Biosafety protects people and the environment from accidental exposure to, or release of, biological agents. Biosecurity protects the biological agents themselves, along with related toxins, equipment and information, from loss, theft, misuse, diversion or intentional release. Put simply, biosafety keeps the agents away from people, while biosecurity keeps the wrong people away from the agents.
Many labs run them as one programme, and the WHO Laboratory Biosafety Manual 4th edition (2020) covers both. But auditors and interview panels expect you to tell them apart, because the risks, controls and people responsible differ.
What is laboratory biosafety?
Biosafety is about preventing unintentional harm. The question is how a worker or the community could be exposed through a needlestick, splash, aerosol, spill or poorly treated waste.
Controls follow a familiar order: good microbiological practice, then engineering controls such as biological safety cabinets (BSCs), then personal protective equipment (PPE).
What is laboratory biosecurity?
Biosecurity is about preventing loss of control, whether careless or deliberate. The concern is that a pathogen culture, a toxin, a reference strain collection or sensitive genetic data ends up somewhere it should not be.
Controls focus on accountability: knowing what you hold, where it is, who can reach it and who moved it last, backed by access control, personnel checks and information security.
Biosafety vs biosecurity: comparison table
| Aspect | Biosafety | Biosecurity |
|---|---|---|
| Goal | Protect people and the environment from the agent | Protect agents, toxins, equipment and data from people who should not have them |
| Threat type | Unintentional exposure or accidental release | Loss, theft, misuse, diversion or intentional release |
| Key question | Could this work harm someone by accident? | Could this material or information leave our control? |
| Typical controls | Good microbiological practice, BSCs, PPE, ventilation, autoclaving | Inventory, access control, locked storage, personnel screening, IT security |
| Who usually leads | Biosafety officer with lab management | Biosafety or biorisk officer with security, facilities and IT |
| Example incident | Aerosol release when a centrifuge tube breaks | A culture vial missing from a freezer box |
| Key documents | Risk assessments, SOPs, biosafety manual, exposure records | Inventory records, access logs, material transfer records, security plan |
The controls point in opposite directions. Biosafety keeps the agent contained so it cannot get out by accident; biosecurity keeps it accounted for so it cannot be taken out on purpose.
Biosafety levels: BSL-1 to BSL-4
The four biosafety levels appear in national guidance such as the US CDC/NIH Biosafety in Microbiological and Biomedical Laboratories (BMBL). Each level builds on the one below.
| Level | Example agents | Key controls |
|---|---|---|
| BSL-1 | Non-pathogenic E. coli K-12, Bacillus subtilis | Standard microbiological practice, open bench work, handwashing, lab coats, decontamination of surfaces and waste |
| BSL-2 | Staphylococcus aureus, non-typhoidal Salmonella | BSL-1 plus restricted access, biohazard signage, BSC for aerosol-generating work, sharps precautions, autoclave available |
| BSL-3 | Mycobacterium tuberculosis | BSL-2 plus controlled entry through an anteroom, inward directional airflow, all open manipulations in a BSC, respiratory protection |
| BSL-4 | Ebola virus | BSL-3 plus Class III BSC or positive-pressure suits, isolated facility, exit shower, decontamination of all waste and effluent |
The WHO risk-based approach
The WHO Laboratory Biosafety Manual 4th edition (2020) moved away from choosing controls mainly from the agent's level. It asks labs to risk-assess the actual procedures, then select controls in three tiers:
- Core requirements: good microbiological practice and procedure, training, PPE, waste handling and basic facility design, applied to all lab work.
- Heightened control measures: added when the risk assessment shows core requirements are not enough, for example BSCs or respiratory protection.
- Maximum containment measures: reserved for the rare activities where the risk is very high.
BSL terms remain common in facility design, national rules and job descriptions, so learn both and check which framework your regulator expects.
ISO 35001:2019 and biorisk management
ISO 35001:2019, Biorisk management for laboratories and other related organisations, brings biosafety and biosecurity into one management system. It follows the same high-level structure as ISO 9001 and ISO 45001, covering leadership, risk assessment, operational controls, performance evaluation and improvement.
Even without certification, it is a useful checklist. It complements, and does not replace, ISO 15189 or ISO/IEC 17025 accreditation.
