Severe weather emergency plan for small businesses: OSHA requirements explained

Last updated 2026-07-10

Does OSHA actually require a severe weather emergency plan?

Yes, and the rule reaches further than most small business owners think. OSHA's Emergency Action Plan (EAP) standard, at 29 CFR 1910.38, applies to nearly every general industry employer in the country. ^[1] It does not exempt small businesses by headcount. There is one paperwork break: if you have 10 or fewer employees, you can communicate the plan orally instead of writing it down. Hit 11 employees and the written plan becomes mandatory.

Severe weather sits squarely inside an EAP's scope. Tornadoes, floods, hurricanes, severe thunderstorms, all of it. OSHA does not publish a separate "severe weather" standard. The agency treats natural disasters as emergency scenarios your EAP has to address. OSHA's guidance on emergency preparedness says plans should account for "all potential hazards in the workplace, including natural disasters." ^[2]

There is a second hook worth knowing. 29 CFR 1910.157 (portable fire extinguishers) requires an EAP as a precondition for compliance. ^[11] So if you assumed you dodged the EAP rule because you run a simple operation, check whether you have fire extinguishers on the wall. You almost certainly do, and that pulls you in.

State-plan states can add requirements on top of the federal floor. There are 22 states plus 2 territories running their own OSHA-approved programs. ^[3] California's Cal/OSHA, for one, requires an Injury and Illness Prevention Program that folds in emergency procedures. If you operate in a state-plan state, check the local rules before you treat the federal standard as your whole obligation.

What are the specific OSHA requirements under 29 CFR 1910.38?

The standard names six elements every written Emergency Action Plan has to contain. ^[1] Here they are in plain language:

1. Procedures for reporting a fire or other emergency. Who calls 911, who notifies employees, how the alarm gets activated. 2. Procedures for emergency evacuation, including exit routes and floor plans. 3. Procedures for employees who stay behind to handle critical operations before they evacuate, like shutting off gas lines or securing equipment. 4. Procedures to account for all employees after evacuation. 5. Procedures for employees performing rescue or medical duties. 6. The name or job title of every person employees can contact for more information about the plan or their duties under it.

Severe weather adds a wrinkle. OSHA expects your plan to cover shelter-in-place, not only evacuation. A tornado means moving people away from windows into interior rooms or a designated shelter, not pushing them out the exit doors. That is the exact opposite of a fire evacuation, and mixing up the two gets people hurt. Your plan has to spell out which emergencies mean evacuate and which mean shelter-in-place.

The standard also requires the plan be available to employees for review at any time. ^[1] You review it with each new hire before they start work, with any employee assigned a new role under the plan, and whenever you revise the plan. Those are codified obligations, not friendly suggestions.

Here is what the standard does not require: a specific format, special software, or a consultant's signature. Content is what matters. A tidy Word document or a clean PDF satisfies the rule as fully as a professionally printed binder does.

What types of severe weather does a small business need to plan for?

The right answer depends on where you sit, and most owners underestimate the range. OSHA's guidance sends employers to FEMA's hazard resources to pin down region-specific threats. ^[2] The honest breakdown by hazard type:

Tornadoes hit the entire central United States and parts of the South and East. Peak season runs March through June, but they have happened in every month of the year. Your plan needs a designated shelter area, a way to receive NWS alerts in real time, and a clear trigger: at what point does a watch become a warning that moves people to shelter?

Hurricanes and tropical storms hit the Gulf Coast, the Atlantic Coast, and inland states as far north as the Carolinas and Tennessee with weakened force. Planning for hurricanes also means planning for the decision to close the facility and clear the area, which raises pay and communication questions your EAP should answer.

Floods are the most common and most deadly natural disaster in the United States, according to FEMA. ^[4] Flash floods give almost no warning. If your facility sits in or near a floodplain, your plan needs a fast-trigger protocol, not a 30-minute deliberation.

