| Security Risk Assessments
Overview
One of the fundamental elements of the Select Agents Regulations is to keep Select Agents and toxins out of the possession of individuals who might intend to misuse them. APHIS and CDC work closely with Department of Justice's Federal Bureau of Investigation, Criminal Justice Information Service (CJIS) to identify those individuals who are prohibited from access to Select Agents and based on the restrictions identified in the USA PATRIOT Act . A security risk assessment is the method used by the CJIS to evaluate an individual's suitability to access Select Agents. CJIS conducts security risk assessments of all individuals, Responsible Officials, Alternate Responsible Officials and non-governmental entities that request access to Select Agents and toxins. APHIS and CDC authorize access to Select Agents and toxins based on the results of the security risk assessment.
This webpage contains general information on the security risk assessment process including frequently asked questions and a link to the FD-961 form (the application for security risk assessment).
NOTE: All FBI FD-961 forms must be sent directly to CJIS. Any forms received by APHIS or CDC will be returned directly to the Responsible Official of the entity which may result in a delay of the process.
For additional guidance on the security risk assessment process, contact CJIS directly at 304-625-4900 or visit CJIS website at Criminal Justice Information Services Website.
FD-961 Form (Application for Security Risk Assessment)
The following process describes how to submit a security risk assessment:
-
The entity's Responsible Official (RO) submits an application or amendment that includes the individual's information using the APHIS/CDC Form 1, Application for Registration for Possession, Use, and Transfer of Select Agents and Toxins to their lead agency (APHIS or CDC, but not both).
-
The lead agency issues to the entity a letter with the unique Department of Justice (DOJ) identifying number for each individual listed on the APHIS/CDC Form 1, Application for Registration for Possession, Use, and Transfer of Select Agents and Toxins.
-
The RO forwards to each individual their unique DOJ identifying number.
-
The individual completes the FD-961 Form and puts his or her unique identifying number in block 11.
-
The RO faxes a request for fingerprint card packages which consists of two fingerprint cards, general instructions, fingerprint instructions, and a pre-addressed return envelope. The request should include the following: the entity name, point of contact or RO, the correct mailing address, contact telephone number and the number of fingerprint card packets being requested. The request should be faxed to the FBI at (304) 625-2198.
-
The entity must submit a completed FD-961 form and two legible fingerprint cards, printed by a local law enforcement agency, and then mail the FD-961 form and fingerprint cards as one package directly to the FBI, Criminal Justice Information Services Division (CJIS), not to APHIS or CDC. The CJIS mailing address is:
FBI, CJIS, Bioterrorism
1000 Custer Hollow Road, Module E-3
Clarksburg, WV 26306-0147
For guidance on how to complete the FD-961 form, see the FBI website
http://www.fbi.gov/terrorinfo/bioterrorfd961.htm for additional information.
NOTE: All FBI FD-961 forms received by APHIS or CDC will be returned directly to the RO of the entity which will delay the processing of your request.
Frequently asked questions concerning Security Risk Assessments
General
Obtaining a Security Risk Assessment
Renewals of Security Risk Assessments
Termination of Access
Visitors
Foreign Nationals
General
- What is a security risk assessment (SRA)?
An SRA is the electronic records check performed by the Federal Bureau of Investigation (FBI), Criminal Justice Information Services Division (CJIS) to determine whether an entity or an individual who wishes to register to possess, use or transfer a select agent or toxin, or an individual who has been identified by a registered entity as having a legitimate need to access a select agent or toxin meets one of the statutory restrictors which would either prohibit registration or restrict access, respectively.
The results of an SRA will assist APHIS and CDC in its determination that the entity may possess, use, or transfer select agents or toxins; or that an individual may have access to biological select agents and toxins (BSAT).
- What are the prohibitors that would be identified in the SRA process?
