J.1_Physical_Access_to_CDC_Facilities.pdf

� � � � � � � � � � ! � � " � � # $ % & % ' � � � � # � " � () * + , - - � . � $ / � $ � � � 0� �

� 2 3

� 4 � � � � � � 5 3 � � � � � � � � � � � 1 � � � � � � � � � � � 6 � � � 7 � � � 1 � � � � � � � � � � � 8 �

� 9: * ; " � � $ < / $ . ; " = � � � $ < 0� � � � � � � 7 � � � � 2 3

� 4 � � � 6 � � � � 6 � � � � � 5 � � 9@ * ; " � # " A B � � , � < � " � 0> � � �C * ; " � D $ < � � E " F . G � < � H � # � $ < 0� 6 6 � � � 6 � � 6 � � � I � � � 3

� � I 3 � � � � � � P 3 � � Q R I Q S T TU * ; " � " . # � / � � � # � $ < 0� �

1 � 6 � � � � � � � � 7 � � 5 � � � � 6 P � � 3 � �Q S Q V 9W * � $ � < # � $ / % $ < # � � # 0X

� � O 5 3 � � � I � � � � J I Y S Y Z [ T R Z \ Q [ Y ] � � 4 � ?

I � � � � J I Y S Y Z ^ V _ Z S [ V _ ] � ` � � � � � � � � I J � � � 5 � 4 � � � � � � � � � � � 6 6 � � I [ [ S Z Y R R Z Y R S V 9a * � � 5 � �

� � I � � � � � � � 6 � � � � 7 � 5 8 � b � � � 6 � � 3

� � 9 � � � 9 5 � � � � � � � � V V Y 9 � � 6 � � � � �

� 9 ` � 5 � I J � � d� � � 6 � � � � 5 � 6 6 e e f g h g i g j k g l m n o p o q r l n q s s r t m n m u g v w g j k t h n i x n y z k { | } l m q j k g l q j ~ p z l g q l g f g w z l m i t � v x { p f � �

Category: Security, General Administration Policy #: CDC-SA-2011-02 Date of Issue: 6/28/2011, Updated 1/2/2018 Proponents: Office of Safety, Security, and Asset Management (OSSAM) Application: Domestic Locations Applicable Staff: All CDC Employees, Non-Employees, and Visitors

PHYSICAL ACCESS TO CDC FACILITIES

Sections: 1. PURPOSE AND SCOPE

2. BACKGROUND

3. POLICY

4. RESPONSIBILITIES

5. REFERENCES

6. ACRONYMS

7. DEFINITIONS

Appendices: A. PHYSICAL ACCESS TO CDC FACILITIES

PROCEDURES GUIDE

B. U.S. CITIZEN ACCESS REQUEST

C. ACCESS GUIDELINES FOR HIGH-RISK RESTRICTED

AREAS WITH AND WITHOUT SELECT AGENTS AND

TOXINS

D. SPECIAL VISITOR CATEGORIES

E. STRATEGIC NATIONAL STOCKPILE (SNS) ACCESS

CONTROL PROCEDURES

1. PURPOSE AND SCOPE

This policy establishes the requirements needed to obtain physical access to facilities leased or owned by the Centers for Disease Control and Prevention (CDC)1 in the United States and its territories. The policy applies to all CDC organizations and to all CDC employees,2 non-employees,3 and all visitors to CDC facilities.

NOTE: This policy does not cover CDC employees or locally employed staff in international locations. The United States Department of State (DoS) and the Regional Security Officer coordinate access to CDC facilities overseas.

1 References to CDC also apply to the Agency for Toxic Substances and Disease Registry (ATSDR).

2 For the purposes of this policy, “employees” consists of members of the civil service, Commissioned Corps officers, and locally employed staff. For more information on these categories, refer to “Employee Categories (Updated March 2017),” available at: http://intranet.cdc.gov/ocio/docs/systems-tools/Employee_Category_Definitions.pdf.

3 For the purposes of this policy, “non-employees” are individuals who provide consistent services to CDC, maintain a regular presence on a CDC facility, or have been issued a physical or logical access credential and are funded by CDC-managed appropriations. As used in this policy, non-employees includes groups of individuals such as guest researchers, contractors, Intergovernmental Personnel Act (IPA) personnel, or students. For more information on these categories, refer to “Non-Employee Categories (Updated March 2017),” available at: http://intranet.cdc.gov/ocio/docs/systems-tools/Non- Employee_Category_Definitions.pdf.

http://intranet.cdc.gov/ocio/docs/systems-tools/Employee_Category_Definitions.pdf http://intranet.cdc.gov/ocio/docs/systems-tools/Employee_Category_Definitions.pdf http://intranet.cdc.gov/ocio/docs/systems-tools/Non-Employee_Category_Definitions.pdf http://intranet.cdc.gov/ocio/docs/systems-tools/Non-Employee_Category_Definitions.pdf

2. BACKGROUND

CDC hosts, employs, and contracts with many individuals and organizations from around the world. In accordance with Federal Management Regulation (FMR), Subchapter C, 102-74, CDC established these procedures and general information designed to protect government property;

protect CDC’s work from unintentional contamination; control access to certain areas and materials; protect sensitive information; and to ensure the health, safety, and security of employees, non-employees, and visitors to CDC facilities.

3. POLICY

All individuals requesting physical access to CDC facilities (leased, owned, or contracted space) and their hosts must follow entrance requirements identified in this policy.4 All visitors present at CDC facilities must follow all applicable CDC policies and procedures. Additional visitor responsibilities are found in Section 4 Responsibilities, Part C of this policy.

