2023-22540. Screening Framework Guidance for Providers and Users of Synthetic Nucleic Acids

AGENCY:

Administration for Strategic Preparedness and Response (ASPR), Department of Health and Human Services (HHS).

ACTION:

Notice.

SUMMARY:

The Administration for Strategic Preparedness and Response is issuing this screening framework guidance, which sets forth baseline standards for the gene and genome synthesis industry, as well as best practices for all entities involved in the provision, use, and transfer of synthetic nucleic acids, regarding screening orders and recipients and maintaining records. In addition, this guidance seeks to encourage best practices to address biosecurity concerns associated with the potential misuse of synthetic nucleic acids in order to bypass existing regulatory controls and commit unlawful acts.

FOR FURTHER INFORMATION CONTACT:

C. Matthew Sharkey, Administration for Strategic Preparedness and Response, Department of Health and Human Services, 400 7th St. SW, Washington, DC 20024; 202–868–9224, [e-mail].

SUPPLEMENTARY INFORMATION:

A request for public comments on the issues covered in this Notice was published in the Federal Register (85 FR 52611 [Aug. 26, 2020]; 85 FR 69630 [Nov. 3, 2020], Review and Revision of the Screening Framework Guidance for Providers of Synthetic Double-Stranded DNA) with a comment period of more than 120 days. Following consideration of the comments received in response to this Notice, HHS issued proposed draft revised guidance as a Federal Register Notice (87 FR 25495 [Apr. 29, 2022], Screening Framework Guidance for Providers and Users of Synthetic Oligonucleotides) and solicited additional comments for a period of 60 days. This Guidance was drafted through a deliberative interagency process to address the topics raised in public comments received in response to these prior Notices as well as other considerations. Responses received from these prior Notices and summaries of updates contained in this Guidance are available for public review at the following website https://aspr.hhs.gov/​legal/​synna.

Screening Framework Guidance for Providers and Users of Synthetic Nucleic Acids

I. Introduction

Synthetic biology is an interdisciplinary field that focuses on the design and fabrication of novel biological components and systems as well as the redesign and fabrication of existing biological systems. Modern biotechnologies have made the conversion of different types of nucleic acids possible ( e.g., RNA to DNA), and longer genomic sequences can now be constructed from very short nucleic acids with higher fidelity. Additionally, synthetic biology is not limited to naturally derived genetic material. Thus, this scientific field has the potential to generate existing or novel components, systems, or organisms directly, using only genetic sequence data.

Advances in nucleic acid synthesis technology and the open-source availability of genetic sequence data have significantly contributed to discovery and innovation in areas such as health and agriculture research and development. However, there are concerns among the scientific community, the nucleic acid synthesis industry, the U.S. government, and the public that individuals with ill intent could exploit biotechnology for harmful purposes. The U.S. government has acted to minimize risks to public health, agriculture, plants, animals, animal or plant products, and the environment due to biological pathogens and toxins. For instance, it has issued the Federal Select Agent Regulations, which regulate a subset of microbial organisms and toxins determined to have the potential to pose a severe threat to public health and safety, animal health, plant health, animal or plant products, or the environment. These regulations are administered jointly by the CDC, Division of Select Agents and Toxins and the Animal and Plant Health Inspection Service, Division of Agricultural Select Agents and Toxins, through the Federal Select Agent Program (FSAP),^[1] which sets forth requirements for the possession, use, and transfer of biological select agents and toxins. A second layer of regulation is provided by the Bureau of Industry and Security (BIS) Export Administration Regulations' Commerce Control List (CCL),^[2] which identifies agents and genetic sequences that require licenses before export from the United States. However, these regulated pathogens and toxins do not represent the entirety of the potential risks to public health, agriculture, plants, animals, animal or plant products, or the environment that could arise from the misuse of synthetic nucleic acids. Non-regulated pathogens and toxins, as well as other novel types of nucleic acid sequences, may also pose significant risks if they are misused. To minimize these risks, a shift is needed from relying solely on lists of regulated pathogens and toxins to also assessing the risks associated with other nucleic acid sequences that may contribute to pathogenicity or harm if introduced into new genetic frameworks ( i.e., Sequences of Concern [SOCs]). Also, modern molecular biological techniques allow the conversion between different types of nucleic acids ( e.g., RNA to DNA, and vice versa), so it has become necessary to treat all types of synthetic genetic materials with equal care. Additionally, benchtop nucleic acid synthesis equipment is increasingly common in modern laboratories, which changes the commercial landscape for synthetic nucleic acids. These advances and others motivated the U.S. government to review and revise the 2010 Screening Framework Guidance for Providers of Synthetic Double-Stranded DNA.^[3]

