FAQ: Security Risk Assessment

An SRA is the electronic records check performed by the Federal Bureau of Investigation (FBI), Criminal Justice Information Service, Bioterrorism Risk Assessment Group (BRAG) to determine whether an entity or an individual who wishes to register to possess, use or transfer a select agent or toxin, or an individual who has been identified by a registered entity as having a legitimate need to access a select agent or toxin meets one of the statutory restrictors which would either prohibit registration or restrict access, respectively.

The results of an SRA will assist DASAT or DRSC in its determination that the entity may possess, use, or transfer select agents or toxins; or that an individual may have access to biological select agents and toxins (BSAT).

Using the SRA process, the FBI will identify whether an individual or an entity is a restricted person as that term is defined by section 175b of Title 18, United States Code. The FBI will also use the SRA process to determine whether an individual has committed a crime set forth in section 2332b(g)(5) of title 18, United States Code; is knowingly involved with any organization that engages in domestic or international terrorism (as defined in section 2331 of title 18, United States Code or any other organization that engages in intentional acts of violence; or is an agent of a foreign power (as defined in section 1801 of title 50, United States Code.

The term “restricted person” means an individual who–

• Is under indictment for a crime punishable by imprisonment for a term exceeding 1 year;
• Has been convicted in any court of a crime punishable by imprisonment for a term exceeding 1 year;
• Is a fugitive from justice;
• Is an unlawful user of any controlled substance (as defined in section 102 of the Controlled Substances Act (21 U.S.C. 802));
• Is an alien illegally or unlawfully in the United States;
• Has been adjudicated as a mental defective or has been committed to any mental institution;
• Is an alien (other than an alien lawfully admitted for permanent residence) who is a national of a country as to which the Secretary of State, pursuant to section 6(j) of the Export Administration Act of 1979 (50 U.S.C. App. 2405(j)), section 620A of chapter 1 of part M of the Foreign Assistance Act of 1961 (22 U.S.C. 2371), or section 40(d) of chapter 3 of the Arms Export Control Act (22 U.S.C. 2780(d)), has made a determination (that remains in effect) that such country has repeatedly provided support for acts of international terrorism; or
• Has been discharged from the Armed Services of the United States under dishonorable conditions.

• The Responsible Official (RO),
• The Alternate Responsible Official (ARO),
• All individuals who will have access to BSAT, and
• Each individual who owns or controls an entity as defined below:
  1. For private academic institutions, any individual that is an officer, trustee, member of the board, or owner of the academic institution, and is in a managerial or executive capacity with regard to BSAT possessed, used, or transferred by the entity;
  2. For entities other than private academic institutions, any individual that is a partner, officer, director, holder or owner of 50 percent or more of its voting stock and is in a managerial or executive capacity with regard to BSAT possessed, used, or transferred by the entity.

Yes. A registered entity may not provide an individual access to BSAT until the individual is approved by DASAT or DRSC, following an SRA.

An individual will be deemed as having access at any point in time the individual has possession of (e.g., ability to carry, use, or manipulate) or the ability to gain possession of a BSAT.

The entity needs to determine if the individual will have access to a select agent or toxin. An individual will be deemed as having access at any point in time the individual has possession of (e.g., ability to carry, use, or manipulate) or the ability to gain possession of a select agent or toxin.

If the individual entering into the registered space is able to access the select agent or toxin, the individual would need to undergo a security risk assessment and receive access approval from the Federal Select Agent Program. The individual would also need to be enrolled in the entity’s suitability assessment program. However, if the individual’s duties are limited that they will never be able to access the select agent or toxin, then the individual would not need to undergo a security risk assessment or be part of the entity’s suitability assessment program. In this circumstance, the individual should be escorted by a person with a security risk assessment and who is enrolled in the entities’ suitability assessment program.

Unique Identifying Numbers (UIN), also known as DOJ Numbers, are generated within eFSAP and assigned to individuals. DOJ numbers are specific to the individual, not the entity. Once assigned, an individual’s UIN will not change, even if the person moves to another entity.

