BRM Manual Template
BRM Manual Template
BRM Manual Template
Facility:
INSTRUCTIONS: The Biorisk Management Manual and supporting Standard Operating Procedure (SOP)
templates provide a general overview of common considerations and information that should be addressed
within a biorisk management system and program. These templates are not exhaustive and facilities must
customize each document to ensure it is locally applicable and relevant.
Black text can be considered generic text that may be appropriate for inclusion in a facility’s biorisk
management manual and SOPs.
Red text should be considered guidance or examples and must be reviewed and replaced with facility-
specific information.
Manual Title: Biorisk Management Manual
Table of Contents
Policies and General Management Page
I. Purpose 3
II. Principle 3
III. Definitions and Terminology 4
IV. Roles and Responsibilities 5
XXIII. References 36
XXIV. Attachments
v1 130509 Page 2 of 36
Manual Title: Biorisk Management Manual
The purpose of this manual is to describe the basic principles of biosafety, biosecurity and biorisk
management that are applicable to and implemented at the [Insert Facility Name]. This manual contains
institutional policies, general information about laboratory operations and references to applicable
international and national regulations and guidelines that protect the safety and security of laboratory
personnel and the surrounding environment from biologically hazardous materials. This manual is
supported by a set of standard operating procedures (SOPs) and attachments that describe the
laboratory operations and detailed work processes related to the principles described in this manual
(refer to Attachment A, Biorisk Management System Plan). This biorisk management core document
collection is part of a larger library of manuals, SOPs, and associated job aides that will assist in
implementing an overarching laboratory quality management system. These additional documents
cover topics such as sample management, diagnostic procedures, and equipment, supplies, facility,
information and quality management.
It is the policy of the [Insert Facility Name] to provide a safe and secure work environment. By following
the guidelines and recommendations herein, the safety of the work environment should be improved by
minimizing and/or eliminating, where possible, biological hazards in this facility and ensuring that
operations with biological agents and toxins are conducted in a safe, secure and reliable manner. These
policies are applicable to all laboratory directors, managers, investigators, technicians and staff who
conduct or are engaged in laboratory work.
II. Principle
The scope of [Insert Facility Name] ‘s biorisk management program is to set requirements necessary to
control risks associated with the handling, storage and disposal of biological agents and toxins in
laboratories and facilities. The laboratory biorisk management system described herein will enable
[Insert Facility Name] to:
Establish and maintain a biorisk management system to control or minimize risk to acceptable
levels in relation to employees, the community and others as well as the environment which
could be directly or indirectly exposed to biological agents or toxins.
Provide assurance that the requirements are in place and implemented effectively.
Provide a framework for training and raising awareness of laboratory biosafety and biosecurity
guidelines and best practices for personnel.
The management system approach enables [Insert Facility Name] to effectively identify, monitor and
control the laboratory biosafety and biosecurity aspects of its activities. An effective management
v1 130509 Page 3 of 36
Manual Title: Biorisk Management Manual
system approach should be built on the concept of continual improvement through a cycle of planning,
implementing, reviewing and improving the processes and actions that an organization undertakes to
meet goals. This is known as the PDCA (Plan-Do-Check-Act) principle which also compliments the AMP
(Assessment-Mitigation-Performance) Model approach to biorisk management (Figure 1).
M
nt iti
ga
e
tio
sm
n
ses
As
Plan Do
Act Check
Performance
Figure 1. Illustration of Plan-Do-Check-Act Cycle aligned with AMP Model for biorisk management
Plan Planning, identification of hazard and risk and establishing goals
Do Implementing training and operational issues
Check Checking, monitoring and corrective action
Act Reviewing, process innovation and acting to make needed changes to the management system
This manual serves to demonstrate that the [Insert Facility Name] recognizes the documents listed
below as informative references and seeks compliance through risk-based, sustainable approaches:
WHO Laboratory Biosafety Manual
WHO Biorisk management: Laboratory biosecurity guidance
CWA 15793, Laboratory Biorisk Management standard
III. Definitions and Terminology [Adapted from CWA 15793, include additional facility-specific terms]
A. Accident-unintended event giving rise to harm
B. Biohazard-potential source of harm caused by biological agents or toxins
C. Biological agent-any microorganism including those which have been genetically modified, cell
cultures and endoparasites, which may be able to provoke any infection, allergy or toxicity in
humans, animals or plants
D. Biorisk-combination of the probability of occurrence of harm and the consequence of that harm
where the source of harm is a biological agent or toxin
E. Biorisk management system-part of an organization’s management system used to develop and
implement its biorisk policy and manage its biorisks
v1 130509 Page 4 of 36
Manual Title: Biorisk Management Manual
IV. Roles and Responsibilities (Adapted from CWA 15793, include additional roles relevant to your facility)
The responsibility for assuring safe and secure handling of biohazardous materials is shared between the
employee, their supervisor (scientific management), top/senior management and the [Insert Facility
Name] Biorisk Management Committee. These responsibilities are described generally below. More
specific duties are outlined within the relevant SOP.
Name
Title
A. Top and Senior Management shall take ultimate responsibility for the organization’s
biorisk management system to ensure that roles, responsibilities and authorities are
defined, documented and communicated and to demonstrate its commitment by
ensuring the availability of resources to establish, implement, maintain and improve the
biorisk management system.
