Biosafety and Biosecurity

Biosafety vs. biosecurity: the operational distinction

The two terms are frequently used together, and institutionally they are often overseen by the same office and even the same committee, but they answer different questions and are triggered by different risks:

• Biosafety asks: how do we prevent an accidental exposure to, or unintended release of, a biological agent? It is addressed through containment level (see Biosafety Level (BSL), BSL-1 through BSL-4), facility engineering controls, personal protective equipment, standard/special microbiological practices, and personnel training, per the CDC/NIH Biosafety in Microbiological and Biomedical Laboratories (BMBL) manual and, for recombinant or synthetic nucleic acid research, the NIH Guidelines.
• Biosecurity asks: how do we prevent deliberate misuse, theft, loss, or diversion of a biological agent or toxin by someone who intends harm? It is addressed through physical and electronic access control, personnel suitability/background screening, chain-of-custody inventory accountability, and incident reporting, and in the US is formalized for the highest-consequence agents through the Federal Select Agent Program (see Select Agent List), jointly administered by CDC and USDA-APHIS under the Public Health Security and Bioterrorism Preparedness and Response Act framework.

A useful shorthand: biosafety controls the accident; biosecurity controls the bad actor. Both frameworks can apply to the same physical material at the same facility simultaneously, and neither substitutes for the other in an institutional risk assessment.

Institutional oversight structure

At most US research institutions, the two frameworks are coordinated but administered through partly distinct mechanisms:

• The Institutional Biosafety Committee (IBC) is the standing body required under the NIH Guidelines to review and approve research involving recombinant/synthetic nucleic acids and other biohazardous materials, assign containment levels, and monitor ongoing biosafety compliance — primarily a biosafety function.
• A designated Biosafety Officer typically manages day-to-day biosafety compliance, training, and incident response, reporting to or working alongside the IBC.
• Institutions registered to possess a select agent or toxin must separately register with, and are subject to inspection by, the Federal Select Agent Program, which reviews the institution’s security plan, personnel suitability, and inventory control procedures — the biosecurity function.
• Where a project meets the criteria for Dual-Use Research of Concern (DURC) — broadly, work with a listed select agent reasonably anticipated to produce one of a defined set of higher-risk outcomes — an Institutional Review Entity (IRE, frequently the IBC acting in an expanded capacity) conducts an additional dual-use risk-mitigation review layered on top of standard biosafety and Select Agent Program biosecurity review.

Many institutions consolidate biosafety and biosecurity oversight administratively (a single Environmental Health & Safety or Research Safety office, a single IBC/IRE), but the underlying regulatory requirements — NIH Guidelines and BMBL for biosafety; the Federal Select Agent Program regulations for biosecurity; the DURC/PEPP policy for dual-use risk — remain three separate, overlapping compliance obligations rather than one combined rule.

Frequently asked questions

What is the simplest way to tell biosafety and biosecurity apart?

Ask whether the scenario is about an accident or a bad actor. Preventing a lab worker from being accidentally exposed, or preventing an agent from accidentally escaping containment, is biosafety. Preventing someone from intentionally stealing, diverting, or misusing an agent is biosecurity.

Does every research institution need a formal biosecurity plan?

Only institutions that possess, use, or transfer an agent or toxin on the HHS/USDA Select Agent List are required to register with, and maintain a security plan under, the Federal Select Agent Program. Institutions without select agents still have biosafety obligations (via the IBC and BMBL practices) for any biohazardous work, but the formal biosecurity/select-agent regulatory regime does not apply to them.

How does Dual-Use Research of Concern (DURC) relate to biosafety and biosecurity?

DURC review is a third, additional layer of oversight, not a rename of either biosafety or biosecurity. It applies specifically when research involving a listed select agent is reasonably anticipated to produce a defined category of higher-risk outcome (for example, enhancing transmissibility or virulence, or conferring resistance to medical countermeasures), and requires institution-level risk-mitigation planning on top of standard biosafety and biosecurity compliance.

Who typically enforces biosecurity requirements at a US institution?

For select agents specifically, the Federal Select Agent Program (jointly administered by CDC and USDA-APHIS) sets and inspects for the requirements. Institutionally, day-to-day biosecurity compliance is usually coordinated by the same Biosafety Officer or Research Safety office that manages biosafety, working with institutional security and human resources for the personnel-suitability screening component.