The CBRNE Risk Gap in Conventional Safety Programs

Chemical, biological, radiological, nuclear and explosive hazards sit outside most corporate safety programs. The reason is rarely negligence. CBRNE is framed as someone else's problem, and that framing carries real risk.

A consistent pattern has emerged across high-consequence industries: compliance programs are maintained, safety documentation is current, and emergency plans are in place, yet a critical category of risk remains largely uncharacterized.

That category is chemical, biological, radiological, nuclear and explosive hazards (CBRNE). It covers industrial chemical releases, biological contamination events, radiological exposure and explosive blast effects. Consequences from these events can cascade rapidly beyond the boundaries of conventional emergency response. The hazards require specialized threat characterization, consequence modeling and multi-agency coordination that most standard safety programs are not built to provide.

CBRNE is typically treated as a terrorism concern, something for law enforcement, intelligence agencies or specialized military units to manage. Most commercial and even many defense organizations operate under the quiet assumption that CBRNE does not apply to them in any meaningful day-to-day sense. That assumption carries real risk.

The Exposure is Broader Than Most Organizations Recognize

A weapons program is not a prerequisite for significant CBRNE risk. Critical infrastructure, large-scale industrial operations, chemical storage facilities, research laboratories, transportation hubs and defense support environments all operate in conditions where a single failure, whether accidental or deliberate, can generate consequences that conventional safety programs were never designed to manage.

The scale of that exposure is easy to underestimate. The Environmental Protection Agency (EPA) regulates approximately 12,000 U.S. facilities under its Risk Management Program (RMP) because of the quantities of hazardous chemicals they store or process. According to EPA, roughly 131 million people live within three miles of one. [1] These facilities include petroleum refineries, chemical manufacturers, water and wastewater treatment plants, food and beverage manufacturers, chemical warehouses and agricultural supply distributors.

The U.S. Government Accountability Office reported in 2022 that about 31 percent of analyzed RMP facilities, or 3,219 of 10,420, are located in areas exposed to natural hazards such as wildfires, flooding and storm surge, any of which can act as an initiating event for a chemical release. [2] The EPA's own analysis supporting its 2024 rulemaking estimated total monetized damages from RMP facility accidents at $477.3 million per year. [3] The Coalition to Prevent Chemical Disasters, an advocacy coalition tracking incidents since April 2020, has documented more than 470 hazardous chemical incidents across the U.S., an average of roughly one every other day. [4] Rail derailments, pipeline failures and transportation incidents add further exposure across supply chains that extend well beyond any single facility fenceline.

Why Conventional Safety and CBRNE Preparedness Rarely Connect

The core issue is structural. Conventional safety and CBRNE preparedness typically exist in separate silos. Conventional safety programs are organized around regulatory compliance and occupational hazard. CBRNE preparedness is organized around threat characterization, consequence modeling and multi-hazard response. The two disciplines use different frameworks, different vocabulary and, in most organizations, different owners. If CBRNE has a dedicated owner at all.

That separation shows up consistently in the field. Across industries, the vulnerabilities look remarkably similar.

• Hazard analyses scoped too narrowly. Process hazard analyses and job hazard analyses are routinely conducted. They are typically scoped around process upsets and personnel injury rather than the full consequence envelope of a CBRNE event, which includes contamination spread, standoff effects, secondary release pathways and multi-agency response requirements.
• Emergency plans built for the wrong scenarios. Most emergency action plans are built around fire, evacuation and medical response. They do not address shelter-in-place decision logic for an airborne chemical release, decontamination logistics following a radiological event or the specialized PPE and resource requirements that determine whether first responders can even enter the facility.
• Compliance mistaken for risk posture. Regulatory compliance is maintained, but compliance is a floor. Meeting EPA RMP thresholds under 40 CFR Part 68, OSHA Process Safety Management requirements under 29 CFR 1910.119, Department of Transportation (DOT) hazardous materials shipping rules or Nuclear Regulatory Commission (NRC) licensing conditions establishes a minimum. It does not define a defensible risk posture against the consequence-based threats that CBRNE events generate.

The regulatory picture is also moving. EPA finalized its Safer Communities by Chemical Accident Prevention rule in March 2024, then announced a reconsideration in March 2025 and a proposed rollback, the Common Sense Approach to Chemical Accident Prevention, in February 2026. [5] For facility operators, that volatility is another reason compliance cannot be the sole anchor for risk posture. Requirements shift, but the underlying hazards do not.

Closing the Gap Through Integrated, Consequence-Based Analysis

Closing these gaps means applying systems safety methodology across the CBRNE risk landscape, from threat and hazard identification through consequence modeling, regulatory alignment and response integration. It requires working across the technical, regulatory and operational dimensions simultaneously. That is a narrow discipline, and few programs have it in-house.

A credible CBRNE risk program brings together several capabilities that are usually held separately:

• Threat and hazard identification across the CBRNE risk landscape, including accidental and deliberate release scenarios.
• Consequence modeling for dispersion, blast, thermal and radiological effects, calibrated to the specific site, process inventory and surrounding environment.
• Regulatory alignment across EPA RMP, OSHA PSM, DOT, NRC, Department of Defense and sector-specific frameworks, so compliance work reinforces the risk program rather than running parallel to it.
• Response integration with internal emergency response team, local fire and HAZMAT, public health and federal partners, including realistic field exercises that test decision logic rather than just notification trees.
• Program management discipline that treats CBRNE preparedness as a sustained capability rather than a one-time assessment.

Organizations that get ahead of this treat CBRNE preparedness as an ongoing program. Those that do not tend to discover the gap during an audit, an incident or when a contract requirement surfaces it unexpectedly. In most cases, remediation at that point is significantly more expensive than prevention would have been.

A Question Worth Asking

For anyone responsible for a facility or program operating in a high-consequence environment, the question is straightforward. Does the current risk picture actually account for CBRNE exposure, or does it assume someone else has that handled?

Jensen Hughes works with critical infrastructure operators, industrial facilities, research institutions and government agencies to close that gap. Our team integrates process safety, security risk consulting, emergency preparedness and consequence-based risk analysis into a single CBRNE risk posture built for the realities of modern operating environments.

Visit our CBRNE page for more information

Sources

1.  U.S. Environmental Protection Agency, "Fact Sheet for Communities: Safer Communities by Chemical Accident Prevention," 2024. epa.gov/rmp
2. U.S. Government Accountability Office, "Chemical Accident Prevention: EPA Should Ensure Regulated Facilities Consider Risks from Climate Change," GAO-22-104494, February 2022. gao.gov/products/gao-22-104494
3. U.S. Environmental Protection Agency, "Accidental Release Prevention Requirements: Risk Management Programs Under the Clean Air Act; Safer Communities by Chemical Accident Prevention," Federal Register, August 31, 2022. federalregister.gov
4. Coalition to Prevent Chemical Disasters, incident tracking database, April 2020 to present. preventchemicaldisasters.org
5. U.S. Environmental Protection Agency, "Risk Management Program Safer Communities by Chemical Accident Prevention Final Rule" and "Common Sense Approach to Chemical Accident Prevention Proposed Rule." epa.gov/rmp