NIST S 7101.20 (Uncontrolled Copy in Print) Page 1

1

2

3 WORK AND WORKER AUTHORIZATION 

4 BASED ON HAZARD REVIEWS

5 (“HAZARD REVIEW”) 

6

7 NIST S 7101.20 

8 Approval Date: 12/23/2020

9 Effective Date: 06/05/2020

10

11

12 1. PURPOSE

13 The purpose of this suborder is to define the requirements and associated roles and 

14 responsibilities for authorizing both hazardous activities (“work”) and workers based on a 

15 systematic level of work planning and control commensurate to the hazards, job 

16 complexities, and physical location, i.e., based on hazard reviews. 

17

18

19 2. BACKGROUND

20 a. This suborder describes NIST’s graded approach to managing the safety of a wide range of 

21 hazardous activities, from those that are relatively simple and routine to those that are highly 

22 complex one-time projects. The graded approach is based on the severity of the consequences 

23 of hazardous events or exposures to hazards and the likelihood of such events or exposures.

24

25 b. While this suborder primarily focuses on hazardous activities performed under normal and 

26 off-normal operating conditions, there are provisions for authorizing work and workers under 

27 abnormal operating conditions in which external factors may alter the risk assessment or 

28 present additional hazards to those directly associated with performance of the activity.

29

30 c. This suborder supersedes NIST Administrative Manual Subchapter 12.06, Hazard Analysis 

31 and Control. 

32

33

34 3. APPLICABILITY

35 a. The requirements of this suborder apply to all activities conducted by NIST employees and 

36 associates as part of their assigned duties under normal operating conditions except for the 

37 following:
NIST S 7101.20 (Uncontrolled Copy in Print) Page 2

38 (1) Common Everyday Tasks Performed Routinely by Members of the General Public at 

39 Work and Home and that Do Not Involve Extraordinary Hazards. This exception 

40 recognizes that NIST staff members possess the knowledge, skills, and abilities to 

41 perform a wide variety of common everyday tasks safely without written hazard reviews. 

42 Examples of such common everyday tasks include working at a computer, reviewing 

43 documents, walking, climbing stairs, picking up objects, and using scissors or short step 

44 stools.

45

46 (2) Inherently Low-Risk Activities. This exception applies to activities that are considered to 

47 present low safety risks without NIST personnel having to implement any safety controls 

to mitigate those risks.1,248 The following activities are considered to present low safety 

49 risks:

50

51 (a) Activities that could result in injuries requiring first aid but only infrequently; and

52

53 (b) Activities that could result in injuries requiring medical treatment beyond first aid but 

54 are very unlikely to do so. 

55

56 Examples of inherently low-risk activities include calibrating a balance, preparing non57 hazardous solutions, and using an optical microscope to examine non-hazardous samples.

58

59 b. The requirements of this suborder apply to any activity, regardless of the hazardous nature of 

60 the activity itself, when performed under abnormal operating conditions (see Section 2.b)

61 where external factors may present hazards or pose additional risk beyond those associated 

62 with performance of the activity, except when:

63

64 (1) Following the general requirements and/or guidance associated with the abnormal 

65 condition provides sufficient protection from the hazards associated with the abnormal 

66 condition; 

67

68 (2) No activity-specific instructions are needed to implement the general requirements and/or 

69 guidance associated with the abnormal operating conditions; and

70

71 (3) The activity-specific risks do not change as a result of the abnormal conditions.

1 This presumes that if such an activity involves the use of equipment with built-in safety features, these features do 

not require written safe work practices, are not easily defeated, and will not be intentionally defeated or separated 

from the equipment.

2 The requirements of this suborder apply to any activity for which PPE is required to mitigate the activity’s safety 

risks. They do not apply to the following uses of PPE: PPE required solely for entry into the space in which the 

inherently low-risk activity is conducted, not for protection from the hazards associated with the activity; PPE used 

voluntarily as an additional layer of protection; and PPE worn solely to protect equipment or materials.
NIST S 7101.20 (Uncontrolled Copy in Print) Page 3

72 c. The exemptions provided in Section 3a do not relieve NIST staff members or management 

73 from their responsibility to manage the safety risks associated with common everyday tasks 

74 and inherently low-risk activities. NIST focuses on these using a variety of mechanisms, 

75 including general safety training, safety-related communications, and incident awareness and 

76 reduction efforts. In addition, the exemptions do not relieve NIST of its responsibility to 

77 evaluate the compatibility of such activities with more hazardous activities in the same 

78 spaces.

79

80

81 4. REFERENCES

82 a. 29 Code of Federal Regulations 1910.132, Personnel Protective Equipment.

83

84

85 5. APPLICABLE OCCUPATIONAL SAFETY AND HEALTH (OSH) SUBORDERS

86 a. NIST S 7101.04: Safety and Health Requirements for Minors;

87

88 b. NIST S 7101.21: Personal Protective Equipment;

89

90 c. NIST S 7101.58: Respiratory Protection;

91

92 d. NIST S 7101.55: Hearing Protection; 

93

94 e. NIST S 7101.22: Hazard Signage;

95

96 f. Other OSH suborders that contain sections focused on the identification, assessment, and 

97 mitigation (i.e., control) of hazards in specific OSH areas, e.g., chemical hazard 

98 communication, chemical management, cryogen safety, dispersible engineered 

99 nanomaterials, hearing protection, and magnetic-field safety, to name several; and

100

101 g. NIST S 7101.23: Safety Education and Training.

102

103

104 6. REQUIREMENTS

105 Requirements are provided for the risk-assessment methodology to be used in conducting 

106 hazard reviews; the content, conduct, and approval of hazard reviews; the authorization of 

107 work and workers; the re-review, and re-approval, of hazard reviews and the re-authorization 

108 of work that falls outside the scope of current hazard reviews; retraining and reauthorization 

109 of workers according to updated hazard reviews; records; activities involving workers from 

110 multiple OUs; and Organizational Unit (OU) implementing procedures. Appendix B 

111 illustrates the processes for authorizing work and workers and the role of hazard reviews.
NIST S 7101.20 (Uncontrolled Copy in Print) Page 4

112 a. Risk-Assessment Methodology

113 Procedures for implementing this suborder shall use the risk-assessment matrix in Appendix 

114 C as the basis for conducting risk assessments. Once a hazard has been identified, the risk of 

115 a hazardous event or exposure associated with that hazard shall be characterized, as indicated 

116 in Appendix C and below, by a Relative Hazard Index (RHI) based on the severity of the 

117 consequences of a hazardous event or exposure to a hazard and the likelihood of such an 

118 event or exposure.

