Hospitals, emergency operations centers, water plants, data centers and communication sites are needed most in the hours after a disaster, which is exactly when hurricanes, tornadoes and earthquakes put them under the greatest stress. Post-disaster investigations keep finding the same lesson: facilities rarely fail because the main structure collapses. They fail because a window breaks, a roof edge peels, a generator floods or an unbraced pipe ruptures. This checklist-style guide covers how protective design principles apply to natural hazards, the standards involved, and the practical upgrades that keep critical facilities running.

Storm surge waves and bending palm trees during a hurricane
Storm surge waves and bending palm trees during a hurricane

Key takeaways

  • Critical facilities are typically designed as Risk Category IV under ASCE 7, with higher design loads and stricter requirements.
  • For wind, protecting the building envelope from debris and keeping the roof attached prevents most of the damage cascade.
  • For earthquakes, nonstructural components such as ceilings, piping, equipment and backup power often determine whether a facility can keep operating.
  • Backup power, fuel, water and communications are part of the protection system and need the same hazard thinking.

Why "operational" is the real goal

Ordinary buildings are designed mainly for life safety: in a rare extreme event, the building may be badly damaged, but it should not collapse on its occupants. Essential facilities need more. A hospital that is standing but has no power, water or usable operating rooms has still failed its community. ASCE 7, the national standard for minimum design loads (the 2024 International Building Code references the 7-22 edition), addresses this by assigning essential facilities, such as hospitals with emergency surgery, fire, rescue and police stations, emergency shelters and emergency operations centers, to Risk Category IV, which raises design loads and tightens requirements for both structural and nonstructural systems.

The US government recognizes 16 critical infrastructure sectors, from energy and water to healthcare and communications, coordinated nationally by CISA. Whatever the sector, the same physical principles of layered protective design apply to natural hazards: limit what can get in, keep the structure and its parts together, and protect the systems that keep the facility functioning.

Wind and wind-borne debris

How wind damage cascades

In hurricanes and tornadoes, debris such as roof gravel, branches, signs and building parts breaks windows and doors. Once the envelope is breached, wind enters the building and pressurizes it from inside, which adds to the suction on the roof and walls. Roof coverings, roof decks and walls that would have survived can then fail, followed by water intrusion that destroys interiors and equipment. Breaking that chain at the first step is the core of wind protection.

Opening protection

Windows, doors and skylights in wind-borne debris regions must resist debris impact or be protected by tested shutters. Products are tested under ASTM E1886 (the test method) and evaluated against ASTM E1996 (the specification), which defines large and small missile test levels. The well-known "large missile" level D is a 9-pound 2x4 timber striking at 50 feet per second (about 34 mph), followed by cyclic pressure testing. Florida and the Miami-Dade product approval system add their own protocols. Laminated glass is common in these assemblies, which is why it is also a staple of protective glazing.

16US critical infrastructure sectors coordinated by CISA
9 lbASTM E1996 large missile D: a 2x4 timber
50 ft/sImpact speed for the large missile D test
250 mphFEMA tornado safe room design wind speed

Roofs and rooftop equipment

  • Roof edges. Many roof failures start at the perimeter, where wind uplift is highest. Edge metal and copings tested to ANSI/SPRI/FM 4435/ES-1 help keep the roof system attached.
  • Roof covering attachment. Fastening patterns and adhesives must match the higher pressures at corners and edges.
  • Rooftop equipment. HVAC units, antennas, solar panels and their curbs need engineered anchorage. Equipment blown off a roof both opens the roof to water and becomes debris for neighboring buildings.
  • Loose aggregate. Gravel and ballast can become missiles that break nearby windows.

Roadside and linear infrastructure faces the same loads. Highway sound walls, signs and light poles are designed for wind under transportation design specifications; our sister site HighwayNoiseBarriers.com covers noise barrier systems in more detail.

Closed metal storm shutters protecting a building facade
Closed metal storm shutters protecting a building facade

Earthquakes

Structural basics

New buildings are designed to ASCE 7 seismic provisions based on a seismic design category, which depends on the site's ground motion, soil and the building's risk category. Risk Category IV buildings use higher importance factors, effectively designing them for larger forces and tighter drift limits so they remain usable. Existing buildings are evaluated and retrofitted using ASCE 41, which lets owners choose performance objectives such as life safety or immediate occupancy.

