§ 331.7 - Registration and related security risk assessments.

§ 331.7 Registration and related security risk assessments.

(a) Unless exempted under § 331.5, an individual or entity shall not possess, use, or transfer any select agent or toxin without a certificate of registration issued by the Administrator.

(b) As a condition of registration, each entity is required to be in compliance with the requirements of this part for select agents and toxins listed on the registration regardless of whether the entity is in actual possession of the select agent or toxin. With regard to toxins, the entity registered for possession, use, or transfer of a toxin must be in compliance with the requirements of this part regardless of the amount of toxins currently in its possession.

(c) As a condition of registration, each entity must designate an individual to be its responsible official. While most registrants are likely to be entities, in the event that an individual applies for and is granted a certificate of registration, the individual will be considered the responsible official.

(d)

(1) As a condition of registration, the following must be approved by the Administrator or the HHS Secretary based on a security risk assessment by the Attorney General:

(i) The individual or entity;

(ii) The responsible official; and

(iii) Unless otherwise exempted under this section, any individual who owns or controls the entity.

(2) Federal, State, or local governmental agencies, including public accredited academic institutions, are exempt from the security risk assessments for the entity and the individual who owns or controls such entity.

(3) An individual will be deemed to own or control an entity under the following conditions:^[1] />

(i) For a private institution of higher education, an individual will be deemed to own or control the entity if the individual is in a managerial or executive capacity with regard to the entity's select agents or toxins or with regard to the individuals with access to the select agents or toxins possessed, used, or transferred by the entity.

(ii) For entities other than institutions of higher education, an individual will be deemed to own or control the entity if the individual:

(A) Owns 50 percent or more of the entity, or is a holder or owner of 50 percent or more of its voting stock; or

(B) Is in a managerial or executive capacity with regard to the entity's select agents or toxins or with regard to the individuals with access to the select agents or toxins possessed, used, or transferred by the entity.

(4) An entity will be considered to be an institution of higher education if it is an institution of higher education as defined in section 101(a) of the Higher Education Act of 1965 (20 U.S.C. 1001(a)), or is an organization described in 501(c)(3) of the Internal Revenue Code of 1986, as amended (26 U.S.C. 501(c)(3)).

(5) To obtain a security risk assessment, an individual or entity must submit the information necessary to conduct a security risk assessment to the Attorney General.

(e) To apply for a certificate of registration for only PPQ select agents or toxins, or for PPQ and VS select agents or toxins, an individual or entity must submit the information requested in the registration application package (APHIS/CDC Form 1) to APHIS. To apply for a certificate of registration for overlap select agents or toxins, overlap select agents or toxins and any combination of PPQ or VS select agents or toxins, or HHS select agents or toxins and any combination of PPQ or VS select agents or toxins, an individual or entity must submit the information requested in the registration application package (APHIS/CDC Form 1) to APHIS or CDC, but not both.

(f) Prior to the issuance of a certificate of registration, the responsible official must promptly provide notification of any changes to the application for registration by submitting the relevant page(s) of the registration application.

(g) The issuance of a certificate of registration may be contingent upon inspection or submission of additional information, such as the security plan, biosafety plan, incident response plan, or any other documents required to be prepared under this part.

(h) A certificate of registration will be valid for one physical location (a room, a building, or a group of buildings) where the responsible official will be able to perform the responsibilities required in this part, for specific select agents or toxins, and for specific activities.

(i) A certificate of registration may be amended to reflect changes in circumstances (e.g., replacement of the responsible official or other personnel changes, changes in ownership or control of the entity, changes in the activities involving any select agents or toxins, or the addition or removal of select agents or toxins).

(1) Prior to any change, the responsible official must apply for an amendment to a certificate of registration by submitting the relevant page(s) of the registration application.^[2] />

(2) The responsible official will be notified in writing if an application to amend a certificate of registration has been approved. Approval of an amendment may be contingent upon an inspection or submission of additional information, such as the security plan, biosafety plan, incident response plan, or any other documents required to be prepared under this part.

(3) No change may be made without such approval.

(j) An entity must immediately notify APHIS or CDC if it loses the services of its responsible official. In the event that an entity loses the services of its responsible official, an entity may continue to possess or use select agents or toxins only if it appoints as the responsible official another individual who has been approved by the Administrator or the HHS Secretary following a security risk assessment by the Attorney General and who meets the requirements of this part.

(k) A certificate of registration will be terminated upon the written request of the entity if the entity no longer possesses or uses any select agents or toxins and no longer wishes to be registered.

(l) A certificate of registration will be valid for a maximum of 3 years.

[70 FR 13278, Mar. 18, 2005, as amended at 82 FR 6205, Jan. 19, 2017]

Footnotes - 331.7

^[1] These conditions may apply to more than one individual.

^[2] Depending on the change, a security risk assessment by the Attorney General may also be required (e.g., replacement of the responsible official, changes in ownership or control of the entity, new researchers or graduate students, etc.).