Persons physically accessing a CDC-controlled facility or area must either have authorized access or be escorted. Persons without a Physical Access Only Card (Corporate 1000 badge), an HHS/CDC Personal Identification Verification (PIV) Credential, or a temporary visitor badge will be allowed unescorted access only to escort-free areas.

Persons with authorized access must ensure that persons who do not have access authorization are not permitted entry into restricted areas. Unauthorized persons may be recognized by the absence of an approved CDC badge.

Persons escorting visitors must present their own credentials to physical access control system readers to facilitate visitor entrance into access controlled areas.

NOTE: CDC employees and contractors with Smart Card access should not permit any individual to accompany them (piggyback) through any physical access control point.

Exception: Access is permitted for an escorted individual who is cleared but does not have a Smart Card.

Violations of this policy will result in disciplinary action, the severity of which can vary depending upon the nature of the infraction. These disciplinary actions can include dismissal for CDC employees, invoking contractual remedies up to and including termination of contracts, and immediate and permanent withdrawal of access privileges for visitors, as provided by 5 Code of Federal Regulations (CFR) Part 752, Adverse Actions, December 4, 2009.

Additional procedures for physical access can be found in Appendix A.

A. Special Access Categories

1. Children (Under Age 18) – The CDC workplace is generally not designed for children.

However, various exceptions for bringing children to CDC facilities are allowed or encouraged, such as “Bring Your Son or Daughter to Work Day” and educational programs and tours. For safety reasons, children are not permitted to enter any high-risk https://www.gsa.gov/portal/ext/public/site/FMR/file/Part102-_74.html/category/21859/#wp2017554 https://www.law.cornell.edu/cfr/text/5/part-752 https://www.law.cornell.edu/cfr/text/5/part-752 restricted area. Examples of these areas are specified in Section 7 below. Special procedures for children are discussed in Appendix D.

2. Compliance Inspectors – CDC laboratories are routinely inspected by internal and external agencies. Special proceedures and escort ratios for compliance inspectors are discussed in Appendix D.

3. Educational Programs and Tours – Visitors may participate in prearranged, pre-approved educational programs and tours of CDC facilities; however, children must be escorted by parents, chaperones, or other adult sponsors. Groups must be accompanied by a CDC employee for any part of the program or tour that occurs outside of designated escort-free areas. Escort- free areas includes touring the Global Health Odyssey Museum, presentations open to the general public located at the Tom Harkin Global Communications Center (Building 19, Roybal Campus), or other similarly defined areas nationwide.

4. Non-U.S. Citizens – The CDC Office of Safety, Security, and Asset Management (OSSAM), Public Health Intelligence Office (PHIO) must review and approve access to all CDC facilities by all non-U.S. citizens who are invited to CDC. Requests for approval must meet all of the deadlines and other requirements of the Non-U.S. Citizen Access Management System (NCAMS). Non-U.S. citizens may not enter high-risk restricted areas or select agents and toxins areas without pre-authoriziaton (please see Appendix C and the NCAMS Policy for more information).

B. Special Access Locations

Please see Appendix C for additional information regarding access requirements for high-risk restricted areas with and without select agents and toxins.

1. Non-Select Agents and Toxins Laboratory Area – Each laboratory supervisor is responsible for the safety of visitors to his or her laboratory or work area. If applicable, proof of required training and medical clearances must be submitted to the laboratory supervisor prior to a visit. All visitors entering a laboratory building and/or participating in a tour of a laboratory must be approved by the responsible division director or designee.

Please see the Office of Infectious Diseases (OID) and National Center for Environmental Health and Agency for Toxic Substances and Disease Registry (NCEH/ATSDR) Laboratory Tour Policy for more information regarding tours of OID and NCEH/ATSDR labs. Hosts for laboratory areas must be a laboratory scientist with access to the laboratory.

2. Select Agents and Toxins Laboratory Area – Special requirements apply to anyone who might have access to select agents and toxins. Individuals who work with select agents and toxins and request access to laboratories require a Department of Justice Security Risk Assessment (SRA) prior to approval.

Individuals that have unescorted access to select agents and toxins or the ability to gain access to select agents and toxins must have an SRA approval. In addition, they must meet all training and access requirements, to include but not limited to personal protective equipment or immunization requirements. For more information, contact the Office of the Associate Director for Laboratory Science and Safety (OADLSS), Office of Laboratory Safety, Select Agent Compliance Team.

http://masoapplications.cdc.gov/Policy/Doc/policy610.pdf http://intranet.cdc.gov/nceh-atsdr/dls/pdf/09/DLSLaboratoryTourPolicy.pdf

4. RESPONSIBILITIES

A. CDC Hosts

• General Requirements – Hosts of visitors to CDC facilities are responsible for the actions of persons whom they have invited to visit CDC facilities. Generally, hosts must:

o Substantiate the purpose of the visit o Submit an access request pursuant to the procedures listed in Appendix B o Inform their CDC supervisor of the visit access request and obtain supervisory approval for the visit o Follow all procedures for pre-visit authorization of the visitor, as described in

Appendix A of this policy o Ensure the visitor does not have unauthorized or unintentional access to sensitive information or materials o Ensure the visitor is aware of and agrees to follow visitor policies and procedures, as outlined in this document and other applicable CDC security/health and safety policies and procedures o Serve, or identify someone to serve, as the visitor’s escort and carry out escort responsibilities described below in Section 4, Part B for areas where the visitor must be escorted NOTE: Escorts for visitors in select agent areas must be SRA-approved individuals for the registered area.

• Non-U.S. Citizen Requirements – Hosting a visiting non-U.S. citizen at CDC requires additional security considerations. The OSSAM intranet site provides helpful information about host training and visits by non-U.S. citizens. (Also see MISO OnDemand

NCAMS.)

