Biosecurity

1
Biosecurity

• Brenda Cuccherini, Ph.D., M.P.H.
• Office of Research Development
• October 16, 2005

2
Why Biosecurity

• We have learned now that we cannot regard
  this planet as being fenced in and a secure
  abiding place for Man we can never anticipate
  the unseen good or evil that may come upon us
  suddenly out of space.
• 
  H.G. Wells
• 
  The War of
  the Worlds

3
A Changing World

• Historical emphasis on safety rather than both
  safety an security
• Increased awareness of vulnerabilities
• Inspections by IG have uncovered weaknesses
• Interest on the Hill
• Need for better emergency preparedness

4
What is Biosecurity?

• It is preventing unauthorized
• Entry into laboratories
• Removal or misuse of microbiological agents or
  hazardous agents
• Removal or misuse of sensitive materials (data,
  equipment, computers)
• Disruption of laboratories (terrorist incident,
  natural disaster, destructive events)

5
Biosecurity More Than Select Agents

• Biosecurity is more than security of
• Select Agents Toxins
• Prevention of a terrorist act
• Biosecurity is safeguarding personnel and
  resources to allow research programs to continue
  and to grow.

6
Biosecurity vs. Biosafety

• Biosecurity protection of materials, data,
  equipment, sites against theft or misuse
• Biosafety administrative polices, work
  practices, safety equipment, lab design to
  protect the worker and the environment

7
Biosecurity Plans

• Developed by each research facility
• Plan based on
• VHA policy
• Federal regulations (VA and non-VA)
• Facility specific assets vulnerabilities
• Facility policies
• Specific to the resources and the risks
• Integrated into the facility plan

8
Components of a Biosecurity Plan

• Physical security
• Personnel security access
• Information security
• Materials control accountability
• Vulnerability assessment
• Emergency response planning

9
Physical Security

• Objective to deter or detect unauthorized
  activities theft, destruction, or misuse of
  property, equipment, materials, data, etc.
• Type of physical security dependent on the risk
  and the impact if an event occurs

10
Physical Security Deterrence

• Physical barriers for buildings individual labs
• Locks
• Windows
• Doors self closing type of construction
• Audio alarms when triggered
• Lighting
• Physical barriers for buildings
• Location
• Fences limited access points
• Physical barriers for sections within individual
  labs
• Locks for cabinets, refrigerators, storage areas,
  etc.

11
Physical Security Detection

• Intrusion alarms
• Frequent patrols
• Video monitoring
• Reviewing access records

12
Personnel Security

• Appropriate credentialing background checks
• All staff officially appointed (compensated, WOC,
  IPA) or under contract
• Security training for personnel
• Develop an environment that fosters personal
  responsibility for security

13
Personnel Access Controls

• Access system key card
• Tracking system
• Deactivation for loss, theft, termination of
  person
• Specific levels of access
• Procedures for
• Obtaining services i.e., delivery, repair and
  cleaning services
• Access by visitors temporary staff/students
• Identifying removing unauthorized persons
• Requiring ID be worn at all times

14
Information Security

• Pertains to information regardless of storage
  method (paper, electronic, audio, visual)
• Identify the sensitivity of the information and
  the applicable regulations policies
• Security of the information is dependent on the
  sensitivity

15
Information Security Measures

• Preventing others from obtaining information by
• Physically stealing it
• Accessing off-site storage
• Finding discarded papers, disks, etc.
• Accidental release
• Breaching computer/network security
• Overhearing verbal discussion
• Password protect everything
• Locking work stations, computers, cabinets

16
Material Control Accountability

• Maintaining an up-to-date inventory
• Acquiring agents/chemicals only when needed
• Storing in a secure location
• Discarding agents that will not be needed in the
  near future

17
Vulnerability Assessment

• Vulnerability A security weakness or deficiency
  susceptibility for malicious actions to occur
  capacity to suffer harm
• Vulnerability assessment A systematic evaluation
  process that identifies
• Potential threats to security
• The impact of an event
• How current security measures would prevent an
  incident
• Potential solutions/protections
• Resources required to implement
  solutions/protections

18
Vulnerability Assessment (2)

• Conducted annually and after each incident
• Should involve applicable non-research services
  at the facility
• Includes
• Identifying risk
• Analyzing preventative procedures in place
• Identifying needed improvement and an
  implementation plan
• Deficiencies identified and potential solutions
  identified and implemented

19
Vulnerability AssessmentIdentification of Risk

• What must be protected?
• What happens if there is loss or misuse?
• What should receive the highest protections?
• How will it be compromised and why
• What is the probability?

20
Emergency Response Plan

• Address all potential scenarios
• Employee must be familiar with plan
• Integrated with the facility plan
• Coordinated with emergency responders in the
  community

21
Elements of an Emergency Response Plan

• Emergency recognition prevention
• Address hazards of specific agents
• Means for emergency responders to gain access
• Emergency alerting response procedures
• Evacuation or shelter in place plans
• Emergency treatment /or decontamination
• Security during and after the incident
• Evaluation of plan yearly or after incidents

22
Katrina The Need for an Emergency Response Plan
23
Employee Responsibilities

• Be familiar with all security policies and
  procedures
• Understand that security breaches by one person
  can impact the facility and all employees
• Complete the required training
• Comply with all requirements

24
Employee Responsibilities Specific Security
Issues

• Wear your ID
• Report breaches of security, unusual activities
• Follow security procedures
• Keep all required offices, storage areas locked
• Safeguard your keys, keycards passwords
• Maintain computer and data security
• Forward all requests for unpublished data to the
  FOIA officer

25

• Maintain Security Plan for Emergencies