While three labs had all or nearly all of the key  security controls we assessed, our September 2008 report demonstrated  that two labs had a significant lack of these controls (see table 1 below). As such, we  recommended that the Director of the CDC take action to implement  specific perimeter controls for all BSL-4 labs to provide assurance that  each lab has a strong perimeter security system in place. HHS indicated that the difference in perimeter security at the five labs was  the result of risk-based planning; however, they did not comment on the  specific vulnerabilities we identified and whether these should be  addressed. In regard to requiring specific perimeter controls for all BSL-4  labs, HHS stated that it would perform further study and outreach to  determine whether additional federal regulations are needed. CDC Has Taken Limited Action to Require Specific Perimeter Security Controls

Significant perimeter security differences continue to exist among the  nation’s five BSL-4 labs operational at the time of our most recent  assessment. The WG is  chaired by HHS and the Department of Defense (DOD) and includes  representatives from several federal agencies and includes a subgroup  that is focused on physical and facility security of biolabs. Two Labs Take Action to Improve Perimeter Security Controls

Although CDC has taken limited action to address our original findings,  the two deficient BSL-4 labs have made progress on their own. One BSL-4  lab made a significant number of improvements to increase perimeter  security, thus reducing the likelihood of intrusion. The second one made  three changes and formed a committee to consider and prioritize other  changes. Camera coverage includes all exterior lab entrances. The cameras  currently cover the exterior of the building. Additional Observations on Federal Oversight of BSL-4 Labs

During the course of our work, we made two additional observations that  concern perimeter security differences among the nation’s five BSL-4 labs  that were operational at the time of our assessment:    All five BSL-4 labs operating in 2008 had a security plan in place when  we assessed them. Yet significant perimeter security differences exist  among these high-containment labs. For example, Lab B is a military facility  subject to far stricter DOD physical security requirements. CDC inspection officials stated their training and experience had been  mainly in the area of safety. According to CDC officials,  they are developing a comprehensive strategy for safety and security  of biosafety labs and will adjust the training and inspection process  accordingly to match this comprehensive strategy. At  that time, we will send copies of this report to the Secretary of Health and  Human Services, the Director of CDC, and other interested parties. Appendix I: Perimeter Security Controls

To perform our perimeter security assessment of biosafety level 4 (BSL-4)  labs, we identified 15 key perimeter security controls.
Why GAO Did This Study

Biosafety laboratories are primarily regulated by either the Department of Health and Human Services (HHS) or the U.S. Department of Agriculture (USDA), depending on whether the substances they handle pose a threat to the health of humans or plants, animals, and related products, respectively. Currently, all operational biosafety level 4 (BSL-4) labs are overseen by HHS's Centers for Disease Control and Prevention (CDC). BSL-4 labs handle the world's most dangerous agents and toxins that cause incurable and deadly diseases. In September 2008, GAO reported that two of the five operational BSL-4 labs had less than a third of the key perimeter security controls GAO assessed and recommended that CDC implement specific perimeter controls for all BSL-4 labs. GAO was asked to (1) provide an update on what action, if any, CDC took to address the 2008 recommendation; (2) determine whether perimeter security controls at the two deficient BSL-4 labs had improved since the 2008 report; and (3) provide other observations about the BSL-4 labs it assessed. To meet these objectives, GAO reviewed CDC's statement to Congress as well as other agency and HHS documentation on actions taken or to be taken with respect to the 2008 recommendation, reviewed new security plans for the two deficient BSL-4 labs, and performed another physical security assessment of these two labs. GAO is not making any recommendations.

What GAO Found

Significant perimeter security differences continue to exist among the nation's five BSL-4 laboratories operational at the time of GAO's assessment. In 2008, GAO reported that three of the five labs had all or nearly all of the 15 key controls GAO evaluated. Two labs, however, demonstrated a significant lack of these controls, such as camera coverage for all exterior lab entrances and vehicle screening. As a result, GAO recommended that CDC work with USDA to require specific perimeter security controls at high-containment facilities. However, to date, CDC has taken limited action on the GAO recommendation. The two labs GAO found to be deficient made progress on their own despite CDC's limited action. One made a significant number of improvements, thus reducing the likelihood of intrusion. The second made a few changes and formed a committee to consider and prioritize other improvements. Two additional observations about BSL-4 labs concern the significant perimeter security differences among the five labs GAO originally assessed for its 2008 report. First, labs with stronger perimeter controls had additional security requirements mandated by other federal agencies. For example, one lab is a military facility subject to far stricter Department of Defense physical security requirements. Second, CDC inspection officials stated their training and experience has been focused on safety. CDC officials said they are developing a comprehensive strategy for safety and security of labs and will adjust the training and inspection process to match this strategy. In commenting on findings from this report, CDC and the two labs provided additional information on steps taken in response to GAO's prior recommendation and findings.