119

120 (1) Severity of the consequences of a hazardous event or exposure to a hazard (“Severity”)

121

122 (a) The severity categories in Appendix C provide qualitative measures of the 

123 consequences of the worst credible hazardous event (see definition of “Worst 

124 Credible Hazardous Event”) or exposure associated with an identified hazard due to 

125 design inadequacies; procedural deficiencies; human error; environmental conditions; 

126 or system, subsystem, or component failure or malfunction. The severity categories 

127 that shall be used are:

128

129 i. CATASTROPHIC: Death or permanent disability; system or facility loss; 

130 major property damage, lasting environmental or public-health impact.

131

132 ii. SEVERE: Serious injury; temporary total disability (more than 3 months); 

133 subsystem loss or significant facility/property damage, temporary 

134 environmental or public-health impact.

135

136 iii. MODERATE: Medical treatment beyond first aid; lost workdays; more than 

137 slight facility/property damage; external reporting requirements; more than 

138 routine clean-up.

139

140 iv. MINOR: First aid or minor medical treatment; negligible or slight 

141 facility/property damage; no external (outside NIST) reporting requirements, 

142 routine cleanup.

143

144 (2) Likelihood of a hazardous event or exposure (“Likelihood”)

145

146 (a) The likelihood categories in Appendix C broadly estimate the probability that a 

147 hazardous event or exposure involving an identified hazard will occur in carrying out 

148 an activity. The likelihood categories that shall be used are:

149

150 i. FREQUENT: Likely to occur frequently or repeatedly.

151
NIST S 7101.20 (Uncontrolled Copy in Print) Page 5

152 ii. PROBABLE: Likely to occur multiple but infrequent times.

153

154 iii. OCCASIONAL: Likely to occur at some time. 

155

156 iv. REMOTE: Possible, but not likely to occur.

157

158 v. IMPROBABLE: Very unlikely: can reasonably be assumed not to occur.

159

160 To the extent practical, likelihood should be assigned based on research, analysis, 

161 experience, or evaluation of historical safety data from work with similar hazards.

162

163 (3) RHIs

164

165 (a) RHIs shall be associated with identified hazards by assigning both severity and 

166 likelihood categories as indicated above and by identifying the corresponding RHIs at 

167 the intersection of the severity column and likelihood row in the risk-assessment 

168 matrix in Appendix C. The RHI levels that shall be used are:

169

170 i. Critical (RHI = 4)

171

172 ii. Serious (RHI = 3)

173

174 iii. Medium (RHI = 2)

175

176 iv. Low (RHI = 1)

177

178 v. Minimal (RHI = 0)

179

180 The RHI for an identified hazard provides a measure of the risk associated with that 

181 hazard assuming that some set of controls has been implemented, where that set of 

182 controls could range from inherent/built-in controls only to inherent/built-in controls 

plus additional controls. In this sense, RHIs are based on mitigated hazards.

3

183

184

185 b. Hazard-Review Process

186 Hazard reviews shall consist of the following primary elements, each of which must be 

187 documented: (1) activity description, (2) activity hazard identification, (3) physical-location 

188 review, (4) compatibility assessment, (5) initial hazard assessment, (6) hazard mitigation, (7) 

3 RHIs are sometimes conceptualized as being based on (a) severity taking into account inherent/built-in controls 

only and (b) likelihood after the implementation of additional controls. This is valid to the extent that additional 

controls reduce, or are considered to reduce, only likelihood, not severity.
NIST S 7101.20 (Uncontrolled Copy in Print) Page 6

189 incident-response plan, and (8) risk assessment. Appendix D provides a flowchart 

190 illustrating the relationship of these elements.

191

192 (1) Activity Description

193 Hazard reviews shall:

194

195 (a) Fully and accurately describe the activity being reviewed, including its intended 

196 outcome or expected result, in a way that is detailed enough for someone outside of 

the division or group to understand it;4197

198

199 (b) Define the activity boundaries by identifying what is included in the activity as well 

200 as what is specifically excluded from the activity, e.g., commissioning, normal 

201 operations, and maintenance of an instrument could be considered separate activities 

202 with their own hazard reviews, depending on how different the hazards and 

203 associated controls are in the three phases;

204

205 (c) Identify distinct subtasks within an activity based on significant differences in the 

206 nature of the work and associated hazards (hazards may differ from task to task and 

207 must be managed accordingly);

208

209 (d) Specify the physical location in which the activity is to be conducted; if the activity is 

210 to be conducted in multiple locations, describe the general environment in which the 

211 activity will be conducted and describe any specific restrictions, if applicable. When 

212 the restrictions vary from location to location, subtasks should be assigned by 

213 location.

214

215 (2) Activity Hazard Identification

216 The activity hazard identification shall:

217

218 (a) Identify the hazards associated with the activity, or, if the activity comprises distinct 

219 subtasks, the hazards associated with each of those subtasks; and 

220

221 (b) Note, reference, or include as attachments to the hazard review the results of any 

222 exposure assessments or calculations conducted to characterize or quantify identified 

223 potential hazards associated with the activity.

224

225 (3) Physical-Location Review

226 The physical-location review shall determine if the venue in which the activity is to be 

227 conducted is appropriate and adequate. Routine laboratory, shop, or mechanical activities 

4 An activity description similar to a scientific abstract would represent a best management practice.
NIST S 7101.20 (Uncontrolled Copy in Print) Page 7

228 are typically acceptable in spaces intended for such activities. OSHE should be consulted, 

229 however, when unique, atypical, or unusual activities may not be consistent with the 

230 proposed venue, and the results of the consultation should be noted in the review. For 

231 example, OSHE should be consulted when the activity involves unusual quantities or 

232 classes of hazardous materials or requires specialized fire and life-safety systems or 

233 emergency-response equipment, and the results should be noted in the review. 

234

235 (4) Compatibility Assessment

236 The compatibility assessment shall examine the hazard reviews associated with the 

237 totality of activities conducted in the proposed physical location, both in the actual space 

238 itself and, when applicable, neighboring spaces, to identify any potentially negative or 

239 antagonistic interactions, taking into account both planned operations and off-normal 

240 conditions that could reasonably be expected to occur.

241

242 (5) Initial Hazard Assessment

243 The initial hazard assessment shall:

244

245 (a) Identify for each identified hazard the key stages in the activity, or its subtasks, at 

246 which a hazardous event or exposure could occur, focusing on those stages essential 

247 to safe conduct of the activity or its subtasks; and

248

249 (b) Assign severity levels to each of the identified hazards, taking into account 

250 inherent/built-in controls only, i.e., prior to identifying any other controls (see 

251 definition of “Inherent/Built-In Controls”); 

252

253 (c) Consider any synergistic, negative, or antagonistic interactions identified in the 

254 compatibility assessment.

