the FD-961 form and includes the UIN in Section II, item #5. For guidance on how to complete the FD-961 form and fingerprint card submissions, please refer to the FBI website.
NOTE: FD-961 forms must be submitted directly to BRAG. All FD-961 forms received by AgSAS or DSAT will be returned directly to the RO, which will delay SRA processing.
After the SRA is processed, FSAP will update the individual’s status in eFSAP.
NOTE: All FD-961 Forms received by AgSAS or DSAT will be returned directly to the RO of the entity, which will delay the processing the SRA. FD-961 Forms must be submitted directly to BRAG.
- How do I request an expedited SRA?
The RO must submit a written request with justification of good cause to APHIS or CDC. Good cause might be a public health or agricultural emergency, national security, or a short term visit by a prominent researcher. A written decision granting or denying the request will be issued (Refer to 42 CFR §73.10(f), 7 CFR §331.10(f), and 9 CFR §121.10(f)).
- Is there anything I can do to avoid delays in the SRA results?
Common errors may delay the SRA process. Please make sure that:
- The information (e.g., name, date of birth) for individuals listed in eFSAP is identical to the information provided on the FD-961 form submitted to BRAG for each individual.
- The UIN is listed correctly on Section II, Item #5 on the FD-961 form.
- All questions are answered completely and correctly on the FD-961 form.
- The applicant signs Section VII (Certification and Consent of Applicant).
- The RO or ARO signs Section VIII (Certification of Responsible or Alternate Responsible Official).
- What steps must be taken if an individual’s last name changes?
In the event that an individual changes their name, role, or title, or is assigned to a new supervising PI, the RO should update this information in eFSAP according to instructions outlined in the eFSAP Form 1 Amendment Instructions.
- What do I do if I am contacted that my SRA is "cancelled"?
If the individual’s current SRA expires during the renewal process and the renewal is cancelled, the individual’s access to select agents or toxins will be terminated. The Responsible Official must immediately notify CDC or APHIS when an individual’s access to select agents or toxins is terminated by the entity.
- Who do I contact if I have questions about SRAs?
For guidance on the SRA process, contact BRAG directly at 304-625-4900.
- When completing question #6 (Position) in Section II (Individual Information) on the FD-961 form, what position should be listed?
Please select the one of the following roles that best describes the individual’s primary responsibilities:
- Alternate Responsible Official
- Animal Care Staff
- Principal Investigator
- Responsible Official
- Other for individuals who do not fall under one of the roles noted above
Renewals of SRAs
- How long is the SRA valid?
An SRA for individuals that will have access to select agents and toxins and RO, ARO, individuals that own or control an entity, and non-exempted entities is valid for a period not to exceed three years. AgSAS or DSAT can cancel approval at any time based on new information germane to the SRA. A registered entity can of course deny access to select agents and toxins to an individual at any time the entity determines that the individual no longer has a legitimate need to handle or use such agents and toxins.
- What is the process for renewing an individual’s approval to access select agents or toxins?
- The RO is notified in eFSAP at 180, 90, 60, 45 days prior to the expiration date of an individual’s current access approval.
- Note: It is the RO’s responsibility to ensure all individuals listed on the entity’s registration have access approval.
- Within 90-180 days prior to the expiration date, any individual identified for access approval renewal should submit a new FD-961 form to BRAG by emailing the completed form to FD961@leo.gov. Fingerprint cards are not required for the renewal process. However, BRAG reserves the right to request additional fingerprint cards, if necessary.
- AgSAS or DSAT will update access approval information in eFSAP.
- What is the process for the renewal request of an entity’s SRA?
BRAG conducts SRAs of all non-exempt entities. AgSAS or DSAT will initiate the SRA process for the entity. Therefore, no action is required by the entity.
- Will a new UIN be assigned to individuals for renewal requests of SRAs?
No. As long as the individual stays employed with the registered entity, the individual will retain his or her original UIN.
Termination of Access
- How does a RO terminate an individual’s access to select agents and toxins?
Section 10(k) of the Select Agent Regulations (42 CFR Part 73, 7 CFR Part 331, and 9 CFR Part 121) requires that the RO immediately notify AgSAS or DSAT when an entity has terminated an individual’s access to select agents or toxins. The notification must include the reason for termination of access. Notification should be submitted in writing via mail, fax, or email to AgSAS or DSAT.
The termination of an individual’s access to select agents and toxins is effective once the amendment is received by the Federal Select Agent Program not when the amendment is approved. It should be noted that all paperwork, biographic and biometric data associated with the individual’s security risk assessment will be removed.
When terminating an individual’s access to select agents or toxins, it is critical that the RO takes steps to ensure that the individual no longer has the ability to access select agents or toxins. This may include retrieving keys, changing locks, disabling passwords, or disabling cardkeys.