Individuals with no legitimate, bona fide, and peaceful purpose should be prevented from accessing genetic materials that could contribute to pathogenicity or toxicity, even when those materials do not contain sequences from FSAP- or CCL-listed pathogens or toxins, and nucleic acid synthesis equipment. Purchasing or synthesizing nucleic acids could enable individuals without a legitimate and peaceful purpose to possess genetic material that would pose risks if misused. Synthetic nucleic acids ordered from Providers can be used to synthesize pathogens de novo or may be used to modify non-pathogenic strains or create higher risk pathogens or toxins. Nucleic acid synthesis has removed the need to directly access the naturally occurring agents or naturally occurring genetic material from these agents for those who may wish to do harm with them. The potential availability of high-risk agents has thereby been greatly expanded due to this changing commercial landscape. The Screening Framework Guidance for Providers and Users of Synthetic Nucleic Acids ( Guidance) reaffirms the recommendation to screen for genetic sequences from regulated organisms and toxins but also recognizes that screening should evolve to encompass all sequences that are recognized to contribute to pathogenicity or toxicity as information regarding these sequences and their verified functions and improved screening methods become available (or as feasible).

This Guidance is intended to assist all entities involved in the provision and use of synthetic nucleic acids in establishing and operating a screening framework for synthetic nucleic acid orders, including mechanisms to identify sequences designed to circumvent lists of regulated organisms or toxins or sequences that are not Best Matches to any sequences in GenBank.^[4] This Guidance sets forth recommended baseline standards for the nucleic acid synthesis industry (Providers) and for Manufacturers of benchtop nucleic acid synthesis devices, as well as best practices for Customers of synthetic nucleic acids ( i.e., institutions, Principal Users, End Users, and Third-Party Vendors) regarding screening orders for SOCs. In addition, this Guidance seeks to encourage best practices to address biosecurity concerns associated with the potential misuse of synthetic nucleic acids to bypass existing regulatory controls.

This Guidance recommends that (1) upon receiving an order for synthetic nucleic acids, Providers and Third-Party Vendors perform sequence screening, verify the identity of their Customers, and follow up to verify the legitimacy of the order when SOCs are identified; (2) institutions, Third-Party Vendors, Principal Users, and End Users keep records of synthetic nucleic acid orders containing SOCs; (3) institutions and/or Principal Users record any transfers involving synthetic nucleic acids containing SOCs beyond the Principal User and manage those transfers responsibly to limit the possibility of misuse; and (4) Manufacturers only distribute equipment capable of synthesizing nucleic acids containing SOCs to Customers whose legitimacy has been verified and implement mechanisms to track legitimate use of their equipment.

If sequence screening identifies SOCs, Providers should perform further validation steps and follow-up screening of the Customer to verify the legitimacy of the order. Open communication between Customers and Providers will facilitate the screening and validation of orders that contain SOCs. Institutions, Principal Users, or End Users are best positioned to know if they are ordering SOCs and are encouraged to provide information with their order to preemptively demonstrate legitimacy of the order when they are aware that it contains SOCs. Providers can facilitate this information-sharing by including a mechanism for self-reporting and verification of legitimacy in their ordering process. If follow-up screening does not resolve concerns about the order, or if there is reason to believe a customer may intentionally or inadvertently violate U.S. laws or regulations, Providers should not fulfill the order and should contact designated entities within the U.S. government ( i.e., U.S. Department of Commerce, Federal Bureau of Investigation [FBI]) for further information and assistance.

