Development of a Biosecurity Checklist for Laboratory Assessment and Monitoring

Abstract

Introduction:

Laboratory biosecurity is of continuously growing interest due to increasing concerns about deliberate misuse of biological materials and emerging biological risks. These risks continue to be magnified by globalization, the rapid pace of scientific development, and dual-use technologies. Worldwide laboratory capacities are expanding, which calls for concrete actions to improve laboratory biosafety and biosecurity practices to protect researchers and the community. Hence, laboratories require comprehensive biorisk management programs to minimize the risk of accidental and deliberate release of infectious biological materials.

Objective:

Malaysia has prioritized the concern of national biosecurity and aims to consolidate laboratory biosecurity performance to detect and prevent the deliberate release of biological agents.

Methods:

Two 3-day workshops were organized over the course of four months in which Malaysia collaborated with The Netherlands. This bilateral engagement aimed to integrate biosecurity practices in their national biorisk management programs, and resulted into a comprehensive biosecurity checklist for laboratory assessment and monitoring.

Results:

This biosecurity checklist is based on Malaysian and Dutch expert opinions and national and international guidelines and regulations. The biosecurity checklist is a survey-driven tool that consists of a set of concrete questions for each key biosecurity area, which are discussion points for assessment.

Conclusion:

We display a practical biosecurity checklist for laboratory assessment and monitoring. Although the presented checklist was the template for the specific Malaysia checklist, it could serve as a template for other countries.

Over the past decades, biosecurity has gained global attention due to increased concerns about deliberate biological incidents and emerging and reemerging biological threats. ¹ With a more globalized world, infectious diseases can spread more rapidly within and across country borders. ² In addition, the existing risks of a significant biological incident will continue to be magnified by rapid advances in technology that may facilitate the modification or creation of pathogens with pandemic potential.^3,4 This calls for new global and concrete actions to improve laboratory biosafety and biosecurity to protect both researchers and the community. In particular, facilities storing dangerous pathogens for disease diagnostics and/or the development of novel therapeutics, pose risks given the potential for diversion, loss, theft, misuse, or intentional release of dangerous pathogens.^5,6 This is more likely to occur in laboratories where biosafety and biosecurity measures are insufficiently embedded within a biorisk management program. ⁷ To improve the biosafety and biosecurity situation in laboratories, it is crucial to identify vulnerabilities and address such issues with appropriate solutions.^8,9 Countermeasures could in this regard prevent insiders or intruders with malicious intentions to access pathogens, equipment, and technologies. ⁷ Hence, laboratories require an adequate level of biosecurity to reduce these potential risks.

Biorisk management refers to a system or process to control and minimize safety and security risks associated with the handling, storage, and disposal of biological agents and toxins in laboratories.^{5 -7} The implementation of a biorisk management system integrates both laboratory biosafety and biosecurity practices. At the same time, it is critical to maintain a functional balance between securing biological materials and preserving an environment that promotes fundamental research. ¹⁰ In addition, to ensure an effective and efficient laboratory performance, the organization needs to focus on the causes of nonconformities and seek ways on how to continuously improve biorisk performance within the organization. ⁷ In this regard, a biosecurity risk assessment could assist in systematically identifying and evaluating facility-specific biosecurity risks and could aid in determining the required level of security.^7,11 The outcomes of an assessment therefore aid in determining and prioritizing mitigating measures to reduce the risks to an acceptable and manageable level. Subsequently, these solutions could then be incorporated into a biorisk management program.

Different biorisk assessment instruments or guidelines to establish strong biosafety and biosecurity capabilities exist—for example, the Biorisk Assessment Model (BIORAM) developed by Sandia National Laboratories ¹¹ ; the Danish biosecurity book, An Efficient and Practical Approach to Biosecurity ¹² ; the Food and Agriculture Organization’s (FAO’s) Safety Laboratory Mapping Tool ¹³ ; and the Biosecurity Self-Scan Toolkit ⁸ and the Biosecurity Vulnerability Scan, ⁹ both developed by the Netherlands Biosecurity Office. ¹⁴ Although different instruments are available to assess biosafety and biosecurity programs within institutions or to identify biosecurity/biosecurity gaps at the national level, there is currently no publicly available biosecurity checklist for laboratory assessments. Malaysia has recently identified the need for such a biosecurity checklist to strengthen its laboratory capacities regarding safety and security by focusing on enhancing biosecurity performances within laboratories to detect and prevent the deliberate release of biological events. To develop such a checklist, Malaysia has reached out to the Biological Weapons Conference for assistance.

