DH Security Standards for Laboratories

7/28/2019 DH Security Standards for Laboratories

1/28

~ ""Home OfficeBU I LD IN G A SAFE, JUSTAND TOLERANT SOCIETY

SecurityStandards forLaboratoriesSubject of Part 7 of the Anti Terrorism,

Crime and Security Act 2001

. haze


2/28

"",P ~Home OfficeBUILDING A SAFE, JUSTAND TOLERANT SOC IETY

SecurityStandards forLaboratoriesSubject of Part 7 of the Anti Terrorism,

Crime and Security Act 2001

e>haze


3/28

Foreword RES T R IC TED

As Minister for Counter Terrorism I am very please to commend this security standard to allthe laboratories who are subject to the Anti Terrorism Crime and Security Act 2001.The key message of this standard is the need to improve physical security measures as wellas ensuring good procedures and practice. By remaining alert but not alarmed, we canreduce the ability of terrorists to carry out their threats.The security of pathogens and toxins in this country is of paramount importance. We all have aduty to protect the public and reduce the opportunity for terrorist activities.It is vitally important that everybody acts rigorously upon the standards in thisdocument. By acting together in a concerted, co-ordinated way, we are far betterequipped to meet our obligation of protecting the people of this country and ournational interests.

Beverley HughesMinister of State for Citizenship,Immigration and Counter-Terrorism

RESTRICTED


4/28

Contents RESTRICTED

Security Standards For Laboratories(In accordance with Part 7 of the Anti Terrorism, Crime and Security Act 2001)SectionsSection 1: Introduction 5Section 2: Responsibilities of Laboratories 7Section 3: General Advice 9Section 4: Critical Areas 13

AppendicesAppendix A: Part 7 ATCSA 2001 18Appendix B: Schedule 5 ATCSA 2001 25Appendix C: Glossary of Abbreviations 26Appendix D: Useful References/Contacts 27

RESTRICTED 3


5/28

4


6/28

Section 1:Introduction1.1In the aftermath of the attacks in Washington and NewYork on September 11th 2001, the Government hastaken a number of measures to strengthen security inthe UK .1.2As part of the counter terrorist effort the Governmentintroduced legislation under Part 7 of the Anti Terrorism,Crime and Security Act 2001 (ATCSA) . It aims to ensurethat the storage and use of dangerous pathogens andtoxins listed within Schedule 5 of the Act are as secureas practicable. This is to be achieved by improvementsto the physical security of laboratory premises and bylimiting access to those authorised to work withSchedule 5 substances.1.3The release of dangerous substances could have severeconsequences for public health and safety, irrespectiveof how such a release might occur. Even a small scalebio-terrorist attack, real or perceived, is likely to havea disproportionate effect on both business and publicconfidence. Improving security measures for thestorage, use and disposal of dangerous biologicalmaterial presents a challenge for the police and thewider biological and security communities. Meetingthis challenge means achieving a balance betweenprotecting the public from terrorism and ensuring thatthe valuable work undertaken in laboratories acrossthe UK continues with the minimum impediment. It isimportant that the different agencies involved worktogether to promote security for all laboratories andthe people who work within them.1.4This document deals specifically with the provisions ofATCSA. It aims to assist laboratory managers to meettheir responsibilities for the security of premises,personnel and materials. The police are responsible forthe enforcement of the legislation: Counter TerrorismSecurity Advisers (CTSAs) in each UK police service willvisit laboratories to provide additional help and moredetailed advice on standards and security matters, takinginto account the individual circumstances of the site.They will work closely with Health & Safety Executive(HSE) inspectors to offer laboratories assistance in

RES T R IC TED

meeting their safety and security obligations. TheNational Counter Terrorism Security Office (NaCTSO)is responsible for the police implementation of Part 7of the ATCSA and for training all the CTSAs, to ensurethat the security advice being given is uniform acrossthe country, commensurate with the threat , and costefficient.1.5The standards provided in this document are flexibleand not necessarily appropriate in every case. This ishighlighted in paragraph 4.4. Before you undertake anyassessment or work, it is important that you contactyour local Counter Terrorism Security Adviser. Detailsregarding your local CTSA and any enquires regardingthis document should be directed to NaCTSO on020 7931 7142 or [email protected]'Bio safety' and 'Bio security' are two different conceptswith some similar features. The requirements of theAdvisory Committee on Dangerous Pathogens (ACDP)guidance are aimed at protecting workers and others.These standards are aimed at preventing theft ofmaterial from a laboratory, including resisting an attackby physical force. The idea is to delay an intruder for aslong as it takes for the nearest response force to arrive.In some cases this may be from local security guardswho are on site. In other cases it may be from a distantpolice station where the delay will be much longer. Thisdocument also alerts laboratories to the potential threatfrom insiders.1.7These standards have been prepared through the cooperation of the Association of Chief Police Officers(ACPO), the Health and Safety Executive (HSE), TheDepartment of Health (DOH), the Department ofEnvironment, Food and Rural Affairs (DEFRA) theHome Office (HO) and Government Security Advisers.Biological Safety Officers and other practitioners in themicrobiological community have also been consulted.However, this is a rapidly developing field and currentadvice may need to be updated accordingly. Feed backis welcomed and encouraged from all those working inthe field.

RESTRICTED 5


7/28

6


8/28

Section 2: RESTRICTEDLaboratories' responsibilities under ATCSA2.1The main objectives of the legislation are to: Ensure that the most dangerous substances listed

within Schedule 5 of ATCSA are stored, worked onand destroyed in the most secure environment aspossible .

Prevent access to these substances by those whoseek to use them for terrorist purposes.

Give the police powers to act to strengthen securityand deal with failure to comply with the Act.

2.2Laboratory managers and Biological Safety Officersshould familiarise themselves with the legislation indetail (copy is attached at Appendix A). A list ofsubstances currently covered by the Act is attached atAppendix B. This list may change from time to time.2.3In broad terms laboratories are required to: Register with the Home Office their holdings of

Schedule 5 substances. Failure to do so is anoffence under the Act and may result inprosecution.

Ensure that Schedule 5 substances and thepremises in which they are kept, stored, workedon and disposed of are secure.

Ensure that access to them is authorised andcontrolled.

Provide information to the police on the securitymeasures in place and the personnel entitled tohave access to Schedule 5 substances.

Comply with advice given by the police to securepremises.