Severe thunderstorms, hail, and lightning matter too, especially with outdoor workers. OSHA's general duty clause (Section 5(a)(1) of the OSH Act) has been used to cite employers for exposing outdoor workers to lightning when no protocol existed. ^[5] If you have people working outside, your severe weather plan needs a lightning policy with a clear stop-work threshold. The common one: suspend work when the gap between lightning flash and thunder is 30 seconds or less, roughly 6 miles out.

Winter storms, ice, and extreme cold round out the list for northern and high-elevation businesses. Those create facility hazards (roof loads, ice on walkways) and travel hazards for employees commuting or making deliveries.

Hazard	Primary Regions	Key Plan Element
Tornado	Central US, South, parts of East	Interior shelter room, NWS alert system
Hurricane	Gulf Coast, Atlantic Coast	Evacuation/closure decision tree
Flood/Flash Flood	All regions, especially floodplains	Fast-trigger protocol, elevation maps
Lightning	All regions (outdoor workers)	30-second rule, work suspension
Winter Storm	Northern US, high elevation	Roof load limits, travel policy
Extreme Heat	Southwest, South, all summer	Heat illness prevention, hydration

Extreme heat earns its own line. OSHA has been working on a heat illness prevention rule, and regardless of where final rulemaking lands, the general duty clause already creates an enforceable duty to protect workers from heat. ^[5] Your severe weather plan should carry heat protocols if you have outdoor workers or non-air-conditioned indoor spaces.

How do you designate a shelter area for tornadoes or high winds?

This is where most small business EAPs fall apart. Owners know they need a shelter area. They just pick the wrong one, or they never walk employees through it.

A tornado shelter should be an interior room or hallway on the lowest floor, away from windows and exterior walls. Basements win. No basement? A windowless interior hallway or bathroom on the ground floor is second best. Large open-span areas like warehouses, big-box retail floors, and cafeterias are dangerous in a tornado because those roofs can drop without interior walls holding them up. Get people out of those spaces.

In a multi-floor building, the shelter area needs to be reachable within roughly 60 to 90 seconds from anywhere in the facility. Time a real drill and find out. If your third-floor crew cannot make the basement before a fast-moving tornado arrives, you need a closer interim shelter.

Document the shelter location in your written EAP with a simple floor plan. Label it on the physical floor plan you post on the wall. Assign a shelter warden who confirms headcount once people are inside. That warden should know the backup spot if the primary shelter is blocked or damaged.

Mobile and manufactured structures get no ambiguity from OSHA. They are not safe shelters during severe thunderstorms or tornadoes. Your plan has to name a nearby permanent structure people can reach, plus a protocol for how fast they leave the mobile unit once a warning drops.

What warning systems does OSHA expect you to have in place?

OSHA does not name a specific alert technology, but the duty is plain: employees have to get timely warning so they can act before the hazard arrives. ^[1] What counts as timely is a judgment call driven by your hazard type and your building's construction.

The National Weather Service pushes Wireless Emergency Alerts (WEAs) automatically to cell phones in the affected area. Free, no subscription. But they fall short for interior employees who cannot hear their phones, workers in loud manufacturing spaces, or moments when cell towers are already jammed.

A NOAA weather radio with an alarm tone is one of the most practical, cheapest options for a small business. Units run $25 to $60. They broadcast NWS alerts 24 hours a day and can be set to alarm only for your county. ^[10]

Outdoor workers need more than a radio. You need a protocol for who watches the sky or a weather app during work hours, and the threshold at which they call a stop-work order. Plenty of contractors run a paid lightning detection app tied to a specific GPS point.

Your internal alarm matters just as much. If your fire alarm is the only way you signal an emergency, make sure employees know that a specific alarm pattern or announcement means shelter-in-place, not evacuate. Sending people out into a tornado is worse than keeping them inside. Set up a distinct intercom announcement or a separate signal for shelter-in-place events.

How should the plan address employee accountability after a severe weather event?

Accountability after an emergency is a required element of 29 CFR 1910.38, and it is one of the most neglected parts of small business EAPs. ^[1] You need to know who is in the building before the event and confirm everyone is safe after.