Where biosafety and biosecurity overlap
The strongest programmes share four building blocks:
- Inventory: a reconciled record of what is held, in which freezer, rack and box, showing both which hazards are present and whether anything is missing.
- Access control: limiting entry to authorised staff reduces both accidental exposure and theft.
- Training: the same people carry out both sets of controls, so train them together and assess competence.
- Incident reporting: one blame-free route for spills, exposures, near misses, missing items and suspicious behaviour, followed by investigation and CAPA.
Worked example: a clinical microbiology lab in Abu Dhabi
A hospital microbiology lab in Abu Dhabi receives a sputum sample from a patient with suspected pulmonary tuberculosis. The same week, a technologist finds a reference strain vial missing from the inventory.
Biosafety: the suspected TB sample
The request form flags suspected TB, so reception staff do not open the container on the bench. In the TB area, the risk assessment, informed by WHO TB laboratory biosafety guidance, sets controls by procedure: aerosol-generating steps in a certified BSC, fit-tested respirators, and sealed centrifuge safety cups opened only inside the cabinet. Culture work happens only in the containment area the assessment requires.
A broken tube would trigger the spill procedure and an exposure report. Case notification follows hospital procedure and Department of Health requirements, which the lab should confirm.
Biosecurity: the missing culture vial
Nobody has been harmed, but control of material has been lost. The technologist does not quietly correct the spreadsheet. She reports it to the biosafety officer, who:
- Secures the freezer and checks neighbouring boxes and racks.
- Reviews the inventory history and who last signed the vial out.
- Checks freezer room access logs and speaks to the staff involved.
- Escalates to management and, where the agent or local rules require, to the relevant authority.
- Raises a CAPA, such as monthly inventory reconciliation.
The vial had been used in a training session and autoclaved, but nobody updated the record. The root cause was a documentation gap, not theft, yet the fix was still a biosecurity control: the lab could not prove where its material had gone.
Common mistakes
- Treating biosecurity as a guard at the door rather than accountability for materials and data.
- Relying on BSL labels instead of assessing the actual procedure and aerosol risk.
- Keeping inventories that are never reconciled against the freezer.
- Not reporting missing items because nobody was hurt.
- Assuming ISO 15189 or ISO/IEC 17025 accreditation automatically covers biorisk management.
Key takeaway: Biosafety stops biological agents harming people by accident. Biosecurity stops agents, toxins and data being lost, stolen or misused. Run them as one risk-based programme, built on accurate inventory, controlled access, competent staff and honest incident reporting.
Frequently Asked Questions
What is the main difference between biosafety and biosecurity?
Biosafety protects people and the environment from unintentional exposure to biological agents, using good practice, containment equipment and PPE. Biosecurity protects biological materials, toxins, equipment and information from loss, theft, misuse, diversion or intentional release, using inventory, access control and accountability. Biosafety deals with accidents; biosecurity deals with loss of control. Most labs manage both together.
What is biosecurity in a laboratory?
Laboratory biosecurity is the set of measures that keeps biological materials and related data under control. It means knowing exactly which agents and toxins you hold, limiting access to authorised staff, recording every transfer, securing storage and data, and reporting missing items or suspicious behaviour.
Are BSL levels still used after the WHO 4th edition manual?
Yes. The WHO Laboratory Biosafety Manual 4th edition (2020) promotes a risk-based approach with core requirements, heightened control measures and maximum containment measures, rather than relying on the agent alone. BSL-1 to BSL-4 terms remain common in national guidance, facility design and job descriptions. Check which framework your regulator and accreditation body expect, and risk-assess either way.
Who is responsible for biosafety and biosecurity in a lab?
Top management is accountable for resources and a safe system of work. Day to day, a biosafety officer or biorisk manager usually coordinates risk assessments, training, audits and investigations, working with security and IT on biosecurity. Every person in the lab is still responsible for following procedures and promptly reporting spills, exposures and missing materials.
Next steps
If you work in a microbiology, clinical or research lab, the Laboratory Biosafety and Biosecurity Essentials course covers risk assessment, containment and biorisk management in practical terms.
To keep building, read our guides to chain of custody for laboratory samples, Good Laboratory Practice (GLP) essentials and CAPA in laboratories. Not sure which course fits your role? Speak to a counsellor.
Looking for structured certification?
Explore Innoryx courses or speak to a counsellor about the right program for you.