Cleaning, sanitizing and disinfecting: what each one does, and when a building needs it

01

What cleaning, sanitizing and disinfecting mean

The three words are defined in slightly different ways by different federal agencies, but they agree on the order and on the idea: each step builds on the one before, and none of the later steps works properly on a dirty surface.

The CDC's guidance for community settings, When and How to Clean and Disinfect a Facility (last reviewed April 2024), puts it this way. Cleaning "decreases the number of germs on surfaces and reduces risk of infection from surfaces". Sanitizing "reduces the remaining germs on surfaces after cleaning". Disinfecting "can kill harmful germs that remain on surfaces after cleaning". The same page makes the point most buildings need to hear: cleaning alone removes most types of harmful germs from surfaces.

The EPA, which registers sanitizers and disinfectants as antimicrobial pesticides, draws the line by what the product kills. Its page What's the difference between products that disinfect, sanitize, and clean surfaces? says: "Cleaning removes dirt and organic matter from surfaces using soap or detergents. Sanitizing kills bacteria on surfaces using chemicals. It is not intended to kill viruses. Disinfecting kills viruses and bacteria on surfaces using chemicals." It adds that surface disinfectants must clear a higher bar for effectiveness in EPA testing than surface sanitizers.

In food service, sanitizing is a defined legal term. The FDA Food Code 2026 defines sanitization as "the application of cumulative heat or chemicals on cleaned food-contact surfaces that, when evaluated for efficacy, is sufficient to yield a reduction of 5 logs, which is equal to a 99.999% reduction of representative disease microorganisms of public health importance." It defines disinfection as a substance that "destroys or irreversibly inactivates bacteria, fungi, and viruses, but not necessarily bacterial spores."

Healthcare uses a fourth level. The CDC's Guideline for Disinfection and Sterilization in Healthcare Facilities, 2008 (updated June 2024) describes cleaning as "the removal of visible soil (e.g., organic and inorganic material) from objects and surfaces", and disinfection as a process that "eliminates many or all pathogenic microorganisms, except bacterial spores, on inanimate objects".

02

When a building needs each one

Most of the work in an ordinary commercial building is cleaning. The CDC's facility guidance, which covers offices, gyms, businesses, community centers and similar community settings, says to clean high-touch surfaces regularly, such as door handles, counters, stair rails, elevator buttons, touchpads, desks, shopping carts and restroom fixtures, and to clean other surfaces when they are visibly dirty. It says to disinfect areas of the facility where people have obviously been ill, for example after someone has vomited, and to follow the local health department if it recommends more during an outbreak.

In practice, the work sorts itself like this:

• Clean: floors, desks, lobby glass, break room tables and most of a building, most of the time.
• Clean, then sanitize: food-contact surfaces in kitchens, cafeterias and break room food prep areas, and utensils and equipment after washing. Under the Food Code, food-contact surfaces must be sanitized before use after cleaning.
• Clean, then disinfect on a routine: restroom fixtures and high-touch points in higher-risk settings, such as healthcare. There that includes noncritical patient-care items such as blood pressure cuffs, bedpans and crutches, and environmental surfaces close to the patient such as bed rails and bedside tables.
• Clean, then disinfect on an event: vomit, feces, blood or other body fluids anywhere in the building, and the areas where someone has been ill.
• Disinfect with a specific product: where the organism calls for it, for example a sporicidal product for C. diff, chosen from the EPA's lists.

More chemistry is not better. The CDC's facility guidance does not recommend fogging, fumigation or wide-area or electrostatic spraying as primary methods unless the product label says the product can be used that way, and it says not to spray low-touch outdoor surfaces such as sidewalks.

The CDC's facility page does not cover healthcare, food service, child care or manufacturing workplaces with their own requirements; those follow their own rules, below.

03

How to clean, sanitize and disinfect properly

Most failures come from skipping a step, not from choosing the wrong product. The steps, drawn from the CDC's facility guidance and the EPA's advice on product labels, are these:

1. Clean first. Remove visible soil with soap or detergent and water. Soil shields germs and uses up the active ingredient.
2. Choose the product for the job. Check the label for the surface type and the organisms it claims. For a specific pathogen, the EPA's Selected EPA-Registered Disinfectants page lists products by claim, such as List K for C. diff spores, List G for norovirus and List S for bloodborne pathogens.
3. Dilute exactly as the label says. Too weak and it does not work; too strong wastes product and can harm people and surfaces. The CDC advises room-temperature water for dilution unless the label says otherwise, and labeling every solution made up.
4. Keep the surface wet for the full contact time. The EPA defines contact time as the time the product must remain on the surface to be effective. The CDC says the surface should stay wet during the entire contact time. If it dries early, reapply.
5. Protect the person doing it. Wear the PPE that Section 8 of the product's safety data sheet recommends, increase ventilation, and never mix products, which the CDC warns could be hazardous. The CDC also says to wash your hands with soap and water for 20 seconds after cleaning, and immediately after disinfecting.
6. Rinse where the label requires it. Under the Food Code 2026, a disinfectant applied to a food-contact surface is rinsed with potable water unless the EPA-registered label says otherwise.