Using the SRA process, the FBI will identify whether an individual or an entity is a restricted person as that term is defined by section 175b of Title 18, United States Code. The FBI will also use the SRA process to determine whether an individual has committed a crime set forth in section 2332b(g)(5) of title 18, United States Code; is knowingly involved with any organization that engages in domestic or international terrorism (as defined in section 2331 of title 18, United States Code or any other organization that engages in intentional acts of violence; or is an agent of a foreign power (as defined in section 1801 of title 50, United States Code.
The term "restricted person" means an individual who--
- Is under indictment for a crime punishable by imprisonment for a term exceeding 1 year;
- Has been convicted in any court of a crime punishable by imprisonment for a term exceeding 1 year;
- Is a fugitive from justice;
- Is an unlawful user of any controlled substance (as defined in section 102 of the Controlled Substances Act (21 U.S.C. 802));
- Is an alien illegally or unlawfully in the United States;
- Has been adjudicated as a mental defective or has been committed to any mental institution;
- Is an alien (other than an alien lawfully admitted for permanent residence) who is a national of a country as to which the Secretary of State, pursuant to section 6(j) of the Export Administration Act of 1979 (50 U.S.C. App. 2405(j)), section 620A of chapter 1 of part M of the Foreign Assistance Act of 1961 (22 U.S.C. 2371), or section 40(d) of chapter 3 of the Arms Export Control Act (22 U.S.C. 2780(d)), has made a determination (that remains in effect) that such country has repeatedly provided support for acts of international terrorism; or
- Has been discharged from the Armed Services of the United States under dishonorable conditions.
- Who must undergo an SRA?
- The Responsible Official (RO),
- The Alternate Responsible Official (ARO),
- All individuals who will have access to BSAT, and
- Each individual who owns or controls an entity as defined below:
- For private academic institutions, any individual that is an officer, trustee, member of the board, or owner of the academic institution, and is in a managerial or executive capacity with regard to BSAT possessed, used, or transferred by the entity;
- For entities other than private academic institutions, any individual that is a partner, officer, director, holder or owner of 50 percent or more of its voting stock and is in a managerial or executive capacity with regard to BSAT possessed, used, or transferred by the entity.
- Currently, we only store BSAT. Do we have to obtain SRA approval for individuals with access to the freezers?
Yes. A registered entity may not provide an individual access to BSAT until the individual is approved by APHIS or CDC, following an SRA.
An individual will be deemed as having access at any point in time the individual has possession of (e.g., ability to carry, use, or manipulate) or the ability to gain possession of a BSAT.
Return to Top
Obtaining an SRA
- What is the process for obtaining an SRA?
The application process for a new registration or an amendment to an existing registration is:
For guidance on how to complete the FD-961 Form, please refer to the FBI website at: http://www.fbi.gov/about-us/cjis/bioterrorism-security-risk-assessment-form .
| NOTE: All FD-961 Forms received by APHIS or CDC will be returned directly to the RO of the entity, which will delay the processing the SRA. FD-961 Forms must be submitted directly to CJIS. |
- How do I request an expedited SRA?
Prior to a request for expedited processing, the RO should confirm that the FD-961 Form and two FD-258 Fingerprint Cards have been received by CJIS for processing.
The RO must submit a written request with justification of good cause to APHIS or CDC. Good cause might be a public health or agricultural emergency, national security, or a short term visit by a prominent researcher. A written decision granting or denying the request will be issued (Refer to 42 CFR 73.10(e), 7 CFR 331.10(e), and 9 CFR 121.10(e)).
- What is the process for change in employment to another registered entity?
Under any case where an individual is changing employers from one registered entity to another registered entity, the new employing entity's RO submits an application or amendment that includes the individual's information using the APHIS/CDC Form 1 to the lead agency (APHIS or CDC, but not both). The individual submits a completed FD-961 Form to CJIS. The individual would put the new assigned UIN provided by APHIS or CDC in block 11. Fingerprint cards are not required if a legible set is already on file with CJIS. CJIS reserves the right to request additional fingerprint cards if necessary. A full SRA must be completed prior to an individual being granted access to select agents and toxins at the new place of employment. The SRA granted under previous employment is NOT transferable.
