Research administrators new to biosecurity oversight routinely conflate four things that are legally and administratively distinct: whether an agent is regulated at all, whether a specific study is Dual Use Research of Concern (DURC), whether an institution must register to possess the agent, and which committee reviews the protocol. This guide maps how those pieces fit together for a US institution, without restating the deep-dive detail CASRAI already publishes on each individual piece — it links out to that instead. It covers compliance oversight only; it does not describe laboratory technique, agent handling, or any procedure that would function as a how-to for producing or enhancing a dangerous agent.
What Makes Research DURC
Dual-Use Research of Concern (DURC) is a narrow, formally defined US regulatory category, not a general label for research with security implications. A study is DURC only when it meets a two-part test: (1) it is life-sciences research involving one of 15 enumerated select agents and toxins, and (2) it is reasonably anticipated to produce knowledge, products, or technology falling into one of seven defined categories of experiment of concern — for example, work that could plausibly enhance an agent’s transmissibility or virulence, confer resistance to available medical countermeasures, or increase its stability, dispersal potential, or ability to evade detection or immune protection. Most research involving a listed agent does not meet the second part of the test and is not DURC. See CASRAI’s full DURC entry for the complete two-part test, worked example, and counter-example.
The Institutional Review Pathway and the Institutional Review Entity
DURC oversight in the United States runs through a sequence of federal policy, not a single statute. The 2012 USG Policy for Oversight of DURC directed federal funding agencies to identify DURC among the work they fund and develop risk-mitigation plans with the responsible institution. The 2014 USG Policy for Institutional Oversight of Life Sciences DURC pushed that review down to the institution itself: any US institution receiving federal funding for life-sciences research involving the 15 listed agents had to establish an institutional review process, typically run through an Institutional Review Entity (IRE), by September 24, 2015. Many institutions designate their existing Institutional Biosafety Committee as the IRE, sometimes expanded with added biosecurity expertise, rather than standing up a separate body. Where a project meets the DURC test, the IRE works with the investigator and funding agency on a risk-mitigation plan, which can range from added biosafety controls to review of publication or data-sharing plans before dissemination.
What PEPP Adds — and the 2025 Policy Transition
A related but distinct track covers Pathogens with Enhanced Pandemic Potential (PEPP) — work, popularly if imprecisely called “gain-of-function” research, that could plausibly generate a pathogen with enhanced transmissibility or virulence in humans sufficient to cause a pandemic. This track descends from the 2017 HHS Potential Pandemic Pathogen Care and Oversight (P3CO) Framework, a pre-funding, agency-level review applied to a narrower, higher-consequence slice of research than general DURC review reaches. In 2024, the “United States Government Policy for Oversight of Dual Use Research of Concern and Pathogens with Enhanced Pandemic Potential” combined and updated the 2012/2014 DURC policies and the 2017 P3CO Framework into a single structure built around two review categories (Category 1, the broader and more consequential tier, capturing select-agent-regulated work and BSL-3/BSL-4-recommended human pathogens meeting defined enhancement criteria; Category 2, a narrower, lower-threshold tier), with review still routed through an institution’s IRE before agency and, for the highest-risk work, interagency review.
That 2024 policy did not remain the final word for long. Executive Order 14292, “Improving the Safety and Security of Biological Research” (May 5, 2025), intervened before the 2024 policy’s implementation was complete: it immediately suspended federally funded research meeting the EO’s “dangerous gain-of-function research” definition (research enhancing an infectious agent’s or toxin’s pathogenicity, transmissibility, or resistance to treatment), directed an end to federal funding of such research when conducted by foreign entities in countries of concern, and set three follow-on deadlines for the Office of Science and Technology Policy (OSTP): within 120 days, revise or replace the 2024 DURC/PEPP policy to strengthen independent oversight and enforcement, increase transparency and accountability through audits, add compliance provisions to federal funding agreements, and establish review cycles at least every four years; within 90 days, revise the framework governing synthetic nucleic acid procurement screening; and within 180 days, develop a strategy — including legislative proposals — to govern and track dangerous gain-of-function research that occurs without federal funding, which the pre-existing framework did not reach.
Current status, as of this page’s last-verified date: CASRAI could not independently confirm, from primary federal sources, whether OSTP’s successor policy (due under the EO’s 120-day clock, roughly September 2025) has been finalized and published, or what its final category structure and IRE mechanics look like relative to the 2024 policy it is meant to replace. Treat the 2024 policy’s structure described above as the most recent complete framework on record, not as confirmed current text, and verify the operative version directly with your institution’s biosafety or research-security office before relying on it for an active protocol. CASRAI’s gain-of-function research guide covers this transition in more depth, including the ePPP definition and how GOF and DURC/PEPP relate.