If an individual being added to an entity’s registration already has a UIN, the Responsible Official obtains the individual’s previously assigned UIN number from FSAP and enters the information into eFSAP.

Yes, provisions for cleaning, maintenance, and repair personnel are as follows: When cleaning, maintenance, or repair personnel (either in-house staff or contracted workers) need access to select agent areas (including storage areas), an entity should either 1) use only FSAP-approved individuals; or 2) provide an FSAP-approved individual as an escort at all times for the non-FSAP approved personnel while the non-FSAP approved personnel are in, or have access to, a select agent area; or 3) if the non-FSAP approved individual will not be escorted, install additional security countermeasures (beyond the basic locked freezer/refrigerator/incubator or lock boxes) to prohibit access to the select agents or toxins by non-FSAP approved individuals; or 4) move the select agents or toxins to a different area that is appropriately registered. Additional countermeasures may include, but are not limited to, an additional lock and key, cipher lock, or tamper alarms interfaced with the facility intrusion detection system. Section 17 (Records) requires that select agent area access logs must be in place to record the name, date, and time of entry into the select agent activity area, including the name of an escort, if applicable.

Note: An entity also must provide biosafety information and training to each individual regardless of whether the individual has SRA approval before he/she works in or visits registered areas. The training should be tailored to address the risks posed by the select agents and toxins present as well as any particular needs of the individual or the work required.

Yes, non-approved individuals will be allowed access to areas where select agents are accessible only if they are continuously escorted by an approved individual and the non-approved individual will not have access to a select agent or toxin. An individual will be deemed as having access at any point in time the individual has possession of (e.g., ability to carry, use, or manipulate) or the ability to gain possession of a select agent or toxin.

It is the intent of the regulations that the escort will have the means and ability to prevent the non-approved individual from obtaining or making use of any accessible select agent or toxin in that area. Please note that section 17; (2) (Records) requires that select agent area access logs must be in place to record the name and date/ time of entry into the select agent activity area, including the name of an escort, if applicable. In addition, an entity also must provide biosafety information and training to each individual regardless of whether the individual has SRA approval before he/she works in or visits registered areas. The training should be tailored to address the risks posed by the select agents and toxins present as well as any particular needs of the individual or the work required.

The individual must undergo an SRA for access approval.  The entity’s RO submits a request for the individual to have approval to access select agents or toxins through eFSAP.  The RO selects the “Generate new DOJ number” button if the individual does not already have a DOJ number. The RO notifies the individual of his/her UIN/DOJ number and instructs the individual to complete the FD-961 form and return it to the RO.

The individual completes the FD-961 form and includes the UIN in Section II, item #5. For guidance on how to complete the FD-961 form and fingerprint card submissions, please refer to the FBI website.

NOTE: FD-961 forms must be submitted directly to BRAG. All FD-961 forms received by DASAT or DRSC will be returned directly to the RO, which will delay SRA processing.

After the SRA is processed, FSAP will update the individual’s status in eFSAP.

NOTE: All FD-961 Forms received by DASAT or DRSC will be returned directly to the RO of the entity, which will delay the processing the SRA. FD-961 Forms must be submitted directly to BRAG.

Common errors may delay the SRA process. Please make sure that:

• The information (e.g., name, date of birth) for individuals listed in eFSAP is identical to the information provided on the FD-961 form submitted to BRAG for each individual.
• The UIN is listed correctly on Section II, Item #5 on the FD-961 form.
• All questions are answered completely and correctly on the FD-961 form.
• The applicant signs Section VII (Certification and Consent of Applicant).
• The RO or ARO signs Section VIII (Certification of Responsible or Alternate Responsible Official).

