Introduction to Biomedical Facility Biosecurity

Course Overview & Objectives

Welcome back to this series on biorisk management. This lesson provides a brief introduction to biosecurity for biomedical facilities. In this short course, we will explore what biosecurity entails, examine the associated risks, and discuss how to manage those risks based on your facility’s unique situation.

Key Objectives

• Integrate: Recognize the importance of biosecurity within a comprehensive biorisk management program.
• Familiarize: Ensure all staff understand the fundamental pillars of biosecurity risk mitigation.
• Assess: Conduct a biosecurity risk assessment within each pillar to recognize and close security gaps.
• Sustain: Use these training materials in a “train-the-trainer” format to continue educating your workforce.

Biosafety vs. Biosecurity: What is the Difference?

While closely related, biosafety and biosecurity have distinct focus areas:

• Biosafety focuses on preventing unintentional exposure to biological agents. It protects staff, animals, the community, and the environment from the pathogens handled inside the lab. Simply put, it protects people from pathogens.
• Biosecurity focuses on preventing intentional harm. It prevents unauthorized access, loss, theft, misuse, diversion, or intentional release of pathogens, toxins, and sensitive data. Simply put, it protects pathogens from people.

Because safety and security risks collectively define your laboratory operating environment, biosafety and biosecurity are inseparable. An effective biorisk management program must address both simultaneously.

Defining Biosecurity

According to the Biosafety in Microbiological and Biomedical Laboratories (BMBL) guidelines, biosecurity refers to:

“Measures designed to prevent loss, theft, or deliberate misuse of biological material, technology, or research-related information from laboratories or laboratory-associated facilities.”

Why Implement a Biosecurity Program?

A robust biosecurity program is vital to:

• Deter Adversaries: Prevent criminals, activists, and bioterrorists from acquiring materials to harm humans, agriculture, or the economy.
• Protect Personnel: Ensure a secure working environment for employees and coworkers.
• Safeguard Assets: Secure high-consequence agents, equipment, and intellectual property.
• Enhance Readiness: Improve facility-wide emergency preparedness.
• Manage Liability: Protect the institution’s business, legal standing, and reputation.

The Foundation: Risk Assessment

Biosecurity management must be entirely risk-based. Rather than blindly copying another facility’s program, your controls should be proportional to your unique threats.

A comprehensive biosecurity risk assessment evaluates the probability and consequences of an incident by analyzing three core components:

  [ Assets ] ————> What valuable items do you possess?

  [ Vulnerabilities ] —> How well are you protecting those items?

  [ Adversaries ] ——-> Who might want to steal or misuse them?

1. Identifying Your Assets

Think beyond the obvious. A facility’s asset list includes:

• Biological agents and toxins (both long-term archives and temporary diagnostic samples)
• Specialized laboratory equipment and infrastructure
• Intellectual property, research records, and sensitive diagnostic results
• Personnel and organizational reputation

2. Categorizing Malicious Use Risk

When prioritizing biological assets, evaluate their threat potential based on three factors:

• Acquisition: How easy is it to isolate from nature or steal from the lab?
• Production: How complex is it to grow, process, and stabilize the agent?
• Dissemination: How easily can it be distributed or weaponized?

Pathogens can be grouped into four levels of malicious use potential:

3. Analyzing Adversaries: Insiders vs. Outsiders

Potential adversaries generally fall into two categories:

• Outsiders: Members of the general public, visitors, contractors, or vendors who do not work at the facility.
  • Security Strategy: Focus on detection and containment to stop them at the physical perimeter.
• Insiders: Approved employees or students with legitimate credentials and unescorted access.
  • Security Strategy: Because insiders possess intimate facility knowledge and immediate opportunity, they represent the highest risk. Security relies on strong institutional trust, personnel vetting, and peer accountability.

The 8 Pillars of Biosecurity Risk Mitigation

Vulnerability assessments reveal the gaps in your security posture. To close these gaps, mitigation measures are organized into eight foundational pillars:

1. Biosecurity Awareness

Security begins with a vigilant workforce. All staff must understand the facility’s risks and their personal role in mitigating them.

• Employees should feel empowered to speak up about security anomalies and hold colleagues accountable.
• Methods to raise awareness: Regular training sessions, workplace posters, security drills, and routine email reminders.

2. Personnel Reliability & Vetting

Personnel security ensures that individuals granted access to sensitive pathogens are responsible, trained, and trustworthy.

• Vetting Components: Credential verification, background screening (criminal, civil, and financial history), reference checks, and public/social media reviews.
• High-Scrutiny Roles: Enhanced screening should target anyone with direct access to pathogens, IT administrators, security forces, safety personnel, facility locksmiths, and shipping staff handling infectious materials.
• Access Control Protocols: Identification badges must be worn visibly at all times, color-coded by access tier, and strictly collected upon employee termination or visitor departure.

3. Transport Security

Facilities remain responsible for biological materials while they are in transit, whether moving between rooms on campus or shipping internationally.