RES T R IC TED 7


9/28

8


10/28

Section 3:General Advice3.1This standard is not intended to override existinglegislation in related areas with which laboratories willbe familiar. Security advice seeks to complement thatprovision, in particular the Control of SubstancesHazardous to Health (COSH H) regulations of the Healthand Safety at Work Act. All laboratories should ensurethat they are fully compliant with this legislation; theguidelines on restricting access to Containment Level 2(CL2) and Containment Level 3 (CL3) laboratories areparticularly relevant. The Advisory Committee onDangerous Pathogens (ACDP) publication "TheManagement, Design and Operation of MicrobiologicalContainment Laboratories" is also essential reading. Insome instances, the security standards specified in thisdocument may exceed those recommended in otherstandards or guidelines. The various agencies will workto bring these into line in the future.3.2Good security is a combination of physical measures,sound procedures and the awareness and attitude ofmanagers and employees. The measures taken toachieve acceptable standards may vary from site tosite, depending on the nature of the work undertaken,the environment of the laboratory and the security cultureof the establishment. Where measures are recommendedand installed they should meet recommended standardsfor that type of installation. Technical advice on securitystandards is contained in sections 3 and 4 of thisdocument. Additional advice and clarification isavailable from CTSAs.3.3It is much easier, and usually more cost effective, tobuild in physical protection from the beginning. Plansfor new build laboratories should include standardsecurity measures from the outset, and laboratoriesmoving to new premises should seek advice, from theirlocal CTSA or NaCTSO, at an early stage.3.4In many cases the measures that existing laboratorieswill be asked to undertake will be simple and inexpensive,especially where existing security at a basic crimeprevention level is good. But more substantial improvements will require more detailed planning of funding,training, procurement and installation.

RESTRICTED

3.5The areas where the substances are used, stored,transported or destroyed are designated 'critical' areas.When assessing the security measures required for thecritical areas, account should also be taken of theoverall site security.3.6In order to assess the security requirement for thelaboratory and site, it is essential to understand the'Philosophy of Protective Security'. The list of questionsthat follow are aimed at assisting in understanding therequirements of a good security regime. Section 4provides detailed advice and specification to enable thedevelopment and installation of the required securitymeasures.3.7The basis of all good physical security regimes is foundedon the 3D principle - Deter, Detect and Delay.Deter - the overt physical and electronic securitymeasures that might provide a serious deterrent to awould-be intruder.Detect - alarm systems, with visual (CCTV) verification,to detect the presence of an intruder.Delay - physical security measures that delay theintruder for a sufficient length of time, to allow aresponse force to attend.For the above philosophy to function effectively, it isessential that Detection precedes Delay.3.8 Assessing the SecurityRequirementLaboratories may find the following questions usefulin beginning to address their security requirements.a) Physical Measuresi. Do you have a full list of all the substances you

possess, where they are located and who hasaccess to them?

ii. Is the critical area of robust construction, capableof withstanding an attack designed to gain accessto a controlled area? Walls, ceilings and floors mayneed reinforcement, or access control may haveto be extended to adjoining areas.

RESTRICTED 9


11/28

Section 3: RESTRICTEDGeneral Adviceiii. Are doors, windows and their frames substantial, i. Are security logs and records easily available to

well fitted and is appropriate glazing protection in CTSAs?place? ii. Is there someone who has responsibility foriv. Are vents and other fixtures adequately fitted and security and who has ready access to senior

secure? personnel to alert them to security concerns andv. Where is the critical area located? If part of larger their responsibilities under the Act?

or multiple use premises, are there any features iii. Do senior managers regularly review their safetyof the surrounding building, such as public access and security measures?corridors that make the area vulnerable? iv. What is the process for transferring scheduled

vi. What other perimeter measures are in place, on substances between labs, storage facilities andthe wider site and in close proximity to the lab? disposal sites? How is this movement tracked

vii. Are there external factors, such as car parks, flat and recorded?roofs, landscaping that might make the area easier v. Is there scrupulous adherence to existingto enter or attack? measures such as wearing passes, signing in

viii. Is the lighting and visibility adequate? and out, password and access code protection,dual working. Is there a procedure for controllingix. Is there an access control system in place? How passes and recovering them when they are nois it monitored and for what parts of the day? longer valid?x. Are protected and private areas clearly marked, vi. Are there frequent visitors to the premises?and unauthorised movement between them How are they handled and supervised?prevented? vii. Are hard copy records, computers and the datab) Electronic Measures they hold secure?Electronic measures include such items as intruder viii. Are there security and contingency plans, anddetection systems (IDS), closed circuit television (CC1V) are they regularly exercised? Such plans shouldand automatic access control systems (AACS). include:i. When an alarm is activated, how is the alarm a. PhYSical security procedures

validated (i.e. was it a false alarm or did an b. Personnel security proceduresintruder trigger the alarm)? c. Record keeping proceduresii. Who is responsible for validating the alarm andsummoning the appropriate response? d. Auditing procedures

iii. Are the electronic measures regularly maintained e. Information securityand tested?

d) Personnel Securityiv. If you have a CC1V system, does it comply with i. Do your recruitment procedures meet recognisedthe recommendations of the Home Office's standards of Human Resources (HR) best practice?'CC1V Operational Requirement' document?Does the AACS require both a Personal ii. Are you sure that your employees are who theyv. say they are and have the qualifications that theyIdentification Number (PIN) and token? If not, a claim to hold? Has each employee's identity andlost or stolen token or compromised PIN will employment history been thoroughly checkedpermit access to an unauthorised person. against relevant documents and references?

c) Procedural Measures iii. Have you trained staff, whether temporarily orCOSHH regulations and the records that accompany permanently employed, in safety and securitythem are a useful starting point for meeting the practices and why they are important?security standards expected under this legislation.