This Guidance also provides recommendations regarding proper records retention protocols and sequence screening methodologies. Additionally, this Guidance recommends that institutions, Principal Users, and End Users develop and follow best practices in biosafety, biosecurity, and responsible conduct regarding the possession, use, and transfer of SOCs. Institutional policies and procedures already in place for safe possession, use, and transfer of these materials, as well as federal and international guidance, such as HHS's Centers for Disease Control and Prevention (CDC) and National Institutes of Health's Biosafety in Microbiological & Biomedical Laboratories (BMBL),^[5] the World Health Organization's Laboratory Biosafety Manual,^[6] and Global Guidance Framework for the Responsible Use of the Life Sciences: Mitigating Biorisks and Governing Dual-Use Research  ^[7] should be used wherever possible to complement the measures suggested in this Guidance to maximize safe and secure practices while seeking to minimize the burden on legitimate life science research.

II. Definitions

The following definitions are applicable for the purpose of this Guidance:

Customer: The individual or entity (such as an institution) that orders or requests synthetic nucleic acids from a Provider, or that purchases synthesis equipment from a Manufacturer.

Principal User: The individual who originates an order or request for synthetic nucleic acids or synthesizes nucleic acids and oversees the use of ordered or synthesized nucleic acids in the laboratory. The Principal User may also be the End User.

End User: The individual who possesses and uses synthetic nucleic acids that they have received from a Customer, Principal User, or another End User.

Provider: The entity that synthesizes and distributes synthetic nucleic acids to a customer. A Provider is understood to be synthesizing nucleic acids as a transactional service, rather than a research scientist collaborating with a colleague (for such transfers between collaborators, see End User in this section of the Guidance).

Third-Party Vendor: An entity that orders synthetic nucleic acids from Providers and sells them or their constructs, with or without reformulation, or resells benchtop equipment for synthesizing nucleic acids.

Manufacturer: An entity that produces and sells benchtop equipment for synthesizing nucleic acids. Manufacturers may provide equipment to individuals, entities, Principal Users, or Third-Party Vendors.

Sequence of Concern (SOC): A nucleotide sequence that is a Best Match (see the SEQUENCE SCREENING METHODOLOGY section of this Guidance) to a sequence of federally regulated agents ( i.e., the Biological Select Agents and Toxins List, or the CCL), except when the sequence is also found in an unregulated organism or toxin. As soon as it is practical to do so, it is also recommended that sequences known to contribute to pathogenicity or toxicity, even when not derived from or encoding regulated biological agents, be treated as SOCs.^[8] Follow-up customer screening to verify legitimacy should take place when a SOC is identified (see Verifying Legitimacy in this section of the Guidance ).^[9]

Synthetic Nucleic Acids Subject to Screening: At a minimum, DNA or RNA, single- or double-stranded, 200 nucleotides (nt) or longer should be screened for SOCs. This Guidance recommends that this length for screening be decreased to 50 nt within three years of the issuance of the Guidance, and that all entities consider the potential for shorter nucleotides to be assembled into SOCs when multiple synthetic nucleic acids are ordered by the same Customer in a bulk order or for multiple orders over time (see the SEQUENCE SCREENING METHODOLOGY section of this Guidance).

Benchtop Nucleic Acid Synthesis Equipment: Benchtop nucleic acid synthesis equipment sold by Manufacturers that is intended to be used to synthesize nucleic acids for use within a research laboratory or within an institution. While this nucleic acid synthesis equipment may not be small enough to be placed on a benchtop ( e.g., it sits on the laboratory floor), it is still considered benchtop equipment if it is sold with the intent that it will be used by researchers individually or in a core facility in an institution.