NOTE: Please contact OSSAM/PHIO for any clearance or approval discrepancies regarding non-U.S. citizen visitors.

B. Escorts

• General Requirements – All escorts must:

o Remain with visitors at all times o Have authorized access to area(s) being visited o Visit only those areas designated in the approved request o Be knowledgeable about area(s) in which the visitor will be escorted o Ensure that visitor registers are completed where applicable o Ensure that the visitor wears his our her temporary badge above the waist and in plain view o Ensure that the visitor’s temporary badge is given to security at the end of each work day or upon expiration o Inform the visitor of CDC policy requirements, articles, or behaviors that are prohibited on CDC premises and explain to the visitor which areas they are authorized to enter without an escort and those areas that require an escort o Inform the visitor of safety, security, and emergency response procedures specific to the area prior to permitting the visitor entry o Ensure that visits to select agent registered areas are properly documented on the Visitor’s Register for the area http://intranet.cdc.gov/ossam/security-access/visitors/index.html http://intranet.cdc.gov/misotrain/ncams.html http://intranet.cdc.gov/misotrain/ncams.html o Escort all visitors to the Visitor’s Center at the end of their visit and ensure that visitors are not unescorted at their departure o Notify the Security Services Office (SSO) or the local security representative if visitor(s) and escort will remain beyond normal business hours in a restricted area or high-risk restricted area for which they are not normally authorized o Ensure visitors comply with the prohibitions against accessing any CDC information technology networks or hardware described in Section 4, Part C below; not take any such actions on behalf of a visitor; and contact their Information System Security Officer regarding questions, exceptions, or other issues related to this requirement

• Restricted Areas – Escorts must ensure persons who have a need-to-know and permission to access an area, but not electronic access authorization, are escorted in restricted areas of CDC facilities and comply with the information regarding high-risk restricted areas can be found in Appendix C.

NOTE: This requirement applies to visitors; any person with a background investigation that has not yet been favorably adjudicated; personnel who must enter an area for maintenance, repair, or cleaning but are not cleared for access; all others without a PIV credential and cardkey that gives them electronic access to a specific area; and select agent and toxin registered areas.

• Transfer of Visitor Control – The originating escort must ensure that the new escort is aware of escort responsibilities if control of a visitor is transferred to another authorized escort. If visitor registers require the escort to sign in with the visitor (such as, for entrance to laboratories), the new escort, originating escort, and visitor must complete appropriate logs upon transfer of escort, so that the visitor signs out under the originating escort and in under the new escort.

C. Visitors

All visitors must:

• Display appropriate temporary badge or other identifying credentials as established by the CDC security policy NOTE: All individuals within CDC facilities must wear their badge in plain sight, above the waist. For additional information regarding visitor badges, see OSSAM’s intranet site, Temporary Badges.

• In addition to the CDC-issued temporary visitor badge, all visitors must have their government-issued photo identification (ID) available for verification upon request by security personnel while on CDC campuses or in CDC facilities

• Be escorted by an authorized person, unless the visit is limited to the facility’s escort-free areas or routine unescorted access is granted by SSO

• Sign applicable visitor registers upon entrance to CDC facilities and as required by security personnel for access to a particular area

• Comply with all directives of safety officers or security personnel and adhere to any requirements that are imposed upon an individual or a particular area

• Adhere to prohibitions on photographing the interior or exterior of CDC buildings and facilities from within the confines of CDC property, with few exceptions NOTE: For additional guidance on photography at CDC, please refer to CDC-GA-2012- 13, Photography, Videography, and Audio Recordings on CDC Facilities Policy.

http://intranet.cdc.gov/ocio/help-desks-contacts/ISSO-security-officer/index.html http://intranet.cdc.gov/ocio/help-desks-contacts/ISSO-security-officer/index.html http://intranet.cdc.gov/ossam/security-access/smart-cards/temporary-badges/index.html http://masoapplications.cdc.gov/Policy/Doc/policy466.pdf

• Comply with all other applicable HHS and CDC policies and computer or Internet use policies, see CDC Policies NOTE: For those visitors with access to select agents and toxins: policies and procedures related to select agents and toxins, see CDC Internal Select Agent Program and the Select Agents and Toxins Compliance Policy.

• Submit to searches as requested by security personnel, including searches of their person, personal effects, and vehicles

• Not use, or connect to, any CDC information technology hardware or networks, with the exception of the CDC guest wireless network (where available) NOTE: This prohibition includes not connecting computers, smartphones, storage media, or any other devices to CDC information technology systems.

D. Supervisors

• General Requirements – All Supervisors must:

o Ensure their workforce meets all applicable requirements for accessing CDC facilities (such as, immunizations, personal protective equipment, knowledge of procedures, and appropriate training) and must understand and comply with all CDC access policies and procedures o Counsel their employees and remind them of the responsibilities and procedures of this policy for any known infractions or other violations of this policy o Ensure that all visitors entering a laboratory building or participating in a tour of a laboratory are approved by the responsible division director or designee in order to ensure that scheduled laboratory work can continue uninterrupted (see Division of Laboratory Science’s Laboratory Tour Policy) NOTE: Hosts for lab areas must be a laboratorian or scientist with access to the lab.

• Non-Select Agents and Toxins Laboratory Area – Each laboratory supervisor is responsible for the safety of visitors to his/her laboratory or work area, including determining that applicable training and immunization requirements have been met and that appropriate personal protective equipment is used in areas where necessary.

Laboratory supervisors must receive proof of proper medical clearance.

