[Code of Federal Regulations]
[Title 42, Volume 1]
[Revised as of October 1, 2004]
From the U.S. Government Printing Office via GPO Access
[CITE: 42CFR73.11]

[Page 457-458]
 
                         TITLE 42--PUBLIC HEALTH
 
    CHAPTER I--PUBLIC HEALTH SERVICE, DEPARTMENT OF HEALTH AND HUMAN 
                                SERVICES
 
PART 73_SELECT AGENTS AND TOXINS--Table of Contents
 
Sec. 73.11  Security.

    (a) An entity must develop and implement a security plan 
establishing policy and procedures that ensure the security of areas 
containing select agents and toxins. The security plan must be based on 
a systematic approach in which threats are defined, vulnerabilities are 
examined, and risks associated with those vulnerabilities are mitigated 
with a security systems approach.
    (b) The plan must:
    (1) Describe inventory control procedures, minimal education and 
experience criteria for those individuals with access to select agents 
or toxins, physical security, and cyber security;
    (2) Contain provisions for routine cleaning, maintenance, and 
repairs; provisions for training personnel in security procedures; 
provisions for securing the area (e.g., card access, key pads, locks) 
and protocols for changing access numbers or locks following staff 
changes;
    (3) Describe procedures for loss or compromise of keys, passwords, 
combinations, etc.;
    (4) Contain procedures for reporting suspicious persons or 
activities, loss or theft of listed agents or toxins, release of listed 
agents or toxins, or alteration of inventory records;
    (5) Contain provisions for the control of access to containers where 
listed agents and toxins are stored; and procedures for reporting and 
removing unauthorized persons;
    (6) Contain provisions for ensuring that all individuals with 
access, including workers and visitors, understand security requirements 
and are trained and equipped to follow established procedures;
    (7) Establish procedures for reporting and removing unauthorized 
persons; and
    (8) Establish procedures for securing the area when individuals 
approved under Sec. 73.8 are not present (e.g., card access system, key 
pads, locks), including protocols for changing access numbers or locks 
following staff changes.
    (c) The security plan must be reviewed by the RO at least annually 
and after any incident.
    (d) With respect to areas containing select agents and toxins, the 
entity must adhere to the following security requirements or implement 
measures to achieve an equivalent or greater level of security as the 
provisions below:
    (1) Allow unescorted access only to individuals who have been 
approved under Sec. 73.8 and who are performing a specifically 
authorized function during hours required to perform the defined job 
(including delivery to an outside shipping agent for transportation in 
commerce);
    (2) Allow individuals not approved under Sec. 73.8 to conduct 
routine cleaning, maintenance, repairs, and other

[[Page 458]]

non-laboratory functions only when escorted and continually monitored by 
individuals approved under Sec. 73.8;
    (3) Provide for the control of access to containers where select 
agents and toxins are stored by requiring freezers, refrigerators, 
cabinets, and other containers where stocks of select agents and toxins 
are stored to be locked (e.g., card access system, lock boxes) when they 
are not in the direct view of approved staff, and by using other 
monitoring measures as needed, such as video surveillance;
    (4) Require the inspection of all packages upon entry to and exit 
from the area;
    (5) Establish a protocol for intra-entity transfers, including 
provisions for ensuring that the packaging, and movement from a 
laboratory to another laboratory or from a laboratory to a shipping 
place, is conducted under the supervision of an individual approved 
under Sec. 73.8;
    (6) Require that each approved individual under 73.8 does not share 
with any other person, his or her unique means (e.g., keycards or 
passwords) of accessing the area or select agent or toxin;
    (7) Require that each individual approved under Sec. 73.8 report 
any of the following immediately to the Responsible Official:
    (i) Any loss or compromise of their keys, passwords, combinations, 
etc.;
    (ii) Any suspicious persons or activities;
    (iii) Any loss or theft of select agents or toxins;
    (iv) Any release of select agents or toxins; and
    (v) Any sign that inventory and use records of select agents or 
toxins have been altered or otherwise compromised.
    (e) The entity must separate areas where select agents and toxins 
are stored or used from the public areas of the buildings.
    (f) Upon termination of the use, a select agent or toxin must be
    (1) Securely stored in accordance with the requirements of this 
section;
    (2) Transferred to another registered facility in accordance with 
Sec. 73.14; or
    (3) Destroyed on-site by autoclaving, incineration, or another 
recognized sterilization or neutralization process.