The multilateral Biological Weapons Convention (BWC) was established in 1972 to prohibit the development, production, stockpiling, and use of biological weapons in warfare. ¹⁵ Currently, 182 signatory countries of the BWC have pledged to implement procedures to improve international cooperation in the field of peaceful biological activities. As stated in the sixth review conference of the BWC, all state parties are required to establish a legislative framework to secure and account for biological materials in laboratories that pose proliferation threats. ¹⁵ Within the framework of the BWC, an Extended Assistance Programme was initiated as part of the European Union Council Decision 2016/51 in support of the BWC. ¹⁶ This Extended Assistance Programme addresses the importance of promoting adherence to the BWC and enhancing national capabilities for implementing obligations under the BWC. Malaysia was one of the signatory parties to be selected, and the Ministry of Defence's Science and Technology Research Institute for Defence (STRIDE), the lead technical agency in Malaysia for the BWC, has signaled the need to address laboratory safety and security and establish more robust systems to prevent the deliberate release of biological agents. The primary aim of this capacity-building initiative is to improve Malaysia’s capacities in the area of biosecurity by developing a comprehensive biosecurity checklist for laboratory assessments and monitoring. A tailored biosecurity checklist could offer a systematic approach for organizations to evaluate and monitor their biorisk management program, especially in the area of biosecurity. In this article, we describe the development of a biosecurity checklist for laboratory assessment by Malaysian and Dutch experts. The presented checklist was the template for the specific Malaysia checklist, but it could also serve as a template for other countries.

Material and Methods

The initiative was co-organized by Malaysia and the Implementation Support Unit (ISU) of the BWC, United Nations Office for Disarmament Affairs, and sponsored by the European Union and the Netherlands Ministry of Foreign Affairs. The Netherlands Biosecurity Office, part of the National Institute for Public Health and the Environment (RIVM), was selected by the Netherlands Ministry of Foreign Affairs and granted expert guidance and assistance throughout this project. The Biosecurity Office is the information center for the government of the Netherlands and for organizations that handle and store high-risk biological material. ¹⁴ Acting as the national biosecurity information platform in the Netherlands, the Biosecurity Office shared expertise on the 8 biosecurity priority areas, assessments, and auditing instruments but also displayed the Biosecurity Self-Scan Toolkit and the Biosecurity Vulnerability Scan.^8,9,14

Two 3-day workshops were organized over the course of 4 months in Malaysia. The initial workshop took place in April 2018, in which the framework for the checklist was established. This checklist was then further refined and finalized in the second workshop in July 2018. A group of 24 biosafety and biosecurity experts from the public health, veterinary, and agricultural sectors was selected to attend both workshops, thereby promoting a one-health approach. During the first workshop, expert opinions were solicited to share their views on the key biosecurity priority areas. In addition, different biosecurity aspects and specific needs were discussed, and experts visited the veterinary laboratory at the Universiti Putra Malaysia to obtain more insight into the specific biosecurity challenges in national laboratories. During the second workshop, the initial checklist was fine-tuned and amended. Furthermore, a site visit at the KPJ Lablink, a private medical laboratory in Kuala Lumpur, allowed the participants to evaluate the workability and applicability of the biosecurity checklist. Based on the results of this pilot assessment, the biosecurity checklist was finalized.

Results

In a bilateral engagement program, Malaysian and Dutch experts developed a comprehensive “laboratory biosecurity assessment and monitoring checklist” (Table 1). This biosecurity checklist is an information-gathering tool for external assessments and is aimed to assist organizations that handle valuable biological materials (VBMs), to assess the aspects of biosecurity and laboratory capacity. Through this practical approach, laboratories can continuously monitor the biosecurity program efficiency and effectiveness. The identification of the biosecurity vulnerabilities within the organization also aids laboratories to determine and prioritize which biosecurity countermeasures are yet to be taken to strengthen their biosecurity management program. Having a comprehensive biosecurity management program in place could contribute to preventing potentials for accidental and deliberate releases of VBMs.