B. Biorisk Management Committee shall be constituted to act as an independent review
group for biorisk issues. Reporting to senior management, the committee shall have
documented terms of reference and include a representative cross-section of expertise,
appropriate to the nature and scale of the activities undertaken. This committee is often
v1 130509 Page 5 of 36
Manual Title: Biorisk Management Manual
v1 130509 Page 6 of 36
Manual Title: Biorisk Management Manual
V. Biorisk Assessment
One universal biorisk assessment methodology is provided in the CWA 15793 (Figure 2) and can be used
to conduct both safety and security assessments.
v1 130509 Page 7 of 36
Manual Title: Biorisk Management Manual
Laboratories that work with biological agents must manage their safety risks to reduce the
potential of accidental exposure of laboratory personnel, the general public, and the
environment to biological agents from the laboratory or facility. Accepted biosafety best
practices and international guidance span a wide variety of potential biosafety risk mitigation
measures. These measures can be categorized as a hierarchy of controls to include substitution,
engineering, procedural and administrative controls, and personnel protective equipment.
Laboratories have an obligation to their staff and community to perform a risk assessment and
choose appropriate mitigation measures to reduce the risk. The determination of which
mitigation measures should be used to address the specific laboratory risks present in the work
environment should be based upon a thorough a risk assessment. Ideally, a risk assessment
should be conducted in a standardized and systematic manner that is repeatable and
comparable. A thorough risk assessment should clearly define the risk being assessed and the
results should clearly support making risk management decisions. By performing a risk
assessment on an operation or event, it is possible to make a systematic evaluation of the
exposure and infection potential and the possible consequences. The results of this risk
assessment can then inform decisions on how the risk can best be avoided, reduced, or
otherwise managed.
v1 130509 Page 8 of 36
Manual Title: Biorisk Management Manual
Direct Contact
Percutaneous
Vector-Borne
Infectious Dose
Prophylaxis or Vaccine Availability
Host Immune Status
Personnel Competency
Consequences of Disease Agent Properties
Morbidity
Mortality
Consequence Mitigation Measure Availability
Therapeutics
Vaccines
Potential for Secondary Transmission
Communicability
Transmissibility
Characterize the Risk Risk Evaluation
Not Tolerable
Tolerable
Acceptable
Available Risk Reduction Strategies
Mitigation Measures (Facility and Equipment Upgrades,
Adapted Practices)
The selected risk assessment method should directly support the characterization,
determination and ultimate acceptance of the (mitigated) risk. A separate assessment should be
conducted for each work process or procedures and agent used; however, data collected for
each work process can support many assessments to avoid misuse of resources and redundant
efforts. The results of the assessments should be used to prioritize risks, evaluate the risk
tolerance for the organization, and to determine what risk mitigation measures should be
implemented to reduce risk to acceptable levels. After defining and implementing appropriate
control measures, the identified risks and controls should be reviewed to confirm proper
implementation provides system improvements.
Facility-specific biosecurity risk assessments follow the same principles outlined above for biosafety,
but also are required to ensure adequate security measures are in place to reduce the risk of the
theft and misuse of biological agents. The objective of a biosecurity risk assessment is to develop a
strategy to manage biosecurity risk, including the likelihood of theft of a biological agent, and the
v1 130509 Page 9 of 36
Manual Title: Biorisk Management Manual
severity of the consequences associated with an attack by that agent. Based on the risk identified,
the vulnerabilities in a facility’s current biosecurity program can be identified and adapted to ensure
unacceptable biosecurity risks are reduced to levels deemed acceptable by facility stakeholders.
The risk assessment should also include a clear definition of the threats the system is designed to
protect against. These threats should be articulated in a Design Basis Threat (DBT) statement that
details the threat and clarifies the mission and performance requirements of the physical security
system. Relevant factors to consider when conducting a facility biosecurity risk assessment are
listed in Table 2 however, not all of these factors will impact risk in the same manner.
In summary, when conducting biorisk assessments it is important to acknowledge that while biosafety focuses
on keeping the workers, human and animal community safe, and biosecurity focuses on keeping the valuable
assets inside the facility secure, these two goals might not always be synergistic. It is important to have both
aspects in mind when deciding upon a relevant biorisk management strategy and actual mitigation measures.
[Insert Facility Name] uses a variety of tools for risk assessments, including Facility Biosafety and Biosecurity
(BS&S) Assessment Forms and a Protocol Risk Assessment Form (refer to Attachment B, Biological Risk
Assessment Forms and Checklists). These forms are completed by Laboratory Managers for review and approval
by the Biorisk Management Advisor and Biorisk Management Committee. [Provide additional details about
review and approval process below, or write supporting SOP to be referenced]
v1 130509 Page 10 of 36
Manual Title: Biorisk Management Manual
Even the most well prepared laboratory may experience accidental or intentional incidents or emergencies such
as fire, biological release, chemical spill, or minor work place injuries despite existing prevention or mitigation
measures. Effective incident response is a mitigation strategy that may reduce the consequences from these
unknown events through planning, and preparing for potential incidents, as well as detecting, communicating,
assessing, responding to and recovering from actual events. Laboratories should have a documented
contingency plan for incident or emergency identification and response. Plans should be developed at a senior
management level and incorporate feedback from frontline staff.
