(ii) The security systems and procedures must be tailored to address sitespecific characteristics and requirements, ongoing programs, and operational needs, and must mitigate the risks identified under paragraph (a)(2)(i) of this section.

(iii) The plan must describe inventory control procedures, personnel suitability for those individuals with access to agents or toxins listed in § 331.3, physical security, and cybersecurity. The plan must also contain provisions for securing the area (e.g., card access, key pads, locks) and protocols for changing access numbers or locks following staff changes; procedures for loss or compromise of keys, passwords, combinations, etc.; procedures for reporting suspicious persons or activities, loss or theft of listed agents or toxins, release of listed agents or toxins, or alteration of inventory records; provisions for the control of access to containers where listed agents and toxins are stored; provisions for routine cleaning, maintenance, and repairs; and procedures for reporting and removing unauthorized persons.

9 For guidance, see the USDA Departmental Manual No. 9610-001, "USDA Security Policies and Procedures for Biosafety Level3 Facilities" (August 30, 2002). The manual may be obtained by calling (301) 734-5519. The manual is also available on the Internet at http://www.usda.gov/ocio/directives/DM/DM9610001.htm. See also Appendix F, "Biosafety in Microbiological and Biomedical Laboratories," in Morbidity and Mortality Weekly Report (2002). This document may be obtained by writing to Select Agent Program, Centers for Disease Control and Prevention, 1600 Clifton Road, NE, Mail Stop E 79, Atlanta, GA 30333. It is also available on the Internet at http://www.cdc.gov/mmwr.

(iv) With respect to areas containing listed agents or toxins, an entity or individual must adhere to the following security requirements or implement measures to achieve an equivalent or greater level of security as the provisions below:

(A) Allow unescorted access only to approved individuals who are performing a specifically authorized function during hours required to perform that job;

(B) Allow individuals not approved under §331.10 to conduct routine cleaning, maintenance, repairs, and other non-laboratory functions only when escorted and continually monitored by approved individuals;

(C) Provide for the control of access to containers where listed agents and toxins are stored by requiring that such containers be locked when not in the direct view of an approved individual and by using other monitoring measures, as needed;

(D) Require the inspection of all packages upon entry and exit;

(E) Establish a protocol for intra-entity transfers, including provisions for ensuring that the packaging and movement, is conducted under the supervision of an approved individual;

(F) Require that approved individuals do not share with any other person their unique means of accessing the area or listed agents or toxins; and

(G) Require that approved individuals immediately report any of the following to the responsible official: (1) Any loss or compromise of keys, passwords, combinations, etc.;

(2) Any suspicious persons or activities;

(3) Any loss or theft of listed agents or toxins;

(4) Any release of a listed agent or toxin; and

(5) Any sign that inventory and use records for listed agents and toxins have been altered or otherwise compromised.

(3) Incident response procedures. 10 The Biocontainment and Security Plan must also include incident response plans for containment breach, security

10 The requirements in this paragraph do not supercede or preempt the enforcement of emergency response requirements imposed by other statutes or regulations.

breach, inventory violations, non-biological incidents such as workplace violence, and cybersecurity breach. The incident response plans must address containment, inventory control, and notification of managers and responders. The incident response plans must also address such events as bomb threats, severe weather (floods, hurricanes, tornadoes), earthquakes, power outages, and other natural disasters or emergencies.

(b) The Biocontainment and Security Plan must be reviewed, performance tested, and updated annually. The plan must also be reviewed and revised, as necessary, after any incident.

§331.12 Training.

(a) The responsible official must provide appropriate training in containment and security procedures to all individuals with access to agents and toxins listed in § 331.3.

(b) The responsible official must provide information and training to an individual at the time the individual is assigned to work with a listed agent or toxin. The responsible official must provide refresher training annually.

§331.13 Transfer of biological agents and toxins.