Table 1.

Biosecurity Checklist That Covers the 8 Priority Areas of Biosecurity.

Biosecurity Priority Area	Questions
Management	Does the management assign specific roles and responsibility as specified in the CEN Workshop Agreement 15793 document?
	Does the organization have a policy on biorisk management that has been developed, authorized, and signed by the organization’s senior management?
	Is the organization’s senior management actively involved in the policy on biosecurity?
	Is the policy on biosecurity revised, periodically, on the basis of experiences and risk assessments?
	Is dedicated budget or resources allocated for the management of biosecurity?
	Is the budget adequate to execute planned or projected activities, such as trainings on biosecurity?
	Does the organization have a system in place to monitor unauthorized personnel to allow them to conduct routine nonlaboratory functions?
	Does the organization have a system to conduct and review the biosecurity assessments?
	Has the organization assigned personnel to oversee the implementation of biosecurity measures?
	Does the organization conduct periodical risk assessments on dual-use and other technological advances (eg, CRISPR-Cas9)?
	Is adherence to the procedures and rules of conduct being monitored?
	Does the organization have an evaluated list of certified vendors and buyers for biological substances?
Biosecurity awareness	Does the organization have at least annual biosecurity awareness activities for all personnel working in laboratory?
	Does the organization have an entry-level biosecurity orientation program for new personnel, which emphasizes the 8 pillars of biosecurity, as well as their roles and responsibilities?
	Does the organization have a continuous training program planned for all personnel involved in implementing biosecurity, including response to biosecurity breach?
	Is dual-use (and other technology advances) awareness being incorporated in the training and awareness programs?
	Are personnel aware of reporting mechanism of any biosecurity breach and that the anonymity of whistleblower is protected?
	Does the institutional biosecurity program transcend through the organization, and is it run by knowledgeable personnel?
	Are personnel aware of the existence of response mechanism and their responsibilities in the event of any biosecurity breach?
	Are personnel aware of their responsibilities regarding biosecurity and how responsibilities are assigned?
Physical security	Do different areas of the facility have different levels of security?
	Does the management enforce an access control policy?
	Are the access controls monitored for each secured area?
	Is there an intrusion detection system to detect unauthorized entry to the facility and biological agents’ storage areas?
	Is there camera coverage for all exterior laboratory building entrances?
	Is an identification card or badge used to identify all personnel and visitors within the confines of the controlled areas?
	Is there a visitor escort procedure established for designated secured areas?
	Are the laboratory doors self-closing?
	Are locks and keys to all buildings and entrances supervised and controlled by a key control official?
	Are keys issued only to authorized personnel?
	Are valuable biological materials stored in secured locations?
	Is the entrance to the secured area, or storage location, secured by a combination of methods?
Accountability for materials	Does the organization have a policy on the inventory management of valuable biological materials?
	Does the organization have a policy on the transfer of valuable biological materials?
	Does the organization have biosecurity procedures in place to prevent deliberate dispersion of biological agents?
	Is there a person assigned who is responsible for the registration and the active management of VBM in order to safeguard the control of these materials?
	Does the organization maintain and update inventory records?
	Does the inventory system in the organization include detailed information regarding the location of the biological agents?
	Does the organization conduct periodic reviews of biological agents’ inventory?
	In the event of unusual or suspicious event, does the organization have a system that triggers investigation?
	Are there biohazard signage at the entrance of laboratories and storage spaces to indicate presence of biological agents without revealing the organisms?
	Are inventory storage locations minimized and adequate protection provided so that only authorized personnel have access?
	Are the valuable biological materials at the organization limited to a certain quantity?
Information security	Has the organization formulated and implemented a policy on information security?
	Does the organization use a classification system to determine sensitive information?
	Does the organization have policy and procedures on individual authorizations regarding access to sensitive or confidential information?
	Do all personnel know and understand the procedures regarding access to sensitive or confidential information?
	Has the organization assigned authorized personnel responsible for information security?
	Is sensitive or confidential information, including paper information, stored in a physically secured place?
	Are computers that store sensitive or confidential information password protected?
	Does the organization install relevant security software to the computers that store sensitive or confidential information?
	Is there an information backup system in place for sensitive or confidential information?
	Are there procedures on emergency response in the event of breach of information security?
	Has the organization implemented administrative control measures with regards to the exchange of sensitive information within and between different organizations?
Transport security	Are guidelines, SOPs, or working instructions related to transport of valuable biological materials available within and between different organizations?
	Are personnel responsible for transporting the valuable biological materials trained in specific requirements and procedures for the transport of these materials?
	Does the selected transport company comply with legislations?
	Does the organization have a preselection procedure for the transport companies they intend to use for transportation of the valuable biological materials?
	Does the organization enforce chain of custody?
	Is the track and trace system for the transportation of biological samples available?
	Is there a material transfer agreement between the organization and the sender/recipient of the valuable biological materials?
	Does the organization ensure that the recipient institution has the appropriate level of biorisk management to receive the sample?
	Does the organization conduct risk assessments for each transportation type used?
	Is the emergency response plan available for the possibility of packages being lost during transportation?
Personnel reliability	Does the organization have a personnel assessment in place?
	Are new recruits in the organization subjected to a formal background screening process, including credentials, skills, personnel traits, and relevant background check based on risk assessment?
	Are background checks conducted on existing personnel on a periodical basis?
	Were mental health assessments or psychological assessments conducted prior to employment or in interval time of employment?
	Does the organization have a policy and guideline on visiting personnel (students, contractors, visitors, clients, temporary workers, etc) regarding security clearance to access the facility?
	Does the organization have an up-to-date list of personnel with authorized access to the facility and biological agents?
	Does the organization have a policy and guideline in place for personnel to report or register unusual behavior in coworkers or visitors?
	Does the organization have a system in place in terms of assessment if existing personnel are transferred to areas where there may be an increased risk profile?
	Does the organization have a system in place for the removal and exclusion of personnel (both temporary and, if appropriate, permanent) from access to the facility or access to the biological agents where it deems necessary through risk assessment?
	Does the organization have SOPs or guidelines to monitor employees working outside regular hours?
Emergency response	Does the organization have an emergency response plan to effectively respond and control biological emergencies or a biosecurity breach?
	Does the emergency response plan contain tasks, responsibilities, and authorizations for response and recovery, including investigation of biological incidents or emergencies?
	Does the organization have a contingency plan in place to guarantee the continuation of day-to-day operations with a sufficiently high level of security?
	Does the organization have protocols with relevant third parties in the event of biological emergencies or biosecurity breach?
	Does the organization organize emergency drills or exercises that also look at biosecurity risks to determine that personnel can respond adequately to emergencies and other biosecurity situations according to plans or expectations?
	Does the organization establish procedures to correct situations where biosecurity is compromised?
	Does the organization establish preventive actions or revise procedures to make sure that situations where biosecurity was compromised will not recur?

