SSBA Standards Review Public Consultation

Overview

The last decade has seen increasing technology advancements, particularly in artificial intelligence, leading to the need for enhanced cybersecurity and other measures to safeguard national security. It is important that the Australian Government uphold its obligations to support national health security through fit-for-purpose Security Sensitive Biological Agents (SSBA) Standards that work to maintain the security of SSBAs while allowing access to those with a genuine need.

Subsection 35(1) of the National Health Security Act 2007 (NHS Act) provides that the Minister may, by legislative instrument, determine standards relating to the handling of SSBAs.

While operating effectively, it is noted that areas of the SSBA Standards could be made clearer, including, but not limited to, clarifying requirements for authorised persons, physical security and inventory management, as well as the introduction of new measures that relate to identity checking and cyber security.

The draft SSBA Standards have been amended to be contemporary, and each part has been revised to align with existing reference legislation and national and international standards on biosecurity.

As part of this consultation, participants are asked to carefully review the draft to ensure accuracy and clarity and to consider any barriers to implementation where new requirements are being proposed. Amendments have been made throughout the SSBA Standards, but some more substantive changes include:

• The removal of identity checking as an additional requirement to that covered by National Health Security (NHS) Checks.
• An additional requirement for all Authorised persons to undergo an NHS Check (introducing NHS Checks for personnel handling Tier 2 agents as well as Tier 1), unless otherwise exempt.
• The introduction of new requirements for managing cyber security risks.

The consultation questions have been generated to seek specific qualitative responses. For example, some are more relevant to regulated entities and others to regulators or private enterprise.

In reviewing the draft SSBA Standards and providing feedback to the consultation questions, participants should note that the current version is a working draft subject to change, pending further consultation with relevant Commonwealth departments and agencies. Any suggested changes must align with reference legislation and whole of government regulatory requirements, and cannot contradict either the NHS Act or the National Health Security Regulations 2018. Primary legislation amendments are not in scope for this review.

Finally, participants should note that while biosecurity and biosafety are intimately linked, biosafety additions or requirements are not in scope for this review. In Australia, there is no single national authority that oversees biosafety. Biosafety is currently managed through a complex intersection of various regulatory frameworks that sit across Government. Any changes to the current construct of biosafety regulation would require review of, and amendment to, primary legislation and other instruments beyond the scope of the SSBA Standards.

To access a copy the draft SSBA Standards, please click the link below or at the bottom of the page under 'Related' (note that depending on your browser settings, you may need to open the link in a new tab). 

Draft SSBA Standards

Why your views matter

The SSBA monitoring and compliance program provides an avenue for continuous feedback on the operation of the SSBA Regulatory Scheme, including insights into any ambiguity or gaps in the current SSBA Standards (available at www.cdc.gov.au/resources/publications/ssba-standards). Effort has been made to capture these views, and now wider consultation on the revised draft is required to ensure that all issues and perspectives are captured.

If you are an individual, diagnostic or research facility, Commonwealth department/agency or other entity that is currently handling or intending to handle SSBAs, then the revised SSBA Standards, once implemented, will impact how you are regulated under the National Health Security Act 2008, the National Health Security Regulations 2018. Responses are anonymous and will not be shared or distributed publicly, however, if you are responding on behalf of an existing registered entity, please be cognisant of the information security requirements outlined in the existing SSBA Standards.

Your feedback is highly valued to ensure the SSBA Standards meet legislative requirements, are practical, fit-for-purpose and commensurate with the level of risk posed.