Planning considers the potential incidents and designates resources to respond effectively and mitigate adverse
effects. These potential incidents should take into account the risk assessment for an individual laboratory area
and the facility as a whole. Common potential laboratory incidents to be included in a facility emergency and
incident plan include, but are not limited to:
Acquisition of resources, storage, and equipment, and provision of personnel training and facility drills is
essential in preparing for and managing an incident or emergency. [Provide additional details about your
Emergency and Incident Planning process below, or write supporting SOP to be referenced]
v1 130509 Page 11 of 36
Manual Title: Biorisk Management Manual
Drills and exercises can also be used in the planning and preparation stages to test the responses to simulated
incidents or emergencies. They can help identify gaps and other improvement opportunities. Plans should be
reviewed and updated at least annually incorporating the information garnered through drills and incident
reports and investigations. Plans should take into consideration the steps between event occurrence and
identification and reporting. A standard reporting chain should exist to facilitate reporting. Incident report forms
are available to provide an opportunity for investigation, root cause analysis, corrective action, and process
improvement (refer to Chapter XXI. Laboratory Emergency and Incident Response, Reporting and Investigation).
v1 130509 Page 12 of 36
Manual Title: Biorisk Management Manual
Laboratory facilities are designated as Biosafety Level (BSL) 1 (basic) through 4 (maximum containment).
Biosafety level designations are based on a composite of the design features, construction, containment
facilities, equipment, practices and operational procedures required for working with agents that pose varying
levels of risk (refer to WHO Laboratory Biosafety Manual).
BSL1 is suitable for work involving well-characterized agents not known to consistently cause disease in
healthy adult humans, and of minimal potential hazard to laboratory personnel and the environment.
Work is generally conducted on open bench tops using standard microbiological practices. Special
containment equipment or facility design is neither required nor generally used.
BSL2 is suitable for work involving agents of moderate potential hazard to personnel and the
environment. Most clinical laboratories use BSL2 for initial diagnostic procedures of unknown samples.
Laboratory personnel have specific training on handling pathogens and sharps, access to the laboratory
is limited and a biological safety cabinet (BSC) is used to contain potential aerosols.
BSL3 is applicable to clinical, diagnostic, teaching, research, or production facilities in which work is done
with indigenous or exotic agents that may cause serious or potentially lethal disease as a result of
exposure by the inhalation route. All procedures involving the manipulation of infectious materials are
conducted within BSCs or by personnel wearing appropriate personal protective clothing and
equipment. The laboratory has special security, engineering and design features.
BSL4 is required for work with dangerous and exotic agents that pose a high individual risk of aerosol-
transmitted laboratory infections and life-threatening disease. All work is conducted in Class III BSC or
Class I or II BSC in combination with full-body, air-supplied, positive pressure personnel suit in
conjunction with highly specialized equipment, engineering and design features.
v1 130509 Page 13 of 36
Manual Title: Biorisk Management Manual
Table 3 for information on required training which will be coordinated through the safety
department.
[Provide additional details about your Personnel Management program below, or write
supporting SOP to be referenced]:
• What types of job categories are considered low, medium or high risk? Is the authorization
process more restrictive for high than that for low and moderate risk positions?
• What is the minimum education requirement for individuals to have unescorted access to
valuable biological materials (VBM), the existing physical security system, and/or the
network infrastructure?
• What should the screening process include (e.g., background check, verification of education
and references) and what are the legal, technical, and financial limitations of this process?
• Are there medical clearances and/or vaccination requirements/recommendations?
• What training will be required prior to access and independent work? Is there a requirement
for proficiency demonstration?
• What behavior should be reported - security violations, criminal conduct, unexplained
financial gain, unexplained absenteeism, degenerating physical appearance,
insubordination/poor work performance, poor workplace relationships, alcohol/substance
abuse, indications of excessive debt, excessive complaining?
v1 130509 Page 14 of 36
Manual Title: Biorisk Management Manual
• What resources are available to employees suffering from adverse life events (e.g., Employee
Assistance Program)
• What are the consequences for violations?
• Designate criteria to establish and maintain the suitability of individuals with access to VBM.
How frequently are personnel re-assessed?
• Designate criteria to establish temporary or permanent revocation of access to VBM for an
individual due to medical restriction, suspension, disqualification, or administrative
termination
• What arrangements are made for short versus long-term visitors? Are they vetted prior to
access?
• What are the escorting procedures?
• Describe procedures for maintaining redundancy and succession planning for critical
operations
• Describe termination procedures to ensure all access is revoked and materials are
transferred (e.g., turn-in of keys, access cards, notebooks, and VBM, and de-activation of all
electronic accounts)
[Provide additional details about your Occupational Health program below, or write supporting SOP to
be referenced]:
• How is medical clearance for PPE provided (e.g., respirators)? And when is it necessary?
• Who is responsible for determining when/if vaccinations are recommended? How do
employees obtain appropriate vaccinations associated with their work?
• Who will provide medical evaluations for high risk conditions (e.g., immunocomprimised,
pregnancy)?
• How will susceptible individuals be informed of the hazards of high risk work?
• Consider provisions for the following:
Providing personnel health and safety education
Managing job-related stress, illnesses and exposures
v1 130509 Page 15 of 36
Manual Title: Biorisk Management Manual
v1 130509 Page 16 of 36
Manual Title: Biorisk Management Manual
• Required PPE and donning and doffing instructions (e.g., lab coats, clothing change into scrub
suits)
• Vaccinations required for entry and/or vaccinations required for direct work
• Handwashing requirements
• Personal shower and/or hygiene requirements (e.g., decontamination of eyeglasses)
• Restriction on jewelry
• Restrictions for food and water consumption within laboratory spaces
• Restrictions for personnel with broken skin (e.g., covering with water-resistant bandage)
• Removal of items from the laboratory (e.g., equipment, samples (e.g., confirmation of
inactivation prior to movement to a lower containment level), notebooks)
• How are entry/exit procedures and potential hazards communicated to employees (e.g., room
signage, labels)?