For a shelter-in-place event like a tornado, the accountability point is the shelter area itself. Assign a shelter warden who holds an up-to-date roster of everyone expected on-site that day. That warden counts heads in the shelter and reports to the incident coordinator (usually the owner or ops manager) once the all-clear sounds, or immediately if someone is missing.

For an evacuation like a flood or a post-storm gas leak, the accountability point is your assembly area. Put it at a safe distance from the building and upwind of any hazard. Mark it on your floor plan. Every manager should know it cold.

Visitors and contractors are the wild card. Your plan has to account for anyone who might be on-site, beyond your payroll. A sign-in log at reception helps. A designated escort who walks guests to the shelter or assembly area helps more.

After the event, document who was present, what happened, and any injuries or near-misses. That record feeds directly into your OSHA recordkeeping obligations under 29 CFR 1904 and gives you data to sharpen the plan. ^[6] If someone was hurt, you will need to file the right forms. A solid incident report process should already be part of your broader safety program.

What training do employees need, and how often?

OSHA requires you to review the EAP with employees under three conditions: when the plan is first established, whenever an employee is assigned new emergency responsibilities, and whenever the plan is revised. ^[1] That is the floor. Most safety professionals recommend an annual review for everyone plus a physical drill at least once a year.

For severe weather, training should cover at minimum: how alerts reach people internally, where the shelter areas are, who the shelter wardens are, how to account for coworkers, and what to do if someone is injured.

Drills matter. Reading a document is not the same as walking the route. A five-minute tornado drill once a year is genuinely useful. Time it. Note where the bottlenecks show up. Check whether the shelter area actually holds everyone who works your busiest shift.

Document every session. OSHA inspectors will ask for training records. Include the date, the content covered, the names of attendees, and who ran it. A sign-in sheet works. So do digital records.

For broader training past emergency procedures, ask whether your supervisors need structured safety management knowledge. A full OSHA 30 course covers emergency planning inside a complete safety curriculum and gives supervisors the footing to implement and explain your EAP credibly.

Here is something nobody talks about enough: language. If a real chunk of your workforce speaks a language other than English, your shelter-in-place announcement and your training materials have to reach them in that language. An EAP only 60% of your workers can understand is not a real EAP.

What are the OSHA penalties for not having a compliant emergency action plan?

As of 2024, OSHA's maximum penalty for a serious violation is $16,131 per violation, and the maximum for willful or repeated violations is $161,323 per violation. ^[7] Those figures adjust every year for inflation under the Federal Civil Penalties Inflation Adjustment Act.

A missing or weak EAP gets cited as a serious violation because OSHA treats it as creating a substantial probability of death or serious physical harm. Inspectors who show up after a workplace injury during a weather event will hunt specifically for the written EAP and the training records. Come up short on either and you get a citation.

Small businesses with fewer than 250 employees and under $36 million in annual sales may qualify for a penalty cut of up to 70% under OSHA's small business penalty reduction policy. ^[7] That helps, but it does not erase the citation or the insurance and reputational fallout that trail it.

The real money risk is not the fine. It is the workers' comp claim, the liability suit, and the business interruption after an event where your lack of preparation contributed to an injury. OSHA fines are the floor on what a weather-related incident costs a small business, never the ceiling.

How do you write a severe weather emergency action plan from scratch?

Here is a working framework. You do not need a consultant to do this well.

Step 1: Identify your hazards. Use FEMA's risk resources and NOAA's historical storm data for your county to figure out which weather events are realistic at your location. ^[4] Do not plan for everything at maximum intensity. Plan for the hazards that actually occur in your region with real frequency.

Step 2: Walk your facility. Find every exit, interior room, low-floor area, and area to avoid (glass-walled conference rooms, open-span roofs, loading docks with overhead doors). Mark the shelter area and the evacuation assembly point on a floor plan.

