Biosafety Level (BSL)

The Biosafety Level (BSL) system is the United States’ primary framework for matching laboratory containment to the risk posed by the biological agents being handled. It is described in the CDC/NIH publication Biosafety in Microbiological and Biomedical Laboratories (BMBL), now in its 6th edition (2020). The BMBL itself is explicit that it is an advisory best-practice document, not a standalone federal regulation — but it is incorporated by reference into binding frameworks that ARE regulatory, most importantly the NIH Guidelines for Research Involving Recombinant or Synthetic Nucleic Acid Molecules, which are a condition of NIH funding for covered research, and the Federal Select Agent Program regulations governing a defined list of especially dangerous pathogens and toxins.

The four biosafety levels

Each BSL is a combination of laboratory practices and technique, safety equipment, and facility design — not a single feature. In general terms:

• BSL-1 — work with well-characterized agents not known to consistently cause disease in healthy adults (e.g., non-pathogenic strains of E. coli). Standard open-bench microbiological practice, no specialized engineering controls, minimal PPE (typically a lab coat, gloves, and eye protection as a standard precaution).
• BSL-2 — work with agents that pose moderate hazards, are generally treatable, and are transmitted primarily by direct contact, ingestion, or mucous-membrane exposure rather than by aerosol (e.g., many clinical and environmental bacterial and viral isolates). Adds restricted access during work, self-closing/lockable doors, a certified biosafety cabinet for any procedure that may generate aerosols or splashes, and additional PPE such as face protection where indicated.
• BSL-3 — work with indigenous or exotic agents that can cause serious or potentially lethal disease through inhalation (e.g., Mycobacterium tuberculosis). Requires sustained, engineered directional airflow into the laboratory, sealed penetrations, a controlled double-door entry, HEPA-filtered exhaust, all agent manipulation performed inside biosafety cabinets, and respiratory protection where indicated in addition to standard PPE.
• BSL-4 — work with dangerous and exotic agents that pose a high risk of life-threatening disease, for which no vaccine or treatment is available, and for which aerosol transmission or a related agent with unpredictable transmission risk exists (e.g., Ebola and Marburg viruses). Requires a dedicated, isolated facility or building, positive-pressure supplied-air suits or a Class III cabinet line, dedicated air supply/exhaust with redundant HEPA filtration, and a mandatory personnel decontamination shower on exit.

These are cumulative: each higher level layers additional practices, equipment, and engineering controls on top of the level below it, rather than replacing them.

BSL-1 through BSL-4 at a glance

The bullet summary above captures the core logic; the table below lines up the practical requirements side by side, the way an investigator or research administrator actually needs to compare them.

These requirements are cumulative, not a menu — a BSL-3 lab must still meet every BSL-2 requirement in addition to what’s listed for BSL-3, and so on up the scale. For the full requirement set at each individual level, including typical agents and the practices the table above only summarizes, see CASRAI’s dedicated entries on BSL-1, BSL-2, BSL-3, and BSL-4.

Risk Group vs. Biosafety Level — a distinction worth keeping precise

The BMBL and the NIH Guidelines also classify biological agents themselves into four Risk Groups (RG1-RG4), based on the agent’s relative pathogenicity for healthy adults and the availability of preventive or therapeutic interventions. Risk Group and BSL are related but not interchangeable: Risk Group describes a property of the agent, while BSL describes the containment applied to a specific piece of work with that agent. Most RG2 agents are handled at BSL-2 and the NIH Guidelines require BSL-4 for all work with RG4 agents, but the IBC’s actual containment determination for a given protocol is a risk assessment — accounting for the specific procedures, volumes, concentration, and route of exposure involved — and can diverge from the default RG-to-BSL mapping in either direction.