- Once an entity removes a person from its registration, can the individual be added to another entity’s registration without undergoing a new SRA?
Possibly. If the individual's access to select agents or toxins was terminated, the individual must undergo a new SRA, which includes completing new finger print cards and an FD 961 form (This process is described in Obtaining an SRA Question #1).
- Is the RO required to notify AgSAS or DSAT if the RO suspends someone’s access to select agents or toxins?
No. The Select Agent Regulations only require notification if the individual’s access to select agents or toxins has been terminated.
- What is the procedure if an individual with approval to access select agents or toxins at one registered entity wishes to access select agents or toxins at additional entities?
A person with an access approval at one entity may be approved at additional entities without going through additional SRAs. The new entity(ies) must reach out to the current entity. The new entity then requests the individual’s UIN from the current entity or FSAP. The new entity then adds the person and UIN to their registration via eFSAP and notifies their FSAP point of contact.
- Are visitors without access approval from the Federal Select Agent Program allowed in a registered space that contains select agents and toxins?
Yes; however, security measures must be adequate to prevent access to select agents and toxins. Entities need to conduct a risk assessment to safeguard select agents and toxins against unauthorized access, theft, loss or release.
- Who can serve as an escort into an area containing select agents or toxins?
Escorts must be individuals approved to access select agents and toxins. The escort must follow security procedures.
- How should the entity’s security plan account for the use of escorts?
- If an escort is used, the person acting as the escort must be SRA approved and knowledgeable of the registered entity’s security requirements and biosafety risks of the select agent or toxin in the areas where the escorted person is being allowed to enter. The escort must be capable of executing appropriate safety protocols.
- A registered entity’s security plan must address the protocol on how non-SRA approved persons are granted access to areas that contain select agents and toxins.
- Train all Non-SRA approved persons on emergency protocols and the risks associated with the select agents and toxins located in the areas they will be entering.
- Entry logs must reflect the name of the visitor, their escort, date and time of entry and purpose of visit. These records must be maintained for three years.
- The Responsible Official should be aware and authorizes any non-SRA approved person accessing areas that contain select agents and toxins.
- The escort is trained to handle security concerns regarding uncooperative non-SRA approved persons accessing areas that contain select agents and toxins.
- Notify the Responsible Official when the entry is concluded.
- A safety or medical emergency has occurred in a laboratory that contains select agents and toxins. Is the registered entity allowed to have emergency first responders enter areas where select agents and toxins are present?
In the event of an emergency where it is not possible to escort first responders, yes, first responders may enter areas were select agents and toxins are present. The entity’s incident response plan should provide procedures in place to monitor the response personnel (e.g., record entry of all individuals into areas containing select agents and toxins) and account for the select agents and toxins as soon as it is practical after the emergency.
- Can a registered entity allow non-SRA approved individuals working with biological agents and/or toxins that are not select agents or toxins to share the same space with SRA approved individuals working with select agents or toxins?
Yes. The non-SRA approved individuals would require to be escorted at all times to ensure that they did not access a select agent or toxin unless additional security measures are in place (e.g., additional lock and key, cipher lock, or tamper alarms interfaced with the facility intrusion detection system) to prohibit access to select agents and toxins by the non-SRA approved individual or the select agent or toxin is removed to a different area that is appropriately registered.
- Is a non-SRA approved maintenance worker without escort allowed in a registered laboratory where the select agents have been removed and the laboratory room has been decontaminated to perform repairs?
Yes. The non-SRA approved maintenance personnel are allowed entry because the select agents have been removed to a different area that is appropriately registered.
- Is a visiting scientist that does not have SRA approval allowed to observe ongoing research with a select agent?
Yes. The individual would require to be escorted at all times to ensure that they do not access a select agent or toxin.
- Is a Federal Select Agent Program inspector allowed access to areas containing select agents and toxins?
Yes. The individuals would require to be escorted at all times to ensure that they do not access a select agent or toxin.
- What is the process if a foreign national wants to visit a registered entity?
If the individual will have access to select agents or toxins, they must have a current SRA. See Obtaining an SRA Question #1 for the process for obtaining an SRA.
Please note for any individual to undergo an SRA, the individual must be physically in the United States with a valid visa. To avoid delays in this process, the RO should inform AgSAS or DSAT of the dates the visit will occur.
- Can a foreign national be identified
DISCLAIMER: The contents of this database lack the force and effect of law, except as authorized by law (including Medicare Advantage Rate Announcements and Advance Notices) or as specifically incorporated into a contract. The Department may not cite, use, or rely on any guidance that is not posted on the guidance repository, except to establish historical facts.