• Describe entry/exit procedures for the access control system (refer to Chapter XVI, Physical
Security Systems)
XI. Laboratory Facility and Infrastructure [Adapted from CWA 15793, Provide additional details about your
facility design and infrastructure below, or write supporting SOP(s) to be referenced]
The organization should ensure that facilities, equipment and processes are designed and operated in a
safe and secure manner with respect to biorisk management. Well-defined housekeeping and
maintenance procedures and schedules are essential in reducing the risks associated with working with
infectious agents and in protecting the integrity of laboratory work. [Provide additional details about
your laboratory housekeeping and maintenance procedures below, or write supporting SOP(s) to be
referenced]
v1 130509 Page 17 of 36
Manual Title: Biorisk Management Manual
v1 130509 Page 18 of 36
Manual Title: Biorisk Management Manual
• The Class I cabinet is designed to provide personnel and environmental protection only.
• The Class II cabinet must meet requirements for the protection of product, personnel
and the environment. This type of cabinet is widely used in clinical, hospital, life science,
research and pharmaceutical laboratories. In general, cabinets are classified according
to the method by which air volumes are recirculated or exhausted.
• Class III cabinets are gas-tight, designed for use with high risk biological agents and
materials.
B. Autoclaves [Adapted from the WHO Laboratory Biosafety Manual Third Edition, Provide
additional details about your facility’s autoclave operation and maintenance procedures below,
or write supporting SOP(s)] (refer to Autoclave: Operation and Maintenance SOP)
Saturated steam under pressure (autoclaving) is the most effective and reliable means of
sterilizing laboratory materials. Autoclaves can also be used to decontaminate some waste
materials prior to disposal. Depending on the type of autoclave, the load size, and autoclave
settings, the time to reach the holding temperatures may vary and can take an hour or more
before reaching the desired temperature. For most purposes, the following cycles will ensure
sterilization of correctly loaded autoclaves:
• 3 min holding time at 134 °C
• 10 min holding time at 126 °C
• 15 min holding time at 121 °C
• 25 min holding time at 115 °C
Examples of different autoclaves include the following:
• Gravity displacement autoclaves-Steam enters the chamber under pressure and
displaces the heavier air downwards and through the valve in the chamber drain, fitted
with a HEPA filter.
• Pre-vacuum autoclaves-These machines allow the removal of air from the chamber
before steam is admitted. The exhaust air is evacuated through a valve fitted with a
HEPA filter. At the end of the cycle, the steam is automatically exhausted. These
autoclaves can operate at 134 °C and the sterilization cycle can therefore be reduced to
3 min. They are ideal for porous loads, but cannot be used to process liquids because of
the vacuum.
• Fuel-heated pressure cooker autoclaves-These autoclaves are loaded from the top and
heated by gas, electricity, or other types of fuels. Steam is generated by heating water in
the base of the vessel, and air is displaced upwards through a relief vent. When all the
air has been removed, the valve on the relief vent is closed and the heat reduced. The
pressure and temperature rise until the safety valve operates at a preset level. This is
the start of the holding time. At the end of the cycle the heat is turned off and the
v1 130509 Page 19 of 36
Manual Title: Biorisk Management Manual
temperature allowed to fall to 80 °C or below before the lid is opened. These should be
used only if a gravity displacement autoclave is not available.
Be sure to read and be familiar with the operating instructions of the specific autoclave model in
use, but the following rules can minimize the hazards inherent to operating pressurized vessels:
• Responsibility for operation and routine care should be assigned to trained individuals.
• A preventive maintenance program should include regular inspection by qualified
personnel of the chamber, door seals and all gauges and controls.
• The drain screen filter of the chamber (if present) should be removed and cleaned daily.
• For autoclaves without an interlocking safety device that prevents the door being
opened when the chamber is pressurized, the main steam valve should be closed and
the temperature allowed to cool to below 80 °C before the door is opened.
• Slow exhaust settings should be used when autoclaving liquids, as they may boil over
when removed due to pressurization and superheating.
• Operators should wear longs sleeves, suitable gloves and visors for protection when
opening the autoclave, even when the temperature has fallen below 80 °C.
• In any routine monitoring of autoclave performance, biological indicators or
thermocouples should be placed at the center of each load. Regular monitoring with
thermocouples and recording devices in a worst-case load is highly desirable to
determine proper operating cycles.
• Autoclaves should be packed according to validated loads.
• Care should be taken to ensure that the relief valves of pressure cooker autoclaves do
not become blocked.
• All materials to be autoclaved should be in containers that allow ready removal of air
and permit good heat penetration; the chamber should be loosely packed so that steam
will reach the load evenly.
• Water may be added to bags to promote steam generation. Bags should allow the
steam to reach their contents and should not be fully sealed.
• The steam should be saturated and free from chemicals (e.g. corrosion inhibitors) that
could contaminate the items being sterilized.
v1 130509 Page 20 of 36
Manual Title: Biorisk Management Manual
• Always wash hands when finished working, when gloves have been removed or
compromised and before leaving the laboratory.
• Wear appropriate PPE within the laboratory (refer to PPE SOP).
• Be sure to remove PPE prior to leaving the laboratory.
• Never mouth pipette; always use mechanical pipettors.
• Use extreme caution when working with sharps.
• Never recap a used needle or otherwise manipulate it by hand.
• Dispose of needles and other sharps in puncture resistant containers ("sharps" containers).
• Label all containers and equipment that contain biohazards with the Universal Biohazard
Symbol.
• Store all biohazardous materials securely in clearly labeled, sealed containers.
• Contain and minimize aerosols by using appropriate equipment and procedures.
• Decontaminate work surfaces when work is finished and after spills.