How a biosafety level is actually determined

A BSL is not looked up from an agent’s name on a list — it is the output of a protocol-specific risk assessment that the IBC performs (informed by, but not limited to, BMBL’s published agent summary statements). The factors that assessment actually weighs include:

• Route of transmission. Contact, ingestion, and mucous-membrane exposure are contained differently than inhalation of infectious aerosols — this is the single biggest driver of the BSL-2/BSL-3 boundary.
• Infectious dose. How little of the agent is required to cause infection shapes how tightly exposure has to be controlled.
• Availability of prophylaxis or treatment. A licensed vaccine or an effective treatment is a large part of why an otherwise severe agent (e.g., M. tuberculosis) is contained at BSL-3 rather than BSL-4.
• Whether the specific procedures generate aerosols or involve sharps. Sonication, vortexing, centrifugation without sealed rotors, and needle use all raise the risk profile of an otherwise lower-risk agent, and can move a procedure’s containment above the agent’s default Risk Group mapping.
• Concentration and volume. Diagnostic-scale quantities and large-scale propagation of the same agent can carry meaningfully different risk.
• Agent stability, host range, and whether animals are involved. These affect environmental persistence and the risk of a wider release beyond the immediate laboratory.

Because the assessment is protocol-specific, the same agent can legitimately be assigned different containment in different labs depending on what is actually being done with it — which is exactly why an IBC risk assessment, not a static agent list, is the operative mechanism (see the Risk Group vs. BSL distinction above).

The Institutional Biosafety Committee’s role

Any institution conducting research covered by the NIH Guidelines must establish a standing Institutional Biosafety Committee (IBC) — a local, standing committee, distinct from the IRB (Institutional Review Board) and from a Scientific Review Committee, though an institution may coordinate review across all three for a single project. The NIH Guidelines set minimum composition requirements: an IBC must have at least five members with collective expertise in recombinant/synthetic nucleic acid molecule research and physical containment practices, and — specifically for community-facing accountability — at least two members who are not affiliated with the institution (beyond their IBC service) and who represent the surrounding community’s health and environmental interests.

Before any covered research may begin, the investigator submits a registration describing the biological agents, vectors, host organisms, and procedures involved. The IBC:

• reviews the experiment against the risk-category framework in the NIH Guidelines (ranging from exempt research, through registration-only categories, up to experiments that require NIH Office of Science Policy or Recombinant DNA Advisory Committee review before the IBC may approve them);
• assigns — or confirms — the required Biosafety Level and any agent-specific practices for the facility and procedures described;
• verifies that personnel training, the physical facility, and engineering controls actually match what the assigned BSL requires; and
• requires re-review and re-approval before any change that increases hazard — a new agent, a new vector, a new procedure, or a new location — takes effect.

This oversight is ongoing, not a one-time gate: investigators are expected to stay in communication with the IBC and the institution’s Biosafety Officer for the life of the protocol, and IBC approval, like IRB/REC approval, is a precondition for starting work, not a formality that follows it.

Biosafety Level vs. Animal Biosafety Level (ABSL) vs. agricultural biosafety (ABSL-Ag)

BSL governs in vitro and bench work. Research involving vertebrate animals runs on a parallel, related classification: Animal Biosafety Level (ABSL), graded ABSL-1 through ABSL-4 using the same underlying logic as BSL, but adding animal-specific engineering controls — HEPA-filtered individually ventilated caging or isolators, negative-pressure animal rooms, and dedicated cage-wash decontamination among them. ABSL and BSL are assigned independently for the same study: a project working with an agent handled at BSL-2 on the open bench may still require ABSL-2 (not automatically the same number) for its vivarium component, because housing infected animals introduces exposure routes — bites, scratches, aerosolized bedding — that bench work doesn’t have.

A further, more specialized tier covers agricultural pathogen work in loose-housed livestock too large to be held in primary containment caging. This work — historically labeled BSL-3-Ag and now more precisely termed ABSL-3Ag in BMBL’s agricultural-pathogen appendix (alongside newer ABSL-2Ag and ABSL-4Ag designations) — is administered jointly with USDA APHIS for USDA-regulated High-Consequence Pathogens. Because loose-housed animals can’t be contained inside a biosafety cabinet the way a bench procedure can, ABSL-3Ag facilities incorporate many of the same engineering features BSL-4 uses for human pathogens (dedicated building, directional airflow, effluent decontamination) even though the agents involved don’t meet the human-pathogen criteria for BSL-4.

