---
title: "The CDC Legionella water management toolkit: what it is and how it compares to UK practice"
source_url: https://legionella.io/articles/cdc-legionella-water-management-toolkit-vs-uk-practice/
canonical_url: https://legionella.io/articles/cdc-legionella-water-management-toolkit-vs-uk-practice/
pillar: "Best Practice & Future of Legionella Control"
summary: "What the CDC water management toolkit actually contains, how its seven-element programme maps to UK HSG274 duties, and which tools you can safely borrow"
primary_keyword: "CDC Legionella toolkit"
date_published: 2026-06-27
date_reviewed: 2026-06-27
author: "Legionella.io editorial team (REMOTE TECH LTD)"
reviewed_against: "HSE L8 and HSG274 guidance"
region: "United Kingdom"
license: "CC BY 4.0 (https://creativecommons.org/licenses/by/4.0/). Quote, adapt or republish with attribution to REMOTE TECH LTD and a link to source_url."
license_url: https://creativecommons.org/licenses/by/4.0/
---

# The CDC Legionella water management toolkit: what it is and how it compares to UK practice

If a US head office has handed you the CDC water management program toolkit and told you to "roll it out", the honest first answer is that it is a good engineering framework and not a UK compliance document. Use it for the structure it gives you, but map it onto your existing HSG274 duties rather than replacing them.

The toolkit is the US Centers for Disease Control and Prevention's practical companion to ASHRAE Standard 188, the American standard that sets out what a building water management programme should contain [1]. It turns that standard into a worked, step-by-step method any building team can follow. The philosophy underneath it is different from the UK's, and that difference is the thing worth understanding before you adopt anything.

## The two philosophies, side by side

UK practice is built around a risk assessment and a written scheme of control. You assess the system, you decide the controls, overwhelmingly temperature, with supporting monitoring, flushing and, where justified, treatment, and you keep the scheme under review by a competent person [2][3]. The legal anchor is the duty to assess and control risk; the temperature regime is the dominant tool.

The CDC and ASHRAE approach is built around a *programme* and its *validation*. It borrows the logic of food-safety HACCP: map the water system, find where the hazard can grow, choose control points, set a measurable limit at each one, monitor it, and prove with data that the programme is actually working [1]. The emphasis is less on a single prescribed control and more on demonstrating that whatever controls you chose are holding.

Neither is wrong. They are answering the same question, how do we keep this building's water safe, with a different centre of gravity. The UK leans on a prescriptive, well-evidenced temperature regime applied through risk assessment. The US leans on a documented control loop you have to verify.

## The seven elements, in plain terms

The CDC toolkit organises the work into seven steps [1]. Read them as a programme lifecycle:

1. **Build the team.** Name the people who own the programme, facilities, water treatment, infection control where relevant, management, so accountability is explicit.
2. **Describe the water systems.** Draw process flow diagrams of every system from the point of entry to each outlet, including cold storage, hot generation, calorifiers, cooling systems and any aerosol-producing equipment.
3. **Identify where Legionella could grow and spread.** Walk the diagram and mark the hazard areas, stagnation, lukewarm zones, scale and sediment, aerosol points.
4. **Decide control measures and how to monitor them.** Choose control locations, set a *control limit* at each (a measurable value that should not be breached), and define how often you check it.
5. **Establish corrective actions.** Write down, in advance, what you do when a control limit is missed, so the response is not improvised.
6. **Confirm the programme works.** Two distinct checks: *verification* (are we doing what we said?) and *validation* (is what we said actually keeping Legionella under control?).
7. **Document and communicate.** Keep records and make sure the people who need them have them.

A UK reader will recognise most of this. Steps 2 and 3 are your risk assessment's system inventory and schematic. Step 4 is your written scheme. Steps 5 to 7 are your corrective actions, review and logbook. The vocabulary differs more than the substance.

## What genuinely maps, and what is extra

The strongest part of the toolkit for a UK team is its discipline around the *control loop*: a named control location, a defined limit, a monitoring frequency and a pre-written corrective action, all on one line. UK written schemes are meant to contain the same information, but in practice they often record the temperature target without the explicit "and here is exactly what we do, and who does it, the moment it drifts". The toolkit forces that completeness.

The concept the toolkit calls *control limits*, sometimes presented as control banding, is broadly the UK's control parameters under another name: the values your scheme says must hold, such as hot water reaching its target at the sentinel outlets and cold staying below its target within the usual short draw-off, with the actual figures set by guidance and your assessment rather than invented on site [3]. The difference is mainly that the US framework asks you to commit each limit to paper as a pass/fail trigger.

*Validation* is the genuine addition. UK schemes are strong on monitoring and review, but the explicit step of proving the whole programme is effective, not just that tasks were done, is something the CDC framing makes harder to skip.

### A borrow / don't-borrow checklist

Use this to decide what to lift from the toolkit and what to leave as a US-only requirement.