• Chain of Custody: Maintain a continuous, signed log documenting exactly who possesses the material at every point in time.
• Transport SOPs: Ensure carriers are fully trained on security protocols and spill response.
• Triple Packaging Concept: Protect the material using a leak-proof primary container, a leak-proof secondary container packed with absorbent material and ice packs, and a durable outer shipping container.

4. Information Security

Protecting sensitive data is just as important as protecting physical pathogens.

• Data Classification: Categorize data into tiers (e.g., Public vs. Restricted) to protect security plans, access codes, exact agent inventories, and employee home addresses.
• Physical & Digital Controls: Secure paper records in locked cabinets with sign-out sheets. Secure electronic data using strong passwords, encryption, air-gapped computers, and restricted cloud access.
• Dual-Use Research of Concern (DURC): Principal Investigators must screen research findings to ensure life science discoveries are not inadvertently published in a way that allows them to be misapplied to cause harm (e.g., enhancing virulence, altering host range, or disrupting immunity).

5. Material Control & Accountability

This pillar establishes strict administrative and physical procedures to track inventory, storage, use, and destruction.

• Inventory Focus: Because living organisms replicate continuously, tracking exact volume in working cultures is unfeasible. Focus accountability instead on tracking archival repository stocks and identifying the specific person responsible for each sample.
• Physical & Administrative Layout: Implement a layered framework combining physical constraints (locks on freezers, biosafety cabinets) with procedural protocols (designating authorized users, mandatory inventory audits).

6. Emergency Response

Emergency plans prevent security breakdowns during crisis situations like fires, power outages, natural disasters, or medical events.

• External Coordination: Pre-coordinate with local police, fire departments, and medical teams so they know where they can safely go during an incident without compromising containment or security.
• Reporting: Establish clear internal and external communication protocols for reporting accidents, missing materials, or unauthorized entries.
• Practice Drills: Conduct regular exercises (e.g., mock biological spills, missing material audits, or unannounced visitor challenges) to find and fix plan deficiencies before a real crisis occurs.

7. Physical Security

Physical infrastructure creates graded, concentric layers of protection around your assets:

       └── [ Outer Building: Offices & Support Staff ]

                └── [ Restricted: Labs & BSL-2 Spaces ]

                         └── [ Exclusion: BSL-3 / High-Risk Airspace ]

                                  └── [ Max Security: Pathogen Vault / Repository ]

• Access Infrastructure: Utilize security tools tailored to your risk level—ranging from manual keys (managed by a dedicated Key Control Officer) and coded PIN keypads to electronic proximity cards and biometric readers (fingerprint or iris scanners).
• Intrusion & Response: Use motion sensors, glass-break alarms, and CCTV cameras to validate security breaches before deploying on-site guard forces or notifying local law enforcement.

8. Program Management

Program management provides the overarching structural support that holds the other seven pillars together. Without executive backing and resource allocation, a biosecurity program cannot succeed.

• Institutional Commitment: Management must draft clear policy manuals, assign specific regulatory roles (such as a Responsible Official), define “acceptable risk” parameters, and provide sustainable funding.
• Iterative Reviews: Because personnel, facility infrastructure, and pathogens change over time, risk assessments and security plans must be reviewed and re-evaluated at least annually or immediately following any security incident.

Now watch this video (https://biosecuritycentral.org/static/78138bfdd284e6522e657469afe9f70c/rivm-aco-20180523-idpbq4vh5-web-hd..mp4) produced by the Netherlands, which reviews many of the concepts we have discussed.

Conclusions

Biosecurity is a complement to and inseparable from biosafety. Safeguarding especially dangerous pathogens is an important responsibility of the biomedical facility. Every location needs to integrate biosafety and biosecurity considerations into decisions about laboratory operations. Risk assessment is a fundamental resource allocation tool for making decisions about which risks need to be protected against.

Here are a few simple steps to remember when implementing biosecurity.

• First obtain strong management support. With out this it will be a struggle.
• Understand what needs to be protected. Use the malicious risk groups.
• Apply highest security to the most critical assets. Focus your limited resources on what needs to be protected.
• Employ a graded security approach. Not everything needs to be protected to the same degree.
• Reduce risk to acceptable level. Management needs to decide what this is and when it is achieved.

Reminder. The eight main pillars of biosecurity are:

• Awareness
• Personnel reliability
• Transport security
• Information security
• Material accountability and control
• Emergency response
• Physical security
• Biorisk management

Exercise

https://biosecuritycentral.org/resource/training-materials/biosecurity-self-scan/

Overcoming Implementation Barriers

Building a biosecurity program can feel overwhelming due to common challenges:

• Limited institutional budgets or staffing resources
• Inadequate training materials or institutional information
• Cultural resistance to operational changes

Remember that biosecurity is a journey, not an all-or-nothing event. You do not need to implement every advanced control immediately. Start with small, practical steps—like improving key control or updating your inventory logs—and consistently build on your progress to create a safer, more secure laboratory environment.

Thanks for watching.