255

256 (6) Hazard Mitigation

257

258 (a) Hazard mitigation shall employ the following “hierarchy of controls” (i.e., preferred 

259 order of implementation of controls) to mitigate each of the identified hazards, with 

260 each subsequent control category being less effective and reliable than the previous 

261 category: 

262

263 i. Elimination;

264

265 ii. Substitution;

266

267 iii. Engineering controls;
NIST S 7101.20 (Uncontrolled Copy in Print) Page 8

268

269 iv. Administrative controls (including signage, warnings, alarms, and training), 

270 and;

271 v. Personal protective equipment (PPE).

272

273 Hierarchy of controls shall be employed until enough controls have been identified to 

274 mitigate the hazards to acceptable levels; in some cases, a combination of controls 

275 may be necessary, e.g., engineering controls such as machine guarding and local 

276 exhaust ventilation could be used in conjunction with training and PPE to mitigate a 

277 hazard. There must be a clear connection between the hazards, the controls, and the 

278 mitigation of the hazards.

279

280 (b) Hazard mitigation shall stipulate the engineering controls required for an activity, 

281 e.g., chemical fume hood, gas cabinet, enclosures, interlocks, blast wall, safety 

282 interlock.

283

284 (c) Hazard mitigation shall specify the alarms and other warnings required for an 

285 activity, e.g., toxic gas alarms, oxygen sensors, warning lights, hazard signage.

286

287 (d) When engineering controls and alarms and other warnings must be integrated into the 

288 building infrastructure, the hazard review shall confirm that the physical location in 

289 which the activity is to be conducted contains, or will contain, such equipment.

290

291 (e) Hazard mitigation shall specify safe operating guidelines, as applicable (see definition 

292 of “Safe Operating Guidelines”), and incorporate these explicitly in the hazard 

293 review, either in their entirety or by reference.

294

295 (f) Hazard mitigation shall specify any restrictions on employees conducting activities 

296 alone or out of hours, and if there are such restrictions, the additional safety measures 

297 that must be implemented, e.g., buddy system, safe operating guideline. 

298

299 (g) Hazard mitigation shall specify any ongoing direct supervision required for 

300 employees to engage in the activity when ongoing direct supervision is deemed a 

301 necessary administrative control.

302

303 (h) Hazard mitigation should specify any restrictions on:

304

305 i. The number of hours employees spends on the activity during a workday;

306

307 ii. The time of day employees conduct the activity; and
NIST S 7101.20 (Uncontrolled Copy in Print) Page 9

308

309 iii. The environmental conditions under which employees conduct the activity.

310

311 (i) Hazard mitigation shall specify the PPE required for conduct of the activity or 

312 subtasks of the activity.

313

314 i. All PPE, including employee-owned PPE, shall be of safe design and 

315 construction for the work to be performed.

316

317 ii. PPE shall be selected in accordance with the requirements in the PPE and 

318 other OSH suborders (e.g., Biosafety, Cryogen Safety, Hearing Protection, 

319 Respiratory Protection, etc.), as applicable. 

320

321 iii. PPE that properly fits each affected employee shall be selected.

322

323 (j) Hazard mitigation shall, based on the physical-location review, identify any 

324 additional controls necessary to conduct the activity safely in the proposed physical 

325 location.

326

327 (k) Hazard mitigation shall, based on the compatibility assessment, identify any 

328 additional controls necessary to conduct the proposed activity safely in proximity to 

329 other activities in the space and, when applicable, neighboring spaces.

330

331 (l) Hazard mitigation shall specify the activity-specific training, to be provided by the 

332 OU, required for employees to engage in the activity, or distinct subtasks of the 

333 activity, in the proposed physical location, and, when applicable, in proximity to other 

334 activities in the space and neighboring spaces.

335

336 i. The Safety Education and Training suborder requires employees to complete 

337 the training specified in OSH suborders (e.g., Biosafety, Cryogen Safety, 

338 Magnetic Fields, etc.) applicable to the work they are to conduct. This training 

339 is documented and recorded in accordance with the requirements of the Safety 

340 Education and Training suborder and need not be specified in the hazard 

341 review.

342

343 ii. When activities involve the use of PPE, the activity-specific training must 

344 result in employees being able to demonstrate an understanding of the 

345 following requirements, and any special activity-specific abilities needed to 

346 use the applicable PPE properly, before they are permitted to perform work 

347 with that PPE:
NIST S 7101.20 (Uncontrolled Copy in Print) Page 10

348 (i) What PPE is necessary;

349

350 (ii) When PPE is necessary;

351

352 (iii) How to properly don, doff, adjust, and wear the PPE;

353

354 (iv) The limitations of the PPE; and

355

356 (v) The proper care, maintenance, useful life, and disposal of the PPE.

357

358 This activity-specific training must address only those activity-specific aspects 

359 of the PPE not covered in either (1) the training provided by OSHE on the 

360 PPE program, or (2) the training completed previously by affected employees 

361 for other activities. This training shall be provided by OU employees, or 

362 others, who have demonstrated an understanding of the activity-specific 

363 aspects of the applicable PPE and any activity-specific ability to use that PPE 

364 properly.

365

366 (m) Voluntary use of controls should be documented in the hazard mitigation section of 

367 the Hazard Review when such use is subject to requirements in other OSH 

suborders.5368

369

370 (7) Incident-Response Plan (Activity Specific)

Planning for incidents, including off-normal conditions6371 , as applicable, is a critical 

372 element of the hazard review process. In addition to providing guidance during an 

373 emergency, the development of incident-response plans may result in the identification of 

374 hazardous conditions that could aggravate or compound an emergency situation. 

375 Additionally, the planning process may bring to light deficiencies, such as the lack of 

376 resources (equipment, trained personnel, supplies) or adequate controls that can be 

377 rectified before an emergency occurs. Hazard reviews shall include activity-specific 

378 incident-response plans that:

379

380 (a) Stipulate any activity-specific equipment and supplies required for incident response, 

381 e.g., emergency shut-off switch, spill containment, special-purpose vacuum cleaner; 

382

383 (b) Include the following when necessary to protect employee safety and health, the 

384 physical location, and the environment:

5 For example, the voluntary use of respiratory protection is governed by specific requirements in the Respiratory 

Protection suborder. 

