Biosafety Risk Assessment: What It Is and Why It Is Important
A practical guide to biosafety risk assessment: risk groups, biosafety levels, and five assessment steps labs need to know.
.jpg)
Download Whitepaper
TL;DR
A biosafety risk assessment is a documented process for identifying biological hazards, evaluating how likely and how severe an exposure would be, and selecting the controls that reduce that risk to an acceptable level. It is what determines the biosafety level, the practices, and the training a piece of work requires.
- Five assessment steps.
Identify the biological agents in use, evaluate risk using transmission route, host range, virulence, infectivity, pathogenicity, allergenicity, and stability, apply controls in order from elimination through engineering controls to personal protective equipment, document and communicate the findings with corrective and preventive actions, then review on a schedule and whenever the work changes.
- Risk groups and biosafety levels.
The National Institutes of Health sorts biological agents into four risk groups by severity and treatment availability. Biosafety Levels 1 through 4 describe containment. They correlate but are not interchangeable, because the procedure, the volume, and the host system can push a Risk Group 2 agent into BSL-3 practices.
- New federal oversight in 2026.
On July 28, 2026 the U.S. Government released the Policy for Stopping High-Risk Life Sciences Research, replacing the 2024 DURC and PEPP policy and the older 2012, 2014, and 2017 frameworks. It moves from a pathogen list to a consequence-based definition and requires an Institutional Review Entity and a named institutional contact at federally funded institutions.
- Where SciSure fits.
SciSure's Health and Safety features support biological project and material registration, committee review, amendments, renewals, training records, and biosafety cabinet certification tracking in one place, so the assessment, the approval, and the evidence behind them stay connected rather than living in separate spreadsheets and inboxes.
This post was originally published in 2024. This 2026 update adds the new federal high-risk research policy, NIH Guidelines and select agent changes, comparison tables for risk groups and biosafety levels, and a fuller explanation of how SciSure supports biosafety oversight.
Ready to see SciSure in action?
No commitment · Free consultation
Materials that are hazardous because of their biological or infectious properties are called biohazardous materials, or biohazards. Research laboratories work with recombinant and synthetically derived nucleic acids, blood, tissues, body fluids, cell lines, bacteria, viruses, viral vectors, plasmids, fungi, prions, and parasites that cause disease in humans, animals, or plants.
Workplace safety law requires employers whose staff are exposed to transmissible infectious pathogens to have written biosafety guidelines and controls in place. That obligation starts with an assessment. Employers must determine which employees have exposures, from work activities or conditions, that are reasonably anticipated to raise their risk of contracting a disease caused by an infectious agent.
The assessment is the decision-making step. Everything downstream, the biosafety level, the cabinet, the training, the waste route, the medical surveillance, follows from it.
Labs using SciSure's Health and Safety modules typically run that decision through a structured biological registration rather than a standalone document, which is what keeps the assessment connected to the people, spaces, and materials it applies to. We'll cover it in further detail below.
Read More: The 5 Best EHS Software Platforms for Labs in 2026
What is a Biosafety Risk Assessment?
A biosafety risk assessment is a systematic process that identifies, evaluates, and mitigates risks associated with the use of biological agents. It aims to:
- Identify procedural hazards and hazardous characteristics of the biological agents being handled.
- Classify biological agents into risk groups by infectivity, virulence, pathogenicity, availability of preventive measures and effective treatments, and potential damage to the environment.
- Determine the appropriate biosafety level for controls and access restrictions.
- Consider biosecurity, which covers prevention of theft, loss, and misuse of hazardous biological agents and toxins, equipment, and valuable information.
- Identify and implement controls that minimize exposure risk for workers, the environment, and the surrounding community.
- Establish regulatory compliance with local and national biosafety requirements.
Other factors to consider in a biosafety risk assessment are the possible routes of transmission of infection in the laboratory, the infectious dose, stability in the environment, host range, whether the agent is indigenous or exotic to the local environment, and the genetic characteristics of the agent. If biological agents are genetically modified, ensure that the risk assessment considers how the agent’s hazard characteristics may change, including its infection potential and severity of disease.