E. Employees

• Abide by the guidelines of this policy

F. Contracting Officer Representative

• Ensure their respective contract staff providing service to their office meet and comply with all applicable requirements for accessing CDC facilities (such as, immunizations, personal protective equipment, knowledge of procedures, and appropriate training) and must understand and comply with all CDC access policies and procedures

5. REFERENCES

A. 5 C.F.R. § 752 (2009).

B. CDC, CDC-SA-2014-02, Non-U.S. Citizen Access Management Policy, last modified July 6, 2017, http://masoapplications.cdc.gov/Policy/Doc/policy610.pdf.

http://masoapplications.cdc.gov/Policy/publicSearch.aspx https://esp.cdc.gov/sites/ocos/oadlss/OLSaf_SelectAgent/SitePages/Home.aspx http://masoapplications.cdc.gov/Policy/Doc/policy562.pdf http://intranet.cdc.gov/nceh-atsdr/dls/pdf/09/DLSLaboratoryTourPolicy.pdf https://www.ecfr.gov/cgi-bin/text-idx?tpl=/ecfrbrowse/Title05/5cfr752_main_02.tpl

C. CDC, CDC-GA-2012-13 Photography, Videography, and Audio Recordings on CDC- Controlled Facilities, last modified October 4, 2012, http://masoapplications.cdc.gov/Policy/Doc/policy466.pdf.

D. CDC, CDC-SM-2011-01 Select Agent and Toxins Compliance Policy, last modified June 7, 2011, http://masoapplications.cdc.gov/Policy/Doc/policy562.pdf.

E. CDC, CDC-GA-2005-02 Use of CDC Information Technology Resources, last modified March 5, 2014, http://masoapplications.cdc.gov/Policy/Doc/policy90.pdf.

F. CDC, Division of Laboratory Sciences: Laboratory Tour Policy, last modified February 27, 2007, http://intranet.cdc.gov/nceh-atsdr/dls/pdf/09/DLSLaboratoryTourPolicy.pdf.

G. CDC, OSSAM Temporary Badge Webpage, CDC, last modified March 1, 2016.

H. Exec. Order No. 13010, as amended by Exec. Order No. 13077 (March 12, 1998).

I. Federal Management Regulation, Subchapter C, Facility Management, FMR Part 102-74

(January 1, 2011).

J. Homeland Security Presidential Directive 7 (December 17, 2003).

K. Presidential Directive 63, Critical Infrastructure Protection (May 22, 1998).

6. ACRONYMS or ABBREVIATIONS

ATSDR – Agency for Toxic Substances and Disease Registry CAC – U.S. Government Agency-issued Common Access Card CDC – Centers for Disease Control and Prevention CFR – Code of Federal Regulations DoS – Department of State FIPS – Federal Information Processing Standards FMR – Federal Management Regulation FSAP – Federal Select Agent Program FTE – full-time equivalent (employee) HHS – Department of Health and Human Services IACUC – Institutional Animal Care and Use Committee ID – Identity document MISO – Management Information Systems Office NCAMS – Non-U.S. Citizen Access Management System OADLSS – Office of the Associate Director for Laboratory Science and Safety OHSO – Occupational Health and Safety Office OID – Office of Infectious Diseases OPDIV – Operating Division OADLSS – Office of the Associate Director for Laboratory Science and Safety OSSAM – Office of Safety, Security, and Asset Management PHIO – Public Health Intelligence Office PIV – Personal Identification Verification RSA – Regional Security Officer SF – Standard Form SRA – Security Risk Assessment SSO – Security Services Office USC – United States Code USG – United States Government USDA – United States Department of Agriculture http://masoapplications.cdc.gov/Policy/Doc/policy562.pdf http://masoapplications.cdc.gov/Policy/Doc/policy90.pdf http://intranet.cdc.gov/nceh-atsdr/dls/pdf/09/DLSLaboratoryTourPolicy.pdf http://intranet.cdc.gov/ossam/security-access/smart-cards/temporary-badges/index.html http://www.gpo.gov/fdsys/pkg/FR-1998-03-12/pdf/98-6628.pdf https://www.gsa.gov/portal/ext/public/site/FMR/file/Part102-_74.html/category/21859/#wp2017554 http://www.dhs.gov/xabout/laws/gc_1214597989952.shtm http://www.fas.org/irp/offdocs/pdd/pdd-63.htm https://en.wikipedia.org/wiki/IACUC

7. DEFINITIONS

Authorized Person – An individual who has been cleared for physical or logical access to CDC facilities or system and has issued a PIV credential

Children – Persons under the age of 18

Corporate 1000 Badge – A badge for internal physical access badge only

Credential – PIV card and data elements associated with an individual that authoritatively binds an identity and certain attributes to that individual

Critical Infrastructure – Those physical and cyber-based systems essential to the minimum operations of the economy and government, as defined by Executive Order 13010, amended by Executive Order 13077, Presidential Decision Directive 63, and Homeland Security Presidential Directive 7 NOTE: All CDC facilities are considered critical infrastructure

Designated Country – A country deemed sensitive for national security reasons (inclusion on the list is subject to change; SSO and the HHS Office of Security and Strategic Information [OSSI] maintain the current list of designated countries)

Escort – An employee who assumes responsibility for a visitor to CDC facilities and who accompanies the visitor, maintaining visual and voice contact at all times, in all non-escort-free areas or areas to which the visitor is not permitted independent access

Escort-Free area – Area requiring no escort (for example, the Roybal Campus Building 19 Visitors Area; Roybal Micro-Market, Building 21; CDC Credit Union; or any other similar area officially designated as such by SSO or at the field sites by the local security office or representative) NOTE: CDC properties that have controlled access require all personnel to wear a badge denoting their status (FTE, Contractor, Temporary, or Visitor) prominently displayed above the waist NOTE: Building 16 Cafeteria is not a designated escort–free area due to its location within the campus