“BSL-2 with BSL-3 practices” (BSL-2+): a voluntary hybrid, not a formal BMBL tier

Research administrators and new IBC members frequently encounter local SOPs that reference “BSL-2+” or “BSL-2 with enhanced/BSL-3 practices.” This is not an officially recognized containment level under BMBL or the NIH Guidelines — there is no fifth tier. It’s a designation individual institutions adopt voluntarily when a BSL-2 agent or procedure carries residual risk that standard BSL-2 doesn’t fully address: limited safety data on a novel or emerging pathogen, work with drug-resistant organisms, procedures that generate higher aerosol volumes than typical BSL-2 work, or the early, uncertain period of an outbreak before an agent’s containment requirements are well established.

A BSL-2+ SOP selectively layers specific BSL-3 elements onto a BSL-2 base — commonly mandatory biosafety-cabinet use for all manipulations (rather than only aerosol-generating steps), additional PPE such as double gloving or respiratory protection, and tighter access control — without requiring the full BSL-3 facility build-out (directional airflow, double-door entry, HEPA-filtered exhaust). Because it isn’t standardized across institutions, exactly what a given lab’s “BSL-2+” designation requires is defined by that institution’s own IBC-approved SOP, not by a BMBL citation — a research administrator evaluating a BSL-2+ protocol should read the actual SOP rather than assume a consistent, portable meaning.

Biosafety cabinet classes and correct use

The biosafety cabinet (BSC) is the primary engineering control referenced throughout the table above, and choosing the wrong class is a common compliance gap. In brief: Class I protects personnel and the environment but not the product inside (no supply-air filtration); Class II — the type used in the large majority of BSL-2 and BSL-3 labs — protects personnel, product, and environment via HEPA-filtered inflow and (depending on subtype A2, B1, or B2) partial or total exhaust, making it suitable for volatile chemical use in varying degrees; Class III is a gas-tight, glove-box design used for BSL-4 work, providing the highest level of personnel protection. A biosafety cabinet is not a chemical fume hood and using one in place of the other creates a real gap in either chemical or biological protection, not just a labeling issue.

This entry covers BSC classification only at the level needed to read the comparison table above; for full mechanical detail, annual certification requirements under NSF/ANSI Standard 49, and field-testing procedures, see CASRAI’s dedicated Biosafety Cabinet Certification & NSF 49 Testing Guide and the Biosafety Cabinet vs. Fume Hood vs. Laminar Flow Hood comparison — that detail isn’t repeated here.

Select agent obligations: who must register

IBC approval and Federal Select Agent Program registration are separate obligations that commonly apply to the same project. Any entity that possesses, uses, or transfers an agent or toxin on the HHS/CDC or USDA/APHIS Select Agent List — above the narrow permissible-amount exclusions for certain toxins — must register with the Federal Select Agent Program before that work begins. Registration is entity-specific, not automatic from IBC protocol approval: it requires the institution to maintain a facility security plan, a biosafety plan, and an incident-response plan, and every individual who will have access to a select agent must independently pass a Security Risk Assessment (a background clearance administered by the Department of Justice) before that access is granted. A protocol involving a select agent therefore needs both IBC biosafety approval and a current, agent-specific entity registration — one does not substitute for the other. See CASRAI’s Dual Use Research of Concern (DURC), Select Agents, and Biosafety Oversight guide for the full registration pathway and how it interacts with DURC review.

Decontamination, waste, and incident/exposure reporting

Waste decontamination scales with containment level, as the table above summarizes: routine surface disinfection at BSL-1; autoclaving or equivalent decontamination of infectious waste before disposal at BSL-2; decontamination of all laboratory waste inside the BSL-3 suite itself before it is removed; and chemical-shower, autoclave, and/or gaseous decontamination of anything leaving BSL-4 containment.