Biosafety and biosecurity answer different questions
Biosafety asks whether the agent can harm someone by accident. Biosecurity asks whether someone could take it and cause harm on purpose. The same registration usually covers both, but the controls differ. Biosafety leans on containment and practice. Biosecurity leans on access control, inventory accuracy, and personnel reliability. Check out our guide to biosafety and biosecurity for a deep dive into the differences.
The Five Components of a Biosafety Risk Assessment
1. Hazard identification
Identify every biological agent involved in the laboratory activity and the hazards associated with each. Use subject matter experts who are familiar with the agents. This step is where most incomplete assessments go wrong, usually by cataloguing the primary organism and missing the cell lines, vectors, human-source material, or animal work around it.
2. Hazard assessment and risk evaluation
Once hazards are identified, evaluate the likelihood and severity of exposure against the agent characteristics below.
3. Risk management
Based on the evaluation, put measures in place that eliminate or minimize the identified risks. Work in order of effectiveness rather than convenience.
PPE sits last for a reason. It protects one person, only when worn correctly, and only until it fails. Check out our guide to chemistry lab safety rules for a deep dive.
4. Documentation and communication
Document the assessment and the findings. Everyone affected needs to know the outcome, the corrective and preventive actions (CAPAs) identified, and the schedule those actions run on. An assessment that lives in one person's drive is not a control, because nobody can act on what they cannot find.
5. Review and update
Review assessments periodically and whenever hazards or operations change. In practice, these are the triggers worth writing into your standard operating procedure:
- A new agent, vector, cell line, or animal model enters the work
- A procedure changes scale, concentration, or introduces aerosol-generating steps
- An incident, near miss, or occupational health finding occurs
- Personnel change, particularly new or pregnant or immunocompromised staff
- The agent's regulatory classification changes (see the 2024 to 2026 changes below)
- The registration reaches its scheduled renewal
This is also why lab safety inspections matter more as your lab scales.
Risk Groups and Biosafety Levels
Biological agents are classified by risk when considering infectivity, pathogenicity, and the availability of preventive measures and treatments. The National Institutes of Health (NIH) established four risk groups in the NIH Guidelines for Research Involving Recombinant or Synthetic Nucleic Acid Molecules.
The four risk groups
The four biosafety levels
The biosafety level (BSL) assigned to a laboratory is determined by the risk posed by the agents in use and the procedures performed on them. Each level specifies requirements for laboratory practices and techniques, safety equipment and containment, and facility design.
The risk groups are not equivalent to the biosafety levels (BSL). The BSL assigned to a laboratory is determined by the risk posed by the biological agents being used. Each BSL has specific EHS requirements for laboratory practices and techniques, equipment and containment measures, and facilities design.
Why a risk group is not a biosafety level
The risk group describes the agent, while the biosafety level describes the containment applied to a specific activity with that agent. A Risk Group 2 organism handled at high volume with sonication may warrant BSL-3 practices. A Risk Group 3 agent handled only as inactivated material may not.
This is the point BMBL 6th edition makes when it describes itself as protocol-driven. It is an advisory document, not a regulation, and it says plainly that no single document can identify every combination of risks and mitigations. The WHO Laboratory Biosafety Manual, 4th edition takes the same position, replacing fixed operational requirements with core requirements plus heightened control measures selected through risk assessment.
What's changed in Biosafety Oversight between 2024 and 2026
The July 2026 policy replacing DURC and PEPP oversight
On July 28, 2026, the administration released the United States Government Policy for Stopping High-Risk Life Sciences Research, dated July 20, 2026. It fulfills Executive Order 14292, signed May 5, 2025, and it replaces the 2024 U.S. Government Policy for Oversight of Dual Use Research of Concern and Pathogens with Enhanced Pandemic Potential, along with the 2012 and 2014 DURC policies and the 2017 P3CO guidance.