Verifying Legitimacy: Review of information that would allow Providers, Manufacturers, Principal Users, or End Users to authenticate the recipient of synthetic nucleic acids containing SOCs or benchtop nucleic acid synthesis equipment as a legitimate member of the scientific community. Information such as proposed end-use of the order, institutional or corporate affiliation (if applicable), the name of a biosafety officer (if available), documentation of internal review and approval of the research, evidence provided by the recipient's Responsible Official that the recipient is registered with FSAP ^[1] or Statement by Ultimate Consignee and Purchaser ( i.e., a completed BIS–711 form ^[10] ) (if applicable), or other evidence of a legitimate research or training program ( e.g., publication history, researcher persistent identifiers such as Open Researcher and Contributor Identifier [ORCID],^[11] business licenses, grant numbers, research plan) or other legitimate use ( e.g., diagnostic test development or manufacture) may be helpful for such verification. In Verifying Legitimacy, providers should avoid the violation of personal privacy. Providers should focus on professional not personal information, except for personal information that is necessary to establish a unique individual user identity to authenticate each recipient.

III. Goals and Scope of the Guidance

Goals: This Guidance has three parallel goals. A primary goal is to minimize the risk that individuals without a legitimate need or individuals with malicious intent will use nucleic acid synthesis technologies to obtain organisms for which possession, use, and transfer is regulated by FSAP and CCL.^1 2 Another goal is to limit the potential for individuals with malicious intent to use synthetic nucleic acids to create high-risk pathogens or toxins using nucleic acid sequences from unregulated organisms. A third goal is to minimize disruption of legitimate research, commerce, and educational activities.

Scope: The Guidance pertains to the sale or transfer of all types of synthetic nucleic acids, i.e., DNA and RNA, whether single- or double-stranded. The Guidance recommends that Providers develop and/or consult a database of known SOCs to determine if the purchase or transfer includes SOCs. It also recommends methods that aim to ensure the legitimacy of Customers, Principal Users, and End Users of synthetic nucleic acids. The Guidance also aims to ensure that entities maintain records of transfers for synthetic nucleic acids containing SOCs.

The Guidance was developed to align with Providers' and Customers' existing protocols and business practices, to be implemented without unnecessary cost, and to minimize any negative impacts on the conduct of research and business operations. Where practical to do so, entities can use existing business practices to verify the legitimacy of Principal Users and End Users and to track the transfer of materials containing SOCs. Many Providers have already instituted measures to address these concerns. The ongoing development of best practices in this area is commendable and encouraged, particularly considering the continued advances in nucleic acid sequencing and synthesis technologies.

IV. Recommendations for Providers, Users, Institutions, and Manufacturers

This Guidance encourages the establishment of mechanisms that aim to ensure that Customers, Principal Users, and End Users ordering SOCs are legitimate. It also recommends that Manufacturers install safeguards in nucleic acid synthesis equipment that aim to ensure only legitimate Customers can synthesize SOCs. This Guidance encourages entities transferring synthetic nucleic acids containing SOCs ( i.e., the Third-Party Vendor, Principal User, End User, or institution) to know to whom they are transferring and to conduct screening to verify that the recipients have a legitimate, bona fide, and peaceful purpose to use the synthetic nucleic acids. This Guidance recommends that the Customers who place these orders use responsible business practices to maintain records of transfers.

Principal Users and End Users are best positioned to understand the nature of their synthetic nucleic acids and oversee and shepherd their responsible use. Principal Users and End Users may also transfer these synthetic nucleic acids to other End Users, such as colleagues, and certain recommendations are made for this case in this Guidance. Principal Users and End Users are encouraged to streamline the screening of their synthetic nucleic acid orders by providing verification of their legitimacy to Providers and Third-Party Vendors, if they know that their order contains SOCs.

Information described in the Verifying Legitimacy definition will be helpful to the Provider or Third-Party Vendor of the synthetic nucleic acids in Verifying Legitimacy. Preemptively providing this information is likely to limit the time and expense for Providers in fulfilling these orders in a manner that ensures safety and security.