Facility – CDC-owned or -leased campus or building

HHS/CDC PIV Credential – an HHS OPDIV-issued, fully FIPS-201 PIV-I and PIV-II compliant, PIV Credential valid for identity verification U.S. Government-wide

High-Risk Restricted Area – Area where high-risk hazards are present, including: select agents and toxins area, laboratory area (as defined below), animal facility, cage cleaning and storage area, engineering shop, power plant, electrical/mechanical equipment room, loading dock, shipment receiving area, vehicle maintenance area, grounds equipment storage area, construction area, incinerator area, underground pipe chase way, tunnel, mine, rooftop, warehouse, materials storage area, or any other area deemed high-risk by management in the Asset Management Services Office, the local facilities representative, management in the OHSO, OADLSS, or safety officer, and/or SSO or the local security office or representative

1) Laboratory Area – Laboratory, laboratory support, and/or storage areas; laboratory corridors; stairwells; offices within laboratories; equipment rooms (such as the freezer, autoclave, and radiation instrument rooms); and any other areas designated by management as being within a laboratory area

2) Select Agents and Toxins Area – High-risk restricted area containing select agents and toxins, often called an “exclusion area”

Host – CDC employee who invites and is responsible for a visitor (U.S. or non-U.S. citizen) present on CDC facilities

Need for Access – Necessity for access to, knowledge of, or possession of specific official information required to carry out official duties

Non-PIV Cardkey – Legacy Cardkey proximity card with a non-PIV cover (no photo) issued to allow electronic access to CDC facilities

Non-U.S. Citizen (Foreign National) – Person who is not a United States citizen, including lawful permanent residents or “green card” holders

NCAMS Approver – PHIO/NCAMS employee responsible for reviewing and approving visit access requests for non-U.S. citizens visiting CDC facilities

Personal Identification Verification (PIV) Credential – HHS physical badge (not paper) issued to an individual that contains stored identity credentials so that the claimed identity of the cardholder can be verified against the stored credential by a person or an automated process

Physical Access Only Card (Corporate 1000) – A CDC-issued credential (compliant with applicable portions of FIPS-201 PIV-I and PIV-II), valid for identity verification only within a CDC controlled facility

Principal Investigator – Individual or scientist who is responsible for select agents and toxins material control, accountability, and material transfer

Requester – CDC employee or non-employee who initiates a request in NCAMS for a non-U.S.

citizen

Responsible Official – The official who has the authority and responsibility to ensure compliance with regulations 42 CFR Part 73, 7 CFR Part 331, and 9 CFR Part 121 for the possession, use and transfer of select agents and toxins at a CDC facility

Restricted Area – Any area not otherwise identified as an escort-free area or high-risk restricted area

Safety Officer – OHSO, OADLSS, or center or office staff person who is assigned center- or office-wide, division, field location, or other work unit responsibilities relating to health, safety, and environmental issues

Select Agents or Toxins – Unless otherwise specified, all of the biological agents or toxins listed in Title 42 CFR 73.3 and 73.4 http://ecfr.gpoaccess.gov/cgi/t/text/text-idx?c=ecfr&tpl=/ecfrbrowse/Title42/42cfr73_main_02.tpl

Security Risk Assessment (SRA) Approval – Approval by the U.S. Department of Justice for access to select agents and toxins at the facility

State-Sponsors-of-Terrorism Countries – Countries determined by the Secretary of State to have repeatedly provided support for acts of international terrorism NOTE: For additional information and the current list of state-sponsor-of-terrorism countries, refer to U.S. DoS: State Sponsors of Terrorism website.

Unescorted Access – Approved temporary access that does not require a visitor to be accompanied by an authorized CDC host or escort

U.S. Citizen – Person who either was born in the United States, its territories, or its possessions or was granted naturalization in accordance with federal laws

Unsolicited Visitor – Individual who approaches CDC and requests an invitation to visit

Visa Requirements – Conditions necessary to obtain a document that allows the individual to travel to a U.S. port of entry, airport, or land border crossing and request permission of the Department of Homeland Security to enter the United States NOTE: Please refer to the Department of State Visa website for more information.

NOTE: Certain Visa types are restricted from access to high-risk restricted, laboratory, and select agents and toxins areas.

Visit Access Request – Request for visitor access made to SSO that includes certain information outlined in the appendices of this policy

Visitor – Person who does not have officially authorized access to CDC facilities or a particular area of CDC facilities NOTE: Employees and contractors are considered visitors if they do not have authorized access to a CDC facility.

1) Business Visitor – Individual/affiliate who will be on site to conduct CDC-related business (meetings, conferences, inspections, interviews, training)

2) Personal Visitor – Individual who is not conducting CDC-related business, requires infrequent access to CDC facilities, and who will not create undue hardship if an escort is required (CDC credit union member, spouse, child, friend or other relative of a CDC employee, or contractor)

Visitor Register – A log book containing visitor sign-in sheets located at strategic checkpoints throughout CDC facilities http://www.state.gov/j/ct/list/c14151.htm https://travel.state.gov/content/travel/en.html https://travel.state.gov/content/travel/en.html

APPENDIX A

PHYSICAL ACCESS TO CDC FACILITIES PROCEDURES GUIDE

The following procedures are considered part of the policy requirements.