10 RESTRICTED


12/28

Security Standards for Laboratories

iv, Does the climate in your laboratory lend itself tostaff being able to raise security concerns aboutcolleagues, security practices etc? Do they knowhow and to whom to report such concerns?

v, Do managers and HR staff know people wellenough to notice any changes in behaviour orattitude that might give rise to security concerns?Do they know what to do if concerns arise?

vi, Is security and good practice built in to appraisalsystems or staff development discussions?

vii , Have any habits developed among staff thatoverride security measures, for example lettingpeople through access controls or doors thatmight not be entitled to be in a controlled area,or even sharing passwords?

viii, Are requests (from both UK nationals and overseasvisitors) to visit the laboratory, or to undertakeshort-term projects, properly checked and thesponsors or sources of their interest known andtrusted? Are such individuals appropriatelysupeNised while in the lab? Is their access limitedto what they need to pursue the agreed purpose oftheir project/visit?

ix, Can you say who has access to what materialsand premises, not only those directly workingwith schedule 5 substances but also cleaners,contractors, students, visitors, autoclaveoperators, porters and administrative staff? Whatdetails do you hold in respect of them? Do youknow where to find such details if you do notkeep them yourself?

x, Could you identify who has access to a particulartype of pathogen or toxin?

xi, Are your arrangements for storage and retrievalof this data resilient and accessible to those whoneed to know?

e. Other Related MeasuresAlthough the Act does not specifically cover thetransfer and transport of pathogens and toxins, oraccess by foreign students, laboratories will wish toconsider the following:

a)

i,

ii ,

iii,

iv,

b)

RESTRICTED

In the past Schedule 5 substances have beentransferred in an informal manner, for example,between scientists at conferences or through thepostal system, Laboratories will need tointroduce more secure and auditable methods oftransfers among professionals,Do you know who you are dealing with? Are theyacting for someone else? Do you know what thematerial is being used for? Do you keep internalrecords of what is being transferred, and to whomand for what reason?Is the carrier security aware? Would it be appropriateto use secure couriers with logistical tracking andend-user receipt?What procedures are in place to ensure thatdangerous biological substances transferredwithin the UK, are passed only to laboratoriesregistered in compliance with ATCSA?When dealing with international contacts, arethey passed only to known and reputablelaboratories? Export control licences are requiredfor international transfers outside of the EU forall pathogens and toxins on Schedule 5, There isa requirement to obtain an individual exportlicence when exporting Ricin and Saxitoxinbetween member states,The Foreign and Commonwealth Office administera scheme called the Voluntary vetting Scheme(VVS), This is aimed at students from certaincountries who come to the UK to take part incertain types of study, Does this scheme apply toanyone in your lab? For further details, look upwww.fco.gov.uk or [email protected] or call 020 7008 2248 ,

RESTRICTED 11


13/28

12


14/28

Section 4:Critical Areas4.1Areas where substances are used, stored, transportedor destroyed are designated critical areas.4.2This section sets the standards for Laboratoriesoperating at Containment Level 2 and ContainmentLevel 3 working on Schedule 5 substances. ForLaboratories operating at Containment Level 4 a higherstandard is required. Special provisions have beenmade to advise Containment Level 4 laboratories.4.3In some cases a perimeter will be the fence around alarge area of land, in other cases the first securitymeasures will start with the access point to a particularbuilding or even a corridor. Physical security measuresshould be viewed from the outside working inwardswith the emphasis centred upon the critical area.4.4Security measures should be viewed in a flexiblelight; that is, where some security measures arelacking, they may be compensated for by others.It is appreciated that, with each site being unique,there may be measures in place that are notmentioned in this standard but which the CTSAconsiders appropriate in the circumstances. It willbe the responsibility of the site to demonstratethat alternative arrangements are sufficientlyrobust.4 .5Where possible, laboratories subject of the ATCSAshould not be located on a ground floor or whereaccess may be assisted by physical elements such asflat roofs.4.6 Physical MeasuresIt is necessary to identify the secure boundary of the'Critical Area ' on which the physical measures willapply. This is dependant upon the location of thelaboratory and whether it is in a building that servesother purposes or is located in secure grounds. Theseissues will affect the physical security measures thatwill need to be put in place.

RESTRICTED

For example:a) On the ground floor external walls will requireboth internal and external protection measures

to walls and openings.b) If located on upper floors, it will require only

internal partition walls and openings to beprotected.

c) The walls will not be so important if the site hasa sterile zone (see para 4.18)

4.7 Doorsetsi. Doors allowing access to critical areas must be

of robust construction and must be certified tomeet LPS 1175: Issue 5 Security Rating 3. Insome cases BSI PAS 24 may be acceptablesubject to consultation with the CTSA.NB: The new European standards (ENV 1627) may soon bepublished; installation of door se ts certified to ENV 1627 willrequire approval from NaCTSO.

ii. Doors with integral air-vents must be carefullychecked to ensure that the vent cannot beremoved.

iii. All doorsets must be adequately fixed to thefabric of the building in accordance with themanufacturer's speCifications.

iv. Double doors must only be used where it isnecessary to allow access for large pieces ofequipment, such doorsets must meet therequirement at (i) above.

v. Glazing immediately adjacent to a security doormust be laminated (minimum thickness 7.5mm)and installed in accordance with BS 6262:1982,and the glazing retention system (frame) must betested to either BS 7950 or LPS 1175: Issue 5Security Rating 2. Alternatively, the glazing mustbe protected by internal grills or an external rollershutter certified to LPS 1175: Issue 5 SecurityRating 1/2.

RESTRICTED 13


15/28

14

Section 4:Critical Areas4.8 Windowsi. All ground floor external windows within thebuilding that may allow access to the critical

areas must be certified to BS7950: 1997.NB: The new European standards (ENV 1627) may soon bepublished; installation of windows certified to ENV 1627 willrequire approval from NaCTSO.

ii. Alternatively windows must be protected byinternal grilles or external roller shutters certifiedto LPS 1175: Issue 5 Security Rating 3, andmust incorporate window security film.

iii. Sliding sash, pivot or fully reversible windows arenot presently covered by BS 7950, therefore themanagement of laboratory buildings incorporatingthese window styles will be advised by the CTSAduring the audit of the additional securityarrangements required .

iv. Additionally all glazing within the above windowsmust be laminated (minimum thickness 7.5mm)to BS6206 and installed in accordance with BS6262:1982.

v. All windows must be securely fixed to the fabric ofthe building in accordance with the manufacturersrecommendations.

4.9 Walls, Ceilings and Floorsi. Equal emphasis should be placed on the security

of walls, ceilings and floors. If these are not builtto a robust standard, e.g. Floor slabs or reinforcedconcrete construction, the security of doors andwindows may be compromised.

ii. Walls must be able to withstand a forced entry. Ifinternal partition walls are not sufficiently robustthey must be re -enforced to a standard equivalentto LPS 1175: Issue 5 Security Rating 3 or by arecognised government test authority.

iii. Critical areas should be examined to ensure thatno access can be gained from any adjoiningareas. Ceilings and floors must provide a similarlevel of protection as the walls.

iv. Should the CTSA or laboratory manager feel thatthe construction of walls, ceilings or floors in acritical area is not adequate, they should consultNaCTSO.