Providers and Third-Party Vendors of synthetic nucleic acids are encouraged to do the following in this context:

• Know and document to whom they are distributing a product.
• Know if the product that they are synthesizing and/or distributing contains identified SOCs.
• Notify Customers and Principal Users when their order contains SOCs.

• Implement adequate security and cybersecurity measures to protect the intellectual property and identity of Customers.^[12]

• Do not fulfill the order and report an order to the FBI when follow-up screening does not resolve concerns.

• Archive the following information for orders containing SOCs for at least three years: Customer information (point-of-contact name, organization, address, email, and phone number), order sequence information (nucleotide sequences ordered, vector used), and order information (date placed and shipped, shipping address, receiver name). Archive this information for longer ( e.g., eight years) if it does not pose an undue burden on business operations.

Customers, Principal Users, and End Users of synthetic nucleic acids are encouraged to develop best practices in five main areas in this context:

• Customers, Principal Users, and End Users who know that their synthetic nucleic acid order contains SOCs are encouraged to preemptively provide information that will assist the Provider or Third-Party Vendor in verifying their legitimacy.
• Customers, Principal Users, and End Users are encouraged to only transfer synthetic nucleic acids containing SOCs to verified individuals with a legitimate use for these synthetic nucleic acids.
• Customers, Principal Users, and End Users are also encouraged to maintain records of these transfers and to communicate them to their biosafety officer, or equivalent, using the responsible business practices in place in their organizations.

• Principal Users and End Users are encouraged to record transfers of synthetic nucleic acids containing SOCs to any other individuals not listed in the original order through a Material Transfer Agreement (MTA), a contract that governs the transfer of materials between entities for use in research, or another sample tracking process. Principal Users, End Users, and institutions are encouraged to retain records of SOC transfers for at least three years, or longer ( e.g., eight years) if it does not pose an undue burden on their operations. Business practices already in place at institutions may be used to fulfill this recommendation.

• Institutions with in-house nucleic acid synthesis capabilities, including synthesis equipment, are also encouraged to apply these recommendations for use or transfers of synthetic nucleic acids containing SOCs.

Manufacturers of benchtop nucleic acid synthesis equipment, Customers using the equipment, and institutions where the equipment is used are encouraged to consider these areas for developing best practices:

• Manufacturers should screen all Customers purchasing benchtop nucleic acid synthesizers to validate customer legitimacy and that the equipment is appropriate for their needs. Manufacturers should only provide nucleic acid synthesizers to Customers that have mechanisms in place that aim to ensure that the devices are only operated by legitimate users.

• Institutions should aim to ensure, as soon as it is possible to do so, that benchtop nucleic acid synthesizers—including those that were acquired prior to this Guidance —are only accessed by users with a legitimate need, such as through validated user accounts. If this equipment is housed in a core facility for an institution, or in other cases when the equipment is being operated by an authorized user on the behalf of another individual, then the institution should aim to ensure that the legitimacy of the individual receiving any synthetic nucleic acids containing SOCs from the authorized user or core facility is also verified. If misuse or unauthorized access to benchtop nucleic acid synthesizers with the intent of obtaining SOCs is suspected, institutions should notify their FBI Field Office Weapons of Mass Destruction (WMD) Coordinator.

• Manufacturers whose benchtop nucleic acid synthesizers require the use of proprietary and sole-use reagents ( i.e., reagents that can only be obtained from the manufacturer of their devices and do not have common applications other than the operation of their devices) should screen Customers purchasing those reagents to verify their legitimacy, even when they were not screened when obtaining their nucleic acid synthesizer ( i.e., when they acquired their device prior to the issuance of this Guidance).

• Manufacturers and their Customers should implement mechanisms to track legitimate use of their equipment, including when it is potentially transferred to a new Principal User or End User during the lifecycle of these equipment (see the definition of Verifying Legitimacy for criteria to verify the legitimacy of a User). Manufacturers may use methods not prescribed within this Guidance to achieve this recommendation, such as by having a closed loop system in which operation of their devices relies upon obtaining reagents only available from the Manufacturers (who establish the legitimacy of Customers whenever they obtain these reagents), asking Customers to report the transfer of their benchtop synthesizers to new users, or requiring new user accounts to be verified by the Manufacturer as legitimate.