The procedure used to authorize physical access to CDC-owned and -leased facilities varies according to the nature of the visit, length of stay, and the restrictions imposed by specific facility areas. It is important that CDC employees and non-employees follow and adhere to the procedures of this policy before inviting anyone to enter CDC facilities. Field locations (within the United States and its territories) may impose additional procedures or site-specific requirements provided they are no less stringent than those outlined in this policy. Field locations may request exceptions to this policy from the Director, Security Services Office (SSO) and/or the field supervisor. These exceptions should be included in the field location’s physical access policy. The Department of State and the Regional Security Officer handle the clearance of CDC personnel and locally employed staff for access to CDC offices and facilities in non-U.S.

territories.

A. General Requirements by Visit Type (Business and Personal Visitor)

1) Pre-Authorization Requirements for Business and Personal Visitors:

U.S. Citizens – Atlanta Campuses: Pre-approval by the SSO and the host’s supervisor is recommended in order to expedite entry. Field Locations: Pre-approval by either a SSO representative on site or local security representative and host’s supervisor is recommended.

NOTE: Advance notice is not required for entry to the Roybal Campus, Global Health Odyssey Museum.

Steps for Pre-Authorization

a) Atlanta Campuses: Submit access request via email to SSO at cdcsecurit@cdc.gov prior to the visit. Field Locations: Submit access request to the SSO representative on site or local security representative prior to visit by following the procedures as provided in Appendix B.

b) Sign in at all visitor registers and provide approved ID (such as, driver’s license, passport, military ID, or USG agency-issued Common Access Card [CAC]) or other photo ID (student or employment) until a favorable adjudication of the appropriate background investigation is obtained from SSO and a PIV credential can be issued.5

c) Visits of 45 Days or More but Less than 180 Days: The visitor must provide fingerprints to a CDC SSO Personnel Security Specialist or equivalent authority at field locations. A CDC Corporate 1000 badge will be issued based upon the return

5 Other acceptable ID for U.S. citizens may include non-driver’s official state ID or other photo ID (student or employment), as determined by SSO. For non-U.S. citizens, a valid country passport, Employment Authorization Document (EAD) card, or Lawful Permanent Residence card (LPR or “green card”) indicating permanent U.S.

residency is required. United Nations laissez-passer passports are invalid identification for security purposes.

NOTE: A USG Agency-issued CAC PIV credential is a FIPS-201-compliant PIV credential and is acceptable with an approved access request for both U.S. and non-U.S. citizens.

mailto:cdcsecurit@cdc.gov of a satisfactory suitability determination. Physical access will be assigned to an individual in accordance with CDC policies and procedures.

d) Visits of 180+ Days: Submit a Standard Form (SF)-85, Questionnaire for Non-

Sensitive Positions, to a CDC SSO Personnel Security Specialist or equivalent authority at field locations if it is anticipated that a business visitor will need routine unescorted access to working areas and will be on site more than 180 days within one year.

e) Business visitors who intend to work unescorted in select agent registered laboratories must also complete select agent access requirements to include SRA approval requirements. For more information, contact the Roybal Campus Responsible Official.

NOTE: In the case of visits greater than 45 days, SSO may approve access when fingerprints cannot be submitted prior to the visit. This will afford the visitor the opportunity to complete the requested paperwork and schedule a fingerprinting appointment. If a fingerprinting appointment is not scheduled before the visitor has accessed CDC facilities for more than five business days, further access will be denied. Exceptions must be approved by SSO. In the case of visits less than 45 days, individuals will be treated as visitors and will be escorted by a badged employee. If unescorted physical access is required, individuals will be subject to fingerprinting (such as, construction supervisors, project managers).

Non-U.S. Citizen (Atlanta/Field Locations):

(In addition to “a” through “e” above)

f) All non-U.S. citizens, regardless of status, must be processed through the Non-U.S.

Citizen Access Management System (NCAMS) prior to gaining physical or logical access to CDC facilities or networks.

g) All non-U.S. citizens must be approved by OSSAM/PHIO and Human Resources Office/Executive and Scientific Resources Office through NCAMS.

See the Non-U.S. Citizen Access Management System Policy for more information.

2) Exemptions

a) Visitors to Non-Select Agents and Toxins Areas – Exceptions to the advance notification requirement for access by business visitors to restricted areas or high-risk restricted areas without select agents and toxins must be obtained in advance from the center or division director with coordination through OADLSS, and be forwarded to SSO, the SSO representative on site, or the local security representative for final approval.

b) Personnel Without Electronic Access Authorization – If a person has been cleared by SSO, the SSO representative on site, or the local security office representative and issued a cardkey to accompany his or her electronic access authorization, then he or she is allowed general access to CDC facilities at other geographic locations. However, personnel without specific clearances to secure or high-risk areas or designated labs shall be escorted by a properly cleared/authorized CDC employee.

3) Visit Hours Permitted

General Visitors Hours - Monday through Friday, 7:00 a.m. to 6:00 p.m., or as set by the field location. Visitors may be allowed access outside of these hours with pre-approval. Weekend and holiday access will not be granted to personal visitors. On a case by case basis, weekend access may be granted with preapproval from SSO.

Business Visitors Hours – May have access at any time with a PIV credential and approval for unescorted access if approved by host and authorized by either SSO, or the local security representative. If a PIV credential has not been issued, then an escort is required which must be coordinated with host.

4) Areas Requiring Escort

All areas that are not designated as escort-free areas require an escort; additional exceptions apply for children (See Appendix C – Special Visitor Categories).