Incident and exposure reporting runs on two separate, overlapping tracks that a research administrator needs to track independently:

• NIH Guidelines / NIH OSP. Institutions must report significant problems, violations of the NIH Guidelines, and significant research-related accidents or illnesses to NIH’s Office of Science Policy, generally within 30 days. A tighter clock applies to actual exposures: incidents resulting in an overt exposure occurring in a BSL-2 or BSL-3 laboratory, and incidents resulting in a potential exposure occurring in a BSL-3 laboratory, must be reported to NIH OSP immediately, not on the standard 30-day cycle. Reports also go to the institution’s own IBC and, where an animal facility is involved, its director.
• OSHA’s Bloodborne Pathogens Standard (29 CFR 1910.1030). This applies independently of, and in addition to, BMBL/NIH biosafety requirements whenever work involves human blood or other potentially infectious materials, regardless of the assigned BSL. It requires a written exposure control plan, a documented offer of hepatitis B vaccination, and — after any exposure incident — confidential post-exposure medical evaluation and follow-up, tracked separately from the NIH reporting pathway above.

The research-administration angle: IBC approval and award setup

Grant compliance offices increasingly treat current IBC approval the way they’ve long treated IRB and IACUC approval: as a hold on releasing funds, not paperwork that can catch up after work starts. Biosafety review isn’t typically submitted alongside the proposal itself the way a full IRB or IACUC protocol is, but NIH’s funding terms condition support for covered recombinant/synthetic-nucleic-acid research on NIH Guidelines compliance — and many institutions’ own award-setup workflows won’t open a spending account for a project involving recombinant material, a human or animal pathogen, or a select agent until the Biosafety Officer confirms an active IBC approval that actually covers the agents and procedures described in the award’s statement of work.

Two consequences follow directly for day-to-day award management. First, because IBC approval is protocol-specific and requires re-review before any hazard-increasing change takes effect, a mid-award scope change — a new agent, a new procedure, or a new performance site — is a fresh biosafety-compliance checkpoint, not just a budget modification; treating it as the latter risks work proceeding without required coverage. Second, where a subaward or collaborating site is involved, each performance site with its own laboratory facility typically needs its own IBC approval (or a documented reliance arrangement, which remains far less standardized for biosafety than the increasingly common single-IRB model for human-subjects research) — and a subaward cannot lawfully route select-agent work to a site that isn’t itself registered under the Federal Select Agent Program, independent of whatever the prime award’s IBC approval covers.

2025 transparency requirements

Following a March 2025 NIH Guide Notice (NOT-OD-25-082), institutions are expected, effective June 1, 2025, to post approved IBC meeting minutes for meetings held on or after that date on a public-facing institutional website (with appropriate redactions), and NIH’s Office of Science Policy separately posts the roster of every IBC registered with it via its IBC Registration Management System. This extends to institutional biosafety oversight the same public-accountability logic that has long applied to IRB and Institutional Animal Care and Use Committee (IACUC) records.

Where BSL intersects other oversight mechanisms

A single protocol frequently triggers more than one committee. Work with recombinant material shared between institutions may also involve a Material Transfer Agreement; samples drawn from a biorepository may carry their own biosafety handling requirements independent of the source material’s original classification; and research involving select agents or toxins, or research meeting the U.S. government’s Dual Use Research of Concern (DURC) criteria — which by policy captures all work with select agents and any human pathogen recommended for BSL-3 or BSL-4 handling under the BMBL — is subject to additional federal oversight layered on top of, not instead of, the IBC’s biosafety review. None of these mechanisms substitute for BSL classification itself; they are adjacent compliance obligations that a research administrator typically tracks alongside it.

Frequently Asked Questions

What does BSL stand for?

BSL stands for Biosafety Level, the graded system used to match laboratory containment practices, equipment, and facility design to the risk posed by the biological agents being handled. It is described in the CDC/NIH’s Biosafety in Microbiological and Biomedical Laboratories (BMBL), now in its 6th edition (2020).

What are the four biosafety levels (BSL-1 to BSL-4)?

BSL-1 covers agents not known to cause disease in healthy adults, using standard open-bench practice and minimal PPE; BSL-2 adds restricted access and a certified biosafety cabinet for agents that pose moderate, generally treatable hazards. BSL-3 requires engineered directional airflow, sealed penetrations, and cabinet-only agent manipulation for agents that can cause serious disease through inhalation, while BSL-4 is reserved for the most dangerous agents and requires a dedicated, isolated facility, positive-pressure suits or a Class III cabinet line, and a mandatory exit shower. Each level is cumulative, layering additional controls on top of the one below it rather than replacing them.

