• Email this page
• Printer-friendly version

FAQ for Select Agent Regulation (42 CFR 73)

1.  What is an entity?

An entity is any government agency (Federal, State, or local), academic institution, corporation, company, partnership, society, association, firm, sole proprietorship, or other legal entity.

2.  Where can I obtain an application?

The application is available at SAP Forms. We now have the application in a PDF fillable format as well as Excel templates of the tables contained in the application. You may also directly contact our office via phone at 404-718-2000 or facsimile 404-718-2096 to obtain an application package.

3.  What agency should the application be submitted to?

The agency that the Responsible Official (RO) should contact is determined by the type of select agent or toxin.

• For HHS agents, the Responsible Official (RO) should submit this form to CDC (telephone: 404-718-2000, facsimile: 404-718-2096, or e-mail: lrsat@cdc.gov).
• For USDA agents, the RO should submit this form to APHIS (telephone: 301-734-5960, facsimile: 301-734-3652, e-mail: Agricultural.Select.Agent.Program@aphis.usda.gov).
• For HHS/USDA overlap agents, the RO may submit this form to APHIS or CDC, but not both. A listing of HHS select agents and toxins is available at http://www.cdc.gov/od/sap. A listing of USDA select agents and toxins is available at http://www.aphis.usda.gov/programs/ag_selectagent/.

4.  What does the registration cover?

The registration will only be valid for the specific select agents and toxins and the specific activities and locations consistent with the information which the certificate of registration or amendment is granted.

5.  What if we need to update, change, or amend our registration?

Prior to any change, the Responsible Official must apply for an amendment to a certificate of registration by submitting the relevant page(s) of the registration application. This includes replacement of the Responsible Official or other personnel changes, changes in ownership or control of the entity, changes in the activities involving any select agents or toxins, or the addition or removal of select agents or toxins.

6.  Who has to have a security risk assessment (SRA)?

All entities (except for Federal, State, or local governmental agencies), the Responsible Official (RO), alternate RO, any individual who owns or controls the entity and all individuals with access to select agents or toxins must have an approved security risk assessment. Each individual who owns or controls a private entity (academic, non-profit, commercial, or other) must have an SRA completed. An individual will be deemed to own or control an entity under the following conditions: (1) For private accredited academic institutions, any individual will be deemed to own or control the entity if the individual is an officer, trustee, member of the board, or owner of the academic institution, and is in a managerial or executive capacity with regard to the select agents or toxins possessed, used, or transferred by the entity; (2) For entities other than accredited academic institutions (public or private), an individual will be deemed to own or control an entity if the individual is a partner, officer, director, holder or owner of 50 percent or more of its voting stock and is in a managerial or executive capacity with regard to select agents or toxins possessed, used, or transferred by the entity. Please see the FBI website for additional information.

7.  What is the general process for obtaining a security risk assessment (SRA)?

The following process applies to a new application or an amendment to an existing application.

• The entity Responsible Official (RO) submits an application or amendment that includes a Table 4B (APHIS/CDC Form 1) to their lead agency (APHIS or CDC, but not both). The lead agency serves as the single point of contact for an entity and is responsible for coordinating all activities and communications with respect to new applications or amendments;

• The lead agency issues back to the entity a letter with the unique Department of Justice (DOJ) identifying number for each individual listed on the Table 4B or amended 4B;

• The RO forwards to each individual their unique DOJ identifying number;

• The individual fills out FBI form (FD-961) and puts their unique identifying number in block 11;

• The individual follows all of the FBI instructions for submitting fingerprints;

• Individuals should be fingerprinted by a law enforcement agency or by an entity trained to do so.

• The entity or individual should provide a stamped envelope addressed to the FBI, Criminal Justice Information Services Division (CJIS), not to APHIS or CDC.

• The mailing address for CJIS is:

  Federal Bureau of Investigation
  Bioterrorism Security Risk Assessment Module E-3
  Criminal Justice Information Services Division
  1000 Custer Hollow Road, Module E-3
  Clarksburg, WV 26306-0147

• Using the envelope provided, the law enforcement agency/entity performing the fingerprinting should mail the FD-961 form provided and fingerprint cards as one package.

• NOTE: All FBI FD-961 forms received by the APHIS or CDC will be returned directly to the RO of the entity in question which will delay the processing of SRAs.

8.  What is the process for obtaining an SRA for the entity? 

The Select Agent Programs will initiate the SRA for the entity.

9.  Why is CJIS requesting renewals of security risk assessments that have not yet expired?

The Select Agent Regulations indicate that SRAs are effective for a period not to exceed five years. However, in an effort to prevent a repeat of the backlog in the processing of SRAs that was experienced after the passing of the Interim Final Rule, a staggered renewal process is being implemented.

10.  How will I know which individuals at my entity are in need of an SRA renewal?

CJIS will provide a list of individuals at your entity that are scheduled for Security Risk Assessments renewal. CDC will send the RO a letter, along with this list of individuals, and an explanation of the process.

11.  What do I (the RO) need to do in order to comply with CJIS’s request?

Within 30 days of the letter, individuals identified for SRA renewal should submit a new FD-961 form. CJIS requests the word “Renewal” be written on the top of the form. Since fingerprints are on file with CJIS, an additional fingerprint card is not required for the renewal. After receiving the list, notify CDC of any employees who no longer require access to the rooms and agents on file, and any who do not require access for greater than the current five year period. If you have any questions after you have received the letter, please call your lead inspector to discuss them.

