Moroccan lab pilot finds cyberbiosecurity gaps are mostly operational

A pilot assessment of seven Moroccan laboratories found that cyberbiosecurity was the least mature dimension of their biorisk management, with the most severe gaps centered on governance, staffing, training and incident planning rather than technical controls. Researchers developed and tested the bilingual Cyberbiosecurity Self-Laboratory Assessment Tool, or Cyber-SLAT, which added 57 cyberbiosecurity questions to an existing laboratory self-assessment. All seven participating facilities completed the resulting 258-question instrument. Of 129 questions that at least three laboratories could not affirm, 53 belonged to the cyberbiosecurity domain. Within that domain, two items were classified as universal gaps and 12 as critical gaps; 12 of the 14 most severe gaps, or 86%, were operational. The pilot was conducted between March and December 2025 and is presented as the first application of the full Cyber-SLAT in North Africa.

The new instrument extends the General-University Self-Laboratory Assessment Tool, a spreadsheet-based instrument designed for public health, environmental and veterinary laboratories operating in low- and medium-resource settings. The original tool contained 201 questions covering infrastructure and equipment, administration and training, biorisk management, specimen management and waste management. The cyberbiosecurity extension was developed collaboratively by the Johns Hopkins Center for Health Security and the Georgetown Center for Global Health Science and Security, drawing on a scoping review and an exploratory review of literature on cyberbiosecurity, cybersecurity, data privacy and laboratory information security. Subject-matter experts from the United States and European Union validated the resulting questions. The added section covers risk evaluation, planning and management, infrastructure and systems, and incident response.

Accessibility shaped the instrument’s design. Cyber-SLAT is available in English and French, can be completed electronically or on paper, and requires only basic spreadsheet software rather than specialized installation or an internet connection. The French version was reviewed for linguistic and cultural appropriateness by Moroccan collaborators. Respondents answer each question “Yes,” “No” or “Not Applicable,” can document proposed corrective actions, and receive an automatically generated action plan. For the pilot, researchers treated both “No” and “Not Applicable” as an inability to confirm a capacity. This precautionary rule turns uncertainty into a potential area for improvement, but it means the reported gap counts represent upper-bound estimates rather than confirmed deficiencies. It also means that a response of “Not Applicable” could reflect a function managed above the laboratory, uncertainty about whether a capacity existed, or another situation in which the laboratory could not verify the capacity in question.

Johns Hopkins University’s Center for Health Security and the Biorisk Management Association of Morocco selected the seven sites to span five institutional types: a private clinical diagnostic laboratory, a university research laboratory, a national reference laboratory, a regional analytical and research laboratory, a regional hospital laboratory, a veterinary research laboratory and a private pharmaceutical laboratory. The sample was purposive rather than statistically representative, reflecting available funding and the engagement-intensive design. Selection also prioritized high-containment facilities and laboratories with United States research partnerships. All seven laboratories submitted complete assessments after approximately six weeks of self-assessment supported by virtual training and local assistance. The final analysis was descriptive: no inferential comparison between laboratories was attempted.

Laboratory directors and biosafety officers usually answered the traditional biorisk questions. For the cyberbiosecurity section, laboratories were encouraged to assemble multidisciplinary teams and involve information technology personnel, including network administrators, database administrators and IT support specialists when available. The source does not establish whether IT staff actually participated in every laboratory’s assessment, so their involvement should not be treated as a uniform feature of the pilot. Teams reached internal consensus, although documented evidence was not required for a “Yes” answer. The findings varied sharply. Three laboratories recorded more than 200 affirmative responses across the full assessment, one recorded 63, and another produced the highest number of “Not Applicable” answers, with 51. The researchers suggested that institutional structures may explain some of this variation, because cybersecurity governance, information technology administration and data security are sometimes managed by a university or parent organization beyond the laboratory’s direct visibility. Such arrangements do not necessarily indicate absent capacity, but they can leave laboratory personnel unclear about protections covering their systems and data.

Risk evaluation was the strongest cyberbiosecurity section. Laboratories generally reported conducting diagnostics involving high-consequence pathogens, performing sequencing, maintaining pathogen inventories and using formal agreements for research collaborations and data sharing. Yet none of the seven laboratories could affirm that it had identified key hazards where physical laboratory processes intersect with digital systems. This universal non-affirmation suggests that laboratories were more familiar with biological risks and external collaborations than with the distinctive vulnerabilities created by connections among equipment, software, networks and data. It does not demonstrate that no laboratory had considered such interfaces; rather, none could confirm that this specific capacity was in place. The weakest area was incident response, although it contained only four questions. No laboratory could confirm having a cyberbiosecurity incident response plan, and critical gaps also included unconfirmed processes for notifying law enforcement, evaluating incidents after the fact and sharing lessons learned.