Please select the one of the following roles that best describes the individual’s primary responsibilities:

• Administrative
• Alternate Responsible Official
• Animal Care Staff
• IT
• Laboratorian
• Janitorial
• Maintenance
• Owner/Controller
• Principal Investigator
• Responsible Official
• Safety
• Security
• Shipping/Receiving
• Other for individuals who do not fall under one of the roles noted above

• The RO is notified in eFSAP at 180, 90, 60, 45 days prior to the expiration date of an individual’s current access approval.
  • Note: It is the RO’s responsibility to ensure all individuals listed on the entity’s registration have access approval.
• Within 90 days prior to the expiration date, any individual identified for access approval renewal should submit a new FD-961 form to BRAG by emailing the completed form to FD961@leo.gov. Fingerprint cards are not required for the renewal process. However, BRAG reserves the right to request additional fingerprint cards, if necessary.
• DASAT or DRSC will update access approval information in eFSAP.

Section 10(k) of the Select Agent Regulations (42 CFR Part 73, 7 CFR Part 331, and 9 CFR Part 121) requires that the RO immediately notify DASAT or DRSC when an entity has terminated an individual’s access to select agents or toxins. The notification must include the reason for termination of access. Notification should be submitted in writing via mail, fax, or email to DASAT or DRSC.

The termination of an individual’s access to select agents and toxins is effective once the amendment is received by the Federal Select Agent Program not when the amendment is approved. It should be noted that all paperwork, biographic and biometric data associated with the individual’s security risk assessment will be removed.

When terminating an individual’s access to select agents or toxins, it is critical that the RO takes steps to ensure that the individual no longer has the ability to access select agents or toxins. This may include retrieving keys, changing locks, disabling passwords, or disabling cardkeys.

Possibly. If the individual’s access to select agents or toxins was terminated, the individual must undergo a new SRA, which includes completing new finger print cards and an FD 961 form (This process is described in Obtaining an SRA Question #1).

A person with an access approval at one entity may be approved at additional entities without going through additional SRAs. The new entity(ies) must reach out to the current entity. The new entity then requests the individual’s UIN from the current entity or FSAP. The new entity then adds the person and UIN to their registration via eFSAP and notifies their FSAP point of contact.

• If an escort is used, the person acting as the escort must be FSAP-approved and knowledgeable of the registered entity’s security requirements and biosafety risks of the select agent or toxin in the areas where the escorted person is being allowed to enter. The escort must be capable of executing appropriate safety protocols.
• A registered entity’s security plan must address the protocol on how non-FSAP approved persons are granted access to areas that contain select agents and toxins.
• Train all non-FSAP approved persons on emergency protocols and the risks associated with the select agents and toxins located in the areas they will be entering.
• Entry logs must reflect the name of the visitor, their escort, date and time of entry and purpose of visit. These records must be maintained for three years.
• The Responsible Official should be aware and authorizes any non-FSAP approved person accessing areas that contain select agents and toxins.
• The escort is trained to handle security concerns regarding uncooperative non-FSAP approved persons accessing areas that contain select agents and toxins.
• Notify the Responsible Official when the entry is concluded.

In the event of an emergency where it is not possible to escort first responders, yes, first responders may enter areas were select agents and toxins are present. The entity’s incident response plan should provide procedures in place to monitor the response personnel (e.g., record entry of all individuals into areas containing select agents and toxins) and account for the select agents and toxins as soon as it is practical after the emergency.

If the individual will have access to select agents or toxins, they must have a current SRA. See Obtaining an SRA Question #1 for the process for obtaining an SRA.

Please note for any individual to undergo an SRA, the individual must be physically in the United States with a valid visa. To avoid delays in this process, the RO should inform DASAT or DRSC of the dates the visit will occur.

A “restricted person” is an individual who falls under one or more of the following categories:

• Is under indictment for a crime punishable by imprisonment for a term exceeding 1 year.
• Has been convicted in any court of a crime punishable by imprisonment for a term exceeding 1 year.
• Is a fugitive from justice.
• Is an unlawful user of any controlled substance (as defined in section 102 of the Controlled Substances Act (21 U.S.C. 802)).
• Is an alien illegally or unlawfully in the United States.
• Has been adjudicated as a mental defective or has been committed to any mental institution.
• (i)Is an alien (other than an alien lawfully admitted for permanent residence) who is a national of a country as to which the Secretary of State, pursuant to section 6(j) of the Export Administration Act of 1979 (50 U.S.C. App. 2405(j)), section 620A of chapter 1 of part M of the Foreign Assistance Act of 1961 (22 U.S.C. 2371), or section 40(d) of chapter 3 of the Arms Export Control Act (22 U.S.C. 2780(d)), has made a determination (that remains in effect) that such country has repeatedly provided support for acts of international terrorism; or (ii) acts for or on behalf of, or operates subject to the direction or control of, a government or official of a country described in this subparagraph.
• Has been discharged from the Armed Services of the United States under dishonorable conditions.
• Is a member of, acts for or on behalf of, operates subject to the direction or control of, a terrorist organization as defined in section 212(a)(3)(B)(vi) of the Immigration and Nationality Act (8 USC 1182(a)(3)(B((iv).