6 Examples of off-normal conditions, i.e., conditions outside of expected operating limits, include over or under 

pressure, over or under temperature, over or under flow rates, and loss of electrical power.
NIST S 7101.20 (Uncontrolled Copy in Print) Page 11

385 i. Procedures for shutting down or placing systems in a safe configuration;

386

387 ii. Plans for responding to off-normal conditions resulting from the failure of one 

388 or more controls in the activity itself and, when necessary, other activities 

389 conducted in the same space or neighboring spaces;

390

391 iii. Plans for responding to events such as utility losses, e.g., power or water, and 

392 building evacuations; and

393

394 iv. The identification of additional controls deemed necessary to reduce risks to 

395 acceptable levels;

396

397 (c) Ensure that decisions regarding employees working alone or out of hours fully 

398 consider the need to respond promptly, if necessary, to incidents that threaten 

399 employee safety and health or the environment; and

400

401 (d) Specify the activity-specific incident-response training, to be provided by the OU, 

402 required for employees to engage in the activity or distinct subtasks of the activity. 

403

404 (8) Risk Assessment

405

406 (a) Hazard Reviews shall include an assessment of the risks by assigning RHIs to each of 

407 the identified hazards subsequent to the application of controls. 

408

409 (b) If the risk assessment subsequent to hazard mitigation results in RHIs that feasibly 

410 could be lower, additional steps to mitigate the hazards shall be taken to reduce the 

411 RHIs to those lower levels.

412

413 (9) Additional Requirements

414

415 (a) Hazard reviews shall meet the additional requirements established in other OSH 

suborders, when applicable;7416

417

418 (b) Hazard reviews shall flag, e.g., using checkboxes, activities requiring the control of 

419 hazardous energy (lockout/tagout), confined-space entry, hearing protection, 

7 For example, hazard reviews of activities involving the use of biohazardous materials must include a Biohazardous 

Materials Registration and Authorization Form approved by the NIST Biosafety Officer; hazard reviews of activities 

involving the use of radioactive material at NIST Gaithersburg must include (among other things) a specific hazard 

assessment and hazard mitigation plan whose safety evaluation by the NIST Gaithersburg Radiation Safety Officer 

has been approved by the NIST Ionizing Radiation Safety Committee.
NIST S 7101.20 (Uncontrolled Copy in Print) Page 12

420 respiratory protection, fall protection, and assessments of exposure to carcinogenic 

421 chemicals;

422

423 (c) Hazard reviews shall be readily available in hard-copy or electronic form in or near 

424 the space in which the associated activities are to be conducted; and

425

426 (d) Hazard reviews shall identify hazardous wastes generated in the conduct of the 

427 activity and include management of those wastes, as applicable. Arrangements for 

428 disposal shall be coordinated with OSHE.

429

430 c. Conduct of Hazard Reviews

431 Hazard reviews shall be conducted by, or in consultation with, individuals with the 

432 knowledge, skills, and abilities to identify, assess, and mitigate the hazards associated with 

433 the activity under review, to conduct the physical-location review and compatibility 

434 assessment, and to develop plans for incident response.

435

(1) Hazard reviews shall be conducted by individuals who collectively8436 have taken the 

437 training provided by OSHE on the Hazard Review program and on all OSH programs 

438 pertinent to the activity under review.

439

440 (2) Hazard reviews should include subject matter experts from OSHE, the Office of Facilities 

441 and Property Management (OFPM), and other OUs when the OU conducting the hazard 

442 review requires additional safety or facilities expertise.

443

444 (3) Hazard reviews shall include consultation with the relevant groups in OSHE, ESO, and 

445 OFPM (e.g., Fire and Facilities Safety Group, Police Services Group, Fire Protection

446 Group, Facilities Maintenance Division) when activity-specific alarms must be tied into 

447 building or facility alarm systems.

448

d. Approval of Hazard Reviews9, 10 449

450 Completed hazard reviews shall be approved by line management, with the approval 

451 signifying that the RHIs associated with the activity represent an acceptable level of safety 

risk.11 452

453

8 At least one member of the team must have taken the required training.

9 Sections 6d-i focus on activities that involve workers from a single OU. Section 6j indicates how Sections 6d-i 

apply to activities that involve workers from multiple OUs.

10 OUs may approve hazard reviews and authorize work at one time provided that the requirements in this section 

and Section 6e, respectively, are met.

11 The approved hazard review serves as the Certification of Hazard Assessment required by 29 CFR 1910.132,

Personal Protective Equipment. 
NIST S 7101.20 (Uncontrolled Copy in Print) Page 13

454 (1) Hazard reviews shall be approved by line managers who have taken the training provided 

455 by OSHE on the Hazard Review program.

456

457 (2) Activities with any RHI = 4 shall not be conducted at NIST. 

458

459 (3) Hazard reviews of activities involving minors (individuals under age 18) that could result 

in their being exposed to hazards with RHI = 2 shall be approved by OU Directors.12, 13 460

461

462 (4) With the exceptions noted in items (5) and (6) below, all other hazard reviews shall be 

463 approved at the following or higher levels of the line management of the OU responsible 

for the activity (see NIST 7101.00):

14 464

465

466 (a) Group Leaders:

467

468 i. Activities with all RHIs ≤ 1.

469

470 (b) Division Chiefs:

471

472 i. Activities with some RHIs = 2 but no RHIs = 3.

473

(c) OU Directors:15 474

475

476 i. Activities with at least one RHI = 3.

477

478 (5) Activities for which the highest hazards have RHI = 2 and these are fully controlled to 

479 industry standards (see definition of “Fully Controlled to Industry Standards”), as 

480 determined by OSHE, may be approved by Group Leaders.

481

482 (6) Activities for which the highest hazards have RHI = 3 and these are fully-controlled to 

483 industry standards (see definition of “Fully Controlled to Industry Standards”), as 

484 determined by OSHE in consultation with experts in the OUs, may be approved by 

485 Division Chiefs.

486

12 As indicated in Section 10. AUTHORITIES, OU Directors may delegate the authority to approve such hazard 

reviews to OU Deputy Directors or Division Chiefs. 

13 Activities with RHIs > 2 and a list of other specific activities are prohibited for minors; see the Safety and Health 

Requirements for Minors suborder.

14 OUs may require lower levels of line management (and others, e.g., chairs of hazard review committees, 

OU/division safety personnel, and project leaders) to sign off on hazard reviews prior to those hazard reviews being 

approved at the levels of line management indicated. 

