Biosecurity Compliance and Risk Management

The US federal government is taking steps to have better pandemic preparedness by enhancing regulations. Recent regulatory developments are addressing the need for the U.S. biomedical research community to strengthen biosecurity measures, especially with synthetic biology and research of potentially dangerous pathogens involving Pathogens with Enhanced Pandemic Potential (PEPP) or when artificial intelligence (AI) is used to exploit or amplify the threat.

The Biden administration’s October 2023 Executive Order on the Safe, Secure, and Trustworthy Development and Use of Artificial Intelligence (EO) describes ways to reduce the potential for AI to enable biological risks. The EO is significant to organizations receiving government funds for life sciences research involving the procurement of any type of synthetic nucleic acids and to organizations that manufacture or distribute any type of synthetic nucleic acids, or benchtop equipment for synthesizing nucleic acids, for federal government-funded research. The EO requires by October 26, 2024, all federal agencies funding life sciences research must, as appropriate and consistent with applicable law, establish as a requirement of funding, synthetic nucleic acid procurement for federally funded research must be conducted through synthetic nucleic acid and synthetic nucleic acid benchtop equipment manufacturers and distributors that adhere to the “Framework for Nucleic Acid Synthesis Screening” (Screening Framework), which was issued by the White House Office of Science and Technology Policy (OSTP) in April 2024. The Screening Framework requires, for those who must comply with the Screening Framework, compliance with the “Screening Framework Guidance for Providers and Users of Synthetic Nucleic Acids” issued by HHS in October 2023. Post the Screening Framework, the funder/sponsor National Institute of Health (NIH)  has produced Guidelines for Research Involving Recombinant or Synthetic Nucleic Acid Molecules, April 2024.

Due to a new Policy for Oversight of Dual Use Research of Concern and Pathogens with Enhanced Pandemic Potential (PEPP Policy), effective May 6, 2025, federal agencies funding certain types of life sciences research on biological agents and toxins with dual use potential will need to ensure the recipients of the funding follow certain practices. This new U.S. government-wide policy combines the current “dual use research” of concern (research having the potential to be both beneficial and harmful) and enhanced potential pandemic pathogen oversight frameworks. The PEPP Policy expands the scope of research requiring:

  • additional scrutiny (expands the list of pathogens and broadly views risks);
  • government agencies funding applicable research ensure the recipient organizations have enhanced risk identification, management, and mitigation plans;
  • organizations engaged in biomedical research to engage in robust collaborations with relevant government agencies.

The Implementation guidance  for the United States Government Policy for Oversight of Dual Use Research of Concern  and Pathogens with Enhanced Pandemic Potential  assists with implementation of the PEPP Policy (Implementation Guidance). NIH intends to work closely with the biomedical research community to help them prepare for the May 6, 2025 effective date of the PEPP Policy.


PEPP Policy Key Points:

  • The PEPP Policy applies to all U.S. federal departments and agencies funding or sponsoring research, whether in the U.S. or internationally, fitting the criteria of enhanced oversight per the policy (Categories 1 and 2).
  • Federal departments or agencies can condition the funding provision to an institution on the institution attesting to the federal government that it will implement stricter oversight of non-federally funded Category 1 and Category 2 research in accordance with the PEPP Policy research framework.
  • For research involving a national emergency, or where the risk outweighs benefit, the applicable federal agency may issue a temporary waiver from the PEPP Policy oversight requirement.
  • The applicable federal departments or agencies are responsible for enforcement and noncompliance may result in the loss of current and future funding or sponsorship.
  • Institutions not receiving federal funding but conducting research involving biosafety or biosecurity risks and not at the Category 1 and 2 level are advised to voluntary implement safety and security measures.

As required by the EO, on April 29, 2024 the OSTP also established a Screening Framework.   The Screening Guidance, among other things, outlines best practices to address biosecurity concerns associated with the potential misuse of synthetic nucleic acids in order to bypass existing regulatory controls and commit unlawful acts. Importantly, the Screening Guidance and Screening Framework apply to procurement of synthetic nucleic acids and whole organism genomes (viruses and bacteria) containing any synthetic organic chemicals.  

The Screening Framework implements a federal screening requirement to establish any research projects receiving federal research funding will be required to procure synthesized nucleic acids, and synthetic nucleic acid benchtop equipment, only from organizations that follow certain screening guidelines. The Screening Framework provides “within 180 days of the release of this framework [on April 29, 2024], federal research funding agencies will require recipients of federal R&D funds to procure synthetic nucleic acids only from providers that implement these best practices.” The deadline for federal agencies to establish such mandatory requirements is October 26, 2024.

The U.S. Department of Commerce’s National Institute of Standards and Technology (NIST) has entered a two-year cooperative research agreement with the nonprofit Engineering Biology Research Consortium (EBRC) to develop screening and safety tools to defend against the potential misuse of artificial intelligence (AI) related to nucleic acid synthesis, a growing field of synthetic biology with great promise but also serious risks. NIST initiated this collaboration to fulfill a task within the recent Executive Order on Safe, Secure, and Trustworthy Artificial Intelligence that charges multiple agencies — including NIST — with developing standards, best practices and implementation guides for nucleic acid synthesis, in light of advances in AI. The Executive Order on AI calls on NIST to initiate an effort to engage with organizations to develop safeguards to defend against potential misuse of AI related to the synthesis of genetic material. NIST is working with EBRC to identify best practices and policies to ensure public safety.

The U.S. biomedical research community must implement current controls on pathogens and toxins including through the Federal Select Agent Program (FSAP) and export controls and associated Guidance on the Select Agent and Toxins. The FSAP regulates the possession, use, and transfer of biological select agents and toxins having the potential to pose a severe threat to public, animal, plant health, or to animal or plant products. A broader set of controls applies to exports of specified pathogens and toxins controlled under the Export Administration Regulations and for certain defense-related elements and organisms under the International Traffic in Arms Regulations. Export controls can apply to specified biological materials that contain genetic elements and genetically modified organisms with DNA associated with the pathogenicity of controlled materials. Biomedical researchers should review especially carefully their work on sensitive pathogens and toxins to assess controls. Institutions conducting biomedical research need to:

Protocol and Policy Updating:

  • Reassess current biosecurity measures, including protocols and policies against new and previous guidances and develop best practices.
  • Implement enhanced screening procedures for nucleic acid providers.

Research Assessing

  • Inventory research on pathogens and toxins to determine potential restrictions.

Oversight Strengthening:

  • Establish or reinforce committees overseeing high-risk research.
  • Implement rigorous approval processes for PEPP-related studies.
  • Enhance screening and background checks on individuals with access to PEPP-related studies.
  • For organizations importing or exporting these products, ensure the products are correctly declared for import or export (as applicable) and documentation of compliance with the Screening Framework and other applicable requirements can be made available, if and as needed.

Training Enhancing:

  • Provide comprehensive biosecurity training for researchers and staff.
  • Ensure awareness of and training related to new regulatory requirements.

Facility Security Improving:

  • Upgrade physical and cybersecurity measures in research facilities.
  • Implement stricter access controls to sensitive areas and materials.

Incident Response Plan Developing:

  • Create comprehensive plans for potential biosecurity breaches.
  • Conduct regular drills and simulations.

Compliance Documentation Creating:

  • Maintain detailed records of compliance efforts.
  • Prepare for potential audits or inspections.

To mitigate legal and security risks, research organizations are wise to take proactive measures to address these new regulatory guidelines.