RESTRICTED

4.10 Critical Areas Accessed via aPublic or Semi Public Corridori. By the very nature of their location, critical areas

accessed via a corridor are difficult to secure toan acceptable level.

ii. Therefore all walls adjacent to the public or semipublic area must be of a substantial construction.Partition walls are not generally considered to beadequate unless the system has been tested toLPS 1175: Issue 5 Security Rating 3. If partitionwalls have been used in the construction of thelaboratory and have not been externally evaluated,then the CTSA will require additional measures beput in place to ensure the integrity of the wall.(See section 4.9.)

iii. Where a lobby is used within a laboratory,interlocking doors provide an increased level ofsecurity to ensure that any unauthorised personcannot follow a member of staff directly into thelaboratory. By passing through the outer door intothe lobby area and securing it before the innerdoor is released, staff can ensure that accesscan be strictly controlled to only those authorised.

iv. All doors enabling access to the critical area, eitherfrom the public corridor or from other areas of thebuilding (including emergency egress doors), mustbe certified to LPS 1175: issue 5 Security Rating 3.NB: The new European standards (ENV 1627) may soon bepublished; installation of windows cert ified to ENV 1627 willrequire approval from NaCTSO.

v. All door sets must be adequately fixed to thefabric of the building in accordance with themanufacturer's specifications.

4.11 Access Controli. An access control system/protocol is essential for

the access to all 'Critical Areas'. There are twodistinct methods of ensuring a controlledaccess/egress; these are either technology basede.g. various electronic systems such as aproximity reader and PIN, or via a manual systemutilising security staff. Push button combinationlocks may be appropriate in somecircumstances, but should be avoided as ageneral rule (See Para 4.4).

RESTRICTED


16/28


ii. These methods are not mutually exclusive,therefore the CTSA may accept two differingcontrol protocols based on the operating hours ofthe laboratory; for example, sites utilising securitystaff during the day only, will need an electronicsystem out of hours. Establishments that have a24 -hour guarding system may be able to rely ona manual system.

iii. All unauthorised staff, visitors and contractorsmust be escorted whilst in the 'critical areas'.

iv. All movement of both staff and visitors in andout of the 'critical area ' must be comprehensivelyrecorded e.g. name, staff number/designation,organisation (if visitors), reason for visit (if visiting),date, time, etc. If the visitor's pass is by way of acarbonised paper pass, records should be securelyretained and passes handed in at the end of a visit.

v. Identification badges must be clearly worn andstaff should be regularly reminded of the need tochallenge strangers and challenge 'tailgaters'when passing through security doors.

vi. The information contained within the log shouldnormally be stored on a computer system and bepassword protected . The computer hard driveshould either be removed or placed in a securestorage facility complying with LPS 1183/ 8S EN1143-1:1997 Security rating 0 (with confirmedfire resistance) or the whole PC should beprotected by a physical protection deviceconforming to LPS 1214: Issue 2 Category I,after normal working hours.

vii. Where technology based access control systemsutilising proximity, magnetic card, or biometricreaders are used, they must incorporate a personalidentification number (PIN).

viii. The system must be flexible enough to allowmanagement of the establishment to trackindividuals throughout the site and log informationsuch as access/egress times, etc.

ix. The control computer should be protected by aphysical protection device conforming to LPS1214: Issue 2 Category I. All data must also bepassword protected.

R E S T RIC T E D

x. If digital code panels are incorporated within anaccess control system, as an additional securityfeature, they must be unique to each user,changed on a regular basis and incorporate aduress code facility.

xi. All emergency exit doors must be fitted with awarning device to alert staff when opened, andincorporated into any technology based accesscontrol system that is in operation.

4.12 Disposal of substancesi. Substances falling within the remit of Schedule 5

of the Act should be disposed of within thecritical area and in compliance with HSElACDPguidance/legislation.ii. If, for whatever reason, substances under the Act

are to be disposed of outside the critical area,prior to autoclaving, then an appropriate memberof staff should escort the person taking the materialto the autoclave point.

iii. There must be an audit trail to show whoaccompanied the substance, details of what hasbeen destroyed, paperwork to show that theywitnessed the disposal , together with otherrelevant information such as time and date, etc.

4.13 Storagei. Storing substances falling under the Act is as

important as working on them in the laboratory.All storage facilities should be incorporatedwithin the critical area.

ii. If the storage facility is located in a separate areawithin the building, or in a separate building, it willbe required to meet the same standards as thoseof the critical area.iii. All substances being transferred between thestorage facility and the critical area must beescorted by two members of staff, who willremain with the substance until receipt has beenacknowledged by staff within the critical area.All movement of substances should be recordedfor audit purposes.

iv. The audit trail must show who accompanied thesubstance, details of the delivery, together withother relevant information.

R E S T RIC T E D 15


17/28

16

Section 4:Critical Areas4.14 Storage ofInformation/Databasesi. All Pathogens and Toxins stored within the

establishment must be labelled in a way thatallows them to be identified to authorisedpersons only.

ii. An audit system must be in place so that recordsare maintained on what types of substances arekept where and in what quantities. If this data ismaintained on an electronic database with back-up facility, the system should comply with therequirements of LPS 1224: Issue 2.

iii. Alternatively the CTSA may accept a less securedatabase, based on either paper or PC, if theofficer is satisfied that the information containedwithin the database is secured in a safe locationi.e. in a fire resistant cabinet conforming to LPS1228: Issue 1 (Paper) , or that the PC is securedutilizing a physical security device conforming toLPS 1214: Issue 2 Category I.

iv. Documents and software media must be disposedof in a secure and approved manner.

4.15 Alarmsi. All sites where substances are held or storedunder the Act, must be protected by an alarmlinked to an Alarm Receiving Centre (ARC)complying with BS 7042 :1988 Specification forHigh Security Intruder Alarm Systems in Buildings.

ii. Additionally, all establishments must have apolice response to alarm activation via the ARC,and therefore must comply with the Associationof Chief Police Officers Security Systems Policy.Further advice can be obtained from the CTSA.

iii. All critical areas of the site must be alarmed. TheCTSA will advise on the location and type ofsystem and whether additional detectors or otherequipment are needed to ensure completecoverage (this does not include technical advice).

iv. Personal attack alarm facilities should beavailable within all areas of risk within the criticalarea. Staff/students must be fully briefed by thelaboratory management regarding the correct useof this facility.