15 OU Directors may wish to establish (standing or ad hoc) Hazard Review Committees to conduct (or review)

hazard reviews for such activities and recommend their approval or disapproval. 
NIST S 7101.20 (Uncontrolled Copy in Print) Page 14

e. Authorization of Work16 487

488 Activities covered by approved hazard reviews shall be authorized to commence by line 

management, with the authorization signifying that controls other than training17 489 have been 

490 verified to have been implemented and that the controls will continue to be implemented as a 

condition for the ongoing conduct of the work.18 491

492

493 (1) Activities shall be authorized by line managers who have taken the training provided by 

494 OSHE on the Hazard Review program.

495

496 (2) Activities with any RHI =4 shall not be authorized by NIST.

497

498 (3) With the exceptions noted in item (4) below, activities covered by all other hazard 

reviews shall be authorized at the following or higher levels of line management:19 499

500

501 (a) Group Leaders:

502

503 i. Activities with all RHIs ≤ 2. 

504

505 (b) Division Chiefs:

506

507 i. Activities with at least one RHI = 3.

508

509 (4) Activities for which the highest hazards have RHI = 3 and these are fully-controlled to 

510 industry standards (see definition of “Fully Controlled to Industry Standards”), as 

511 determined by OSHE, may be authorized by Group Leaders.

512

513 (5) If an activity of one OU is to be conducted in space assigned to another OU, access to 

514 that space must be authorized by the line management of the second OU subject to any 

515 conditions established by that OU to protect other employees working in the space from 

516 the hazards associated with the activity. These conditions must be included as part of the 

517 formal authorization of work (see NIST 7101.00).

518

16 OUs may approve hazard reviews and authorize work at one time provided that the requirements in this section 

and Section 6e, respectively, are met.

17 Training is addressed not in the authorization of work, but in the authorization of workers; see Section 6f. 

18 So, for example, if a chemical fume hood is a required control, and the chemical fume hood is out of service or 

suspected to be functioning improperly, the work must stop until the fume hood is fully operational or an equivalent 

control is identified and implemented. Similarly, PPE must be in good working condition; defective or damaged 

PPE shall not be used.

19 OUs may require lower levels of line management (and others, such as chairs of hazard review committees, 

OU/division safety personnel, and project leaders) to sign off on authorizations of work prior to work being 

authorized at the level of line management indicated.
NIST S 7101.20 (Uncontrolled Copy in Print) Page 15

519 f. Authorization of Workers

520 To engage in activities that have been authorized by line management, workers must 

521 themselves be authorized to perform that work by line management. This authorization 

522 signifies that:

523

524 • The workers have taken the training specified in the OSH suborders applicable to the 

525 work they are to conduct and the activity-specific training identified in Sections 

526 6b(6)(i) (Hazard Mitigation) and 6b(7)(c) (Incident-Response Plan);

527

528 • Line-management has an appropriate degree of confidence, based on personal 

529 knowledge, observation, or reliable input from others, that the workers to be 

530 authorized:

531

532 o Have the knowledge, skills, and abilities to perform the work safely and 

533 correctly; and

534

535 o Fully understand the boundaries/conditions imposed on the activity by the 

536 activity hazard review, the need to work within those boundaries/conditions, 

537 and the process for requesting work that falls outside of those 

538 boundaries/conditions.

539

540 (1) Workers shall be authorized by line managers who have taken the training provided by 

541 OSHE on the Hazard Review program and, in the case of official first-level supervisors, 

on all OSH programs applicable to the work to be conducted;20 542 and

543

544 (2) Workers shall be authorized by their official first-level supervisors, or at that level and 

higher.

21, 22 545 

546

547 g. Re-Review and Re-Approval of Hazard Reviews and Re-Authorization of Work and 

548 Workers

549

20 The Safety Education and Training suborder requires official first-level supervisors to complete training on the 

OSH suborders applicable to the work to be conducted by employees they supervise. This training is documented 

and recorded in accordance with the requirements of the Safety Education and Training suborder and need not be 

specified in the hazard review.

21 If a worker is to be authorized to carry out only a specified set of subtasks of a larger activity, that worker need

only take the training applicable to that specified set of subtasks. 

22 If an activity involves workers from one or more groups or divisions within a single OU, the OU may wish to 

establish additional requirements for authorizing workers across organizational lines. For example, if an activity 

owned by one group involves workers from a second group and the two Group Leaders are the official first-level 

supervisors, the OU may wish to have the workers from the second group authorized first by their Group Leader and 

then by the Group Leader of the group that owns the activity. 
NIST S 7101.20 (Uncontrolled Copy in Print) Page 16

550 (1) Hazard reviews shall be re-reviewed whenever:

551

552 (a) Changes in existing activity parameters would introduce new hazards or increase 

existing hazards; 23 553

554

555 (b) Changes in engineering controls, administrative controls, or PPE would increase 

556 safety risks; or

557

558 (c) Previously unrecognized safety issues are identified, e.g., through direct observation 

559 or discussion, relating to an incident or audit that indicates inadequate controls, or 

560 abnormal operating conditions which affect availability or efficacy of documented, 

561 planned controls.

562

563 (2) Hazard reviews shall be re-reviewed on a predetermined basis to verify that the hazards 

564 have not changed substantially since the hazard review was last approved or reviewed, 

565 and that existing controls are adequate. Predetermined review periods: 

566

567 (a) Shall be established when hazard reviews are initially reviewed and approved and 

568 when they are re-reviewed;

569

570 (b) Shall not exceed three years;

571

572 (c) Shall be included in the hazard review documentation; 

573

574 (d) Shall be based on risk and the potential for change, with higher-risk, more potentially 

575 variable activities being reviewed more frequently; and

576 (e) May be more frequent based on the likelihood for change within an activity.

577

578 (3) When re-reviews indicate that hazards have not changed and that existing controls are 

579 adequate, the re-reviewed hazard reviews shall include the date of the re-review, the 

580 signature(s) of the individual(s) conducting the re-review, and the signature of the 

581 responsible line manager.

582

583 (4) When re-reviews indicate that hazards have changed or that existing controls are 

584 inadequate:

585

23 For example, changes in equipment, equipment operation, materials, maximum quantities of materials, 

concentrations, operating temperatures and pressures, power levels, or process rates, or changes in permit conditions 

for permit-required activities, that would introduce new hazards or increase existing hazards.
NIST S 7101.20 (Uncontrolled Copy in Print) Page 17

586 (a) The re-reviewed hazard reviews shall be re-approved in accordance with the 

587 requirements in Section 6d; and

588

589 (b) Work and workers shall be re-authorized in accordance with the requirements in 

590 Sections 6e and 6f, respectively.

591

592 The re-approval of the hazard review and the re-authorization of work shall take place at 

593 the levels of line management determined by the hazards that have changed or for which 

594 the existing controls are inadequate, or at a higher level of line management. 