The other severe gaps were concentrated in planning, management and infrastructure. Six of seven laboratories could not affirm designated cyberbiosecurity responsibilities, regular staff training in cyber, data and information security, a threat-mitigation policy, or training on risks associated with internet-connected devices, generative artificial intelligence chatbots, online platforms and personal devices connected to institutional networks. Critical technical items included whether staff browser and application access to the internet was restricted, whether recognized security standards were used for storing and transferring sensitive data, whether an end-to-end map of laboratory and pathogen data flows existed, and whether laboratory information management system data could be accessed through additional health information systems. These results do not prove that every participating facility lacked the underlying safeguards. They show that laboratories could not confirm those capabilities through the self-assessment.

Corrective actions focused heavily on high-risk activities, key documents and policies. Proposed measures included assigning cyberbiosecurity responsibilities to existing personnel, organizing annual awareness sessions, creating threat-mitigation standard operating procedures, restricting or monitoring browser use, adopting data-sharing and encryption protocols, mapping data flows, establishing law-enforcement contacts and arranging post-incident reviews. Four laboratories entered cyberbiosecurity corrective actions directly into the tool, while all seven participated in a collective master plan developed during a two-day meeting in Rabat. Six of its eight actions were designated high priority, with proposed timelines ranging from one to six months. The plan linked actions to relevant ISO/IEC 27001 sections and assigned responsibility to laboratory leadership, institutional information systems departments or cyberbiosecurity officers who were still to be appointed. The action plans were planned for implementation over an 18-month performance period, but the study did not verify their execution.

The dialogue, which included representatives from Morocco’s General Directorate of Information Systems Security, also produced a collective strategy centered on compliance with national cybersecurity laws and standards, management-supported policies interoperable across laboratories, and development of Morocco as a regional cyberbiosecurity reference center. Participants identified existing legal and quality-management frameworks, accreditation processes and the new government linkage as strengths, while naming limited budgets, shortages of qualified personnel, absent policies, user resistance and insufficient time for planning as weaknesses. Risk exercises using a likelihood-impact method rated data breaches through subcontractors, unauthorized access through shared printers and copiers, and equipment theft above phishing. The study’s authors argue that assigning responsibility, training staff, restricting sensitive-device use and preparing incident procedures could address practical risks even when sophisticated technical safeguards remain unavailable. The assessment itself also created a channel between laboratory personnel and Morocco’s national cybersecurity authority, a relationship the researchers said had not previously existed for these participants.

Because the study was a small, cross-sectional pilot based on self-reported responses, it cannot establish national prevalence, track changes over time or determine whether the action plans were implemented. The cyberbiosecurity questions had not been formally evaluated for content validity, reliability or inter-rater agreement, and the pilot lacked a hazard metric for questions where an affirmative answer might itself indicate danger. The authors also stress that no pre- or post-intervention comparison was conducted. Nevertheless, the completed assessments and collective plan provide an empirical starting point for a field often dominated by theoretical threats and technical scenarios. They also show why ready-made cybersecurity standards alone may not suffice: in the Moroccan sample, laboratories needed practical tools, local partnerships and cross-functional dialogue before technical controls could be implemented and sustained.

Subject of Research: Pilot assessment of laboratory cyberbiosecurity capacity across seven Moroccan institutions

Article Title: Evaluating laboratory cyberbiosecurity capacity in Morocco: development and pilot implementation of the cyber self-laboratory assessment tool (Cyber-SLAT)

Article References: Linder, A. G., Grégoire, V., Baassi, L., Lemrabet, S., & Sorrell, E. M. (2026). Evaluating laboratory cyberbiosecurity capacity in Morocco: development and pilot implementation of the cyber self-laboratory assessment tool (Cyber-SLAT). Frontiers in Bioengineering and Biotechnology, 14, Article 1947925. https://doi.org/10.3389/fbioe.2026.1947925

Image Credits: AI Generated

DOI: 10.3389/fbioe.2026.1947925

Keywords: cyberbiosecurity, Morocco, laboratory safety, Cyber-SLAT, biorisk management, cybersecurity, information security, incident response, laboratory governance, data stewardship, Evaluating, laboratory