Step 3: Write the procedures. For each hazard, write a one-page procedure covering the trigger (what warning level prompts action), the action (shelter-in-place or evacuate), the shelter or assembly location, the warden's role, and the all-clear process. Plain language, short sentences. This is not a legal brief. It is a how-to for a stressed employee.

Step 4: Assign roles. Name the incident coordinator, shelter wardens, and backup wardens. List job titles and phone numbers. If key people are out, the plan still has to work.

Step 5: Integrate your alert system. Document exactly how employees get notified, which alarm signal means shelter-in-place, and which means evacuate.

Step 6: Review and train. Walk through the plan with every employee. Run a drill. Fix what breaks.

Step 7: Review annually and after any incident or near-miss.

To skip the blank-page problem, the SafetyFolio program generator walks you through each required element in about 15 minutes and produces a document you can hand to employees the same day.

Your EAP should live in a binder every manager can find, with a digital copy accessible off-site so you can pull it up even when your building is closed after an event.

Does your emergency plan need to cover remote or hybrid employees?

This is genuinely unsettled, and the honest answer is that OSHA has not issued clear guidance for remote workers and severe weather. The OSH Act covers employees in the course of employment, and most interpretations focus on the physical workplace the employer controls.

Even so, two practical reasons push you to address remote workers in your EAP. First, if remote employees come to your facility some days, they need to know the plan for those days. Second, some standards, recordkeeping under 29 CFR 1904 in particular, do apply to injuries during work activities in a home office. ^[6] If a remote employee gets hurt because you sent them into a severe storm to run a work errand, that is a recordable incident and a possible general duty clause violation.

The most defensible move is a short section in your EAP telling remote employees what to do during severe weather while working: stop outdoor work, follow local emergency management guidance, and contact their supervisor once safe. It costs almost nothing and signals that your safety culture reaches past the four walls of your facility.

For businesses building more formal safety structures across a scattered workforce, OSHA training options now include formats that fit employees who never set foot in a central site.

What should you do after a severe weather event at your business?

The hours right after a severe weather event are where a lot of small businesses make expensive mistakes. Here is what to actually do.

Do not re-enter a damaged building until it has been inspected. Structural damage from wind, flood water, or debris is not always visible from outside, and secondary collapses are a real hazard. If there is any doubt about structural integrity, wait for a qualified inspector.

If there are injuries, provide first aid and call emergency services. Document the incident thoroughly. Under 29 CFR 1904, you must record work-related injuries and illnesses on your OSHA 300 log within seven calendar days of learning about them. ^[6] If an employee dies or is hospitalized from a work-related weather event, the timelines tighten: a fatality must be reported to OSHA within 8 hours, an in-patient hospitalization within 24 hours. ^[6]

Run a post-incident debrief with your team. What worked? What did not? Where did people hesitate? Feed that into an updated EAP. A plan that does not improve after a real event will fail worse next time.

Check for utility hazards: gas leaks, downed power lines near the building, flood-contaminated electrical systems. These post-storm hazards kill people who survived the storm itself.

Document property damage with photos and a written log for insurance. Contact your commercial insurer inside the window your policy requires, usually 24 to 72 hours.

If federal or state disaster declarations cover your area, check whether Small Business Administration (SBA) disaster loan programs apply. ^[8] These are low-interest loans for businesses that took physical or economic damage, and they have carried many small businesses through hurricane and flood recoveries.

How does a severe weather plan fit into your overall OSHA written safety program?

The EAP is one piece of a broader written safety program, and it works better integrated than treated as a standalone file. Your full program should cover hazard identification, hazard communication for chemical hazards, lockout tagout for equipment, and any industry-specific standards that apply to you.

Severe weather procedures tie into several other program elements. Your EAP evacuation routes need to match the posted floor plans your fire prevention plan requires. Your shelter wardens may double as first aid responders. Your accountability process feeds your injury recordkeeping.

For a business that has never built a full written safety program, the EAP is a good starting point. It is concrete, it has a clear regulatory citation, and every employee sees why it matters. Writing it tends to surface other gaps, a missing first aid kit inspection procedure or an unclear chain of command during incidents, that you can then work through in order.