Is the BMBL a legal requirement, or just guidance?

The BMBL itself is an advisory best-practice document, not a standalone federal regulation. It is, however, incorporated by reference into binding frameworks that are regulatory — most importantly the NIH Guidelines for Research Involving Recombinant or Synthetic Nucleic Acid Molecules, a condition of NIH funding for covered research, and the Federal Select Agent Program regulations.

What’s the difference between an agent’s Risk Group and its Biosafety Level?

Risk Group (RG1-RG4) describes a property of the biological agent itself — its relative pathogenicity for healthy adults and the availability of preventive or therapeutic interventions. Biosafety Level describes the containment applied to a specific piece of work with that agent. Most RG2 agents are handled at BSL-2 and the NIH Guidelines require BSL-4 for all work with RG4 agents, but an Institutional Biosafety Committee’s risk assessment for a given protocol — accounting for the specific procedures, volumes, and route of exposure — can diverge from that default mapping in either direction.

Who decides what biosafety level a lab needs?

The Institutional Biosafety Committee (IBC) — a standing committee required at any institution conducting research covered by the NIH Guidelines — assigns or confirms the required biosafety level after reviewing an investigator’s registration describing the agents, vectors, host organisms, and procedures involved. It also verifies that personnel training, the facility, and engineering controls actually match the assigned BSL, and requires re-review before any change that increases hazard takes effect.

What’s the difference between BSL and ABSL (Animal Biosafety Level)?

BSL governs in vitro and bench work; Animal Biosafety Level (ABSL, graded ABSL-1 through ABSL-4) is a parallel classification for research involving vertebrate animals, adding animal-specific engineering controls such as HEPA-filtered caging and negative-pressure animal rooms. BSL and ABSL are assigned independently for the same study — an agent handled at BSL-2 on the bench may still require a different ABSL tier for its vivarium component.

What is “BSL-2+” or “BSL-2 with BSL-3 practices”?

It’s a voluntary local enhancement, not an officially recognized fifth containment tier under BMBL or the NIH Guidelines. Institutions adopt it when a BSL-2 agent or procedure carries residual risk — such as a novel pathogen with limited safety data — by layering select BSL-3 elements (mandatory biosafety-cabinet use, additional PPE, tighter access control) onto a BSL-2 base without the full BSL-3 facility build-out. Its exact requirements are defined by the adopting institution’s own IBC-approved SOP, not by a standardized BMBL definition.

Who has to register with the Federal Select Agent Program?

Any entity that possesses, uses, or transfers an agent or toxin on the HHS/CDC or USDA/APHIS Select Agent List, above narrow permissible-amount exclusions for certain toxins, must register before that work begins. Registration is entity-specific and separate from IBC protocol approval — it requires a facility security plan, a biosafety plan, an incident-response plan, and an individual Security Risk Assessment (DOJ background clearance) for everyone with access to the agent.

What has to be reported to NIH, and how quickly?

Institutions must report significant problems, violations of the NIH Guidelines, and significant research-related accidents or illnesses to NIH’s Office of Science Policy, generally within 30 days. Incidents resulting in an overt exposure at BSL-2 or BSL-3, and incidents resulting in a potential exposure at BSL-3, must be reported immediately rather than on that standard cycle. This reporting duty is separate from OSHA’s Bloodborne Pathogens Standard (29 CFR 1910.1030), which independently requires its own exposure control plan and post-exposure medical follow-up whenever human blood or other potentially infectious materials are involved.

Does IBC approval affect when a grant can be set up?

At many institutions, yes — the award-setup workflow won’t release funds or open a spending account for a project involving recombinant material, a pathogen, or a select agent until the Biosafety Officer confirms a current IBC approval covering the specific agents and procedures in the award’s statement of work. Because IBC approval is protocol-specific, a mid-award scope change (new agent, new procedure, new performance site) is a fresh compliance checkpoint, not just a budget modification.