RESTRICTED

4.16 CCTVi. CCTV coverage may assist if the establishment

does not have dedicated security staff 24 hoursper day. CCTV can be used to verify alarmactivations and record staff/contractor movement.It is not viewed as a deterrent under mostcircumstances.

ii. The management and maintenance of the CCTVsystem is of paramount importance and shouldcomply with BS 7958:1999 Codes of Practice forCCTV or PSBD Guidelines and the Data ProtectionAct 1998. If necessary the CTSA will considerrequesting an audit of an existing system toensure it is meeting the operational requirements.

iii. All CCTV systems within establishments withlaboratories registered under the Act shouldrecord and/or monitor 24 hours per day, sevendays a week from a secure location.

iv. Recording facilities and protocols must beacceptable for production during court proceedingsshould there be a need to do so . All recordingsmust also comply with the Data Protection Act1998. The CTSA will advise laboratorymanagement of the requirements if necessary.

4.17 External Utility Facilitiesi. Any utility, gas , electricity, oil ,

telecommunications and alarm monitoringequipment which is essential for the safety andsecurity of the critical area must be secured inthe appropriate housings with access coversmeeting LPS 1175: Issue 5, Security rating 4.

ii. In the event, for whatever reason, of any essentialutility failing, a responsible person must be notifiedvia a suitable alerting system and appropriateaction taken to restore the supply.

iii. If there is any utility equipment outside the areacontrolled by the laboratory establishment, andconsidered to be 'at risk ' by the CTSA, the utilitycompany should be contacted to discuss howthe facilities can be secured in line with therequirement outlined in 4.17 (i).

RES T R IC TED


18/28


4.18 Sterile Zonesi. Some laboratories may be housed on securesites where a sterile zone already exists. This

method of physical protection may be appropriateat other sites.

ii. A sterile zone is a strip of open space thatsurrounds a building or establishment with fenceson either side. It should be in the order of 2metres in width and should be established aroundthe perimeter of the laboratory building whereappropriate. There must be no landscaping offeringconcealment within the area.

iii . The CTSA will advise management of the need tolight any areas around the building.

iv. The National Counter Terrorism Security Officecan be contacted on 020 7931 7142 or [email protected] If you require anyfurther advice or would like details of your localCTSA, please do not hesitate to get in contact. NaCTSO/ACPO

RESTRICTED

R E S T RIC TE D 17


19/28

Appendix A: RESTRICTEDPart 7SECURITY OF PATHOGENS AND TOXINS (4) A notice under this section must-58 Pathogens and toxins in relation to which (a) identify the premises in which the substance is

requirements under Part 7 apply kept or used;(1) Schedule 5 (which lists the pathogens and toxins (b) identify any building or site of which the

in relation to which the requirements of this Part premises form part; andapply) has effect. (c) contain such other particulars (if any) as may be

(2) The Secretary of State may by order modify any prescribed.provision of Schedule 5 (including the notes). (5) The occupier of any premises in which any

(3) The Secretary of State may not add any dangerous substance is kept or used on the daypathogen or toxin to that Schedule unless he is on which this section comes into force must givesatisfied that the pathogen or toxin could be a notice under this section before the end of theused in an act of terrorism to endanger life or period of one month beginning with that day.cause serious harm to human health. (6) Where-

(4) In this Part "dangerous substance" means- (a) a substance which is kept or used in any(a) anything which consists of or includes a premises becomes a dangerous substance by

substance for the time being mentioned in virtue of a modification of Schedule 5, butSchedule 5; or (b) no other dangerous substance is kept or used

(b) anything which is infected with or otherwise there,carries any such substance. the occupier of the premises must give a notice

(5) But something otherwise falling within subsection under this section before the end of the period(4) is not to be regarded as a dangerous of one month beginning with the day on whichsubstance if- that modification comes into force.(a) it satisfies prescribed conditions; or 60 Information about security of dangerous

(b) it is kept or used in prescribed circumstances. substances59 Duty to notify Secretary of State before (1) A constable may give to the occupier of anyrelevant premises a notice requiring him to givekeeping or using dangerous substances the chief officer of police such information as is(1) The occupier of any premises must give a notice specified or described in the notice by a time soto the Secretary of State before any dangerous specified and in a form and manner so specified.substance is kept or used there. (2) The required information must relate to-(2) Subsection (1) does not apply to premises in (a) any dangerous substance kept or used in therespect of which a notice has previously been

given under that subsection (unless it has been premises; orwith drawn) . (b) the measures taken (whether by the occupier or

(3) The occupier of any premises in respect of which any other person) to ensure the security of anya notice has been given may withdraw the notice such substance.if no dangerous substance is kept or used there.

18 RESTRICTED


20/28


(3) In this Part references to measures taken toensure the security of any dangerous substancekept or used in any relevant premises include-

(a) measures taken to ensure the security of anybuilding or site of which the premises form part;and

(b) measures taken for the purpose of ensuringaccess to the substance is given only to thosewhose activities require access and only incircumstances that ensure the security of thesubstance.

(4) In this Part "relevant premises" means anypremises-

(a) in which any dangerous substance is kept orused, or

(b) in respect of which a notice under section 59 is inforce.

61 Information about persons with access todangerous substances

(1) A police officer of at least the rank of inspectormay give to the occupier of any relevant premisesa notice requiring him to give the chief officer ofpolice a list of-

(a) each person who has access to any dangeroussubstance kept or used there;

(b) each person who , in such circumstances as arespecified or described in the notice, has accessto such part of the premises as is so specified ordescribed;

(c) each person who, in such circumstances as arespecified or described in the notice, has accessto the premises; or

(d) each person who, in such circumstances as arespecified or described in the notice, has accessto any building or site of which the premisesform part.

RESTRICTED

(2) A list under subsection (1) must be given beforethe end of the period of one month beginningwith the day on which the notice is given.

(3) Where a list under subsection (1) is given, theoccupier of the premises for the time being-

(a) must secure that only the persons mentioned inthe list are given the access identified in the listrelating to them; but

(b) may give a supplementary list to the chief officerof police of other persons to whom it is proposedto give access.