• Manufacturers should integrate into benchtop nucleic acid synthesizers the capability to screen sequences for SOCs and to authenticate legitimate users. This level of screening should be on par with the SOC screening best practices recommended for Providers in this Guidance, including screening against SOC databases, when available, that are updated regularly as new SOCs are identified as a required step before synthesizing the sequence, in a verifiable manner.^[13] Manufacturers should implement this recommendation using measures that ensure cybersecurity considerations are addressed to guard against malign use and to protect both the intellectual property and identity of users.^[14]

• Manufacturers should not store databases of SOCs that include sequences from unregulated pathogens or toxins on the device itself in an unencrypted manner or a manner that could allow users to extract the database. The aggregation of all sequences that contribute to pathogenicity or toxicity poses a biosecurity risk that may endanger public health, agriculture, plants, animals, animal or plant products, or the environment if disclosed to entities or individuals with malintent.

• Manufacturers should consider using cryptographic methods of screening that protect the contents of the order from disclosure.
• Manufacturers are encouraged to include mechanisms to ensure the integrity of the synthesis process to prevent circumvention of the SOC screening methodology through physical or logical manipulation of the devices or reagents.
• Manufacturers are also encouraged to include a data logging function to maintain a record of the nucleic acids synthesized on their equipment.
• Manufacturers are encouraged to formulate a reference architecture prescribing guidance for the secure implementation, configuration, and operation of devices.

V. Sequence Screening Methodology

Providers should screen orders to determine whether they contain SOCs. Appropriate sequence screening software should be selected by Providers of synthetic nucleic acids. This Guidance recommends that Providers use either Best Match with a local sequence alignment technique (such as the Basic Local Alignment Search Tool [BLAST] family of tools ^[15] ) or another screening approach that they assess to be equivalent or superior to the Best Match approach. Providers are encouraged to determine whether synthetic nucleic acid orders contain sequences that are Best Matches over the appropriate windows to any SOC. By using the Best Match approach, the sequence with the greatest percent identity over each 66 amino acid or 200 nt window (or within three years of the publication of this Guidance, over each 16 amino acid or 50 nt window), in all six reading frames, should be considered the Best Match, regardless of the statistical significance or percent identity. The Best Match approach is intended to minimize the number of sequence hits due to sequences that are shared among both SOCs and non-SOCs.

Some synthetic nucleic acid orders may be appropriate for screening even if all components of the order are nucleic acids shorter than the screening window length. In some cases, orders of short nucleic acids may be intended to construct longer nucleic acids that themselves may constitute SOCs. To minimize the risk of this scenario, this Guidance encourages screening all sequences ordered by an individual customer, using a short sequence alignment software package. If the resulting ungapped alignment of any constituents of a customer's order is a Best Match to any SOC, and if these sequences are constructed to allow their ligation to form these SOCs ( i.e., overlaps are present to support the construction of a larger nucleic acid, which itself is a SOC), Providers should consider those orders as containing SOCs and perform standard follow-up Customer screening to establish legitimacy (see Verifying Legitimacy in the DEFINITIONS section of the Guidance).