OSHA's free On-Site Consultation Program runs in every state and provides confidential, no-penalty hazard assessments for small businesses. ^[9] Use it, especially if you have never had a formal safety review. The consultants are walled off from OSHA enforcement and cannot issue citations. The program is genuinely useful and badly underused.

The SafetyFolio program generator handles the EAP as part of a complete written safety program you can build in one session, so the documents stay consistent with each other instead of getting written piecemeal over months.

Frequently asked questions

Is a severe weather emergency plan legally required by OSHA for small businesses?

Yes. OSHA's Emergency Action Plan standard, 29 CFR 1910.38, applies to nearly all general industry employers regardless of size. Businesses with 10 or fewer employees can keep the plan oral rather than written, but the plan itself is still required. Businesses with 11 or more must keep a written plan available for employee review at any time.

How many employees do you need before OSHA requires a written emergency action plan?

The written requirement kicks in at 11 employees. Employers with 10 or fewer workers may communicate their emergency action plan verbally, per 29 CFR 1910.38(b). But even verbal plans must cover all the required elements: evacuation routes, reporting procedures, accountability, and the name of someone employees can contact for plan details.

What is the difference between an evacuation plan and a shelter-in-place plan?

An evacuation plan moves people out of and away from a building, typically for fires or post-storm gas leaks. A shelter-in-place plan moves people to a protected interior location within the building, used for tornadoes, active shooters, or outdoor chemical spills. Severe weather planning needs both, since different hazards demand opposite responses. Your EAP must specify which action applies to which event.

Does OSHA have a specific tornado safety standard?

No. OSHA has no standalone tornado safety standard. Tornado preparedness falls under the general Emergency Action Plan standard at 29 CFR 1910.38 and, for hazards not otherwise covered, under the general duty clause in Section 5(a)(1) of the OSH Act. OSHA publishes tornado preparedness guidance on its website, but that guidance is educational, not a standalone enforceable standard.

What should a small business do if a tornado warning is issued during business hours?

Move everyone immediately to the designated shelter area: an interior room or hallway on the lowest floor, away from windows and exterior walls. A shelter warden takes a headcount. Do not use elevators. Stay put until an official all-clear is issued or the warning expires. Document who sheltered, note any injuries, and debrief afterward. Update the plan if anything did not work.

How often should a small business conduct severe weather drills?

OSHA requires EAP training when the plan is created, when an employee is assigned new responsibilities, and whenever the plan changes. Most safety professionals recommend at least one physical drill per year. In high-tornado or high-hurricane areas, twice a year is reasonable. Document every drill with attendance records and a short after-action note covering what worked and what needs fixing.

Are outdoor workers covered by OSHA's severe weather requirements?

Yes. Outdoor workers face lightning, extreme heat, high winds, and flooding. OSHA's general duty clause has been applied to employers who failed to protect outdoor workers from lightning and heat hazards. Your EAP should include a clear work-suspension threshold for lightning, typically 30 seconds between flash and thunder, and heat illness prevention procedures for extreme heat events.

What is the OSHA penalty for not having an emergency action plan?

As of 2024, OSHA's maximum penalty for a serious violation of 29 CFR 1910.38 is $16,131 per violation. Willful or repeated violations can reach $161,323. Small businesses may qualify for penalty reductions of up to 70% through OSHA's small business penalty policy, but the citation itself and the underlying liability exposure remain. Penalties adjust annually for inflation.

Does a home-based or remote business need an OSHA emergency action plan?

OSHA's EAP standard applies to workplaces the employer controls. A solo home-based business with no employees is generally outside OSHA's jurisdiction. But if you have employees working at your location even part time, the standard applies to that workspace. For remote employees working from home, OSHA enforcement is limited, though best practice is to include basic severe weather guidance as a duty of care.

Can a small business use a free template for its severe weather emergency action plan?