The Federal Select Agent Program
Separately from DURC, any US entity — academic, government, or commercial — that possesses, uses, or transfers a listed select agent or toxin above regulatory exclusion thresholds must register with the Federal Select Agent Program (FSAP), regardless of funding source and regardless of whether the work is DURC. FSAP is jointly administered by CDC (human and overlap agents, under 42 CFR Part 73) and USDA APHIS (agricultural and overlap agents, under 7 CFR Part 331 and 9 CFR Part 121). A smaller subset of the list, designated Tier 1, carries the program’s most stringent security, biosafety, and personnel-suitability requirements because of the potential for mass-casualty misuse.
Registration requires submitting an APHIS/CDC Form 1 to the program and receiving approval before beginning work; it is entity- and agent-specific, tied to registered space, renewed roughly every three years, and subject to unannounced inspection. Every registered entity must designate a Responsible Official (plus at least one alternate) personally accountable for compliance. Before any individual — including students, postdocs, and visiting researchers, not just the principal investigator — may access a listed agent, the entity must submit that person’s information for an FBI Criminal Justice Information Services Security Risk Assessment, and access cannot begin until it clears. Tier 1 agents require an additional, ongoing suitability-assessment program beyond the baseline check. Registration status is a threshold, entity-and-person-level gate, distinct from whether a given study also triggers DURC review or what containment level a protocol requires — see CASRAI’s Select Agent List entry for the full listing criteria, exclusion mechanics, and registration detail.
The Institutional Biosafety Committee, and How It Differs from the IRB and IACUC
The Institutional Biosafety Committee (IBC) is the standing body the NIH Guidelines for Research Involving Recombinant or Synthetic Nucleic Acid Molecules require every covered institution to establish and register with NIH’s Office of Science Policy. No covered recombinant/synthetic nucleic acid (r/sNA) research may begin until the IBC has reviewed and approved, or for lower-risk categories been notified of, the protocol. Minimum composition is at least five members collectively qualified to assess r/sNA research risk, including at least two members unaffiliated with the institution representing community health and environmental interests. The IBC assigns or confirms a protocol’s containment level (commonly by reference to the CDC/NIH Biosafety in Microbiological and Biomedical Laboratories, or BMBL, manual), inspects facilities, requires re-review when a protocol’s risk profile changes, and — often serving as or alongside the institution’s IRE — screens for DURC and PEPP triggers.
Institutions new to this space frequently assume the IRB or IACUC already covers biosafety risk; neither does. All three are core protocol-review committees with distinct legal bases and distinct subject matter, and a single project can require more than one in combination:
- IRB (Institutional Review Board) reviews research involving human subjects, under the Common Rule (45 CFR 46) and FDA human-subjects regulations.
- IACUC (Institutional Animal Care and Use Committee) reviews research involving live vertebrate animals, under the Animal Welfare Act and the PHS Policy on Humane Care and Use of Laboratory Animals.
- IBC reviews research involving recombinant or synthetic nucleic acid molecules, and at most institutions biohazardous materials more broadly, under the NIH Guidelines and institutional biosafety policy.
A gene-therapy study that begins in an animal model and is intended to progress toward a human trial can require sequential or parallel approval from all three: IACUC for the animal work, IBC for the recombinant vector, and eventually IRB (plus FDA) once the protocol reaches human subjects. For a side-by-side comparison, see CASRAI’s IACUC vs. IBC and IRB vs. IBC comparisons.
The NIH Guidelines for Recombinant or Synthetic Nucleic Acid Molecules
The NIH Guidelines are the instrument that actually creates the IBC requirement and defines what it must review: a tiered set of risk categories (ranging from exempt work through categories requiring NIH review before local IBC approval), containment assignment tied to the BMBL’s biosafety levels, and specific heightened requirements for human gene transfer protocols. Under NIH Guide Notice NOT-OD-25-082, effective for meetings held on or after June 1, 2025, institutions are expected to publicly post approved IBC meeting minutes, with appropriate redactions, rather than only making them available on request. CASRAI’s dedicated guide, The NIH Guidelines for Recombinant/Synthetic Nucleic Acid Molecules, covers the full risk-category structure and registration mechanics; the RAC history guide covers how federal-level review of the highest-visibility human gene transfer protocols has evolved.
Animal Welfare Assurance and the IACUC Side
Where a DURC-relevant or select-agent project involves an animal model — common in pathogenesis and countermeasure research — IACUC oversight runs in parallel with, not instead of, biosafety and select-agent review. Two federal frameworks anchor US animal-research oversight: the Animal Welfare Act (AWA), administered by USDA, which sets minimum care and treatment standards for covered species and requires USDA registration and inspection; and the PHS Policy on Humane Care and Use of Laboratory Animals, which NIH’s Office of Laboratory Animal Welfare (OLAW) oversees for institutions receiving Public Health Service funding. PHS Policy extends coverage to species the AWA does not reach, including most laboratory rodents, through the institution’s Animal Welfare Assurance — a formal, OLAW-approved document describing how the institution’s animal care and use program meets PHS Policy, without which PHS-funded animal research cannot proceed. Both frameworks require the institution’s IACUC to review and approve protocols, inspect facilities semiannually, and apply the 3Rs (replacement, reduction, refinement) in protocol design. Many institutions working with higher-consequence agents in animal models also pursue AAALAC International accreditation, a voluntary standard layered on top of the AWA/PHS baseline.