Biological agents and toxins listed in §331.3 may only be transferred to an individual or entity registered to possess, use, or transfer that particular agent or toxin. However, the sender of an agent or toxin may be an individual or entity that has a certificate of registration for the agent or toxin, an individual or entity that is exempt from the requirements of this part, or an individual or entity located outside of the United States. Biological agents or toxins may only be transferred under the conditions of this section and must be authorized by APHIS prior to the transfer.

(a) Importation and interstate movement. In addition to the permit required under part 330 of this chapter, biological agents or toxins listed in § 331.3 may be imported or moved interstate only with the prior authorization of APHIS. To obtain such authorization, the sender and the responsible official for the recipient must complete and submit APHIS Form 2041 to

APHIS, in accordance with paragraph (c) of this section.

(b) Intrastate movement. Biological agents or toxins listed in §331.3 may be moved intrastate only with the prior authorization of APHIS. To obtain authorization, the sender and the responsible official for the recipient must complete and submit APHIS Form 2041 to APHIS prior to each transfer, in accordance with paragraph (c) of this section.

(c) APHIS Form 2041; process and procedures. (1) Prior to each transfer, the sender and the responsible official for the recipient must complete APHIS Form 2041, and the sender must submit the form to APHIS.11

(2) APHIS will authorize the transfer based on a finding that the recipient has a certificate of registration covering the transfer of the listed agent or toxin.

(3) The responsible official for the recipient entity must notify APHIS and the sender upon receipt of the agent or toxin by mailing or faxing a completed APHIS Form 2041 within 2 business days.

(4) The responsible official for the recipient must notify APHIS immediately if the agent or toxin has not been received within 48 hours after the expected delivery or if the package containing the agent or toxin is leaking or has been damaged.

(d) The sender must comply with all applicable laws governing packaging and shipping.

§331.14 Records.

(a) The responsible official must maintain complete, up-to-date records of information necessary to give an accounting of all of the activities related to agents or toxins listed in §331.3. Such records must include the following:

(1) The Biocontainment and Security Plan;

11 APHIS Form 2041 may be obtained by calling (301) 734-5519 or faxing a request to (301) 734-8700. The form is also available on the Internet at http://www.aphis.usda.gov/ppq/ permits. APHIS Form 2041 may be mailed to Biological and Technical Services, PPQ, APHIS, 4700 River Road Unit 133, Riverdale, MD 20737-1236; or faxed to (301) 734-8700.

(2) A current list of all individuals with access to agents or toxins listed in § 331.3;

(3) Training records for individuals with access to such agents or toxins;

(4) Accurate and current inventory records (including source and characterization data);

(5) Permits and transfer documents (APHIS Form 2041) issued by APHIS;

(6) Security records (e.g., transactions from automated access control systems, testing and maintenance of security systems, visitor logs); and

(7) Containment and security incident reports.

(b) The responsible official must maintain such records for 3 years.

(c) All records must be produced upon request to APHIS inspectors, and appropriate Federal, State, or local law enforcement authorities.

§ 331.15 Inspections.

(a) To ensure compliance with the regulations, any APHIS inspector must be allowed, without previous notification, to enter and inspect the entire premises, all materials and equipment, and all records required to be maintained by this part.

(b) Prior to issuing a certificate of registration to an entity or individual, APHIS may inspect and evaluate their premises and records to ensure compliance with the regulations and the containment and security requirements.

§ 331.16 Notification in the event of theft, loss, or release of a biological agent or toxin.

(a) The responsible official must orally notify APHIS and appropriate Federal, State, or local law enforcement agencies immediately upon discovery of the theft or loss of agents or toxins listed in §331.3. The oral notification must be followed by a written report (APHIS Form 2043) within 7 days.

(b) The responsible official must orally notify APHIS immediately upon discovery that a release of an agent or toxin has occurred outside of the biocontainment area. The oral notification must be followed by a written report (APHIS Form 2043) within 7 days. Upon notification and a finding that the release poses a threat to animal or plant health, or animal or plant prod

ucts, APHIS will notify relevant Federal, State, and local authorities, and the public, if necessary.