595

596 h. Retraining and Re-Authorization of Workers

597

598 (1) Employees who have been authorized to conduct work shall, as a condition of their 

599 authorization, complete retraining identified by the OUs whenever there is reason to 

600 believe that employees lack the knowledge, understanding, or skill necessary to conduct 

601 their work safely. Individual OSH suborders list specific circumstances under which such 

602 retraining is required. General circumstances under which retraining is required include, 

603 but are not limited to:

604

605 (a) An observation or other condition reveals that a worker lacks the necessary 

606 knowledge understanding or skill; or

607

608 (b) An inspection or audit points to a systemic deficiency warranting retraining.

609

610 i. Records

611

612 (1) Copies of all current hazard reviews and work and worker authorizations shall be 

613 maintained in hard copy or electronic form.

614

615 (2) Copies of hazard reviews and work and worker authorizations for activities that have 

616 ceased shall be maintained in hard copy or electronic form for at least one (1) year unless 

617 the hazard assessment involved exposure monitoring, in which case the hazard review 

618 and work and worker authorizations shall be submitted to OSHE for retention in 

619 accordance with the requirements of the Industrial Hygiene program.

620

621 (3) Training shall be documented and recorded in accordance with the requirements, roles, 

622 and responsibilities in the Safety Education and Training suborder.

623

624 j. Activities Involving Workers from Multiple OUs

625
NIST S 7101.20 (Uncontrolled Copy in Print) Page 18

626 (1) The activity shall be owned by the de facto lead OU or, if it is not obvious which OU is 

627 the de facto lead OU, by the OU determined to be the lead OU by discussion among the 

628 involved OUs.

629

630 (2) The hazard review shall be approved by the lead OU in accordance with the 

631 requirements in Section 6d, Approval of Hazard Reviews.

632

633 (3) Work shall be authorized by the lead OU in accordance with the requirements in Section 

634 6e, Authorization of Work.

635

636 (4) Workers from the lead OU shall be authorized by the lead OU in accordance with the 

637 requirements in Section 6f, Authorization of Workers.

638

639 (5) Workers from OUs other than the lead OU shall be authorized by their respective OUs 

640 in accordance with the requirements in Section 6f and by the lead OU (“final 

641 authorization”) in accordance with its own requirements.

642

643 (a) In authorizing workers from their OUs, OUs other than the lead OU should 

644 determine that the hazard review is adequate, that the safety risk to workers from 

645 their OUs is acceptable, and that the work has been authorized by the lead OU.

646

647 (6) Hazard reviews shall be re-reviewed and re-approved and work and workers from the 

648 lead OU shall be re-authorized by the lead OU in accordance with the requirements in 

649 Section 6g, Re-Review and Re-Approval of Hazard Reviews and Re-Authorization of 

650 Work and Workers.

651

652 (7) Workers from OUs other than the lead OU shall be re-authorized by their respective 

653 OUs in accordance with the requirements in Section 6g and by the lead OU (“final re654 authorization”) in accordance with its own requirements.

655 (8) Workers from the lead OU shall be retrained and re-authorized by the lead OU in

656 accordance with the requirements in Section 6h, Retraining and Re-Authorization of 

657 Workers.

658

659 (9) Workers from other than the lead OU shall be retrained and re-authorized by their 

660 respective OUs in accordance with the requirements in Section 6h and by the lead OU in 

661 accordance with its own requirements.

662

663 (10) Records related to hazard-review documentation, the authorization of work, and the 

664 authorization of workers from the lead OU shall be maintained by the lead OU in 

665 accordance with the requirements in Section 6i, Records.
NIST S 7101.20 (Uncontrolled Copy in Print) Page 19

666 (11) Records of the authorization of workers from OUs other than the lead OU shall be 

667 maintained as follows:

668

669 (a) Records of the authorization of workers from OUs other than the lead OU shall be 

670 maintained by the workers’ respective OUs; and

671

672 (b) Records of the final authorizations of such workers by the lead OU shall be 

673 maintained by the lead OU. 

674

675 k. OU Hazard Review and Work and Worker Authorization Procedures

676 Written procedures, which, if followed, would result in the requirements in Sections 6a-j 

677 being met, shall be developed and maintained by each OU. 

678

679

680 7. DEFINITIONS

681 a. Abnormal Conditions – Operational occurrences caused by external factors which are not 

682 expected to occur as part of normal and off-normal conditions and may alter the risk 

683 assessment or present additional hazards to those directly associated with performance of the 

684 activity. Examples include restricted access to campus or need to work in close contact with 

685 another staff member during pandemic conditions.

686

687 b. Activity – An experiment, operation, process, or job, often comprising subtasks, conducted to 

688 achieve a specific outcome.

689

690 c. Direct Supervision – Relative to an employee, a term meaning that a second employee, 

691 proficient in the activity being conducted by the first employee, shall be either present in the 

692 work area while the activity is being conducted or available for consultation within a 

693 reasonable amount of time commensurate with the need for consultation, based on the 

694 proficiency of the first employee.

695

696 d. Fully Controlled to Industry Standards (Used in Reference to Hazards) – Controlled by a 

697 device, apparatus, or system being designed in accordance with applicable regulatory and 

698 consensus standards and predicated upon that device, apparatus, or system being used in a 

699 prescribed manner. The mitigation of hazards that are fully controlled to industry standards 

700 relies primarily on built-in/engineering controls or inherent design features but may, in some 

701 cases, rely upon best practices. In either case, the control should be traceable to a broad 

702 industry, consensus-based set of controls.

703
NIST S 7101.20 (Uncontrolled Copy in Print) Page 20

704 e. Hazard – Source, situation, or act with a potential for harm in terms of human injury or ill 

705 health, adverse impact on the environment, damage or loss of equipment or property, or a 

combination of these (from NIST 7101.00).24 706

707

708 f. Hazard Identification – Process of recognizing that a hazard exists and defining its 

709 characteristics (from NIST 7101.00).

710

711 g. Hazard Review (Document) – A document describing the results of the hazard-review 

712 process.