Oversight Body Comparison
The table below maps each body discussed on this page against what it reviews, what triggers its review, and who must register with it. Use it as a quick reference, not a substitute for confirming applicability with your own institutional offices.
| Oversight body | What it reviews | What triggers review | Who must register |
|---|---|---|---|
| Institutional Biosafety Committee (IBC) | Containment and lab practice for recombinant/synthetic nucleic acid and, at most institutions, biohazardous-materials research | Any covered r/sNA project, per the NIH Guidelines | The institution (IBC roster registered with NIH OSP); individual protocols registered with the IBC before work starts |
| Institutional Review Entity (IRE) — DURC/PEPP screening | Whether a specific study meets the DURC two-part test or PEPP/Category 1-2 criteria, and the resulting risk-mitigation plan | Life-sciences research involving a listed select agent that is reasonably anticipated to produce one of the defined experiment-of-concern outcomes | No separate registration; institutions receiving relevant federal funding must maintain an IRE process, often their existing IBC |
| Federal Select Agent Program (FSAP) | Entity biosafety, security, and personnel-suitability plans for possessing, using, or transferring listed agents/toxins | Possessing, using, or transferring a select agent or toxin above exclusion thresholds, any funding source | The entity (APHIS/CDC Form 1) and every individual needing access (FBI Security Risk Assessment) |
| Institutional Animal Care and Use Committee (IACUC) | Protocol design, housing, and procedures for live vertebrate animal research, applying the 3Rs | Any covered animal-research protocol under the AWA and/or PHS Policy | The institution (USDA registration under AWA; OLAW-approved Animal Welfare Assurance for PHS-funded work) |
| Institutional Review Board (IRB) | Risk-benefit balance and informed consent for research involving human subjects | Any covered human-subjects research under the Common Rule (45 CFR 46) or FDA regulations | The institution (Federalwide Assurance with HHS OHRP); individual protocols submitted to the IRB |
Frequently Asked Questions
Is every study using a select agent automatically DURC?
No. Select-agent status and DURC status are separate questions. A study can use a listed agent and never meet the DURC two-part test if it is not reasonably anticipated to produce one of the seven defined experiment-of-concern outcomes — for example, using a standard published protocol solely to confirm a diagnostic result. Conversely, select-agent registration is required independent of whether a project ever triggers DURC review.
Does select-agent registration replace IBC, IRB, or IACUC review?
No. Select-agent registration, IBC biosafety review, DURC/IRE screening, and, where applicable, IRB or IACUC review are separate, complementary approval tracks administered by different bodies. A project can require several of them at once, and clearing one does not clear the others.
What is the difference between DURC and PEPP/gain-of-function oversight?
DURC is the broader category, defined by the two-part agent-plus-experiment-category test. PEPP (the successor to the P3CO Framework, popularly called gain-of-function oversight) is a narrower, higher-consequence track applying additional agency-level, pre-funding review to research that could plausibly produce a pathogen with enhanced pandemic potential in humans. The 2024 USG policy combined both into one framework; PEPP-level review is additional to standard DURC review, not a substitute for it.
Who at an institution decides whether a project needs an Animal Welfare Assurance?
The institution’s IACUC, working with its Institutional Official and OLAW, determines whether PHS-funded animal work is covered and whether the existing Assurance’s scope covers a new protocol’s species and activities; OLAW approves and maintains the Assurance itself.
Where should I confirm the current DURC/PEPP policy text before relying on it?
Directly with your institution’s biosafety or research-security office, and against primary federal sources (OSTP, ASPR, and NIH Guide notices) — this framework has changed twice in just over a decade and was under active revision again as of this page’s last-verified date, following Executive Order 14292.
Related CASRAI Coverage
For the export-control side of dual-use technology (a separate legal regime that can apply to the same project), see Export Control (EAR/ITAR) and International Research Collaboration and, for controlled unclassified information handling, NIST SP 800-171 and CUI in University Research. For the biosafety-officer role that typically supports the IBC day to day, see Biosafety Officer (BSO): Role and Responsibilities. For the general containment framework referenced throughout this page, see CASRAI’s entries on Biosafety Level (BSL), BSL-3, and BSL-4.
Last verified: August 16, 2026. The DURC/PEPP federal policy framework was under active revision at that time following Executive Order 14292 (May 5, 2025) — confirm current status with your institutional biosafety or research-security office before relying on the 2024 policy structure described above for an active protocol.
