	Security Assessment from September 2008 Report

Select agent regulations do not mandate that specific perimeter security  controls be present at BSL-4 labs, resulting in a significant difference in  perimeter security between the nation’s five labs. While  three labs had all or nearly all of the key security controls we assessed,  our September 2008 report demonstrated that two labs (Labs C and E) had  a significant lack of these controls. CDC Has Taken Limited Action to Require Specific Perimeter Security Controls

Significant perimeter security differences continue to exist among the  nation’s five BSL-4 labs operational at the time of our most recent  assessment. The WG is chaired by HHS  and the Department of Defense (DOD) and includes representatives  from several federal agencies and includes a subgroup that is focused  on physical and facility security of biolabs. Two Labs Take Action to Improve Perimeter Security Controls

Although CDC has taken limited action to address our findings from our  September 2008 report, the two deficient BSL-4 labs have made progress  on their own. In our July 2009 report, we stated that one BSL-4 lab made a  significant number of improvements to increase perimeter security, thus  reducing the likelihood of intrusion. The second one made three changes  and formed a committee to consider and prioritize other changes. Camera coverage includes all exterior lab entrances. The cameras currently cover the exterior of the  building. Armed guards are present on the campus. Additional Observations on Federal Oversight of BSL-4 Labs

In our July 2009 report, we made two additional observations that concern  perimeter security differences among the nation’s five BSL-4 labs that  were operational at the time of our assessment:    All five BSL-4 labs operating in 2008 had a security plan in place when  we assessed them. For example, Lab B is a military facility  subject to far stricter DOD physical security requirements. CDC inspection officials stated their training and experience had been  mainly in the area of safety. According to CDC officials,  they are developing a comprehensive strategy for safety and security of  biosafety labs and will adjust the training and inspection process  accordingly to match this comprehensive strategy.
Why GAO Did This Study

Biosafety laboratories are primarily regulated by either the Department of Health and Human Services (HHS) or the U.S. Department of Agriculture (USDA), depending on whether the substances they handle pose a threat to the health of humans or plants, animals, and related products, respectively. Currently, all operational biosafety level 4 (BSL-4) labs are overseen by HHS's Centers for Disease Control and Prevention (CDC). BSL-4 labs handle the world's most dangerous agents and toxins that cause incurable and deadly diseases. This testimony summarizes GAO's previously issued reports on perimeter security at the nation's BSL-4 laboratories that were issued in September 2008 (GAO-08-1092) and July 2009 (GAO-09-851). Specifically, this testimony describes (1) the findings and recommendation on key perimeter security controls at five of the nation's operational BSL-4 labs, (2) CDC efforts to address our recommendation, (3) improvements that have been made to the perimeter security controls at the two labs found to be deficient, and (4) other observations about the BSL-4 labs GAO assessed.

What GAO Found

Significant perimeter security differences continue to exist among the nation's five BSL-4 laboratories operational at the time of GAO's assessment. In September 2008, GAO reported that three of the five labs had all or nearly all of the 15 key controls GAO evaluated. Two labs, however, demonstrated a significant lack of these controls, such as camera coverage for all exterior lab entrances and vehicle screening. As a result, GAO recommended that CDC work with USDA to require specific perimeter security controls at high-containment facilities. However, as we reported in July 2009, CDC has taken limited action on the GAO recommendation. In July 2009, GAO reported that the two deficient labs made progress on their own despite CDC's limited action. One made a significant number of improvements, thus reducing the likelihood of intrusion. The second made a few changes and formed a committee to consider and prioritize other improvements. Two additional observations about BSL-4 labs concern the significant perimeter security differences among the five labs GAO originally assessed for our September 2008 report. First, labs with stronger perimeter controls had additional security requirements mandated by other federal agencies. For example, one lab is a military facility subject to far stricter Department of Defense physical security requirements. Second, CDC inspection officials stated their training and experience has been focused on safety. CDC officials said they are developing a comprehensive strategy for safety and security of labs and will adjust the training and inspection process to match this strategy.