Institutions running life-sciences research involving select agents and toxins are, as of mid-2026, still operating under a federal dual-use oversight framework that is officially in a holding pattern. The United States Government Policy for Oversight of Dual Use Research of Concern and Pathogens with Enhanced Pandemic Potential (DURC-PEPP), finalized in 2024, remains the current binding text that institutional biosafety committees (IBCs), biosafety officers, and research administration offices must comply with — but a May 2025 executive order directed federal departments and agencies to review and revise or replace it, and no confirmed superseding policy text has been published as of this writing. For institutions, that means the practical answer to “what do we need in place right now” is unchanged from the 2024 policy, even while the policy itself is under active federal review.
The framework currently in force
DURC-PEPP combines two things that used to sit in adjacent but separate tracks: institutional oversight of Dual Use Research of Concern (DURC), and the more intensive, agency-level pre-funding review historically associated with the Potential Pandemic Pathogen Care and Oversight (P3CO) framework for research that could enhance a pathogen’s transmissibility or virulence in humans — now folded in as the “PEPP” half of the combined policy. It builds directly on the 2014 USG Policy for Institutional Oversight of Life Sciences DURC, which first pushed day-to-day DURC review down to the institutional level via a designated Institutional Review Entity (IRE), with an original institutional compliance deadline of September 24, 2015 for having a review process in place.
A study falls under DURC review if it clears a two-part test: it involves one of a defined list of high-consequence agents or toxins, and it is reasonably anticipated to produce one of several defined categories of experiments of concern (broadly: enhancing transmissibility or virulence, conferring resistance to medical countermeasures, or evading detection). See CASRAI’s DURC entry for the operational definition; see the Select Agent List for the underlying roster of regulated agents and toxins that DURC screening draws on. Research anticipated to cross into PEPP-level concern — most recognizably, gain-of-function-type work on potential pandemic pathogens — triggers additional agency-level review on top of, not instead of, standard institutional DURC review.
What changed, and what hasn’t
The substantive change since 2024 isn’t a new institutional requirement — it’s uncertainty about how long the current requirements will stay the current requirements. The May 2025 executive order directed a federal review of biosecurity and biosafety oversight policy generally, explicitly including DURC-PEPP, with instructions to revise or replace it. As of the most recent check against the Administration for Strategic Preparedness and Response’s (ASPR) Science, Safety, and Security portal, that review had not yet produced a publicly issued superseding policy. Institutions should treat this as an open compliance risk to monitor, not a settled outcome in either direction — don’t assume the 2024 text will be replaced on any particular timeline, and don’t assume it won’t be. The safest operating posture for an IBC or biosafety office right now is full compliance with the 2024 policy as written, plus a standing watch item to check ASPR’s and NIH’s Office of Science Policy’s DURC-PEPP pages before any institutional policy refresh, annual training update, or funder-facing certification.
What institutions need in place right now
- A designated Institutional Review Entity (IRE). The IRE is the body responsible for identifying, reviewing, and overseeing DURC and PEPP-level research at the institution. Many institutions designate their existing Institutional Biosafety Committee (IBC) as the IRE, sometimes with added biosecurity expertise brought onto the committee or consulted case-by-case; others maintain a separate DURC/biosecurity review committee that works alongside the IBC. Either model satisfies the policy as long as the IRE has the expertise, authority, and process to apply the two-part test.
- A working screening and identification process. This means a documented mechanism for identifying research proposals, ongoing projects, and pending publications or presentations that may involve DURC or PEPP-level research — not a one-time check at proposal submission. Screening needs to run at initial review, at any material change in scope, and again before public dissemination of results.
- A risk mitigation plan process for anything that screens positive. Where research is identified as DURC or PEPP-level, the policy requires a documented risk mitigation plan developed with the institution and, where applicable, the funding agency — covering elements like biosafety/biosecurity controls, personnel reliability, and communication plan review before publication.
- Institutional certification and reporting to funding agencies. Institutions receiving federal life-sciences funding are generally expected to certify their DURC-PEPP oversight capacity to funding agencies and to report qualifying research through agency-specified channels — the specific mechanics vary by funder, so confirm the current reporting pathway with each relevant program office rather than assuming a single uniform federal portal.
- Training and recordkeeping. Documented training for IRE/IBC members and for principal investigators working with agents on the covered list, plus records demonstrating the screening and review process actually ran, are what an institution would need to produce if a funder or oversight body asked to see its DURC-PEPP compliance program in practice.
Why this matters for RA offices, not just biosafety
DURC-PEPP compliance sits at the intersection of biosafety, research security, and grants compliance — which is exactly why it tends to fall through the cracks between offices. A proposal can pass biosafety review for containment and PPE without anyone applying the DURC two-part test to its actual experimental aims; a funding certification can get signed by a research administration office that has no visibility into what the IBC has or hasn’t screened. Institutions that treat DURC-PEPP purely as “a biosafety committee thing” risk exactly the certification-without-substance gap that oversight reviews look for. The practical fix is procedural: make DURC-PEPP screening a checkpoint in proposal routing (so it happens before submission, not after an award is already in hand), and make sure whoever signs the institutional certification to a funder has an actual line of sight into the IRE’s screening log.
See biosafety vs. biosecurity for how DURC-PEPP oversight relates to — and is distinct from — routine containment-level biosafety review, and the Biosafety Officer role for how BSO responsibilities typically divide from the IBC/IRE’s committee-level review authority. For committee structure more broadly, IACUC vs. IBC and IRB vs. IBC lay out how biosafety oversight sits alongside the institution’s other human- and animal-subjects review bodies.
What to watch
Until a superseding policy is formally issued, institutions should keep their 2024-policy-based DURC-PEPP program current and auditable, and build a light monitoring habit into the compliance calendar: a periodic check of ASPR’s and NIH OSP’s DURC-PEPP pages, and attention to any funder-specific guidance updates (NIH’s Office of Science Policy and other funding agencies typically issue their own implementation guidance alongside the government-wide policy). If and when a revised policy is issued, expect a transition period with a defined institutional compliance deadline, similar to the pattern set by the 2014 policy — plan for a policy and training refresh cycle rather than an immediate cutover.