713

714 h. Hazard Review (Process) – The formal process, aspects of which could be iterative, of 

715 describing an activity, identifying the hazards associated with the activity, reviewing the 

716 physical-location in which the activity will be carried out, assessing the compatibility of the 

717 activity with nearby activities, conducting an initial hazard assessment, identifying controls 

718 to mitigate the hazards, developing an incident-response plan, conducting a risk assessment, 

719 and developing plans for managing wastes generated during the conduct of the activity.

720

721 i. Hierarchy of Controls – A range of hazard control methods arranged in order of 

722 implementation preference from elimination to substitution, engineering controls, 

723 administrative controls, and personal protective equipment.

724

725 j. Inherent/Built-In Controls – Features of a system's design that prevent or limit the severity of 

726 the consequences of system failure. Inherent/built-in controls cannot be defeated or separated 

727 from the system without conscious or willful effort. 

728

729 k. Likelihood of a Hazardous Event or Exposure (“Likelihood”) – An estimate of the 

730 probability of a hazardous event or exposure.

731

732 l. Line Management – For the purposes of this suborder, the OU Director, Division Chief, and 

733 Group Leader, or equivalent.

734

735 m. Office-Like Space – A space, such as a conference room, copier room, break room, or 

736 ordinary computer room that has the same types of hazards as a typical office or office 

737 environment.

24 This definition parallels that in Occupational Health and Safety Assessment Series (OHSAS) Standard 

18001:2007, Occupational Health and Safety Management Systems – Requirements. For comparison, OSHA 3071, 

Job Hazard Analysis, 2002 (revised) defines a hazard as “the potential for harm, often associated with a condition or 

activity that, if left uncontrolled, can result in injury, illness or damage to property or the environment”, and 

American National Standard for Occupational Safety and Health Management Systems, ANSI/AIHA Z10-2005, 

defines a hazard as “a condition, set of circumstances, or inherent property that can cause injury, illness or death”.
NIST S 7101.20 (Uncontrolled Copy in Print) Page 21

738 n. Off-Normal Conditions – Operational occurrences which may be expected to occur that are 

739 generally outside routine or planned operations. For example, loss of cooling water would be 

740 an “off-normal” condition which could cause a heat-sink to overheat and combust. Other 

741 examples include power failure, error at power-up or power-down, loss of cryogen 

742 containment, human error, etc.

743

744 o. Relative Hazard Index (RHI) – A measure of the risk of a hazardous event or exposure based 

745 on a combination of the severity of the consequences of the hazardous event or exposure to a 

746 hazard and its likelihood.

747

748 p. Risk – Combination of the likelihood of an occurrence of a hazardous event or exposure and 

749 the severity of injury or ill health that can be caused by the event or exposure (from NIST 

750 7101.00).

751

752 q. Risk Assessment – Process of evaluating the risks arising from hazards, taking into account 

753 the adequacy of any existing controls, and deciding whether or not the risks are acceptable 

754 (from NIST 7101.00).

755

756 r. Safe Operating Guideline – A written set of requirements or practices developed or designed 

757 to enable a task to be carried out safely. Safe operating guidelines can include, but are not 

758 limited to, standard operating procedures, job hazard analyses, and instrument/equipment 

759 instruction manuals.

760

761 s. Severity of the Consequences of a Hazardous Event or Exposure to a Hazard (“Severity”) –

762 A qualitative measure of the consequences of the worst credible hazardous event or exposure 

763 associated with an identified hazard due to design inadequacies; procedural deficiencies; 

764 human error; environmental conditions; or system, subsystem, or component failure or 

765 malfunction.

766

767 t. Standard Operating Procedure – A written step-by-step procedure or operational protocol 

768 used to document how a given task must be carried out to ensure safe operation. Standard 

769 operating procedures are generally needed when failure to follow a prescribed set of steps 

770 results in significant increase in risk.

771

772 u. Worst Credible Hazardous Event – Most severe or serious event capable of being believed, 

773 taking into account all relevant considerations.

774

775

776 8. ACRONYMS

777 a. HR – Hazard Review
NIST S 7101.20 (Uncontrolled Copy in Print) Page 22

778 b. OSH – Occupational Safety and Health

779

780 c. OSHE – Office of Safety, Health, and Environment

781

782 d. OU – Organizational Unit

783

784 e. PPE – Personal Protective Equipment

785

786 f. RHI – Relative Hazard Index

787

788

789 9. ROLES AND RESPONSIBILITIES

790 a. NIST Director and Associate Directors:

791

792 (1) Concur or non-concur on approvals by OU Directors of hazard reviews of activities 

793 elevated to the directorship level.

794

795 b. OU Directors:

796

797 (1) Ensure that written OU procedures are developed, maintained, and implemented to 

798 ensure that the requirements of Sections 6a-j are met within their respective OUs.

799

800 c. Line Management:

801

802 (1) Take the training provided by OSHE on the Hazard Review program;

803

804 (2) Ensure that hazard reviews are conducted for all new activities;

805

806 (3) Involve employees in the conduct of hazard reviews as appropriate;

807

808 (4) Ensure that hazard reviews are conducted by individuals who collectively have taken the 

809 training provided by OSHE on the Hazard Review program and on all NIST OSH 

810 programs pertinent to the activity under review;

811

812 (5) Approve hazard reviews in accordance with the requirements of Section 6d, with the 

813 approval signifying that the RHIs associated with the activity represent an acceptable 

814 level of risk;

815

816 (6) Authorize activities in accordance with the requirements of Section 6e, with the 

817 authorization signifying that controls other than training have been verified to have been 
NIST S 7101.20 (Uncontrolled Copy in Print) Page 23

818 implemented and that required safety equipment shall be maintained in proper working 

819 order in accordance with manufacturers’ specifications and all applicable standards;

820

821 (7) Authorize workers in accordance with the requirements of Section 6f, with the 

822 authorization signifying that (a) the workers have taken the training provided by OSHE 

823 on all NIST OSH programs pertinent to the activity to be conducted and the training 

824 identified in Sections 6b(6)(l) and 6b(7)(d), (b) line management has an appropriate 

825 degree of confidence, based on personal knowledge, observation, or reliable input from 

826 others, that the workers to be authorized have the knowledge, skills, and abilities to 

827 perform the work safely and correctly, and (c) the workers fully understand the activity 

828 boundaries/conditions, the need to work within those established boundaries/conditions, 

829 and the process for requesting work that falls outside those boundaries/conditions;

830

831 (8) Re-review and re-approve hazard reviews and re-authorize work and workers in 

832 accordance with the requirements of Section 6g; 

833

834 (9) While visiting laboratories, discussing work, or conducting management observations:

835

836 (a) Be vigilant for “scope creep”, i.e., advertent or inadvertent changes in activity 

837 boundaries/conditions or controls that introduce new hazards, increase existing 

838 hazards, or otherwise increase safety risk; and

839

840 (b) If scope creep is identified, stop work and require re-review and re-approval of the 

841 hazard review and re-authorization of work and workers, as per Section 6g;

842

843 (10) Maintain records in accordance with the requirements of Section 6h.

