Summary

Biosafety laboratories are primarily regulated by either the Department of Health and Human Services (HHS) or the U.S. Department of Agriculture (USDA), depending on whether the substances they handle pose a threat to the health of humans or plants, animals, and related products, respectively. Currently, all operational biosafety level 4 (BSL-4) labs are overseen by HHS's Centers for Disease Control and Prevention (CDC). BSL-4 labs handle the world's most dangerous agents and toxins that cause incurable and deadly diseases. In September 2008, GAO reported that two of the five operational BSL-4 labs had less than a third of the key perimeter security controls GAO assessed and recommended that CDC implement specific perimeter controls for all BSL-4 labs. GAO was asked to (1) provide an update on what action, if any, CDC took to address the 2008 recommendation; (2) determine whether perimeter security controls at the two deficient BSL-4 labs had improved since the 2008 report; and (3) provide other observations about the BSL-4 labs it assessed. To meet these objectives, GAO reviewed CDC's statement to Congress as well as other agency and HHS documentation on actions taken or to be taken with respect to the 2008 recommendation, reviewed new security plans for the two deficient BSL-4 labs, and performed another physical security assessment of these two labs. GAO is not making any recommendations.

Significant perimeter security differences continue to exist among the nation's five BSL-4 laboratories operational at the time of GAO's assessment. In 2008, GAO reported that three of the five labs had all or nearly all of the 15 key controls GAO evaluated. Two labs, however, demonstrated a significant lack of these controls, such as camera coverage for all exterior lab entrances and vehicle screening. As a result, GAO recommended that CDC work with USDA to require specific perimeter security controls at high-containment facilities. However, to date, CDC has taken limited action on the GAO recommendation. The two labs GAO found to be deficient made progress on their own despite CDC's limited action. One made a significant number of improvements, thus reducing the likelihood of intrusion. The second made a few changes and formed a committee to consider and prioritize other improvements. Two additional observations about BSL-4 labs concern the significant perimeter security differences among the five labs GAO originally assessed for its 2008 report. First, labs with stronger perimeter controls had additional security requirements mandated by other federal agencies. For example, one lab is a military facility subject to far stricter Department of Defense physical security requirements. Second, CDC inspection officials stated their training and experience has been focused on safety. CDC officials said they are developing a comprehensive strategy for safety and security of labs and will adjust the training and inspection process to match this strategy. In commenting on findings from this report, CDC and the two labs provided additional information on steps taken in response to GAO's prior recommendation and findings.