(4) Where a supplementary list is given undersubsection (3)(b) , the occupier of the premisesfor the time being must secure that personsmentioned in that list do not have the proposedaccess relating to them until the end of theperiod of 30 days beginning with the day onwhich that list is given.

(5) The chief officer of police may direct that aperson may have such access before the end ofthat period.

(6) The Secretary of State may by order modify theperiod mentioned in subsection (4).

(7) Any list under this section must-(a) identify the access which the person has , or is

proposed to have;(b) state the full name of that person , his date of

birth, his address and his nationality; and(c) contain such other matters (if any) as may be

prescribed.62 Directions requiring security measures(1) A constable may give directions to the occupier

of any relevant premises requiring him to takesuch measures to ensure the security of anydangerous substance kept or used there as arespecified or described in the directions by a timeso specified .



21/28

Appendix A: RESTRICTEDPart 7SECURITY OF PATHOGENS AND TOXINS (4) A notice under this section must-58 Pathogens and toxins in relation to which (a) identify the premises in which the substance is

requirements under Part 7 apply kept or used;(1) Schedule 5 (which lists the pathogens and toxins (b) identify any building or site of which the

in relation to which the requirements of this Part premises form part; andapply) has effect. (c) contain such other particulars (if any) as may be

(2) The Secretary of State may by order modify any prescribed.provision of Schedule 5 (including the notes). (5) The occupier of any premises in which any

(3) The Secretary of State may not add any dangerous substance is kept or used on the daypathogen or toxin to that Schedule unless he is on which this section comes into force must givesatisfied that the pathogen or toxin could be a notice under this section before the end of theused in an act of terrorism to endanger life or period of one month beginning with that day.cause serious harm to human health. (6) Where-(4) In this Part "dangerous substance" means- (a) a substance which is kept or used in any

(a) anything which consists of or includes a premises becomes a dangerous substance bysubstance for the time being mentioned in virtue of a modification of Schedule 5, butSchedule 5; or (b) no other dangerous substance is kept or used

(b) anything which is infected with or otherwise there,carries any such substance. the occupier of the premises must give a notice(5) But something otherwise falling within subsection under this section before the end of the period(4) is not to be regarded as a dangerous of one month beginning with the day on whichsubstance if- that modification comes into force.

(a) it satisfies prescribed conditions; or 60 Information about security of dangerous(b) it is kept or used in prescribed circumstances. substances59 Duty to notify Secretary of State before (1) A constable may give to the occupier of anyrelevant premises a notice requiring him to givekeeping or using dangerous substances the chief officer of police such information as is(1) The occupier of any premises must give a notice specified or described in the notice by a time soto the Secretary of State before any dangerous specified and in a form and manner so specified.substance is kept or used there . (2) The required information must relate to-(2) Subsection (1) does not apply to premises in

(a) any dangerous substance kept or used in therespect of which a notice has previously beengiven under that subsection (unless it has been premises; orwithdrawn). (b) the measures taken (whether by the occupier or

(3) The occupier of any premises in respect of which any other person) to ensure the security of anya notice has been given may withdraw the notice such substance.if no dangerous substance is kept or used there.

RESTRICTED


22/28


(3) In this Part references to measures taken toensure the security of any dangerous substancekept or used in any relevant premises include-

(a) measures taken to ensure the security of anybuilding or site of which the premises form part;and

(b) measures taken for the purpose of ensuringaccess to the substance is given only to thosewhose activities require access and only incircumstances that ensure the security of thesubstance.

(4) In this Part "relevant premises" means anypremises-

(a) in which any dangerous substance is kept orused, or

(b) in respect of which a notice under section 59 is inforce.

61 Information about persons with access todangerous substances

(1) A police officer of at least the rank of inspectormay give to the occupier of any relevant premisesa notice requiring him to give the chief officer ofpolice a list of-

(a) each person who has access to any dangeroussubstance kept or used there;

(b) each person who, in such circumstances as arespecified or described in the notice, has accessto such part of the premises as is so specified ordescribed;

(c) each person who, in such circumstances as arespecified or described in the notice, has accessto the premises; or

(d) each person who, in such circumstances as arespecified or described in the notice, has accessto any building or site of which the premisesform part.

R ES T RIC T ED

(2) A list under subsection (1) must be given beforethe end of the period of one month beginningwith the day on which the notice is given.

(3) Where a list under subsection (1) is given, theoccupier of the premises for the time being-

(a) must secure that only the persons mentioned inthe list are given the access identified in the listrelating to them; but

(b) may give a supplementary list to the chief officerof police of other persons to whom it is proposedto give access.

(4) Where a supplementary list is given undersUbsection (3)(b), the occupier of the premisesfor the time being must secure that personsmentioned in that list do not have the proposedaccess relating to them until the end of theperiod of 30 days beginning with the day onwhich that list is given.

(5) The chief officer of police may direct that aperson may have such access before the end ofthat period.

(6) The Secretary of State may by order modify theperiod mentioned in subsection (4).

(7) Any list under this section must-(a) identify the access which the person has, or is

proposed to have;(b) state the full name of that person, his date of

birth, his address and his nationality; and(c) contain such other matters (if any) as may be

prescribed.62 Directions requiring security measures(1) A constable may give directions to the occupier

of any relevant premises requiring him to takesuch measures to ensure the security of anydangerous substance kept or used there as arespecified or described in the directions by a timeso specified.



23/28

Appendix A:Part 7(2) The directions may-(a) specify or describe the substances in relation to

the security of which the measures relate; and(b) require the occupier to give a notice to the chief

officer of police before any other dangeroussubstance specified or described in thedirections is kept or used in the premises.

63 Directions requiring disposal of dangeroussubstances

(1) Where the Secretary of State has reasonablegrounds for believing that adequate measures toensure the security of any dangerous substancekept or used in any relevant premises are notbeing taken and are unlikely to be taken, he maygive a direction to the occupier of the premisesrequiring him to dispose of the substance.

(2) The direction must-(a) specify the manner in which, and time by which,

the dangerous substance must be disposed of;or

(b) require the occupier to produce the dangeroussubstance to a person specified or described inthe notice in a manner and by a time sospecified for him to dispose of.