844

845 d. Official First-Level Supervisors Authorizing Work (in addition to their responsibilities as 

846 part of Line Management):

847

848 (1) Complete the training provided by OSHE on all NIST OSH programs pertinent to the 

849 work to be authorized; and

850

851 e. Employees Conducting Hazard Reviews:

852

853 (1) Take the training provided by OSHE on the Hazard Review program.

854

855 f. Employees Authorized to Engage in Work: 

856
NIST S 7101.20 (Uncontrolled Copy in Print) Page 24

857 (1) Complete the training provided by OSHE on all NIST OSH programs pertinent to the 

858 work to be conducted and the training provided by the OU identified in Sections 6b(6)(i) 

859 (Hazard Mitigation) and 6b(7)(c) (Incident-Response Plan), as applicable; and

860

861 (2) Work within the boundaries/conditions of the hazard review at all times and in 

862 accordance with required controls and training;

863

864 (2) If it is necessary or desirable to work outside the boundaries/conditions of a hazard 

865 review or change existing controls, request line management re-review of the hazard 

866 review as per Section 6g; and

867

868 (3) Be vigilant for scope creep, and if scope creep is identified, stop work and request line 

869 management re-review of the hazard review, as per Section 6g.

870

871 g. Employees Assigned Responsibility for Safety Equipment:

872

873 (1) Ensure that required safety equipment is maintained in proper working order in 

874 accordance with manufacturers’ specifications and all applicable standards.

875

876 h. Employees:

877

878 (1) Participate in the conduct of hazard reviews as appropriate.

879

880 i. Chief Safety Officer: 

881

882 (1) Maintain this suborder;

883 (2) Develop and maintain any necessary supporting NIST directives, including procedures, 

884 guidance, and notices;

885

886 (3) Review the efficacy of written OU procedures for meeting the requirements of this 

887 suborder and provide the results of those reviews to the respective OU Directors; and

888

889 (4) Support, through the OSHE staff, OU implementation of this suborder. 

890

891 j. OSH Program Manager for the Hazard Review program:

892

893 (1) Make determinations that particular hazards are controlled to industry standards and 

894 maintain and make available to the OUs a list of such hazards and their associated RHIs;

895
NIST S 7101.20 (Uncontrolled Copy in Print) Page 25

896 (2) Develop and maintain any necessary deployment tools, including forms, instructions, IT 

897 applications, training, and user guides;

898

899 (3) Serve as the primary point of contact and subject matter expert on:

900

901 (a) Federal, State and local regulatory requirements and guidelines; and

902

903 (b) Consensus industry standards and best practices.

904

905 (4) Ensure effective communication with management and staff on program-related issues.

906

907

908 10. AUTHORITIES

909 For authorities applicable to all NIST OSH suborders, see NIST 7101.00. There are no 

910 authorities specific to this suborder alone.

911 

912

913 11. DIRECTIVE OWNER

914 Chief Safety Officer

915

916

917 12. APPENDICES

918 Appendix A. Revision History

919

920 Appendix B. Processes for Authorizing Work and Workers 

921

922 Appendix C. Risk-Assessment Matrix 

923

924 Appendix D. Elements of the Hazard Review Process 

925
NIST S 7101.20 (Uncontrolled Copy in Print) Page 26

926 Appendix A. Revision History

927

Revision Date Responsible 

Person

Description of Change

1 01/23/15 Richard Kayser Modifications made to Section 3. 

Applicability, subsequent to Executive 

Safety Committee review.

2 11/07/17 Richard Kayser Modified Section 6 to make more explicit 

the need for workers to understand the 

requirements of hazard reviews and the 

need to stay within scope or request rereview. Modified Section 9 to reflect the 

responsibilities necessary to fulfil the 

modified requirements in Section 6.

3 05/05/2020 • Modified Section 2.b to include 

abnormal conditions

• Modified Section 3.b to include 

applicability of abnormal conditions. 

• Modified Section 6g(1)(c) to include 

abnormal conditions

4 12/23/2020 April Camenisch Updated links under References and 

Applicable Suborders.

928

929
NIST S 7101.20 (Uncontrolled Copy in Print) Page 27

Appendix B. Processes for Authorizing Work and Workers (for details on the hazard-review process, see Appendix D)
NIST S 7101.20 (Uncontrolled Copy in Print) Page 28

Appendix C. Risk-Assessment Matrix 

This matrix is used to determine the risk level, or Relative Hazard Index (RHI), for a given 

hazard.

POTENTIAL SEVERITY OF THE CONSEQUENCES

OF A HAZARDOUS EVENT OR EXPOSURE TO A HAZARD

Catastrophic

Death or 

permanent 

disability

System or 

facility loss

Lasting 

environmental or 

public-health 

impact

Severe

Serious injury; 

temporary 

disability

Subsystem loss 

or significant 

facility/property 

damage

Temporary 

environmental or 

public-health 

impact

Moderate

Medical 

treatment beyond 

first aid; lostwork-day(s)

More than slight 

facility/property 

damage

External 

reporting 

requirements; 

more than routine

clean-up

Minor

First-aid only

Negligible or 

slight 

facility/property 

damage

No external 

reporting 

requirements; 

routine clean-up

LIKELIHOOD OF OCCURRENCE

Frequent

Likely to occur 

repeatedly

CRITICAL

RHI=4

CRITICAL

RHI=4

SERIOUS

RHI=3

Medium

RHI=2

Probable

Likely to occur 

multiple but 

infrequent times

CRITICAL

RHI=4

CRITICAL

RHI=4

SERIOUS

RHI=3

Medium

RHI=2

Occasional

Likely to occur 

at some time

CRITICAL

RHI=4

SERIOUS

RHI=3

Medium

RHI=2

Low

RHI=1

Remote

Possible, but not 

likely to occur

SERIOUS

RHI=3

Medium

RHI=2

Medium

RHI=2

Low

RHI=1

Improbable

Very unlikely; 

can reasonably 

assume it will 

not occur

Medium

RHI=2

Low

RHI=1

Low

RHI=1

Minimal

RHI=0
NIST S 7101.20 (Uncontrolled Copy in Print) Page 29

Appendix D. Elements of the Hazard Review Process (see Section 6b)