Abbreviations: SOP, standard operating procedure; VBM, valuable biological material.

The checklist covers the 8 priority areas of biosecurity as previously set up by the Netherlands Biosecurity Office.^8,9,14 The biosecurity checklist is designed in the form of questionnaire covering the 8 focus areas of biosecurity to provide an indication of the current level of biosecurity of an organization. The checklist consists of a set of concrete questions per focus area and can be used by, for example, biosafety and biosecurity professionals. The intended user could answer the different questions with “yes,” “no,” or “in progress.” The latter option indicates that the respective laboratory is in the progress of addressing the specific biosecurity gap. Where any of the questions of this biosecurity checklist are not applicable due to the nature of the organization, that specific question could be considered for exclusion. In this case, the user can fill in “not applicable.” In addition, the questions taken up in the checklist can be accompanied with country-specific explanatory or background information to prevent misinterpretation. The questions that are included in the questionnaire are discussion points for the assessments and can be used as a template in the evaluation of any full assessment cycle. In addition, this biosecurity checklist is targeted on interagency assessments and monitoring and is therefore significantly different from, for example, the Dutch Self-Scan Toolkit. ⁸ This toolkit is aimed at self-assessments, provides guidelines, and can be used for training activities within an institute. Although the biosecurity checklist covers the same key areas, it is primarily targeted on external evaluations.