Nonstructural components: the usual weak link

After earthquakes, many facilities that are structurally sound still close because of nonstructural damage: fallen ceilings and light fixtures, ruptured sprinkler and water pipes, toppled shelving and equipment, damaged elevators and failed backup generators. FEMA's practical guide to nonstructural earthquake hazards, FEMA E-74, covers bracing and anchorage details for common items. Priorities for critical facilities typically include:

  • Anchor and brace emergency generators, fuel tanks, transfer switches and batteries.
  • Brace sprinkler, domestic water, medical gas and fuel piping, with flexible connections at building joints.
  • Anchor tall shelving, server racks, medical and laboratory equipment.
  • Brace suspended ceilings and light fixtures in occupied and critical spaces.
  • Secure water heaters, boilers and chillers.
  • Check elevator seismic features where elevators are needed for patient or equipment movement.

Flooding and power: the systems that keep you running

Flooding is the hazard that most often takes out critical equipment. ASCE 24 sets flood-resistant design requirements, and FEMA's guidance on protecting building utilities recommends elevating electrical, mechanical and communication equipment above the design flood elevation with added freeboard, or protecting it with flood barriers where elevation is impossible. Basements are a poor location for switchgear, generators and fuel pumps in any flood-prone facility.

Backup power needs to be designed as a system: generator, fuel supply and delivery, transfer switches, cooling, exhaust and the rooms that house them must all survive the same hazards as the building. FEMA P-1019 addresses emergency power for critical facilities and is a useful reference for owners and engineers.

Do not forget interdependencies

A water plant needs power; a hospital needs water; everyone needs communications and fuel deliveries. Map what your facility depends on, how long you can operate without each input and how resupply will reach you if roads are closed.

A resilience assessment, step by step

  1. Define the mission. Decide which functions must continue during and after an event and for how long.
  2. Identify hazards. Use ASCE 7 hazard data, FEMA flood maps, local seismic data and historical records for wind, flood and earthquake.
  3. Walk the building. Look for unprotected openings, roof edge conditions, unanchored rooftop and interior equipment, below-grade critical equipment and single points of failure.
  4. Engage engineers. Have licensed structural and MEP engineers evaluate priority systems using ASCE 41, ASCE 7 and the relevant FEMA guidance. Our engineer selection guide lists qualifications to look for.
  5. Prioritize. Rank upgrades by their effect on keeping critical functions running, and phase them with capital renewal so replacements are done to higher standards.
  6. Plan for people. Provide safe refuge for staff who must stay through an event, such as an ICC 500 storm shelter, covered in our safe room guide.
  7. Exercise and update. Test generators under load, run tabletop exercises and update plans after every drill or real event.

High-value, lower-cost upgrades

  • Bracing and anchoring nonstructural items
  • Upgrading roof edge securement during reroofing
  • Relocating critical equipment out of basements
  • Adding tested shutters to vulnerable openings

Larger investments

  • Structural seismic retrofits
  • Replacing glazing with impact-rated systems
  • Hardened generator buildings and fuel systems
  • Dedicated storm shelters for staff

Frequently asked questions

What is Risk Category IV?

Under ASCE 7, Risk Category IV covers essential facilities such as hospitals with emergency services, fire and police stations, emergency operations centers and designated shelters. These buildings are designed for higher loads so they can remain functional after major events.

What is a wind-borne debris region?

It is an area, defined by building codes based on design wind speeds and distance from the coast, where glazed openings must resist debris impact or be protected by tested shutters.

Why do structurally sound buildings close after earthquakes?

Nonstructural damage, such as broken pipes, fallen ceilings, damaged equipment and failed backup power, can make a building unusable even when the structure performs well. Bracing and anchorage address this.

Which standard is used to evaluate existing buildings for earthquakes?

ASCE 41, Seismic Evaluation and Retrofit of Existing Buildings, is the primary US standard. It lets owners select performance objectives ranging from collapse prevention to immediate occupancy.