12.  Is there anything I can do to avoid delays in the security risk assessment results?

Common errors may delay the security risk assessment process. Please pay careful attention to:

• The name (including the middle initial), the date of birth and address, (including zip code) for individuals listed on the Table 4B (APHIS/CDC Form 1). This information should be identical to that given on the Form FD-961 submitted to CJIS for each individual.
• Typographical errors regarding date of birth are very common.
• Information for staff, agent, principal investigator, or room that do not agree with corresponding information on file for principal investigator, agents and rooms already registered will delay the processing of amendments or update to an application. These errors must be resolved prior to the release of a SRA approval letter by the CDC Select Agent Program.

13.  What is the procedure if an individual from one registered entity wants to visit or work at another registered entity?

• If the individual(s) will have access to select agents or toxins, the receiving entity RO should request the sending entity RO to provide a letter stating that the individual(s) is currently identified on Table 4B of the sending entity’s registration. The receiving entity is defined as the entity where the training, work or visit will take place. The sending entity is defined as the entity where the individual(s) are currently employed. The individual must have a current SRA approval. The letter includes: individual’s full name, date of birth, date of issuance of the SRA approval and unique DOJ identifying number of the individual(s).
• The receiving entity RO should submit this letter and amended registration documentation to the lead agency (APHIS or CDC) including an amended Table 4B and Sections 5B through 5G, where applicable (e.g. Principal Investigator, specific agents or toxins, specific laboratory buildings/rooms, etc.).
• Once the visit is complete, the receiving entity RO should amend the entity’s registration to remove the visiting individual’s name from the Table 4B. In some circumstances the receiving entity RO may decide to leave the individual(s) on the registration, it the same individual(s) will be visiting again.

14.  What is the procedure if an individual from an unregistered entity wants to visit a registered entity?

• If an individual(s) will have access to select agents or toxins, they must have a current security risk assessment. Follow the procedures as indicated in Question 7 above.
• Once the visit is complete, the receiving entity RO should amend the entity’s registration to remove the visiting individual’s name from the Table 4B. In some circumstances the receiving entity RO may decide to leave the individual(s) on the registration, if the same individual(s) will be visiting again.

If you have questions regarding completion of the FD-961 form, contact the FBI directly at (304) 625-4900 or visit http://www.fbi.gov/terrorinfo/bioterrorfd961.htm. Written requests may be faxed to (304) 625-5393 (for FD-961 forms) or (304) 625-3984 (for fingerprint cards). These faxed requests should include the following: entity name, point of contact or RO, mailing address, contact telephone number and the number of fingerprint card packets requested.

If you have questions concerning the FBI/CJIS SRA process, contact FBI/CJIS at (304) 625-4900. If you have questions on how to obtain a USDA assigned DOJ unique identifying number, please contact (301) 734-5960. If you have question on how to obtain a CDC assigned DOJ unique identifying number, please contact 404-718-2000.

15.  What do entities that plan to conduct training at their facilities need to do in order to meet the requirements of 42 CFR 73?

First, the entity responsible for the training should determine if the agents or toxins they wish to use in the training meet the definition of a select agent or toxin as defined in 7 CFR 331, 9 CFR 121, and 42 CFR 73.

If the material being used in the training event meets the exclusion criteria, then it is considered excluded from the regulations and therefore is not subject to the registration, transfer, record-keeping and other requirements of 7 CFR 331, 9 CFR 121, and 42 CFR 73.

If the entity will be using select agents or toxins in their training event, then current information regarding the entity, the principal investigator (PI) responsible for the select agents or toxins used in the training, and the laboratory rooms used in the training, must be on file with CDC's Select Agent Program (or, in the case of overlap agents, with CDC or APHIS). If this information is not on file with the CDC Select Agent Program, then the entity should amend their application for registration with us.

The Responsible Official (RO) should contact our office at 404-718-2000 if they have questions on how to amend their application for registration with us.

The Responsible Official (RO) from the entity will also need to submit the following information to the CDC Select Agent Program at least 8 weeks prior to the training event:

1. A summary of what type of training will occur, where it will occur and when it will occur. Include in your summary:
   1. Date of event,
   2. Building and laboratory room numbers where event will occur,
   3. Objectives of the training event (2-3 sentences)
2. An updated Table 4B that lists personnel with authorized access, their affiliations and the specific agents that they will have access to at the entity that is sponsoring the training. These individuals will require approved security risk assessments from the FBI specific to the entity where training is conducted. See question 7 for additional details.
3. A statement as to whether the participants will handle select agents during the training event. If participants will have direct access to select agents or toxins during the training, then provide their names with number 2, above.
4. When the training event is over, the RO must provide CDC's Select Agent Program with an update to remove authorized personnel from the entity registration.

The entity should submit paperwork well in advance of the training event to ensure that a delay of the training will not occur. For additional clarification contact CDC's Select Agent Program by telephone (404-718-2000), facsimile (404-718-2096), e-mail (lrsat@cdc.gov), or mail at:

Centers for Disease Control and Prevention
Select Agent Program
1600 Clifton Rd NE, Mailstop A-46
Atlanta GA 30333

Adding reconstructed replication competent forms of the 1918 pandemic influenza virus containing any portion of the coding regions of all eight gene segments to the HHS Select Agents and Toxins list