• Use disinfectants with proven efficacy against the specific biohazard being handled (refer to
Chapter XVIII, Disinfectants and Decontamination).
• Dispose of waste properly (refer to Waste Handling and Disposal SOP).
• Know and understand the biology and infectious potential of the biohazardous agents being
handled.
• Work with the appropriate mitigation controls required for the biohazard being handled as
determined in the risk assessment.
• Provide training for new employees prior to independent work with biohazards.
• Handle all potential biohazards as if an infectious agent is present.
• Plan in advance for response to accidents, spills, and injuries (refer to Chapter VI, Laboratory
Emergency and Incident Planning).
• Know the location of appropriate spill kits or other decontamination equipment.
• Report all accidents to your supervisor and the Biorisk Management Advisor/Safety
Department (refer to Chapter XXI, Laboratory Emergency and Incident Response, Reporting
and Investigation).
v1 130509 Page 21 of 36
Manual Title: Biorisk Management Manual
Donning and Removing Personal Protective Equipment Poster). Examples of PPE relevant to laboratory
settings include protective clothing, gloves, and eye, face and respiratory protection. [Provide additional
details about your facility’s PPE procedures below, and/or use the supporting PPE SOP template]
• How is the need for PPE determined?
• Who specifies the PPE to be used and ensures it is available for use?
• Who maintains and distributes PPE?
• How are employees trained on how to use PPE?
• Are employees permitted to repair and/or reuse durable PPE?
• Is there special PPE for emergency situations?
Facilities that work with biological agents and/or toxins should develop a system to manage and oversee
its inventory of these materials. This inventory may be integrated into a broader inventory of biological
materials, reagents, supplies, and other property stored and used at the facility. A designated person
should be assigned responsibility for overseeing the inventory. The level of oversight and access control
imposed on biological agents and toxins, and associated inventory information (such as storage
locations, quantities, etc.), should be based on a risk assessment that includes consideration of both
safety and security, as well as any applicable laws, regulations, or policies. [List the applicable laws
and/or regulations]
In addition to helping better manage facility resources and improve overall facility performance and
efficiency (e.g., by helping to better control the quantities of various supplies maintained on site), the
inventory helps form the basis for material control and accountability (MC&A) measures to help oversee
the storage and use of biological agents and toxins, as well as other valuable biological materials. The
primary objectives of MC&A are to establish internal oversight of biological agents and toxins, and to
discourage theft and/or misuse. The inventory in general, and particularly the inventory of biological
agents and toxins, should therefore be current, complete, accurate, and updated regularly to account
for changes in inventory levels. Those personnel assigned responsibility for assembling and/or
maintaining the inventory should ensure the inventory information meets these basic conditions. Based
on risk, the facility should determine and document what type and level of information should be
captured for each item. [List the specific information to be collected in the inventory system below, or
reference the appropriate Valuable Biological Material Inventory Management SOP]
• What specific criteria/data will recorded, such as:
v1 130509 Page 22 of 36
Manual Title: Biorisk Management Manual
o Name of agent/toxin
o Characteristics (e.g., strain designation, GenBank Accession number)
o Quantity acquired (e.g., containers, vials, tubes)
o Initial and current quantity amount (e.g., milligrams, milliliters)
o Date of acquisition
o Source of acquisition
o Storage location (e.g., building, room, and freezer)
o When removed and/or returned from storage and by whom
o Purpose of use
o Transfer records (e.g., name and quantity of agent, date of transfer, name of sender and
recipient)
o Notification of theft, loss, or release records
o Destruction records (e.g., name and quantity of agent, date, by whom)
• What training is provided to ensure compliance with the inventory management system?
• Who is responsible for MC&A (e.g., accountable individual for each item in the inventory:
updates to the inventory system to include use, transfers and destruction)
• What are the inventory reconciliation processes (e.g., frequency of auditing, reporting and
resolving discrepancies)?
• How are materials handled and stored (e.g., appropriate temperature control, prevention of
overcrowding, well organized, shelf-life management)?
• Are inventory locations minimized and provided adequate protection so that only authorized
personnel have access (refer to Chapter XVI, Physical Security Systems)?
• How is information protected (refer to Chapter XVII, Information Control)?
• How are materials from suppliers validated?
• Are materials clearly labeled and tracked?
v1 130509 Page 23 of 36
Manual Title: Biorisk Management Manual
whose loss, theft, compromise, and/or unauthorized use will most adversely affect international or
national security, and/or the health and safety of employees, the public, and the environment. In
addition, these elements are selected and implemented following a site-specific biosecurity risk
assessment to ensure that all elements are practical, sustainable and commensurate with identified risks
(refer to Chapter V, Biorisk Assessment).
B. Access Controls
The goal of an access control system is to allow authorized persons to enter secure areas, and
prevent or delay the entry of unauthorized persons into secured areas. Access controls provide
reasonable assurance that only authorized personnel are allowed to enter a restricted area. The
type and number of controls depend on the level of security required. Access can be controlled
with a variety of unique items (e.g., badges, physical or electronic keys, knowledge (code),
biometrics). These items can be used in combination or sequentially to increase the probability
that and individual is indeed authorized. Sharing of unique credentials is prohibited. Prior to
granting an individual access to the laboratory, an assessment should be made to determine
wether that person has demonstrated a need and received authorization for access (refer to
Chapter IX, Laboratory Access Determination).
[Provide additional details about your facility’s access control systems which may include:
administrative controls such as lists of approved individuals and visitors; the use of personnel
escorts; credentials such as photo identification badges for employees and visitor badges;
electronic equipment such as badge readers, key pads that recognize unique codes, and
biometric scanners; and keys.]