**Safe to borrow into a UK programme**

- [ ] Process flow diagrams of every water system, clearer than most UK schematics and useful evidence for your risk assessment.
- [ ] The one-line control loop format: location, limit, monitoring frequency, corrective action, owner.
- [ ] The named programme team with explicit accountability.
- [ ] The validation habit, periodically asking "is the whole programme actually working?", not just "were the tasks done?".
- [ ] Pre-written corrective actions, so a missed reading triggers a planned response.

**Keep, but translate to UK requirements first**

- [ ] Control limits, set yours from UK guidance and your risk assessment, not from US figures, and hedge any number to what your scheme states [3].
- [ ] Sampling expectations, UK practice does not treat routine Legionella sampling the same way some US programmes do; sample to BS 7592 and your assessment, not a borrowed schedule.

**Do not treat as UK compliance**

- [ ] Following the CDC toolkit or ASHRAE 188 does **not** discharge your duty under the ACoP L8 framework, that duty rests on your UK risk assessment and written scheme [2].
- [ ] US terminology in audits, keep your records legible to a UK enforcing authority, which will look for HSG274 concepts, not ASHRAE ones.

## How to run both without double-running

If your group standard mandates the CDC or ASHRAE structure, the pragmatic call is to make your UK risk assessment and written scheme the legal spine, then present them in the toolkit's seven-element layout for the corporate audit. The process flow diagrams and the control-loop table satisfy the group; the temperature-led scheme, competent review and logbook satisfy UK law. You document once and report twice, rather than maintaining two parallel systems that will drift apart.

Where the two genuinely conflict, for example a group control limit looser than UK guidance, the rule is simple: apply the stricter requirement. A US-headquartered standard is a floor for the group, never a ceiling on your UK obligations.

This is a high-level comparison of two frameworks, not a compliance ruling on either. Whether a given control limit, monitoring frequency or sampling regime is right for your building is a decision for a competent person through a site-specific risk assessment under UK guidance, the CDC and ASHRAE documents inform that judgement but do not settle it, and nothing here is legal advice.

## FAQ

### Does using the CDC toolkit make my building UK-compliant?

No. The toolkit is a sound way to structure and evidence a water management programme, but UK compliance flows from your risk assessment and written scheme of control under the ACoP L8 framework and HSG274 [2][3]. You can run the toolkit's seven elements and still fall short of UK law if the underlying assessment and temperature regime are not in place. Treat it as a delivery method, not a substitute for the UK duty.

### How is a CDC "control limit" different from the UK temperature regime?

They overlap heavily. A control limit is a measurable value at a defined point that should not be breached, which is exactly what your UK control parameters are. The difference is framing: the CDC approach asks you to write each limit as an explicit pass/fail trigger with a pre-planned corrective action, whereas UK schemes sometimes record the target without the committed response. Set the actual figures from UK guidance and your assessment, not from US sources.

### Can I use the CDC process flow diagrams in a UK scheme?

Yes, and they are one of the best things to borrow. A clear flow diagram of each system from incoming main to every outlet strengthens your risk assessment's asset inventory and schematic, and gives auditors a single picture of where the hazard areas sit. There is nothing US-specific about a good diagram; it supports HSG274 work directly.

### Are ASHRAE 188 or the CDC toolkit mandatory in the UK?

No. Neither is a UK legal requirement. They may be contractually mandatory if a US-headquartered group imposes them as a corporate standard, but UK enforcement is concerned with the ACoP L8 framework and HSG274, not ASHRAE. Where a group standard and UK guidance differ, apply the stricter of the two.

## What to do next

Take your current written scheme of control and lay it out as the toolkit's seven elements on a single page. The gaps that appear, usually a missing flow diagram, a control parameter with no written corrective action, or no validation step, are the genuinely useful imports. Fix those against UK guidance, and leave the US-specific sampling and terminology where they are.

## Related reading

- [WHO Water Safety in Buildings vs UK ACoP L8](https://legionella.io/articles/who-water-safety-in-buildings-vs-uk-acop-l8-compared/)
- [ASHRAE 188 and Guideline 12 for UK teams](https://legionella.io/articles/ashrae-188-and-guideline-12-explained-for-uk-teams/)
- [ESGLI guidelines vs UK HSG274](https://legionella.io/articles/esgli-european-guidelines-vs-uk-hsg274-reconciliation/)
- [Developing a comprehensive water safety plan](https://legionella.io/articles/developing-a-comprehensive-water-safety-plan/)

## Sources

[1] CDC, "Developing a Water Management Program to Reduce Legionella Growth and Spread in Buildings: A Practical Guide to Implementing Industry Standards". https://www.cdc.gov/legionella/

[2] HSE, ACoP L8 (2013), “Managing the risk: management responsibilities, training and competence”, p.14. https://www.hse.gov.uk/pubns/books/l8.htm

[3] HSE, HSG274 Part 2 (2024), “Operation and inspection of hot and cold water systems”, p.70. https://www.hse.gov.uk/pubns/books/hsg274.htm