These sequence screening recommendations do not preclude the use by Providers of a curated database of sequences that may directly contribute to pathogenicity or toxicity to identify SOCs. This Guidance recognizes that a database of known sequences that contribute to pathogenicity and toxicity in humans, animals, and plants, and that have a direct and harmful impact on a host, may not yet exist or may not yet be fully developed and encourages industry consortia and/or any other interested parties in the continued development of such a database for screening SOCs—provided that measures are taken to prevent such a database from being misused. These measures should include establishing a security office, security protocols, and a personnel reliability program—based on a risk assessment—to guide selection, implementation, and monitoring of cybersecurity and information security capabilities and protection. These measures should aim to ensure database confidentiality and integrity (including user access controls and sequence encryption, both in transit and at rest) and compliance with applicable laws such that data on SOCs are protected against unauthorized access, exfiltration, or other use. Providers may also choose to use other screening approaches that they assess to be equivalent or superior to the Best Match approach or supplement it, including a customized database or approaches that evaluate the biological risk associated with sequences from unregulated agents ( i.e., not FSAP- or CCL-listed pathogens or toxins). This Guidance encourages the continued development of best practices to address risks associated with nucleic acid synthesis technologies.

Providers, Third-Party Vendors, and professional consortia are encouraged to develop secure mechanisms—designed to respect privacy, security, commercial, intellectual property, and other concerns—to detect SOCs that may be broken up among multiple Providers or Vendors, or among multiple orders at a single Provider or Vendor over a period of time, to evade screening.

In addition, Providers may wish to consider developing solutions for determining which sequences from pathogens should not cause concern ( i.e., pass list of genes that pose no pathogenic or toxicity risk).

VI. Customer Screening

In addition to verifying the Customer identity for all orders, Verifying Legitimacy of Customers and Users is recommended when orders contain SOCs, and for orders of nucleic acid synthesis equipment. Customers and Users are encouraged to streamline the Customer screening process by providing verification of their legitimacy when submitting an order containing SOCs. Information described in the definition of Verifying Legitimacy may be helpful for such verification (See also Red Flags for Verifying Legitimacy in the Companion Guide to Assist in Implementing the Recommendations of the Screening Framework Guidance for Providers and Users of Synthetic Nucleic Acids).

This Guidance encourages Customers and Principal Users to also Verify Legitimacy of End Users receiving SOCs. Records of such verification and transfer can be created and maintained by using business practices that document such transfers ( e.g., MTAs). The Principal User is best positioned to determine the legitimacy of any End User to whom SOCs are transferred. Keeping a record of such transfers should not cause undue burden on the essential research carried out across the biotechnology enterprise and may therefore entail only a minor adaptation of responsible business practices already in place. This Guidance does not include recommendations for reporting transfers to new End Users back to the original Provider. It would be sufficient for each Principal User or End User transferring the materials to verify the legitimacy of the recipient during each transfer and for all parties to retain a record of it for at least three years, and longer ( e.g., eight years) if this does not pose an undue burden on their operations.

Providers should be aware of regulatory and statutory prohibitions related to U.S. persons dealing with certain foreign persons, entities, and companies. Providers are encouraged to check the Customer against the International Trade Administration consolidated list of individuals and entities for which the U.S. government maintains restrictions on certain exports, re-exports, or transfers of items.^[16] In the event that a company, entity, or person on the list appears to match that of a customer or other recipient, additional due diligence should be conducted before proceeding. There may be a strict export prohibition, a requirement for seeking a license application, or other evaluation of the Customer or other recipient necessary to ensure it does not result in an activity prohibited by any U.S. export regulations, or other restrictions. Before fulfilling the order, to ensure full compliance with all the terms and conditions of the restrictions placed on the parties on this list, the Provider must check the official publication of restricted parties in the Federal Register .

VII. Following Up With the U.S. Government in Cases Where Malintent is Suspected by Providers, Third-Party Vendors, or Manufacturers

If sequence or Customer screening raises concerns that are not alleviated through follow-up screening, Providers, Third-Party Vendors, and Manufacturers should not fulfill the order and are strongly encouraged to contact their nearest FBI Field Office's WMD Coordinator. Institutions are encouraged to work with their Principal Users and End Users to help them understand that only individuals with legitimate, bona fide, and peaceful purpose should obtain synthetic nucleic acids containing SOCs.