• What areas of the facility are secure area(s)? What separates the secure area(s) from
other areas (e.g. a perimeter fence, gate, guards, secure doors)?
• Is the protection graded? Are there increasing layers of security at the facility based on
proximity to VBM or other high-value/risk assets?
• Describe the access control system and the credentials required to enter each secure
area (e.g., access rosters, escorts, badges, keys, codes, manual and electronic systems)
v1 130509 Page 24 of 36
Manual Title: Biorisk Management Manual
• What are the hours of operation? Do employees have access during specific times?
• Describe parking restrictions (Who is authorized to park vehicles on site? Are vehicle
stickers or placards required? Is parking segregated form the building? How are
deliveries and delivery vehicles handled?)
• How is the access control system maintained (e.g., periodic performance testing)?
• Describe the process for enrolling personnel in the access control system
• Describe the process for removing personnel from the access control system
• How is tailgating prohibited to ensure each individual presents their own unique
identifier for access?
• Describe visitor control and escorting procedures (Is there an approval process? Do
visitors have designated parking? Are visitor logs used?)
• Describe the features of facility badges:
o Are there different types of badges (e.g., employee, visitor, temporary)?
o Do they have electronic access control (e.g., proximity, magnetic stripe)?
o How long are badges valid?
o When/where must badges be worn (e.g., administrative areas, laboratories)?
The use of keys and/or codes for access control is only effective when they are properly
maintained and controlled. This can be accomplished through a Key Control Program and
associated documentation (refer to Attachment G, Key and Code Control Form). [Provide
additional details about your facility’s key and code control program below, and/or reference the
appropriate SOP(s)]
• Who determines when to implement keys/codes?
• Is there a dedicated Key Custodian/Control Officer responsible for the Key Control
Program?
• When are keys/codes changed? (e.g., loss or compromise, personnel changes)
• Are keys inventoried? At what frequency?
• Are keys returned/electronic access deactivated when an individual no longer requires
access?
• Does staff immediately report loss or theft of access credentials or keys?
C. Intrusion Detection
Intrusion detection notifies facility staff that an unauthorized individual has either attempted to
enter or actually entered a restricted area. For low risk and administrative areas, abnormal
observations such as a broken window or a secure door that is ajar may suffice, while facilities
and areas with a higher potential for malicious conduct may choose to implement additional
monitoring. Depending on the outcome of a comprehensive risk assessment, the facility may
maintain one or more intrusion detection mechanisms to detect unauthorized access and
activity. Intrusion detection systems typically consist of sensors (either automated or human), a
v1 130509 Page 25 of 36
Manual Title: Biorisk Management Manual
mechanism to communicate to appropriate personnel that a sensor has been activated (alarms),
and personnel who perform an assessment of the alarm to determine what response is
required.
[Provide additional details about your facility’s intrusion detection system(s) below]
• Describe the sensors used (e.g., trained guards, active or passive infrared motion
detectors, magnetic switches, and glass break sensors)
• Describe the alarm system (e.g., how is it activated (unauthorized entry or movement), is
it an audible and/or visual notification, does it automatically notify on/off-site guard
forces and/or local law enforcement)?
• Does the system have a redundant power supply to ensure functionality during a power
failure?
• How is the intrusion detection system maintained (e.g., reset process, periodic
performance testing, battery replacement, sensor cleaning, firmware or software
updates)?
Once an alarm has been communicated, an assessment should be performed by the guard force
or other authorized personnel (such as local law enforcement personnel) to determine if the
alarm is false or valid, and what actions, if any, are required to either interrupt the adversary or
initiate an incident response protocol (refer to Chapter XXI, Laboratory Emergency and Incident
Response, Reporting and Investigation). Video surveillance refers to the monitoring of a
designated area using a camera system. While constant monitoring of video surveillance is
typically not the most effective a means of detection, it can be used to aid in alarm assessment
and may also serve as a deterrent to unauthorized activity. The system may record all activity in
the area for a defined period of time, which can be used to review events that occur in that
timeframe. If the system does not have recording capability it may still be useful in real-time
and alarm assessment.
[Provide additional details about your facility’s alarm assessment and response procures below]
• Describe how responders perform an alarm assessment (by going to the site of the alarm
to investigate, or remotely from a central alarm station equipped with appropriately
configured communication and display system(s))
• Is a video surveillance system used? Are videos recorded? How long are they
maintained? How is the video surveillance system maintained?
• Are results of alarm assessments documented? Is there an event log?
• Define roles and responsibilities during response (e.g., guard force, laboratory staff,
management). Who responds to alarms and how are they trained? Is there a written
response plan or procedures?
v1 130509 Page 26 of 36
Manual Title: Biorisk Management Manual
• Describe access delay measures to impede the progress of the adversary (e.g., guards,
perimeter fencing, vehicle barriers, sturdy/locked doors, window bars, solid construction)
In summary, all security measures should be implemented in a graded manner based on assessed
biosecurity risk. Once a security system has been designed and implemented, management should
ensure its successful operation through exercises, drills and self-assessments that cover: physical
security, personnel management, MC&A, transport operations, and information security (refer to
Chapter XXII, Biorisk Management System Assessment and Improvement).
[Provide additional details about your facility’s information security policies and procedures
below, and/or reference the appropriate SOP(s)]
• How is information determined to be sensitive? Is sensitive information marked or labeled? How
is information reviewed and approved for public release?