64 Directions requiring denial of access(1) The Secretary of State may give directions to the

occupier of any relevant premises requiring him tosecure that the person identified in the directions-

(a) is not to have access to any dangerous substancekept or used there;

(b) is not to have, in such circumstances (if any) asmay be specified or described in the directions,access to such part of the premises as is sospecified or described;

(c) is not to have, in such circumstances (if any) asmay be specified or described in the directions,access to the premises; or

20

RESTRICTED

(d) is not to have, in such circumstances (if any) asmay be specified or described in the directions,access to any building or site of which the premisesform part.

(2) The directions must be given under the hand ofthe Secretary of State.

(3) The Secretary of State may not give the directions

65(1)

(2)

(3)

(4)

(a)(b)

(c)(5)

unless he believes that they are necessary in theinterests of national security.Powers of entryA constable may, on giving notice under thissection, enter any relevant premises, or any buildingor site of which the premises form part, at areasonable time for the purpose of assessing themeasures taken to ensure the security of anydangerous substance kept or used in the premises.The notice must be given to the occupier of thepremises, or (as the case may be) the occupier ofthe building or site of which the premises form part,at least 2 working days before the proposed entry.The notice must set out the purpose mentionedin subsection (1) .A constable who has entered any premises,building or site by virtue of subsection (1) mayfor the purpose mentioned in that subsection-search the premises, building or site;require any person who appears to the constableto be in charge of the premises, building or siteto facilitate any such inspection; andrequire any such person to answer any question.The powers of a constable under this sectioninclude power to take with him such otherpersons as appear to him to be necessary.

RESTRICTED/


24/28

Security Standards for Laboratories RESTRICTED

66 Search warrants (2) A person who, in giving any information to a person(1) If, in England and Wales or Northern Ireland, on exercising functions under this Part, knowingly oran application made by a constable a justice of recklessly makes a statement which is false or

the peace is satisfied that there are reasonable misleading in a material particular is guilty of angrounds for believing- offence.

(a) that a dangerous substance is kept or used in (3) A person guilty of an offence under this sectionany premises but that no notice under section is liable-59 is in force in respect of the premises, or (a) on conviction on indictment, to imprisonment for

(b) that the occupier of any relevant premises is a term not exceeding five years or a fine (or both);failing to comply with any direction given to him andunder section 62 or 63 , and that any of the (b) on summary conviction, to imprisonment for aconditions mentioned in subsection (4) apply, he term not exceeding six months or a fine notmay issue a warrant authorising a constable to exceeding the statutory maximum (or both).enter the premises, if necessary by force, and tosearch them. 68 Bodies corporate

(2) If, in Scotland, on an application made by the (1) If an offence under this Part committed by aprocurator fiscal the sheriff is satisfied as mentioned body corporate is shown to have been committedin subsection (1), he may issue a warrant with the consent or connivance of, or to beauthorising a constable to enter the premises , attributable to any neglect on the part of-if necessary by force, and to search them. (a) any officer, or

(3) A constable may seize and retain anything which (b) any other employee of the body corporate who ishe believes is or contains a dangerous substance. in charge of any relevant premises or the access4) The conditions mentioned in subsection (1) are- to any dangerous substance kept or used there,(a) that it is not practicable to communicate with any he, as well as the body corporate, is guilty of the

person entitled to grant entry to the premises; offence and liable to be proceeded against andpunished accordingly.(b) that it is practicable to communicate with a (2) In this section "officer", in relation to a bodyperson entitled to grant entry to the premises butit is not practicable to communicate with any corporate, means-person entitled to grant access to any substance (a) any director, manager, secretary or other similarwhich may be a dangerous substance; officer of the body corporate; or

(c) that entry to the premises will not be granted (b) any person purporting to act in any suchunless a warrant is produced; capacity.

(d) that the purpose of a search may be frustrated (3) Where the affairs of a body corporate areor seriously prejudiced unless a constable managed by its members, this section applies inarriving at the premises can secure immediate relation to the acts and defaults of a member inentry to them. connection with his functions of management asif he were a director of the body corporate .

67 Offences(1) An occupier who fails without reasonable excuse

to comply with any duty or direction imposed onhim by or under this Part is guilty of an offence.



25/28

Appendix A: RESTRICTEDPart 769 Partnerships and unincorporated (6) If an offence under this Part committed by an

associations unincorporated association is shown to have(1) Proceedings for an offence alleged to have been been committed with the consent or connivance

committed by a partnership or an unincorporated of, or to be attributable to any neglect on theassociation must be brought in the name of the part of-partnership or association (and not in that of any (a) any officer, orof its members). (b) any employee of the association who is in charge(2) A fine imposed on the partnership or association of any relevant premises or the access to anyon its conviction of an offence is to be paid out dangerous substance kept or used there,of the funds of the partnership or association. he, as well as the association, is guilty of the(3) Rules of court relating to the service of documents offence and liable to be proceeded against andare to have effect as if the partnership or punished accordingly.association were a body corporate . (7) In subsection (6) "officer", in relation to any(4) In proceedings for an offence brought against the association, means-partnership or association- (a) any officer of the association or any member of(a) section 33 of the Criminal Justice Act 1925 (c. its governing body; or86) and Schedule 3 to the Magistrates' Courts (b) any person purporting to act in such a capacity.Act 1980 (c . 43) (procedure) apply as they do inrelation to a body corporate; 70 Denial of access: appeals(b) sections 70 and 143 of the Criminal Procedure (1) There shall be a commission, to be known as the(Scotland) Act 1995 (c. 46) (procedure) apply as Pathogens Access Appeal Commission.they do in relation to a body corporate;

(2) Any person aggrieved by directions given under(c) section 18 of the Criminal Justice (Northern section 64 may appeal to the Commission .Ireland) Act 1945 (c. 15 (N.I.)) and Schedule 4to the Magistrates' Courts (Northern Ireland) (3) The Commission must allow an appeal if it considersOrder 1981 (S .I. 1981/1675 (N. I. 26)) that the decision to give the directions was flawed(procedure) apply as they do in relation to a when considered in the light of the principlesbody corporate. applicable on an application for judicial review.

