Two of the nation's five biosafety level 4 (BSL-4) labs lack outer-ring security controls to protect against a terrorist attack or theft of some of the world's most dangerous pathogens, such as the Ebola and smallpox viruses, according to a new report from the Governmental Accountability Office (GAO).

In the report, the GAO recommended that the US Centers for Disease Control and Prevention (CDC) implement specific perimeter security controls for all of the country's BSL-4 labs. Currently, the CDC's Select Agent regulations don't specify the perimeter controls that should be in place at the labs, which has resulted in varying security levels among the BSL-4 labs, the report said.

GAO investigators conducted site visits at the labs using a survey that focused on 15 perimeter controls that they said represent a baseline for security at BSL-4 labs. Examples of the controls included barriers to prevent vehicles from approaching the lab, closed-circuit television monitoring, and armed guards at entrances.

Three labs had nearly all of the security controls in place, but one had only four and another had three the controls. Investigators noted that the three labs with the tightest security were subject to additional federal security measures required by other agencies that own or control the labs.

The GAO did not name the labs because of security concerns. However, the Associated Press (AP) in an Oct 16 report said the two labs that scored low on the GAO's security assessment are at the Southwest Foundation for Biomedical Research, a private facility in San Antonio, Tex., and at Georgia State University (GSU) in Atlanta.

Though the CDC's Select Agent regulations don't specify the perimeter controls needed for BSL-4 labs, the school said it has added numerous additional security controls since the GAO's assessment and that it is aggressively addressing the remaining issues.

In a response that accompanies the GAO report, the US Department of Health and Human Services (HHS) wrote that security measures at the labs have been based on risk assessments for each facility and are structured more as performance objectives than as compliance rules.

HHS asked the GAO to address if the 15 security controls it used were research-based. The GAO responded that it has used the security survey in the past and that though the list doesn't represent the only measures that provide perimeter security, it does reflect "common-sense security measures."

HHS said the CDC, along with the US Department of Agriculture, will consult with security experts and the research community to determine what perimeter enhancements are needed at the BSL-4 labs. "The CDC is committed to enhancing security at our nation's BSL-4 laboratories based on risk and sound science, while balancing security enhancements against any impact on the important research being conducted by these laboratories," HHS wrote in its response.