The Federal Select Agent Program (FSAP) will deny or revoke a “restricted person’s” approval for access to any select agent or toxin.

In addition, FSAP may deny, limit, or revoke approval for access to any select agent or toxin for an individual if (See section 10 (Restricting access to select agents and toxins; security risk assessments) of the select agent regulations):

• The individual is reasonably suspected by any Federal law enforcement or intelligence agency of
  • Committing a crime specified in 18 U.S.C. 2332b(g)(5);
  • Knowing involvement with an organization that engages in domestic or international terrorism (as defined in 18 U.S.C. 2331) or with any other organization that engages in intentional crimes of violence or
  • Being an agent of a foreign power (as defined in 50 U.S.C. 1801).
• It is determined such action is necessary to protect public health and safety, animal health or animal products, or plant health or plant products.

After notification by FSAP that an individual’s access to select agents and toxins has been denied or revoked, the Responsible Official must immediately notify the individual that he or she has lost their access to select agents or toxins and immediately take steps to ensure that the individual will not have  access to select agents and toxins (e.g., have the individual turn in keys or changing locks, update the electronic access records, etc.).

Depending on an individual’s role, or any determination by the entity that suspicious activity may have occurred with this individual while the individual had access to select agents and toxins, FSAP recommends conducting a review of entity inventory and access records to ensure that select agents and toxins have been safeguarded against theft, loss, or release.

Section 20(b) of the select agent regulations allows an individual to appeal a denial, limitation, or revocation of access approval. The appeal must be in writing, state the factual basis for the appeal, and be submitted to FSAP within 180 calendar days of the decision.

An individual who would like a copy of his or her FBI records should go to the FBI Identification Record Request webpage or write to:

Criminal Justice Information Services Division
Attention: Record Request
1000 Custer Hollow Road
Clarksburg, WV 26306

NOTE: It should be noted that the individual will remain identified as restricted person throughout the appeal process.

Yes. Although access to select agents and toxins by restricted persons is prohibited, there may be occasions when an entity needs to provide access to an area in which select agents are stored or used.  It is the policy of the FSAP that a registered entity may allow a restricted person into an area containing select agents and toxins under the following conditions:

• Under no circumstances is the entity allowed to provide a restricted person access to a select agent or toxin.
• The entity’s security plan addresses how the entity will safeguard select agents and toxins against theft, loss, release, or unauthorized access by allowing a restricted person entry into areas containing select agents and toxins.
• The RO is notified that a restricted person requires entry into an area containing select agents and toxins and determines the risk of a restricted person accessing this select agent or toxin in this area. Based on this assessment, the RO approves or denies the request.
• The entity, as provided in the entity’s security plan, secures all the select agents and toxins against unauthorized access while the restricted person is in an area containing select agents and toxins (e.g., select agents or toxins are removed from the area or agents and toxins are secured in containers that would not allow access by restricted person, etc.).
• The restricted person is escorted and continuously monitored by an individual who received access approval to select agents and toxins by FSAP, following a security risk assessment by the Attorney General. The restricted person escort must be aware of their duty to not allow the restricted person access to a select agent or toxin.
• Section 17 (Records) of the select agent regulations requires that access logs must be in place to record the name and date/time of entry into the registered area including the name of the escort.
• The entity verifies that all the select agents and toxins remained secure during the presence of the restricted person in the area containing select agents and toxins and the restricted person did not access the agent or toxin.