Written and maintained by CASRAI Editorial Board
Last updated
The Federal Select Agent Program (FSAP), jointly administered by CDC’s Division of Regulatory Science and Compliance and USDA-APHIS’s Division of Agricultural Select Agents and Toxins, regulates any US entity that possesses, uses, or transfers a listed biological agent or toxin above regulatory exclusion thresholds. Registration is not self-certifying: an entity must apply, be approved, and designate a Responsible Official (RO) before any covered work can begin. See CASRAI’s Select Agent List entry for what makes an agent or toxin regulated in the first place; this guide covers the two things a research-administration office actually has to execute once that threshold is crossed — the registration lifecycle itself, and what the regulations require of the person who signs for it.
Who Must Register
Any entity — academic, government, or commercial — that possesses, uses, or transfers a select agent or toxin above its regulatory exclusion threshold must register, regardless of whether the work is federally funded. The requirement attaches to the entity and the specific registered space, not to a grant or contract, which is why an institution can carry an active FSAP registration with no federal award tied to it at all.
The Registration Process: APHIS/CDC Form 1
Registration runs through the APHIS/CDC Form 1 (“Application for Registration for Possession, Use, and Transfer of Select Agents and Toxins”), submitted electronically through the Electronic Federal Select Agent Portal (eFSAP). The initial application must identify the specific agents and toxins, the registered space where they will be held, and the individual designated as Responsible Official, and must be accompanied by the entity’s biosafety, security, and incident-response plans. FSAP approval — not submission — is what authorizes work to begin; an entity may not possess or use a select agent while an application is pending.
Once issued, a Certificate of Registration is entity-specific and space-specific: it does not transfer to a new building, a new legal entity, or a different set of agents without a formal update. That’s why the regulations build in a standing update mechanism rather than treating the initial certificate as a one-time filing.
Amendments: What Changes Require an Update
An amendment is a request to change an issued Certificate of Registration, submitted through the same Form 1 workflow in eFSAP. Common triggers include adding or removing a select agent or toxin, adding registered space, changing the individuals approved for access, and replacing the Responsible Official or an alternate. Because access approval is tied to a specific person having cleared a Security Risk Assessment (see below) for that specific registration, personnel changes are not a paperwork formality — a new hire cannot be added to covered work until their amendment clears.
Renewal: The Three-Year Cycle
A Certificate of Registration must be reauthorized at least every three years from the date it was initially issued or last renewed. In practice, the RO submits a Request for Registration Renewal amendment roughly 60 days before the expiration date, selecting that action in eFSAP and signing Section 2 of Form 1. Missing the renewal window doesn’t just create a compliance gap on paper — a lapsed registration means the entity is no longer authorized to possess the agent at all, which is why renewal tracking is typically built into an institution’s compliance calendar well ahead of the 60-day mark rather than left to the RO to remember unprompted.
The Responsible Official: Designation and Qualifications
Every registered entity must designate an individual as Responsible Official, plus at least one alternate, who must, per 42 CFR 73.9:
- be approved by HHS (or USDA, for agriculture-only registrations) following a Security Risk Assessment conducted by the FBI;
- be familiar with the select agent regulations to the extent needed to ensure the entity’s compliance;
- hold the authority to act on the entity’s behalf in select-agent matters; and
- maintain an actual physical presence at the registered entity — not a telephonic or remote one — sufficient to respond in a timely manner to onsite incidents under the entity’s incident-response plan.
That last requirement is a real operational constraint, not boilerplate: an RO who splits time across a satellite campus or travels extensively can create a genuine compliance problem if they can’t reasonably reach the registered space when an incident occurs, which is part of why most institutions designate at least one alternate RO with independent authority to act.
The Responsible Official’s Fundamental Duties
The entity delegates to the RO the authority to manage security, biocontainment/biosafety, and incident response for its select agent work, but the RO retains ultimate responsibility for the entity’s compliance even where day-to-day tasks are delegated to others. Per FSAP’s Responsible Official Resource Manual, the RO’s recurring duties include:
- Access control — limiting access to select agents and toxins to individuals who have been FSAP-approved for that specific registration, and providing a confidential reporting channel (a hotline) to everyone with registered access for biosafety or security concerns.
- Annual internal inspection — conducting and documenting a yearly inspection of registered storage and use areas, recording deficiencies found and the corrective action taken.