What changes for institutions:
Consequence-based rather than list-based.
The policy defines dangerous gain-of-function (DGOF) research by outcome, including enhancing harmful consequences, defeating immunization or therapeutics, increasing transmissibility or stability, altering host range, and reconstituting eradicated agents. Federal support for DGOF research is prohibited. Research with the potential to meet the definition is permissible following independent review.
A second category for international work.
International research of concern (IROC) restricts federal funding for life sciences research conducted in countries of concern or by institutions or individuals of concern.
Principal investigator attestation.
PIs must evaluate proposed and ongoing research and attest in writing to their determination, with continuous re-evaluation. If research may meet the DGOF definition at any point, the PI must halt it and notify within 24 hours.
New institutional bodies.
Institutions receiving federal life sciences funding will establish an Institutional Review Entity (IRE) of at least five members with relevant subject matter expertise, and designate an Institutional Contact for Dangerous Gain-of-Function (ICDGOF). The policy encourages including Institutional Biosafety Committee members. Institutions have 180 days from issuance, which lands around mid to late January 2027.
Annual training and records.
Institutions will develop and mandate annual DGOF training for researchers and maintain a record of everyone who accepts and complies with the policy.
Real consequences.
Violations, including a deliberately false negative attestation, can trigger revocation of funding and up to five years of ineligibility for federal life sciences funds. The independent third-party review body may randomly audit up to 25 percent of negative attestations annually.
Agency-specific implementation guidance is due within 120 days of issuance, so the operational detail is still landing. The point for now is that your institution will need documented, auditable evidence of who assessed what, when, and on what basis.
NIH Guidelines: gene drives and reclassified agents
The April 2024 revision of the NIH Guidelines, effective September 30, 2024, added Section III-D-8 requiring experiments with gene drive modified organisms (GDMOs) to be conducted at a minimum of BL2, with specific risk assessment considerations and defined responsibilities for IBCs and Biological Safety Officers. The same revision replaced "helper viruses" with the broader term "helper systems" and reclassified West Nile virus and Saint Louis encephalitis virus as Risk Group 2 agents, aligning them with BMBL 6th edition containment guidance.
IBC minutes are now public
Under NOT-OD-25-082, approved minutes from IBC meetings held on or after June 1, 2025 must be posted on a public-facing institutional website, immediately after approval and after allowable redactions. Minutes stay posted for a minimum of five years, and minutes from earlier meetings remain available on request. NIH OSP has published a minutes template and points to consider.
This one changes writing habits more than workflows. Minutes now have two audiences: the committee and the public. Check out our guide to preparing a strong IBC submission for some practical tips.
Select agent list changes
HHS and USDA final rules effective January 16, 2025 removed five agents from the select agent and toxin list, including Brucella abortus, Brucella melitensis, and Brucella suis from the overlap list, African horse sickness virus, and Peronosclerospora philippinensis. Nipah virus was designated a Tier 1 select agent.
How Chemical Safety Practices Improve Biosafety
If your chemical safety program is mature and your biosafety program is the weaker one, borrow from what already works. The two disciplines share more structure than most programs use.
How SciSure supports Biosafety Risk Assessments
A biosafety risk assessment is only as good as the record behind it. The assessment has to connect to the people trained on it, the spaces it applies to, the materials it covers, and the review that approved it. When those live in four systems, reconstructing the chain for an auditor becomes a project.
SciSure's Health and Safety features keep them in one place. Here is what that covers, with the usual caveat that available modules and configuration vary by customer.
Register projects and biological materials in a structured way
Biological registrations in SciSure use configurable project forms covering projects, materials, personnel, and spaces. Materials are drawn from a standardized biomaterials library with defined attributes and containment levels, including recombinant research and genetically modified organism tracking, and integration with ATCC-verified cell lines. Registrations can include the applicable surveys and forms for recombinant or synthetic nucleic acid work, viral vectors, and pathogens, depending on what is enabled in your instance.