The label is the instruction. The EPA says to always follow the label directions when using EPA-registered products. The standard statement on a pesticide label, quoted in Annex 3 of the Food Code, is that "It is a violation of Federal law to use this product in a manner inconsistent with its labeling." The CDC's healthcare guideline adds that a user who departs from the label, such as with a shorter contact time, assumes liability and is potentially subject to enforcement under the Federal Insecticide, Fungicide, and Rodenticide Act (FIFRA).

Tools matter too. The same healthcare guideline warns that if mop water with disinfectant is not changed regularly, "e.g., after every three to four rooms, at no longer than 60-minute intervals", mopping can spread heavy contamination, and it recommends laundering mops frequently, for example daily. Color-coded cloths and mops keep restroom tools out of kitchens and patient areas.

04

The rules that apply, setting by setting

For an ordinary office or store, no federal regulation says how often to disinfect. The duties that do apply are about the chemicals and about body fluids, and they come from OSHA. In the 21 states and Puerto Rico that run their own OSHA-approved State Plans covering private employers, such as California, the State Plan's standards apply instead. They must be at least as effective as federal OSHA's, and some go further, so check the state before relying on the federal text.

• Chemicals: OSHA's Hazard Communication standard, 29 CFR 1910.1200, requires employers to keep safety data sheets "readily accessible during each work shift to employees when they are in their work area(s)", and to train employees on the hazardous chemicals in their work area when they start and whenever a new hazard arrives.
• Blood and body fluids: where employees can reasonably be expected to contact blood or other potentially infectious materials, OSHA's Bloodborne Pathogens standard, 29 CFR 1910.1030, requires the employer to "determine and implement an appropriate written schedule for cleaning and method of decontamination based upon the location within the facility, type of surface to be cleaned, type of soil present, and tasks or procedures being performed in the area." Contaminated work surfaces must be decontaminated with an appropriate disinfectant after procedures, as soon as feasible after a spill, and at the end of the shift if they may have become contaminated. The EPA says that using the products on its disinfectant lists consistently with their labels complies with OSHA's bloodborne pathogens requirements.
• Food service: state and local health departments enforce the Food Code, which the FDA publishes as a model; each jurisdiction adopts an edition, often with amendments, so check which one your health department uses. The 2026 edition keeps the core rules: food-contact surfaces used with time/temperature control for safety food are cleaned at least every four hours, and sanitized before use after cleaning, with chemical sanitizers used at the concentration, temperature and contact time the code and the EPA label set. A test kit that accurately measures the concentration of sanitizing solutions must be provided.
• Disinfection in food service: the 2026 edition adds a new Part 4-10. Equipment, food-contact and nonfood-contact surfaces and utensils must be disinfected when available sanitizers do not control the pathogens of concern: when contaminated with vomitus, fecal matter, blood or any other bodily fluid that can lead to disease transmission, or during a foodborne disease outbreak or imminent health hazard. A test kit for disinfecting solutions is now required too. Where your jurisdiction is still on an earlier edition, these particular sections may not yet be enforceable there, but they describe good practice.
• Healthcare: the CDC's disinfection guideline classifies environmental surfaces as noncritical, because they touch intact skin, and says noncritical medical equipment surfaces should be disinfected with an EPA-registered low- or intermediate-level disinfectant.

Schools, child care centers and long-term care facilities often have state licensing rules on top of these; where one sets a frequency or product, the written procedure should name it.

05

Writing it into the schedule, and checking it was done

The difference only helps if it reaches the cleaning schedule and the person holding the spray bottle. A good janitorial or custodial scope of work says, for each area:

• which surfaces are cleaned, which are sanitized and which are disinfected, and how often;
• the product for each, by name and EPA registration number where it is a sanitizer or disinfectant, and the dilution;
• the contact time, in plain words on the task card, not only on the label;
• the tools, including cloth and mop colors and when mop water is changed;
• the PPE, and where the safety data sheets are kept;
• what happens on an event: a body fluid spill, an illness in the building, a notice from the health department.

Frequencies follow risk and use. The OSHA bloodborne pathogens schedule, where it applies, has to be written down and based on location, surface, soil and task, which is a sensible way to plan every area, whether or not the standard applies.

Checking comes in three kinds. The first is whether the task was done at all, at the right place and time. The second is whether it was done properly: the product diluted correctly, which in food service means reading the test strip, and the surface left wet for its contact time. The third is whether the surface is clean, which supervisors judge by inspection and some facilities measure with tools such as ATP testing. None of the three replaces the others.