5) Type of Badge Issued

a) Personal Visitor - Issued a temporary CDC visitor badge without a photo and the badge does not provide cardkey access; however an escort is required

b) Business Visitor -

i. Issued a temporary CDC visitor badge without a photo and the badge does not provide cardkey access; business visits are generally limited to five business days only and an escort is required NOTE: Temporary Visitor badges can be extended up to 45 business days.

ii. If the visitor requires access for more than 45 business days:

• Less than a 180 Day Period: CDC Physical Access Only Card

(corporate 1000) to adjudicated candidates (fingerprints only)

• More than 180 Days: HHS/CDC PIV Credential to adjudicated candidates with completed National Agency Check with Inquiries (NACI)

NOTE: Submit SF-85, Questionnaire for Non-Sensitive Positions, to a CDC SSO Personnel Security Specialist or equivalent authority at field locations if it is anticipated that a business visitor will need routine unescorted access to working areas and will be on site more than 180 days within one year.

However, all visitors requiring network access will be processed for a NACI.

http://main.opm.gov/forms/pdf_fill/SF85.pdf

iii. CDC Physical Access Only Card is issued to allow electronic (unescorted) access to CDC facilities.

iv. Enrollment in the entity biometric access system6 is required prior to obtaining unescorted access to select agent registered areas and upon completion of all access requirements. For more information, refer to the Select Agent and Toxins Compliance Policy.

B. Badge/PIV Credential Return

Personal visitors will be issued visitor badges when they arrive on site and must return their badges to the local security office or representative each day as they leave.

Business visitors should return their PIV credentials to SSO, the SSO representative on site, or the local security representative prior to but not later than the expiration date.

C. Visitor-to-Escort Ratios

Area Visitor-to-Escort Ratio (maximum) Personal visitors in non-select agents and toxins areas

5:1 with continuous monitoring

Business visitors in non-select agents and toxins areas

5:1 with monitoring until CDC Internal PIV credential is obtained

Personal visitors in restricted and high-risk restricted areas without select agents and toxins

4:1 with continuous monitoring

Business visitors in restricted and high-risk restricted areas without select agents and toxins

1:1 with monitoring until CDC Internal PIV credential is obtained

Personal visitors are highly discouraged in select agents and toxins areas

N/A

Business visitors in select agents and toxins areas

1:1 with continuous monitoring until SRA approval and issuance of PIV credential

Compliance inspectors in select agents and toxins areas

5:1 with continuous monitoring

6 For unescorted access to a Select Agent area, the individual is required to visit a cardkey office with his/her Smart Card-based PIV Credential, undergo an enrollment process to authenticate the validity of the credential, and enroll his/her fingerprint template into a subsystem of the P2000 system. In order to gain access to the select agent and toxins areas, the individual must be registered in SSO’s biometric access system that utilizes and confirms fingerprints and iris recognition (in some instances) before allowing entry.

http://masoapplications.cdc.gov/Policy/Doc/policy562.pdf

APPENDIX B

U.S. CITIZEN ACCESS REQUEST

In order to expedite entry, CDC personnel should notify SSO Physical Security, cdcsecurit@cdc.gov, or the local facility security representative prior to the date of visit, per the provisions of this policy. This notification should include:

• Visitor's Full Name

• U.S. citizen? (Yes or No)

• Date and Time of Visit

• Campus/Building/Room of Visit

• Entry Point of Visitor

• CDC Point of Contact and Phone Number

• Point of Contact's Campus, Building, and Room

• Escort Name and Contact Number

• Purpose of Visit

NOTE: SSO cannot approve day-of-visit requests for access to laboratory buildings without the permission of OID. Designated OID contacts for day-of-visit approvals for the Roybal Campus in Atlanta can be reached at 404-639-0749 or 404-639-0744. Questions should be directed to OID.

mailto:cdcsecurit@cdc.gov

APPENDIX C

ACCESS GUIDELINES FOR HIGH-RISK RESTRICTED AREAS WITH AND

WITHOUT SELECT AGENTS AND TOXINS

1) Requirements for Access to High-Risk Restricted Areas Without Select Agents and

Toxins

a) All visitors to high-risk restricted areas without select agents and toxins must remain under escort unless the visitor’s required level of background investigation is complete and favorably adjudicated. Visitors to these areas with background investigations at or above the level required for unescorted access may submit (or have their hosts submit) this information to SSO, the SSO representative on site, or the local security office representative in advance of arrival. With his or her supervisor’s approval, a visitor’s host may request unescorted access from SSO, the SSO representative on site, or the local security office representative.

b) The CDC host of a visitor to restricted areas and high-risk restricted areas without select agents and toxins must submit pre-visit documentation as outlined below.

Visitor Type Citizenship Status

Documentation Needed to be Submitted to SSO, the SSO Representative on Site, or the Local Security Office Representative

Days Before Visit Documentation is Required

All Visitors U.S. citizen Access request 3+ business days All Visitors Non-U.S.

citizen Access request 10+ business days

2) Requirements for Access to Area with Select Agents and Toxins

Select Agents and Toxins Laboratory Area – Special requirements apply to any visitor who may have access to select agents and toxins. Access approval for all individuals requesting access to laboratories who work with select agents and toxins may require a Department of Justice Security Risk Assessment Approval (SRA approval). For more information, refer to CDC Internal Select Agent Compliance Program.

a) Personal and Business visitors to select agents and toxins areas are discouraged.

