What GBAC STAR Accreditation Actually Requires: A Facility Manager’s Operational Checklist

Who this is for

This guide is for facility managers, operations directors, and BSC account managers preparing for GBAC STAR facility or service provider accreditation — or responding to an RFP that requires GBAC STAR certification as a vendor qualification. It is also useful for infection prevention coordinators who need to understand the chemical and training documentation requirements before involving an outside auditor.

GBAC STAR is administered by the Global Biorisk Advisory Council, a division of ISSA. It exists in two tiers: facility accreditation (for building owners and operators) and service provider accreditation (for BSCs performing cleaning and disinfection services). The requirements differ; this guide addresses both where they overlap on chemical and training documentation.

The 20 elements: what operations teams actually control

The GBAC STAR program has 20 elements across three domains: Practices and Procedures, Performance and Containment, and Training and Communication. The elements with the most direct operational impact on a cleaning program are clustered in Practices and Procedures, where chemical selection, SDS documentation, dilution protocols, and verification methods are assessed.

The most commonly cited gaps in pre-audit assessments are: missing or outdated SDS documentation, undocumented disinfectant contact times, no ATP verification records, and training records that cannot be matched to specific employees and specific program elements. These are documentation failures, not chemistry failures — the cleaning program often meets requirements, but the evidence does not exist in a form an auditor can credit.

Chemical selection requirements

GBAC STAR requires that disinfectants used in the program be EPA-registered for the claimed pathogen spectrum. The registration number must be documented alongside the specific use-dilution and contact time from the EPA-registered label. Using a product off-label — at a different concentration or contact time than registered — means the GBAC STAR disinfection protocol is not compliant, regardless of chemistry quality.

What to document for each disinfectant in the program

• EPA registration number (found on the product label, format: EPA Reg. No. XXXXX-XXX)
• Active ingredient and concentration at use dilution
• Specific pathogens claimed on the label that match your facility risk profile
• Contact time (dwell time) as registered — not manufacturer’s informal guidance
• Surface type restrictions or compatibilities noted on the label
• PPE requirements from SDS Section 8, matched to training records

Verify that your disinfectant chemistry is appropriate for your surface materials before documenting. The Chemical Compatibility Checker can flag incompatible pairings before they become an audit finding.

SDS management requirements

Under OSHA’s Hazard Communication Standard (29 CFR 1910.1200), an SDS must be immediately accessible for every hazardous chemical in the workplace. GBAC STAR auditors assess this requirement as part of the Practices and Procedures domain. The common failure: an SDS binder that exists but is out of date, or a digital SDS system where staff cannot locate the document for a specific product during an audit walk.

GBAC STAR also requires that SDS documents reflect the current formulation of the product in use. When a manufacturer reformulates a product (even with the same brand name), a new SDS is issued. Using an SDS from 2019 for a product reformulated in 2023 is a non-conformance. Establish a process for SDS updates when a product SKU changes or at minimum annually.

ATP verification and performance documentation

GBAC STAR requires a measurable performance verification method. ATP bioluminescence testing is the most commonly used approach — it measures residual organic matter on surfaces and provides a numeric result that can be logged and trended. The program requires that baseline readings be established, action thresholds defined, and corrective action documented when results exceed the threshold.

ATP verification alone does not confirm pathogen elimination — it confirms organic soil removal, which is a prerequisite for effective disinfection. GBAC STAR auditors understand this distinction. The requirement is for a documented verification process, not a guarantee of pathogen-free surfaces.

Minimum ATP documentation elements

• Meter calibration records (annually or per manufacturer specification)
• Test site map identifying which surfaces are sampled on which frequency
• Pass/fail threshold documented in the protocol (typically based on meter manufacturer’s recommendation for facility type)
• Log of results by date, location, and staff member
• Corrective action log for any result exceeding the threshold

Staff training records

GBAC STAR requires verifiable training records for all staff performing cleaning and disinfection. Verifiable means: a record that can be matched to a specific named employee, includes the date and topic trained, and ideally includes a signature or digital confirmation. Generic training logs (“Team trained on disinfection protocols, March 2026”) do not meet this standard.

Training must cover: product hazard identification and SDS access; correct dilution and application methods; contact time requirements; PPE selection and use; and the facility’s specific biorisk response procedures. For PPE selection documentation, the PPE Selector generates a chemistry-specific PPE specification that can be incorporated into training materials as a reference document.

Common mistakes

Treating accreditation as a one-time event. GBAC STAR requires annual renewal with updated documentation. A facility that achieves accreditation and then stops updating SDS records, training logs, and ATP baselines will fail renewal. Build the documentation system into ongoing operations, not the pre-audit sprint.

Documenting contact time based on marketing materials, not the registered label. Manufacturer marketing may cite a two-minute contact time; the EPA-registered label may show five minutes. The label controls. Auditors check the registered label, not the sell sheet.

Assuming the BSC’s accreditation covers the facility. GBAC STAR facility accreditation and service provider accreditation are separate designations. A facility owner cannot use a BSC’s service provider accreditation as a substitute for facility accreditation. Confirm which designation is required in the contract or RFP language.

Quick checklist

• Confirm all disinfectants have current EPA registration numbers documented in the program protocol
• Pull SDS for every chemical in use and verify the formulation date matches current product
• Establish an ATP testing map, threshold, and log before the audit
• Build individual employee training records with date, topic, and signature
• Confirm PPE specification matches SDS Section 8 for each chemistry in use
• Assign a named person responsible for SDS updates and training log maintenance
• Confirm whether facility or service provider accreditation (or both) is required in your contract