06

Where the cleaning record fails, and what SiteClara does about it

The record rarely says which of the three jobs was done. A restroom sheet on the back of the door has a column of initials and times, often filled in for the whole shift at once, and nothing about whether the fixtures were disinfected or only wiped. The body fluid cleanup in the stairwell was done by whoever was nearest and written down nowhere. When a tenant, a health inspector or an infection preventionist asks when that area was last disinfected, and with what, the answer is a memory.

SiteClara records checks at the place they happen. A printed QR code poster, with an optional NFC tag behind it, goes in each area where a check is scheduled, such as a restroom, a break room or a kitchen prep area. A custodian scans the code or taps the tag on their own phone, with no app to install, sees the checks set for that place, and marks each one done, or says what stopped them. The building writes the checks, so a restroom check can ask whether the fixtures were cleaned and then disinfected, and a kitchen check can ask for the sanitizer test strip reading, with a photo when one is asked for. The time and the named person are recorded as it happens. A problem found on the way, such as an empty soap dispenser, a broken sanitizer dispenser or a spill that needs a disinfecting cleanup, goes onto the team's list of jobs until someone closes it.

The janitorial supervisor sees what is due, done and missed, and records the reason when a check was missed. Each day they review the totals and photos and approve a report that goes the next morning to nominated managers, such as the facility manager or the client, showing what was reported, completed and still open, and how the scheduled checks went.

07

Questions people ask

Is cleaning, sanitizing, and disinfecting the same thing?

No. The CDC's When and How to Clean and Disinfect a Facility treats them as three steps: cleaning decreases the number of germs on surfaces, sanitizing reduces the germs that remain after cleaning, and disinfecting can kill harmful germs that remain after cleaning. The EPA's What's the difference between products that disinfect, sanitize, and clean surfaces? adds that sanitizing kills bacteria but is not intended to kill viruses, while disinfecting kills both.

Which comes first, sanitizing or disinfecting?

Cleaning comes first, before either one. The CDC's When and How to Clean and Disinfect a Facility says to clean surfaces before sanitizing or disinfecting them, because dirt may make it harder for the chemicals to kill germs. After cleaning, most surfaces need nothing more, and where more is needed it is usually one or the other: sanitizing for surfaces that come into contact with food, disinfecting where the risk calls for it, such as a body fluid spill.

What are the three types of disinfection?

In healthcare, the CDC's A Rational Approach to Disinfection and Sterilization describes three levels of disinfection: high-level, intermediate-level and low-level. High-level disinfection eliminates all microorganisms in or on an instrument except small numbers of bacterial spores, and it is used for semicritical items that touch mucous membranes or nonintact skin. Low-level disinfectants are used on noncritical items and surfaces, those that touch intact skin, which is where most building cleaning sits. Intermediate-level disinfectants are used on noncritical surfaces that may briefly touch nonintact skin, such as hydrotherapy tanks and bed rails.

How do you clean, sanitize, and disinfect safely?

The CDC's When and How to Clean and Disinfect a Facility sets out the steps: clean first with soap and water or a cleaner suited to the surface, read the product label to check it can be used on that surface, make sure the area is well ventilated, wear the recommended personal protective equipment, keep the surface wet for the product's contact time, dilute with room-temperature water unless the label says otherwise, never mix products, label any solution you make up, store products away from children and animals, and wash your hands afterward.

What does disinfecting kill?

The EPA's What's the difference between products that disinfect, sanitize, and clean surfaces? says disinfecting kills viruses and bacteria on surfaces using chemicals, that surface disinfectants must clear a higher bar for effectiveness in EPA testing than sanitizers, and that users should pay close attention to the contact time. A product may claim to kill only the organisms the EPA has approved on its label, which is why the EPA's Selected EPA-Registered Disinfectants page lists products by organism, such as List N for SARS-CoV-2, the virus that causes COVID-19.

08

Further reading, and a list to take away

For community settings, start with the CDC's When and How to Clean and Disinfect a Facility. For products, read the EPA's What's the difference between products that disinfect, sanitize, and clean surfaces? and search its Selected EPA-Registered Disinfectants lists by the organism you need. Food service follows the FDA Food Code 2026 as adopted by the state or local health department. Healthcare starts from the CDC's Guideline for Disinfection and Sterilization in Healthcare Facilities, 2008. For worker protection, read OSHA's Hazard Communication standard and Bloodborne Pathogens standard, and your state plan's version where you have one.

Before you sign off a cleaning program, check that:

• each area says which surfaces are cleaned, sanitized or disinfected, and how often;
• every surface is cleaned before it is sanitized or disinfected;
• each sanitizer and disinfectant is EPA-registered, named with its dilution, and right for the surface and the organism;
• the contact time is on the task card and staff have been shown how to meet it;
• food service has a working test kit for sanitizing and disinfecting solutions, and uses it;
• there is a written procedure for body fluid cleanup, and the people who do it are trained and equipped;
• the record shows who did each check, where and when, not a column of initials filled in at the end of the shift.