NIOSH logo and tagline

Engineering Controls Database

Guidance for Protecting Building Environments From Airborne Chemical, Biological, or Radiological Attacks

Terrorism events have increased interest in the vulnerability of U.S. workplaces, schools, and other occupied buildings to chemical, biological, or radiological (CBR) threats.
Of particular concern are the airflow patterns and dynamics in buildings, specifically in the building heating, ventilating, and air conditioning (HVAC) systems. These systems can become an entry point and a distribution system for hazardous contaminants, particularly CBR agents.
Building owners need reliable information about how they can (1) modify their buildings to decrease the likelihood or effects of a CBR incident and (2) respond quickly and appropriately should a CBR incident occur. Comprehensive guidance is needed in several areas, including:

• How to modify existing buildings for better air protection and security.

• How to design new buildings to be more secure.

• What plans building managers should prepare in advance to help them make effective decisions in the midst of a CBR incident.

Preparatory Recommendations – Know Your Building

In initiating any plan to modify building system design or operation, an important first step is to understand these systems: How were they intended to operate? How do they currently operate?

Getting to know your building may best be handled by conducting a walk-through inspection of the building and its systems, including the HVAC, fire protection, and life-safety systems. During this inspection, compare the most up-to-date design drawings available to the operation of the current systems (Note: If sufficient questions or surprises arise from the building walk-through, an independent evaluation by a qualified HVAC professional should be used to establish a useful baseline). Without this baseline knowledge, it is difficult to accurately identify what impact a particular security modification may have on building operation. While it is important to understand how the existing building systems function, the systems need not operate per design before you implement security measures.

Specific Recommendations

The recommendations can be divided into four general categories: (1) things not to do; (2) physical security; (3) ventilation and filtration; and (4) maintenance, administration, and training. Some of these items, such as securing mechanical rooms, may be started prior to your completing the recommendations in the "Know your building" section. Items within each of the four categories are listed in the order of priority. Items considered to be highly critical are identified by “***” next to the number. Additional information concerning the recommendations listed below can be found in NIOSH 2002.

Things not to do:

More than anything else, building owners and managers should ensure that any actions they take do not have a detrimental effect on the building systems (HVAC, fire protection, life safety, etc.) or the building occupants under normal building operation. Some efforts to protect the building from a CBR attack could have adverse effects on the building's indoor environmental quality. Building owners and managers should understand how the building systems operate and assess the impact of security measures on those systems.

*** 1. Do not permanently seal outdoor air intakes.

*** 2. Do not modify the HVAC system without first understanding the effects on the building systems or the occupants.

***3. Do not interfere with fire protection and life safety systems.

Physical security

Preventing terrorist access to a targeted facility requires physical security of entry, storage, roof, and mechanical areas, as well as securing access to the outdoor air intakes of the building HVAC system. The physical security needs of each building should be assessed, as the threat of a CBR attack will vary considerably from building to building. For example, the threat to a large corporate headquarters may be considered greater than the threat to a small retail establishment. Some physical security measures, such as locking doors to mechanical rooms, are low cost and will not inconvenience the users of the building. These types of measures can be implemented in most buildings. Other physical security measures, such as increased security personnel or package x-ray equipment, are more costly or may inconvenience users substantially. These measures should be implemented when merited after consideration of the threat and consequences of a terrorist attack. Building owners and managers should be familiar with their buildings and understand what assets require protection and what characteristics about the building or its occupants make it a potential target. By first assessing the vulnerabilities of facilities, building owners and managers can address physical security in an effective manner. While the identification and resolution of building vulnerabilities will be specific to each building, some physical security actions are applicable to many building types (Figures 1, 2, 3, 4, 5). These include:

*** 1. Prevent access to outdoor air intakes.

• Extend outdoor air intake vents.
• Establish a security zone around outdoor air intakes.

*** 2. Prevent public access to mechanical areas.

*** 3. Prevent public access to building roofs.

4. Implement security measures, such as guards, alarms, and cameras to protect vulnerable areas.

5. Isolate lobbies, mailrooms, loading docks, and storage areas.

6. Secure return air grills.

7. Restrict access to building operation systems by outside personnel.

8. Restrict access to building information.

9. Upgrade building physical security.
Figure 1

Figure 1

Figure 2

Figure 2

Figure 3

Figure 3

Figure 4

Figure 4

Figure 5

Figure 5


Ventilation and filtration

HVAC systems and their components should be evaluated with respect to how they impact vulnerability to the introduction of CBR agents. Relevant issues include the HVAC system controls, the ability of the HVAC system to purge the building, the efficiency of installed filters, the capacity of the system relative to potential filter upgrades, and the significance of uncontrolled leakage into the building. Another consideration is the vulnerability of the HVAC
system and components themselves, particularly when the facility is open to the public. For buildings under secure access, interior components may be considered less vulnerable, depending upon the perceived threat and the confidence in the level of security.

***1. Evaluate HVAC control options.

*** 2. Assess filtration.

3. Ducted and non-ducted return air systems.

4. Low-leakage, fast-acting dampers.

5. Building air tightness.

Maintenance, administration, and training

Maintenance of ventilation systems and training of staff are critical for controlling exposure to airborne contaminants, such as CBR agents.

***1. Emergency plans, policies, and procedures

***2. HVAC maintenance staff training.

***3. Preventive maintenance and procedures.

NOTE: The above information is taken directly from the following publication:
NIOSH [2002]. Guidance for: Protecting building environments from airborne chemical, biological, or radiological attacks. Cincinnati, OH: U.S. Department of Health and Human Services, Public Health Service, Centers for Disease Control and Prevention, National Institute for Occupational Safety and Health. DHHS (NIOSH) Publication Number 2002-139.
277-11; 278-05-2; 278-05-3; 278-05-A-1; 278-05-A-2; 278-05-D; 278-07; 279-05-B; 279-05-C; 279-05-D; 279-05-E; 280-05-A-1; 280-05-G-1; 280-05-H; 280-05-I;
NIOSH [2002]. Guidance for: Protecting building environments from airborne chemical, biological, or radiological attacks. Cincinnati, OH: U.S. Department of Health and Human Services, Public Health Service, Centers for Disease Control and Prevention, National Institute for Occupational Safety and Health. DHHS (NIOSH) Publication Number 2002-139.

NIOSH [2003]. Guidance for: Filtration and air-cleaning systems to protect building environments. Cincinnati, OH: U.S. Department of Health and Human Services, Public Health Service, Centers for Disease Control and Prevention, National Institute for Occupational Safety and Health. DHHS (NIOSH) Publication Number 2003-136.
building occupants
building vulnerability
terrorist attack