- Is there anything I can do to avoid delays in the SRA results?
Common errors may delay the SRA process. Please pay careful attention to:
- Ensure that the information (e.g., name, date of birth, etc.) for individuals listed on the APHIS/CDC Form 1 is identical to the information provided on the FD-961 Form submitted to CJIS for each individual.
- Ensure that the APHIS or CDC assigned UIN is correct and listed on Section II, Item #11 on the FD-961 Form.
- Ensure all questions are answered on the FD-961 Form.
- Ensure that the applicant signs Section II (below the certification questions) and Section III (consent page).
- What is the process if an individual gets married and the last name changes?
The entity RO submits an amended APHIS/CDC Form 1 to the entity's lead agency (APHIS or CDC) that indicates the name change.
- Who do I contact if I have questions about SRAs?
For guidance on the SRA process, contact CJIS directly at 304-625-4900.
Return to Top
Renewals of SRAs
- How long is the SRA valid?
An SRA for individuals that will have access to select agents and toxins is valid for a period not to exceed three years. APHIS or CDC can cancel approval at any time based on new information germane to the SRA. A registered entity can of course deny access to select agents and toxins to an individual at any time the entity determines that the individual no longer has a legitimate need to handle or use such agents and toxins. The RO, ARO, individuals that own or control an entity, and non-exempted entities must obtain SRA approval each time the certificate of registration is renewed. A certificate of registration is valid for a maximum of three years.
- Why did the policy change from access to select agents and toxins being valid for a period of five years to three years?
On January 9, 2009, President George W. Bush signed Executive Order (EO) 13486 entitled “Strengthening Laboratory Biosecurity in the United States.” This EO established a Working Group (WG) co-chaired by the Secretary of Defense and the Secretary of Health and Human Services. The scope of WG activities pertained to the policy of the United States that facilities that possess biological select agents and toxins have appropriate security and personnel assurance practices to protect against theft, misuse, or diversion to unlawful activity of such agents and toxins. The WG provided final recommendations through careful consideration of proposals from subgroups, and comments received from select agent entities and the public. The report is available at: http://orise.orau.gov/emi/scapa/files/biosecurity-report.pdf .
One of the recommendations to enhance security was to perform an SRA required by the Select Agent Regulations (7 CFR § 331.10, 9 CFR § 121.10, 42 CFR § 73.10) every three years for all individuals with access to select agents and toxins instead of the current policy of performing the SRA every five years. The Federal Select Agent Program concurs with this recommendation.
- Who is affected by this new policy of approval for access to select agents and toxins being valid for a period of three years?
Effective June 1, 2011, individuals renewing SRAs will receive access approval to select agents and toxins for a period of three years unless terminated earlier by the entity, APHIS, or CDC.
- What is the process for the renewal request of an individual’s SRA?
- APHIS or CDC will provide the RO with a list of individuals who need renewed SRAs and details regarding the SRA renewal process. Note: It is the RO's responsibility to ensure all individuals listed on the entity's registration are SRA approved.
- No less than 45 days prior to their expiration date, any individual identified for SRA renewal should submit a new FD-961 Form to CJIS by faxing to 304-625-2198. Fingerprint cards are not required for the renewal process. However, CJIS reserves the right to request additional fingerprint cards if necessary.
- APHIS or CDC will notify the RO in writing the results of the individual's SRA.
- What is the process for the renewal request of an entity’s SRA?
CJIS conducts SRAs of all non-exempt entities. APHIS or CDC will initiate the SRA process for the entity. Therefore, no action is required by the entity.
- Will a new UIN be assigned to individuals for renewal requests of SRAs?
No. As long as the individual stays employed with the registered entity, the individual will retain his or her original UIN.
Return to Top
Termination of Access
- How does a RO terminate an individual’s access to select agents and toxins?
Section 10(j) of the Select Agent Regulations (42 CFR part 73, 7 CFR part 331, and 9 CFR part 121) requires that the RO immediately notify APHIS or CDC when an entity has terminated an individual's access to select agents or toxins. The notification must include the reason for termination of access. Notification should be submitted in writing via mail, fax, or email to APHIS or CDC.