VIII. Records Retention

The Guidance recommends that Providers, Third-Party Vendors, and Manufacturers retain the following types of records for at least three years, and longer ( e.g., eight years) if this does not pose an undue burden on their operations:

• Records of Customer orders including the following information: Customer information (point-of contact name, organization, address, email, and phone number), order sequence information (nucleotide sequences ordered, vector used), and order information (date placed and shipped, shipping address, receiver name);
• Records of protocols for sequence screening and for determining whether a sequence hit qualifies as a SOC;
• Records of screening documentation of all hits, even if the order was deemed acceptable;
• Records of any follow-up screening, even if the order was ultimately filled; and
• The ultimate disposition of any SOC orders, with documentation of reasoning for final decision (fulfill versus deny).

IX. Periodic Review, Evaluation, and Improvement of This Guidance

This Guidance addresses biosecurity risks that have emerged in a dynamic and rapidly developing technological landscape. It is likely that new risks will emerge and that new technological approaches will also appear to address them. As such, this Guidance encourages the further development of mechanisms to detect SOCs and screening strategies for sequences that contribute directly to pathogenicity and toxicity. For instance, strategies may be used by malicious Customers to obfuscate SOCs, including engineering pathogenic or toxic proteins with completely novel sequences. In such cases, synthetic nucleic acid orders may contain 50 nt windows that are not a match to any known sequence. Although there are likely legitimate explanations for orders of sequences with no matches in existing databases ( e.g., nucleic acids ordered to populate microarrays or to store digital information), in such cases, it may be possible to use predictive bioinformatic algorithms to screen sequences that are not a match to any known sequences to determine if they could produce proteins that are structurally and functionally identical to SOCs. This Guidance encourages Providers to continue to develop these methods to best ensure the safety and security of the synthetic nucleic acid research enterprise.

This Guidance will be periodically revisited, including by soliciting stakeholder input, and feedback is encouraged from the nucleic acid synthesis industry as well as from their customers as they implement the Guidance. Furthermore, implementation of this Guidance will be supported through the publication of a Companion Guide.

Dawn O'Connell,

Assistant Secretary for Preparedness and Response.

Footnotes

1.   https://www.selectagents.gov/​sat/​list.htm.

2.   https://www.bis.doc.gov/​index.php/​regulations/​commerce-control-list-ccl.

3.  75 FR 62820 (Oct. 13, 2010).

4.   https://www.ncbi.nlm.nih.gov/​genbank/​.

5.   https://www.cdc.gov/​labs/​BMBL.html.

6.   https://www.who.int/​publications/​i/​item/​9789240011311.

7.   https://www.who.int/​publications/​i/​item/​9789240056107.

8.  Pathogenicity or toxicity that threatens public health, agriculture, plants, animals, animal or plant products, or the environment. SOCs include sequences for which a direct and harmful impact on a host has been verified based on published experimental data; and, where experimental data do not exist, based on homology to a sequence encoding a verified function.

9.  Organizations should define and document their criteria for determining whether a sequence is of concern. In order to ensure compliance with the FSAP and CCL regulations, sequences of concern should include sequences derived from their listed agents—except when they are also found in unregulated agents.

10.   https://www.bis.doc.gov/​index.php/​documents/​just-licensing-forms/​803-bis-711-statement-by-ultimate-consignee-and-purchaser-1/​file.

11.  Open Researcher and Contributor Identifier ( https://orcid.org/​).

12.  Providers and Third-Party Vendors are encouraged to follow the ISA/IEC 27032:2012 & ISO/IEC 62443 standards for cybersecurity and information security.

13.  Here, verifiability means the ability to confirm that: every prospective sequence has been screened for SOCs against an up-to-date database, and screening is up to date and performant; when users input sequences of concern, this is flagged and reported in real time; and attempts to tamper with the device to avoid screening are flagged and reported in real time.

14.  Manufacturers are encouraged to follow the ISO/IEC 27032:2012 & ISO ISA/IEC 62443 standards for cybersecurity and information security.

15.   https://blast.ncbi.nlm.nih.gov/​Blast.cgi.

16.   https://www.trade.gov/​consolidated-screening-list.