(c) The responsible official must orally notify APHIS of a theft, loss, or release of an agent or toxin by calling (301) 734-5519. A copy of APHIS Form 2043 may be obtained by writing to Biological and Technical Services, PPQ, APHIS, 4700 River Road Unit 133, Riverdale, MD 20737-1236, or by calling (301) 734-5519. APHIS Form 2043 may be mailed to the same address or faxed to (301) 734-8700.

§ 331.17 Administrative review.

An individual or entity may appeal a denial or revocation of registration under this part. An individual who has been denied access to listed agents or toxins or who has been granted only limited access to listed agents or toxins under this part may appeal that decision.12 The appeal must be in writing and submitted to the Administrator within 30 days of the decision. The appeal must state all of the facts and reasons upon which the individual or entity disagrees with the decision. Where the denial or revocation of registration or the denial or limitation of an individual's access approval is based solely upon an identification by the Attorney General, APHIS will forward the request for review to the Attorney General. The Administrator's decision constitutes final agency action.

A:

340.4 Permits for the introduction of a regulated article.

340.5 Petition to amend the list of organisms.

340.6 Petition for determination of nonregulated status.

340.7 Marking and identity.

340.8 Container requirements for the movement of regulated articles. 340.9 Cost and charges.

AUTHORITY: 7 U.S.C. 1622n and 7701-7772; 31 U.S.C. 9701; 7 CFR 2.22, 2.80, and 371.3.

SOURCE: 52 FR 22908, June 16, 1987, unless otherwise noted.

$340.0 Restrictions on the introduction of regulated articles.

(a) No person shall introduce any regulated article unless the Administrator is:

(1) Notified of the introduction in accordance with §340.3, or such introduction is authorized by permit in accordance with $340.4, or such introduction is conditionally exempt from permit requirements under § 340.2(b); and

(2) Such introduction is in conformity with all other applicable restrictions in this part.1

(b) Any regulated article introduced not in compliance with the requirements of this part shall be subject to the immediate application of such reE medial measures or safeguards as an inspector determines necessary to prevent the introduction of such plant pests. 2

[52 FR 22908, June 16, 1987, as amended at 58 FR 17056, Mar. 31, 1993; 62 FR 23956, May 2, 1997; 66 FR 21058, Apr. 27, 2001]

1Part 340 regulates, among other things, the introduction of organisms and products altered or produced through genetic engineering that are plant pests or are believed to be plant pests. The introduction into the United States of such articles also may be subject to other regulations promulgated under the Plant Protection Act (7 U.S.C. 7701-7772) and found in 7 CFR parts 319, 330, and 360. For example, under regulations promulgated in "Subpart-Nursery Stock, Plants, Roots, Bulbs, Seeds, and Other Plant Products" (7 CFR 319.37-3), a permit is required for the importation of certain classes of nursery stock whether such stock is genetically engineered or not. Accordingly, individuals should refer to those regulations before importing any nursery stock.

2An inspector may hold, seize, quarantine, treat, apply other remedial measures to, destroy, or otherwise dispose of plants, plant

$340.1 Definitions.

Terms used in the singular form in this part shall be construed as the plural, and vice versa, as the case may demand. The following terms, when used in this part, shall be construed, respectively, to mean:

Administrator. The Administrator of the Animal and Plant Health Inspection Service (APHIS) or any other employee of APHIS to whom authority has been or may be delegated to act in the Administrator's stead.

Animal and Plant Health Inspection Service (APHIS). An agency of the United States Department of Agriculture.

Antecedent organism. An organism that has already been the subject of a determination of nonregulated status by APHIS under § 340.6, and that is used as a reference for comparison to the regulated article under consideration under these regulations.

Courtesy permit. A written permit issued by the Administrator, in accordance with § 340.4(h).

Donor organism. The organism from which genetic material is obtained for transfer to the recipient organism.