However, if a visit to a select agents and toxins area is strictly limited to non-laboratory type activities (i.e., a guided tour where no access to select agents and toxins is provided) and the visitor(s) remains under escort at all times, access may be granted if pre-visit requirements are met.

b) Business visitors who are already in possession of authorization for select agents and toxins access must have their host submit the appropriate proof and documentation to the Responsible Official (RO) (at least 45 business days in advance of arrival) and receive the RO’s approval. Concurrently, PHIO must receive the request for non-U.S. citizen visit in NCAMS at least 45 days before the visit.

c) The CDC host of a visitor to areas containing select agents and toxins must submit pre-visit documentation as outlined below:

https://esp.cdc.gov/sites/ocos/oadlss/OLSaf_SelectAgent/SitePages/Home.aspx

Visitor Type

Citizenship Status

Approval and Information Needed for Submission

Days Before Visit Submission is Required

Business U.S. citizen

Access Request to SSO, the SSO representative on site, or the local security office representative

RO/Principal Investigator (PI) approval

45+ business days

Business

Non-U.S. citizen from non-designated country

Access Request to SSO, the SSO representative on site, or the local security office representative

SF-85 to SSO or equivalent authority at field locations

RO/PI approval

60+ business days

Business Non-U.S. citizen from designated country

Access Request to SSO, the SSO representative on site, or the local security office representative

SF-85 to SSO RO/PI approval

75+ business days

Personal U.S. citizen N/A

Personal Non-U.S. citizen N/A

3) Exemptions

a. Visitors to select agents and toxins areas – Exceptions to advance notification requirements for access by business visitors to select agents and toxins areas must be obtained in advance from the Center or Division Director, PI, the RO, and SSO, the SSO representative on site, or the local security representative.

b. Exemptions – Inspections to select agents and toxins areas – The 5:1 ratio will apply during inspections that include multi-disciplinary review which results in many inspectors (e.g., FSAP, OADLSS, OHSO) entering the space at the same time

c. Exemptions – Maintenance to select agents and toxins areas – The 5:1 ratio will apply during maintenance while laboratories are down. Individuals requesting approval for independent access to select agent and toxin areas when the laboratory is down for maintenance must submit a biometric enrollment form to the RO/ARO for approval.

NOTE: All select agent and toxins must be secured during the maintenance.

APPENDIX D

SPECIAL VISITOR CATEGORIES

1) Children (Under Age 18) – Children may be allowed to visit CDC offices not associated with high-risk restricted areas in special situations, such as an employee who experiences a problem with child care and when the child is not ill. In such cases, the CDC employee, working visitor, or contractor who is the child’s parent or guardian must notify his or her immediate supervisor (or host) of the child’s presence and expected time in the workplace.

Supervisors must concur with the amount of time requested for a child to be present;

however, in no case may a child be present for a full workday. As necessary, leave should be granted to the employee so as to attend to the child at home rather than at the workplace.

Generally, children must follow the same procedures as other personal visitors, however, some special requirements must be followed. The CDC employee, working visitor, or contractor who is the parent or guardian of the child is responsible for following these requirements:

a) All children must be signed in at the visitor center by a parent or guardian. Advanced notice to SSO is not required but is recommended.

b) Children under 12 years of age must be under direct supervision of the parent or guardian at all times.

c) Children will not be allowed on campus during public health emergencies unless approved by the Director, CDC.

d) Children 12 years of age or older may visit the restroom without an escort.

e) Children are prohibited from using agency telephones or operating office equipment.

f) Children are not allowed in designated laboratory areas.

2) Compliance Inspectors – CDC laboratories undergo internal and external inspections.

Internal inspections are conducted by internal CDC groups such as OADLSS and IACUC.

External agencies that inspect CDC laboratories include the Association for Assessment and Accreditation of Laboratory Animal Care, Centers for Medicare and Medicaid Services, Federal Select Agent Program, Government Accountability Office, and the Office of the Inspector General.

A 5:1 visitor-to-escort ratio will apply during inspections of select agent registered space by compliance inspectors.

3) Emergency Operations Center (EOC) Tours – All EOC tours require a Division of

Emergency Operations (DEO) Tour Request Form, CDC EOC Tour Request Form, be submitted to DEO Admin Staff a minimum of seven business days in advance. The request form and all questions regarding EOC tours should be sent to eocadminspt@cdc.gov. Non- U.S. citizen visitor tour requests must have PHIO/NCAMS approval before the DEO Tour Request Form will be approved.

4) Media Visits – All requests for media visits must be coordinated with SSO’s Physical Security Branch, SSO representative on site, or the local security representative in advance of the visit. Most media visits shall be conducted in escort-free areas (such as the Roybal Campus Building 19 designated media rooms or the Roybal Campus Global Health Odyssey Museum located in Building 19) or other similar defined areas nationwide. Access https://www.google.com/url?sa=t&rct=j&q=&esrc=s&source=web&cd=12&cad=rja&uact=8&sqi=2&ved=0ahUKEwjD0c2fgP_UAhXHjz4KHdlaAdAQFghWMAs&url=https%3A%2F%2Fwww.cms.gov%2Fclia&usg=AFQjCNGTZ1S4pJPiaIsKEe_5c_z_UGeVjw file://nmtc-t100-srv1/T100srv1/Emergency%20Operations/PORTAL/OPS/Portal%20Links/DEOC%20Tours/EOC%20Tour%20Instructions%20&%20Request%20Form%20as%20of%2008-04-09.doc to all other areas, including external areas that are within the campus perimeter, must be approved and individuals will be escorted while at the facility. Foreign media are not authorized in restricted, high-risk restricted, laboratory, or select agents and toxins areas.

Media representatives identified as non-U.S. citizens must be entered into the NCAMS and approved by OSSAM/PHIO prior to access. The host must ensure all media requests for visits are coordinated through the appropriate/responsible media relations office prior to forwarding visit request to SSO. For guidelines on photography at CDC facilities, refer to CDC-GA-2012-13, Photography, Videography, and Audio Recordings on CDC Facilities Policy.

If there is a request for a last minute media event on campus, please call SSO Physical Security at 404-639-3175…