(a) Security.

1. (1) Any registered person must develop and implement a written security plan outlined in 42 C.F.R. § 73.11.
2. (2) Any registered person may not provide another person access to a select agent or toxin, unless the access is approved by the United States Secretary of Health and Human Services or Administrator, following a security risk assessment by the United States Attorney General outlined in 42 C.F.R. § 73.10.

(b) Biosafety. Any person required to register under this part must develop and implement a written:

1. (1) Biosafety plan that is commensurate with the risk of agent or toxin, given its intended use as outlined in 42 C.F.R. § 73.12; and
2. (2) Incident response plan as outlined in 42 C.F.R. § 73.14.