Environment. All the land, air, and water; and all living organisms in association with land, air and water.

Expression vector. A cloning vector designed so that a coding sequence inserted at a particular site will be transcribed and translated into protein.

Genetic engineering. The genetic modification of organisms by recombinant DNA techniques.

Inspector. Any employee of the Animal and Plant Health Inspection Service, U.S. Department of Agriculture, or other person, authorized by the Administrator, in accordance with law to enforce the provisions of this part.

Interstate. From any State into or through any other State.

Introduce or introduction. To move into or through the United States, to release into the environment, to move interstate, or any attempt thereat.

pests, or other articles in accordance with sections 411, 412, 421, and 434 of the Plant Protection Act (7 U.S.C. 7711, 7712, 7731, and 7754).

Move (moving, movement). To ship, offer for shipment, offer for entry, import, receive for transportation, carry, or otherwise transport or move, or allow to be moved into, through, or within the United States.

Organism. Any active, infective, or dormant stage or life form of an entity characterized as living, including vertebrate and invertebrate animals, plants, bacteria, fungi, mycoplasmas, mycoplasma-like organisms, as well as entities such as viroids, viruses, or any entity characterized as living, related to the foregoing.

Permit. A written permit issued by the Administrator, for the introduction of a regulated article under conditions determined by the Administrator, not to present a risk of plant pest introduction.

Person. Any individual, partnership, corporation, company, society, association, or other organized group.

and

Plant. Any living stage or form of any member of the plant kingdom3 including, but not limited to, eukaryotic algae, mosses, club mosses, ferns, angiosperms, gymnosperms, lichens (which contain algae) including any parts (e.g. pollen, seeds, cells, tubers, stems) thereof, and any cellular components (e.g. plasmids, ribosomes, etc.) thereof.

Plant pest. Any living stage (including active and dormant forms) of insects, mites, nematodes, slugs, snails, protozoa, or other invertebrate animals, bacteria, fungi, other parasitic plants or reproductive parts thereof; viruses; or any organisms similar to or allied with any of the foregoing; or any infectious agents or substances, which can directly or indirectly injure or cause disease or damage in or to any plants or parts thereof, or any processed, manufactured, or other products of plants.

Product. Anything made by or from, or derived from an organism, living or dead.

Recipient organism. The organism which receives genetic material from a donor organism.

3 The taxonomic scheme for the plant kingdom is that found in Synopsis and Classification of Living Organisms by S.P. Parker, McGraw Hill (1984).

Regulated article. Any organism which has been altered or produced through genetic engineering, if the donor organism, recipient organism, or vector or vector agent belongs to any genera or taxa designated in §340.2 and meets the definition of plant pest, or is an unclassified organism and/or an organism whose classification is unknown, or any product which contains such an organism, or any other organism or product altered or produced through genetic engineering which the Administrator, determines is a plant pest or has reason to believe is a plant pest. Excluded are recipient microorganisms which are not plant pests and which have resulted from the addition of genetic material from a donor organism where the material is well characterized and contains only non-coding regulatory regions.

Release into the environment. The use of a regulated article outside the constraints of physical confinement that are found in a laboratory, contained greenhouse, or a fermenter or other contained structure.

Responsible person. The person who has control and will maintain control over the introduction of the regulated article and assure that all conditions contained in the permit and requirements in this part are complied with. A responsible person shall be a resident of the United States or designate an agent who is a resident of the United States.

Secretary. The Secretary of Agriculture, or any other officer or employee of the Department of Agriculture to whom authority to act in his/her stead has been or may hereafter be delegated.

Stably integrated. The cloned genetic material is contiguous with elements of the recipient genome and is replicated exclusively by mechanisms used by recipient genomic DNA.

State. Any State, the District of Columbia, American Samoa, Guam, Northern Mariana Islands, Puerto Rico, the Virgin Islands of the United States, and any other Territories or Districts of the United States.

State regulatory official. State official with responsibilities for plant health,