This biosecurity checklist could pave the way to identify and understand biosecurity aspects that constitute areas for improvement. The checklist is a concrete tool that can be incorporated in an organization’s laboratory biosecurity assessment cycle. Such an assessment is foreseen to be carried out by individuals who are familiar with biosafety and biosecurity practices and biorisk management. The intent of the biosecurity assessment is to enable discussions on best practices and recommendations on how to improve laboratory biosecurity performances. In addition, the outcome of the biosecurity checklist could aid in determining and prioritizing mitigating measures to reduce the risks to an acceptable and manageable level. This provides more insight into what mitigating measures are necessary as to maintain a workable balance between securing VBMs and preserving an environment that promotes fundamental research. The workable balance, and therefore the required level of security, is strongly dependent on the type of organization, the nature of the VBMs stored within the organization, and the research being conducted within that organization.

If the assessment is carried out on a voluntary basis, weak biosecurity performance could be used as a starting point for improvements, hopefully in a collaborative effort (eg, in a laboratory network) or jointly with the external assessor. However, this may vary per country. Different key factors are important to establish a successful institutional biorisk management program. Successful biosecurity programs largely rely on a commitment by the management, such as the allocation of resources and making sure that biosecurity measures are integrated throughout the organization. ⁷ In addition, another key factor to implement a successful biosecurity management system requires continuous improvement. ⁷ This indicates that the laboratory assessment can be part of a routine in which biosecurity performances are periodically monitored, opportunities for improvement are identified, and where root causes are determined to prevent recurrence.

Discussion

Laboratory biosecurity remains often an undervalued aspect in the field of biorisk management. With the development of the described biosecurity checklist for laboratory assessment and monitoring (Table 1), countries will be able to further strengthen their capacities in the area of biosecurity. As it is a practical tool, various laboratories, irrespective of their biosafety containment level or the type of work, can use this biosecurity checklist. Notably, the biosecurity checklist should be considered a living document, which means that the checklist should also be frequently reviewed after its implementation. Revisions, updates, and customization to national guidelines are strongly recommended as biosecurity involves challenges that are continuously changing and evolving, primarily due to newly emerging biological agents, bioterrorist threats, or cutting-edge technologies. Therefore, revisions should take place at a national level, through a cycle of planning, implementing, reviewing, and improving the biosecurity checklist, and should continue to take place at regular intervals for as long as the checklist exists. ⁷ Although the presented checklist has been used as a template for a dedicated Malaysia checklist, it can also serve as a template for other countries.

One of the most important elements for successful implementation of biosecurity initiatives partially depends on the biosecurity culture, meaning a scientific community that has a proper understanding of the essence and importance of biosecurity, as well as a community that shows commitment to address biosecurity issues. ¹² With the development of this biosecurity checklist, Malaysia has taken an important step toward its obligations to the BWC. This biosecurity checklist is intended for all laboratories that pursue to improve their current level of biosecurity and to identify gaps in their existing biosecurity program. Malaysia is faced with a new challenge to raise more awareness concerning the newly developed laboratory biosecurity checklist, thereby having institutions to understand what biosecurity risks are involved in their work, as well as to make them understand why certain control measures are necessary. After all, this biosecurity checklist is about a common interest in preventing security breaches, biological warfare and bioterrorism, and the exploitation of legitimate science. As an initial step toward establishing a comprehensive biosecurity oversight system, Malaysia anticipates introducing a peer review system in which external experts from a respective laboratory will carry out a biosecurity assessment within another laboratory, thereby using the developed checklist. The external assessor could act as a partner that can help and advise the facility on how to enhance laboratory biosecurity. This requires a safe and trustful environment where both facilities share biosecurity knowledge and issues in an open and friendly manner and where solutions to address these issues are sought. The biosecurity checklist could, in this case, be used as a guidance document to encourage an open dialogue between the external assessor and the respective laboratory.

Conclusion

Here, we describe the development process of a biosecurity checklist for laboratory assessments and monitoring in support of the Biological Weapons Convention. In addition, we displayed a generic biosecurity checklist that could either be directly adapted or be further tailored according to the country-specific needs. This biosecurity checklist provides a practical and universal approach for laboratories that pursue to improve their current level of biosecurity within the organization, to create awareness among all stakeholders within the organization, and to provide solutions to improve the weakest organizational biosecurity performances. In this way, countries can address their laboratory safety and security posture to establish stronger biosecurity systems to detect and prevent the deliberate release of biological events.