• What information is sensitive at your facility (e.g., security-related information, inventories, floor
plans, access rosters, laboratory notebooks and data
• Describe desktop security procedures
• Describe network security procedures and what elements are included in the network (e.g.,
routers, servers, Web servers and applications, domains, firewalls, wireless local area networks
and remote access)
• Is there a secure server room? Are there stand-alone computers on isolated networks used
within restricted areas?
• Describe how communication is controlled (e.g., encryption/ password protection)
• Are cell phones, cameras and other media storage devices limited or restricted?
• Is there centralized copying/ printing?
• How are hard copy (paper) and electronic files destroyed (e.g., shredding)?
v1 130509 Page 27 of 36
Manual Title: Biorisk Management Manual
A. Disinfectants
If a product is -cidal, it kills or inactivates an agent (e.g. bacteri-, viru-, fungi-, tuberculo-,
microbi-, spori-, or germi-.) To determine whether a specific agent will be killed, the label must
be read thoroughly. Particular care should be taken when handling concentrated stock
solutions of disinfectants. A majority of disinfectants are toxic to the human body by skin
contact or inhalation. Personnel assigned the task of preparing working concentrations from
stock solutions must be properly informed as to the potential hazards and trained in the safe
procedures to follow. Concentrated disinfectants are particularly harmful to the eyes. Even a
small droplet splashed into the eyes may cause blindness. Eye protection, long-sleeved
garments, chemically resistant gloves, aprons, and boots should be worn to protect the skin
from the corrosive and toxic effects of the disinfectant.
The effectiveness of a disinfectant to kill or inactivate infectious agents will depend upon many
factors. The following factors must be considered before assuming a disinfectant will be
suitable for the particular application as all chemicals are not equally effective against the
different types of microorganisms:
• Susceptibility of target organism (lipid virus (least), bacteria, fungi, non-lipid virus,
mycobacteria, bacterial spores, prions (most))
• Use concentration
• Presence of organic material, protein content
• Contact time
• Environmental stability
The degree of contamination affects the time required for disinfection, the amount of chemical
required, and other variables. Different chemicals have different modes of action and levels of
activity. It is important to understand the mode of action in order to select the appropriate
chemical. Be sure to follow the manufacturer’s instruction for proper use of all disinfectants.
[Provide additional details about your facility’s disinfectant selection and use procedures below
or reference a supporting SOP (e.g., Handbook for Preparing Reagents and Culture Media]
• How are disinfectants selected?
• Who is responsible for purchasing disinfectants?
v1 130509 Page 28 of 36
Manual Title: Biorisk Management Manual
Users must avoid inhalation of vapors used for space decontamination. Stock containers of
these products should be capable of confining these vapors and should be kept in properly
ventilated chemical storage areas (refer to Chemical Hygiene Program, if available). In preparing
and applying use-dilutions, personnel should control the operations to prevent exposure of
others and wear respiratory protection as necessary. [If vapor and/or gas decontamination is
performed, proper SOPs need to be written to address:
• Who determines when this type of decontamination is needed?
• List method and products used for this type of decontamination
• How is exposure to employees minimized (e.g., perform work after hours)?
• Who is responsible for performing work (e.g., Facilities Management)?
• How is efficacy of decontamination evaluated?
v1 130509 Page 29 of 36
Manual Title: Biorisk Management Manual
training/retraining, and communication are important elements of the system as are periodic reviews of
procedures and reassessment of risks.
A risk assessment should be performed to determine the best method(s) for waste collection, handling,
transport, storage, decontamination/disinfection, and final disposal. The risk assessment should prompt
an informed development of a risk mitigation plan, including elimination of hazards by work
modifications, substitutions of less hazardous equipment or materials, engineering and administrative
controls and provision of PPE. All infectious waste generated from a laboratory should be
decontaminated prior to disposal. Decontamination as close as possible to the point or source of
generation fosters safer waste handling and minimizes the chance of personnel inadvertently coming in
contact with infectious material. When it is not possible to dispose of waste close to the source, safe
transportation procedures should be established to reduce the risk of contamination to any personnel.
In addition, waste handling systems should be developed and implemented in accordance with local,
national, and international regulations and/or requirements. [Reference applicable waste and disposal-
related regulations here]
[Provide additional details about your facility’s waste handling and disposal procedures below or
reference the Waste Handling and Disposal SOP]
• Describe Waste Identification and Separation – A system should be adopted for the
identification and separation of laboratory waste and waste containers (e.g., solids,
liquids, sharps, chemicals). Use pictures, flow charts and other job aides to communicate
proper procedures.
• Describe Waste Collection - Waste should be collected at the point of generation. Waste
containers, pans, or jars, preferably unbreakable (e.g. plastic), should be appropriately
sized and conveniently located in the work place. All containers must be clearly marked.
• Describe How Waste is Stored- How long can waste be stored and at what temperature?
Untreated biohazardous waste should be secured appropriately to prevent unauthorized
removal.
• Describe PPE for Waste Handling - Proper PPE should be sturdy and protect against
sharps, chemicals, and high temperatures, as appropriate.
• Describe How Mixed Waste is Handled - If biohazardous waste is mixed with other
hazardous waste (e.g. chemical or radioactive), refer to the facility’s chemical hygiene
plan and/or consult with the appropriate safety officer to determine whether how the
hazardous waste should be handled.
• Describe Sharps Handling and Disposal – Sharps use should be minimized in the
laboratory as they are a major source of accidents. Use blunt-tipped scissors. Never
bend, recap or manipulate sharps by hand.
• Describe Waste Treatment- Where does decontamination take place with regard to the
waste creation? Is there a secondary form of decontamination necessary? Is waste
v1 130509 Page 30 of 36
Manual Title: Biorisk Management Manual
1. Classify - determining whether your shipment is a regulated dangerous good or not; Category A,
Category B, exempt human/animal specimen, etc.