(5) If an offence under this Part committed by a (4) A party to any appeal under this section whichpartnership is shown to have been committed the Commission has determined may bring awith the consent or connivance of, or to be further appeal on a question of law to-attributable to any neglect on the part of- (a) the Court of Appeal, if the first appeal was heard

(a) a partner or a person purporting to act as a in England and Wales; (b) the Court of Session,partner, or (b) any employee of the partnership if the first appeal was heard in Scotland; orwho is in charge of any relevant premises or the (c) the Court of Appeal in Northern Ireland, if theaccess to any dangerous substance kept or used first appeal was heard in Northern Ireland.there, he, as well as the partnership, is guilty of (5) An appeal under subsection 0 may be broughtthe offence and liable to be proceeded againstand punished accordingly. only with the permission of-

22 RESTRICTED


26/28


(a) the Commission; or(b) where the Commission refuses permission, thecourt to which the appeal would be brought.(6) Schedule 6 (constitution of the Commission and

procedure) has effect.71 Other appeals(1) Any person who is required to do any act in

response to-(a) any notice under section 60, or(b) any directions under section 62 or 63,

may appeal to a magistrates' court against therequirement on the ground that, having regard toall the circumstances of the case, it isunreasonable to be required to do that act.

(2) An appeal may not be brought after the end ofthe period of one month beginning with the dayon which the notice or directions were given.

(3) If the magistrates' court allows the appeal,it may-

(a) direct that the required act need not be done; or(b) make such modification of the requirement as it

considers appropriate.(4) An appeal shall lie to the Crown Court against

any decision of the magistrates ' court.(5) Subsections (1) to (3) apply to Scotland with the

substitution for references to the magistrates'court of references to the sheriff.

(6) The appeal to the sheriff is by way of summaryapplication.

(7) A further appeal shall lie-(a) to the sheriff principal from the decision of the

sheriff; and(b) with the leave of the sheriff principal, to the Court

of Session from the decision of the sheriff principal.(8) In the application of this section to Northern

Ireland references to a magistrates' court are toa court of summary jurisdiction.

RESTRICTED

72 Giving of directions or noticesAny direction or notice under this Part may begiven by post.

73 Orders and regulations(1) The power to make an order or regulations under

this Part is exercisable by statutory instrument.(2) A statutory instrument containing an order under

section 58 shall not be made unless a draft of ithas been laid before and approved by a resolutionof each House of Parliament.

(3) A statutory instrument containing(a) an order under section 61, or(b) regulations under section 58, 59 or 61 , shall be

subject to annulment in pursuance of aresolution of either House of Parliament.

74 Interpretation of Part 7(1) In this Part-

"act of terrorism" has the same meaning as inthe Terrorism Act 2000 (c. 11); "chief officer ofpolice" means-

(a) in relation to any premises in Great Britain, thechief officer of police for the area in which thepremises are situated; and

(b) in relation to any premises in Northern Ireland,the Chief Constable of the Police Service ofNorthern Ireland;"dangerous substance" has the meaning given insection 58;"direction" means a direction in writing; "notice"means a notice in writing;"occupier" includes a partnership or unincorporatedassociation and, in relation to premises that areunoccupied, means any person entitled to occupythe premises;"prescribed" means prescribed in regulationsmade by the Secretary of State; and"relevant premises" has the meaning given insection 60.

R E S T RIC T ED 23


27/28

24

Appendix A:Part 7(2) In this Part references to measures taken to ensure

the security of any dangerous substance are to beconstrued in accordance with section 60.75 Power to extend Part 7 to animal or plant

pathogens, pests or toxic chemicals(1) The Secretary of State may, in relation to

anything to which this section applies, make anorder applying, or making provision correspondingto, any provision of this Part, with or withoutmodifications.

(2) This section applies to-(a) toxic chemicals (within the meaning of theChemical Weapons Act 1996 (c. 6)) ;(b) animal pathogens;(c) plant pathogens; and(d) pests.(3) The power under this section may be exercised

in relation to any chemical only if the Secretaryof State is satisfied that the chemical could beused in an act of terrorism to endanger life orcause serious harm to human health .

(4) The power under this section may be exercisedin relation to any pathogen or pest only if theSecretary of State is satisfied that there is a riskthat the pathogen or pest is of a description thatcould be used in an act of terrorism to cause-

(a) widespread damage to property;(b) significant disruption to the public; or(c) significant alarm to the public.

RESTRICTED

(5) An order under this section may-(a) provide for any reference in the order to an

instrument or other document to take effect as areference to that instrument or document asrevised or re-issued from time to time;

(b) make different provision for different purposes;and

(c) make such incidental, supplementary andtransitional provision as the Secretary of Statethinks fit.

(6) A statutory instrument containing an order underthis section shall not be made unless a draft of ithas been laid before and approved by a resolutionof each House of Parliament.

RESTRICTED


28/28

Appendix B:Schedule 5PATHOGENS AND TOXINS (VIRUSES)

Chikungunya virusCongo-crimean haemorrhagic fever virusDengue fever virusEastern equine encephalitis virusEbola virusHantaan virusJapanese encephalitis virusJunin virusLassa fever virusLymphocytic choriomeningitis virusMachupo virusMarburg virusMonkey pox virusRift Valley fever virusTick-borne encephalitis virus (Russian SpringSummer encephalitis virus)Variola virusVenezuelan equine encephalitis virusWestern equine encephalitis virusYellow fever virus

RICKETTSIAEBartonellaquintana (Rochalimea quintana, Rickettsiaquintana)Coxiella burnetiiRickettsia prowazekiRickettsia rickettsii

BACTERIABacillus anthracisBrucella abortusBrucella melitensisBrucella suisBurkholderia mallei (Pseudomonas mallei)

RESTRICTED

Burkholderia pseudomallei (Pseudomonaspseudomallei)Chlamydophila psittaciClostridium botulinumFrancisella tularensisSalmonella typhiShigella dysenteriaeVibrio choleraeYersinia pestis

TOXINSAflatoxinsBotulinum toxinsClostridium perfringens toxinsConotoxinMicrocystin (Cyanginosin)RicinSaxitoxinShiga toxinStaphylococcus aureus toxinsTetrodotoxinVerotoxin

Notes1 Any reference in this Schedule to a micro-organism

includes-(a) any genetiC material containing any nucleic acid

sequence associated with the pathogenicity of themicro-organism; and (b) any genetically modifiedorganism containing any such sequence.

2 Any reference in this Schedule to a toxin includes(a) any genetiC material containing any nucleic acid

sequence for the coding of the toxin; and(b) any genetically modified organism containing any

such sequence.3 Any reference in this Schedule to a toxin includes

subunits of the toxin.

DH Security Standards for Laboratories

Documents

Transcript of DH Security Standards for Laboratories