The practical benefit is consistency: when two PIs register the same cell line, they get the same containment attributes rather than two different free-text answers.
Move registrations through review without email chains
With SciSure, registrations progress through defined states, from started, through PI certification, through EHS and biosafety review, through committee review, to approved, with amendment and renewal paths from there. Reviewers can request clarification, add reviewer notes, and move submissions to committee. Committee functionality covers membership, agendas, meetings, minutes, and resolution of reviewer notes, so an IBC can review submissions together rather than in a thread.
Automated reminders handle approvals, renewals, and expirations, which is usually where paper-based programs lose time.
Keep the documentation a reviewer will ask for
Every registration carries its own history: who submitted, who reviewed, what changed, and when. That record is what turns "we assessed this" into something demonstrable. It also gives committees a starting point for the minutes they now have to post publicly, though the minutes themselves still need human drafting and redaction against the NIH guidance.
Connect biosafety to training, chemical data, and equipment
Training
SciSure tracks certifications, assignments, expirations, and completion across job activities. Our partners include Vivid and HSI which provides you access to professional training, with three courses included. Read our guide on biosafety training to learn more.
Chemical inventory
ChemTracker handles container-level chemical inventory and SDS access alongside the biosafety record, which matters for the decontamination and waste workflows described above. ChemTracker is designed for chemicals rather than biological materials, so biological inventory belongs in biological registration and sample management.
Equipment
Biological safety cabinets, fume hoods, and other safety-critical equipment can be scheduled, certified, and logged in the equipment module, so a containment control has a maintenance record attached to it.
What this looks like in practice
SmartLabs runs SciSure's Health and Safety features across hundreds of lab spaces on both U.S. coasts. They started with chemical inventory, SDS, inspections, and equipment management in December 2019, added Biosafety Management in 2021, and medical surveillance in 2022. The biosafety layer was added onto an inventory and inspection foundation that was already in place, which is a realistic path for most growing programs.
The results after implementing SciSure: hazard visibility at suite level, training gaps that are now closed, systems that reference each other, and improved reconciliation time.
These chemical figures are chemical figures, not biosafety metrics. They are included here because the same principle drives both: an inventory you can query in minutes is an inventory you can actually assess risk against.
FAQs about Biosafety Risk Assessments
How often should a biosafety risk assessment be reviewed?
On a defined schedule, usually annually or at registration renewal, and whenever the work changes. Triggers include a new agent or vector, a change in procedure scale or aerosol generation, an incident or near miss, personnel changes, and any change to the agent's regulatory classification.
Is a risk group the same as a biosafety level?
No. The risk group describes the agent. The biosafety level describes the containment applied to a specific activity. Procedure, volume, concentration, and host system can all push work to a higher containment level than the agent's risk group alone would suggest.
What replaced the DURC and PEPP policy?
The United States Government Policy for Stopping High-Risk Life Sciences Research, released July 28, 2026. It replaces the 2024 DURC and PEPP policy, the 2012 and 2014 DURC policies, and the 2017 P3CO guidance, and it defines high-risk research by consequence rather than by a list of pathogens.
Do we have to publish our IBC minutes?
If your institution is subject to the NIH Guidelines, yes, for meetings held on or after June 1, 2025. Approved minutes go on a public-facing institutional website after allowable redactions and stay posted for at least five years.
Can software make our lab compliant?
No. Software supports compliant practice by structuring the records, reviews, and reminders your program depends on. Your institution still owns the risk assessments, the standard operating procedures, the training, the committee decisions, and the validation of anything used in a regulated context.
If your biosafety program still runs on documents in shared drives, the fastest improvement is putting the assessment, the approval, and the evidence in the same system. So that when the classification of an agent changes, or a new federal policy lands, you can find every affected registration in one query rather than one conversation at a time.
Talk to a specialist about how SciSure supports biosafety registration, committee review, and audit readiness.
Read more of our blogs about modern lab management
Discover the latest in lab operations, from sample management to AI innovations, designed to enhance efficiency and drive scientific breakthroughs.