When terminating an individual's access to select agents or toxins, it is critical that the RO takes steps to ensure that the individual no longer has the ability to access select agents or toxins. This may include retrieving keys, changing locks, disabling passwords, or disabling cardkeys.
- Once an individual’s access to select agents and toxins is terminated, can the individual’s access to select agents and toxin be reactivated without undergoing a new SRA?
No. If the individual's access to select agents or toxins is terminated, the individual must undergo a new SRA (This process is described in, Obtaining an SRA Question # 1). As long as the individual stays employed with the registered entity, the individual will retain his/her original UIN. The individual would put the UIN provided by APHIS or CDC on Section II, item #11 of the FD-961 Form. Two FD-258 Fingerprint Cards are not required if a legible set is already on file with the CJIS; however, CJIS reserves the right to request additional fingerprint cards if necessary. A full SRA must be completed prior to an individual being granted access to select agents and toxins. The SRA granted previously is NOT transferable.
- Is the RO required to notify APHIS or CDC if the RO suspends someone’s access to select agents or toxins?
No. The Select Agent Regulations only require notification if the individual's access to select agents or toxins has been terminated.
Return to Top
Visitors
- What is the procedure if an individual with access approval from one registered entity wants to visit another registered entity and have access to BSAT?
The receiving entity's RO should request that the sending entity's RO provide the receiving entity's RO a letter which states the individual is currently identified on the sending entity's certificate of registration. The receiving entity is defined as the entity where the training, work or visit will take place. The sending entity is defined as the entity where the individual is currently located. The individual must have a current SRA approval. The letter should include: visitor's full name, date of birth, date of issuance of the SRA approval and UIN of the individual.
The receiving entity's RO should submit this letter and a request for an amendment to the registration to the lead agency (APHIS or CDC). The amendment request should provide the updated sections of the APHIS/CDC Form 1 where applicable (e.g., Principal Investigator, specific agents or toxins, specific laboratory buildings/rooms, etc.).
Once the visit is complete, the receiving entity's RO should amend the entity's registration (APHIS/CDC Form 1) to remove the visitor. In some circumstances, the receiving entity's RO may decide to leave the visitor on the registration, if the same individual will be visiting the entity again.
- What is the procedure if an individual from an unregistered entity wants to visit a registered entity?
A registered entity may not provide an individual access or an individual may not access a select agent or toxin, unless the individual is approved by the APHIS or CDC, following a security risk assessment by CJIS (Section 10(a)) of the Select Agent Regulations (42 CFR part 73, 7 CFR part 331, and 9 CFR part 121).
An individual will be deemed having access at any point in time the individual has possession of (e.g., ability to carry, use, or manipulate) or the ability to gain possession of a select agent or toxin (Section 10 (b)) of the Select Agent Regulations (42 CFR part 73, 7 CFR part 331, and 9 CFR part 121).
See Obtaining an SRA Question #1 for the process for obtaining an SRA.
Once the visit is complete, the receiving entity's RO should amend the entity's registration (APHIS/CDC Form 1) to remove the visitor. In some circumstances, the receiving entity's RO may decide to leave the visitor on the registration, if the same individual will be visiting the entity again.
Return to Top
Foreign Nationals
- What is the process if a foreign national wants to visit a registered entity?
If the individual will have access to select agents or toxins, they must have a current SRA. See Obtaining an SRA Question #1 for the process for obtaining an SRA.
Please note for any individual to undergo an SRA, the individual must be physically in the United States with a valid visa. To avoid delays in this process, the RO should inform CDC or APHIS of the dates the visit will occur.
- Can a foreign national be identified as an owner/controller of a registered entity?
Yes. The individual must have a current SRA. See Obtaining an SRA Question #1 for the process for obtaining an SRA.
Please note for any individual to receive an SRA, the individual must have a legal presence in the United States (e.g., valid green card).
Return to Top
|
|