- Annual drills — running and documenting security and biosafety drills, including test results and participant names, at least annually.
- Procedures and training — reviewing and annually validating inactivation and viable-agent-removal procedures, updating training whenever those procedures change, and documenting completion.
- Records in eFSAP — keeping the entity’s registration information current in the federal portal, not just in an internal file.
- Incident reporting — reporting failures of an inactivation procedure, and theft, loss, or release of a select agent or toxin, to FSAP; also reporting the identification and final disposition of any select agent or toxin encountered incidentally in a diagnostic or verification specimen.
- Tier 1 coordination — for entities holding Tier 1 agents, coordinating with dedicated safety and security professionals on the additional physical-security and personnel-suitability measures those agents require.
An RO can delegate execution of these tasks — a biosafety officer running the annual inspection, an IBC coordinator tracking training completion — but cannot delegate away the underlying responsibility for whether the entity is actually in compliance. That distinction is why the RO role sits above, and coordinates rather than replaces, the work of the Institutional Biosafety Committee and any dedicated biosafety officer.
Personnel Security: The Security Risk Assessment
Before any individual — a principal investigator, but also students, postdocs, technicians, and visiting researchers — may access a select agent or toxin, the entity submits their identifying information to HHS/CDC or USDA/APHIS, which forwards it to the FBI’s Criminal Justice Information Services (CJIS) Division for a Security Risk Assessment. The SRA screens the individual against the federal “restricted person” criteria and against terrorism screening records; access cannot be granted until it clears. For Tier 1 agents specifically, the entity must additionally run an ongoing suitability-assessment program that continues to monitor cleared individuals for the duration of their access, rather than treating the SRA as a one-time gate.
Inspections and Enforcement
Registered entities are subject to unannounced inspection by FSAP at any time, in addition to the RO’s own annual internal inspection. Findings that show a registration is out of compliance can lead to a corrective action plan, suspension, or revocation of the Certificate of Registration; conduct that rises to a knowing or willful violation of the select agent statute can also be referred for civil or criminal enforcement. Because a suspended or revoked registration means the entity loses its legal authority to possess the agent at all, most institutions treat any inspection finding as something the RO escalates immediately rather than resolves quietly at the lab level.
How Select Agent Registration Differs from IBC, DURC, and BSL Review
Select-agent registration, IBC biosafety review, Dual Use Research of Concern (DURC) review, and Biosafety Level (BSL) containment answer different questions and run as parallel, not substitutable, approval tracks. Registration asks whether the entity and the individual are cleared to possess or access a specific listed agent at all. IBC review asks whether a specific protocol’s biosafety practices are adequate, independent of whether the agent happens to be a select agent. DURC review asks the narrower experiment-level question of whether a study involving certain select agents is reasonably anticipated to produce one of seven defined categories of concerning outcome. BSL sets the physical containment level the work requires. A project can clear one of these tracks and still need the others; an institution’s RO typically coordinates all four rather than treating registration as the only gate. See CASRAI’s Biosecurity Plan guide for how the security-plan element of registration (42 CFR 73.11) is actually built out.
Frequently Asked Questions
Can an entity possess a select agent while its registration application is still pending?
No. FSAP approval, not submission of Form 1, is what authorizes possession, use, or transfer. Work with the agent cannot begin until the certificate is issued.
Does the Responsible Official have to physically work in the lab?
No, but 42 CFR 73.9 requires a genuine physical presence at the registered entity sufficient to respond to onsite incidents in a timely manner — a purely remote or telephonic RO does not satisfy the regulation. This is a common reason institutions name an on-site alternate RO with independent authority.
How often does an FSAP registration need to be renewed?
At least every three years from the date of initial issuance or last renewal, with the renewal amendment typically submitted about 60 days ahead of the expiration date.
Can the Responsible Official delegate their duties to a biosafety officer or IBC coordinator?
Day-to-day execution can be delegated — running the annual inspection, tracking training completion — but the RO retains ultimate responsibility for the entity’s compliance regardless of who performs the task.
What happens if a select agent is lost, stolen, or released?
The RO must report the incident to FSAP; failures of inactivation procedures likewise carry a reporting obligation. Registered entities are also subject to unannounced inspection, and a compliance failure can lead to a corrective action plan, suspension, or revocation of the registration.