2. Identify - selecting a proper shipping name for your shipment. All dangerous goods must be
assigned a proper shipping name and United Nations (UN) Identification number. These names
and numbers are standard throughout the world.
3. Package - infectious substances have specific packaging requirements that include a triple
package concept: a leak-proof primary, leak-proof secondary, sufficient absorbent, and sturdy
outer packaging.
4. Mark and Label – proper marking and labeling helps identify the contents and describe the
hazardous nature. The marks and labels required by international dangerous goods shipping
v1 130509 Page 31 of 36
Manual Title: Biorisk Management Manual
regulations are the same in every country. Irrelevant marks and labels should be removed from
any reused packaging.
5. Document - several international standardized documents are designed to accompany
shipments of dangerous goods. The following documents may be necessary for shipments
depending on the dangerous good, the mode of transport, and the destination:
• Shipper's declaration for dangerous goods
• Pro-forma invoice listing details about the shipment, contents, number of packages, etc.
• Air waybill
• Import and/or export permits
• For security purposes, a Memorandum of Understanding (MOU) may also be necessary
to be completed and signed by both the sending organization and the receiving
organization.
[Provide additional details about your facility’s specimen packaging and transportation procedures
below and/or reference applicable documents (e.g., Transportation and Shipping SOP, Sample Collection
Handbook)]
• Describe the shipping functions at your facility (e.g., centralized (dedicated department),
decentralized (trained individual users), or a risk-based hybrid)
• Describe training/certification required for individuals responsible for shipping
• List the personnel or department responsible for dangerous goods shipping
• Describe how security of samples is maintained throughout the shipping process (e.g., transport
security procedures to be followed by sending, carrier and recipient entities)
• How are packages inspected (e.g., leaking, stained, odor, unusual, unexpected, odd size)?
• Where are packages brought and stored when first received? Is the area secured?
• How is material transported from reception to the lab(s)?
• Are employees trained to report suspicious packages? How are they reported?
v1 130509 Page 32 of 36
Manual Title: Biorisk Management Manual
v1 130509 Page 33 of 36
Manual Title: Biorisk Management Manual
v1 130509 Page 34 of 36
Manual Title: Biorisk Management Manual
Laboratories may have several different systems that contribute to the effectiveness of biorisk
management such as: testing and quality control, financial management, research results,
general safety, and staff performance. The performance of these systems may be monitored to
determine the overall performance of the BRM system. Biorisk management system
performance refers to the way in which a biorisk management system actually functions to
manage or minimize risk. Since actual biorisk management system performance may not match
the planned level of risk management, performance measurements should be conducted to
assess the differences between the expected and the observed. Biorisk management systems
should undergo periodic review (Act portion of P-D-C-A) to ensure continued suitability,
adequacy, and effectiveness. One essential tool is the reporting and analysis of laboratory
inspection results (refer to Attachment I, WHO Laboratory Biosafety Manual, Part VII Safety
Checklist). [Provide additional details about your facility’s management review process which
should consist of analysis of data generated to measure performance such as:]
• Inspections, audits (describe frequency and scope)
• Monitoring records (e.g., equipment performance, quality control logs)
• Root-cause analysis of accident investigations (e.g., accident, injury, near-miss
investigation data)
• Corrective and preventive actions
• Training programs
• Results of safety and security exercises and drills
• Data from surveys, questionnaires and employee feedback/observations
• Evaluation of improvements that have been implemented
XXIII. References
A. Centers for Disease Control and Prevention (CDC)/National Institutes of Health (NIH), Biosafety
in Microbiological and Biomedical Laboratories (BMBL), 5th Edition,
http://www.cdc.gov/biosafety/publications/bmbl5/index.htm
B. CDC, Primary Containment for Biohazards: Selection, Installation and Use of Biological Safety
Cabinets, http://www.cdc.gov/biosafety/publications/bmbl5/BMBL5_appendixA.pdf
C. Comité Européen de Normalisation (European Standards Organization) (CEN) Workshop
Agreement (CWA) 15793:2011, Laboratory biorisk management,
ftp://ftp.cenorm.be/CEN/Sectors/TCandWorkshops/Workshops/CWA15793_September2011.pd
f
D. CWA 16393:2012, Laboratory biorisk management - Guidelines for the implementation of CWA
15793:2008, ftp://ftp.cen.eu/CEN/Sectors/List/ICT/Workshops/CWA%2016393.pdf
v1 130509 Page 35 of 36
Manual Title: Biorisk Management Manual
XXIV. Attachments
A. Biorisk Management System Plan
B. Biological Risk Assessment Forms and Checklists
1. (http://www.cdc.gov/biosafety/publications/BiologicalRiskAssessmentWorksheet.pdf)
2. (http://www.selectagents.gov/Checklists.html)
3. (http://www.who.int/ihr/publications/laboratory_tool/en/index.html)
4. Protocol Risk Assessment Tool (.xls and .pdf)
C. Medical Alert Card Template (http://www.cdc.gov/biosafety/publications/)
D. Laboratory Access Request Form Template
E. Equipment Use Log Template
F. Sequence for Donning and Removing Personal Protective Equipment Poster-Clinical Settings
(http://www.cdc.gov/HAI/pdfs/ppe/ppeposter148.pdf)
G. Key and Code Control Form Template
H. Incident Response Form Template and Log
I. WHO Laboratory Biosafety Manual, Part VII Safety Checklist
v1 130509 Page 36 of 36