Yes. OSHA publishes guidance and checklists on its website that can shape your plan, and no specific format is legally required. The requirement is that the content meets the six elements in 29 CFR 1910.38, not that it looks a certain way. A clear, site-specific document employees actually understand beats an elaborate template nobody reads.

What records do you need to keep after a severe weather incident at work?

You must record work-related injuries on your OSHA 300 log within seven calendar days of learning about them, under 29 CFR 1904. A fatality must be reported to OSHA within 8 hours. An in-patient hospitalization must be reported within 24 hours. Beyond OSHA requirements, document property damage, response actions, and any EAP deviations for insurance and plan improvement.

How do you identify which severe weather hazards to include in your plan?

Start with FEMA's hazard resources and NOAA historical storm data for your specific county. Tornadoes, floods, and severe thunderstorms are relevant across most of the continental US. Hurricanes matter on the Gulf and Atlantic Coasts. Extreme heat applies anywhere outdoor or non-air-conditioned work occurs. Build your plan around hazards that realistically occur at your location, not every theoretically possible scenario.

Does OSHA require businesses to have a weather alert system or NOAA radio?

OSHA does not mandate a specific technology, but the EAP must ensure employees receive timely warning to take protective action. In practice that means a reliable alert mechanism reaching all employees, including those in loud or isolated work areas. A NOAA weather radio with county-specific alarm capability is a practical, low-cost solution for most small businesses, costing $25 to $60.

What is the OSHA general duty clause and how does it apply to severe weather?

Section 5(a)(1) of the OSH Act requires employers to provide a workplace free from recognized hazards that cause or are likely to cause death or serious physical harm. When no specific OSHA standard covers a hazard, OSHA uses this clause to cite employers. It has been applied to lightning exposure, extreme heat, and other weather hazards where no formal standard exists but the hazard and feasible protections are well established.

Sources

1. OSHA, 29 CFR 1910.38 Emergency Action Plans: 29 CFR 1910.38 lists the six required elements of an Emergency Action Plan and the written-plan threshold of more than 10 employees
2. OSHA, Emergency Preparedness and Response: OSHA guidance states that emergency action plans should account for all potential hazards, including natural disasters
3. OSHA, State Plans: 22 states and 2 territories operate OSHA-approved state plans that may add requirements beyond the federal baseline
4. FEMA, Natural Hazards: Floods are the most common and most deadly natural disaster in the United States; FEMA provides hazard identification resources by region
5. OSHA, General Duty Clause, Section 5(a)(1) of the OSH Act: The general duty clause requires employers to protect workers from recognized hazards including lightning and extreme heat where no specific standard applies
6. OSHA, 29 CFR 1904 Recording and Reporting Occupational Injuries and Illnesses: Work-related injuries must be recorded on the OSHA 300 log within seven calendar days; fatalities reported within 8 hours, in-patient hospitalizations within 24 hours
7. OSHA, Civil Penalty Policy and Maximum Penalty Amounts: As of 2024, the maximum penalty for a serious OSHA violation is $16,131 per violation; willful/repeated violations reach $161,323; small businesses may qualify for up to 70% reduction
8. U.S. Small Business Administration, Disaster Assistance: SBA disaster loan programs provide low-interest loans to businesses that sustained physical or economic damage from federally declared disasters
9. OSHA, On-Site Consultation Program: OSHA's free On-Site Consultation Program provides confidential hazard assessments for small businesses in every state; consultants cannot issue citations
10. NOAA National Weather Service, NOAA Weather Radio All Hazards: NOAA weather radio units costing $25 to $60 broadcast NWS alerts 24 hours a day and can be set to alarm for specific counties
11. OSHA, 29 CFR 1910.157 Portable Fire Extinguishers: 29 CFR 1910.157 requires an Emergency Action Plan as a precondition for compliance, expanding EAP applicability
12. Bureau of Labor Statistics, Census of Fatal Occupational Injuries: BLS fatal occupational injury data tracks weather-related workplace fatalities including those from floods, lightning, and extreme heat