The Big 6 Foodborne Pathogens: List & Controls

The Big 6 Foodborne Pathogens: FDA's List, Risks & Manufacturer Controls

The Big 6 foodborne pathogens are Norovirus, Salmonella (Nontyphoidal), Salmonella Typhi, Shigella spp., Shiga toxin-producing E. coli (STEC), and Hepatitis A. The FDA Food Code singles these six out because an infected food employee can transmit any one of them to thousands of consumers through a single shift of contact with ready-to-eat food. This guide covers what these pathogens are, how they slot into your hazard analysis, your FSMA preventive controls, and your GFSI scheme requirements.

The Big 6 Foodborne Pathogens at a Glance

FDA's Definition of the Big 6

The FDA Food Code 2022 uses the term "Big 6" to describe six pathogens listed under §2-201.11 that require mandatory reporting, restriction, or exclusion of food employees. If a food employee is diagnosed with, or is symptomatic for, any of these six, the person-in-charge must act immediately to prevent transmission through food contact. This is an employee illness management framework, not a general hazard ranking.

Big 6 Pathogen Comparison Table

Four of the six pathogens have infective doses measured in the tens of organisms or viral particles, meaning hand hygiene lapses that seem minor can cause real outbreaks. Every item on the list can contaminate ready-to-eat foods without a subsequent kill step, and all six carry a universal exclusion requirement.

What Is the "Big 6"? FDA's Regulatory Origin

How the FDA Food Code Defines the List (§2-201.11)

Section 2-201.11 of the FDA Food Code 2022 lists the conditions under which food employees must notify the person-in-charge, including diagnosis with or symptoms of any of the six pathogens. The Food Code is a model code adopted by state and local jurisdictions, and its employee health provisions are incorporated by reference into FSMA's preventive controls framework. Your employee health policy, corrective action procedures, and audit documentation all flow from it.

Why These Pathogens Were Singled Out

The FDA chose the Big 6 based on three shared characteristics:

• High infectivity at low doses. Each pathogen can cause illness with an exposure measured in single-digit to low-triple-digit organism counts or viral particles.
• Efficient foodborne transmission. All six spread readily through contaminated food or food-contact surfaces, and most survive environmental conditions long enough to reach a consumer.
• Potential for severe or systemic outcomes. Outcomes range from severe dehydration to hemolytic uremic syndrome, typhoid septicemia, and fulminant hepatic failure.

The combination of these three factors makes a single infected food worker a credible source of a multi-facility outbreak.

The Big 6 vs. CDC's Six Highest-Burden Foodborne Pathogens

The FDA Food Code's "Big 6"

The FDA's Big 6 is an employee-health framework, not a ranked list of the pathogens most likely to make people sick. The criteria for inclusion were transmission route (fecal-oral, person-to-food), severity of outcome, and dose-response characteristics. The list answers a practical operational question: which diagnoses require you to send a food worker home today?

The CDC's "Top Six by Burden"

According to CDC: Estimates of Burden of Foodborne Illness in the United States, the six pathogens responsible for the greatest illnesses, hospitalizations, and deaths are Norovirus, Nontyphoidal Salmonella, Clostridium perfringens, Campylobacter, Staphylococcus aureus, and enterotoxigenic E. coli (ETEC). Only Norovirus and Nontyphoidal Salmonella appear on both lists.

Why the Two Lists Differ, and Which One Applies to Your Facility

For your employee illness and exclusion program, the FDA Big 6 is the operative framework. For your hazard analysis under FSMA, you need to consider a much broader hazard universe, including Campylobacter and Listeria monocytogenes. Use the FDA Big 6 as the floor for your employee health policy and your full hazard analysis to drive process and sanitation controls.

Per-Pathogen Profiles

The FDA Bad Bug Book (Second Edition) is the primary regulatory reference for pathogen-specific data. Cross-reference your food safety guide for food manufacturers when mapping these organisms to your specific process and product types.

Norovirus

Norovirus is the leading cause of foodborne illness in the United States, responsible for an estimated 19 to 21 million illnesses per year. Infected food workers who handle ready-to-eat foods before proper exclusion account for a significant share of outbreaks, and viral shedding continues for days to weeks after symptoms resolve.

Norovirus resists many common sanitizers at routine use concentrations and survives on stainless steel surfaces long enough to contaminate product batches. Your most effective controls are employee exclusion for at least 48 hours after symptoms resolve, monitored handwashing compliance, and sanitizer selection validated against non-enveloped viruses. See CDC: About Norovirus for current clinical data.

Salmonella (Nontyphoidal)

Nontyphoidal Salmonella encompasses over 2,500 serotypes, with primary reservoirs in poultry, eggs, raw produce, low-water-activity foods such as nut butters and spices, and unpasteurized dairy. In immunocompromised individuals and young children it can cause invasive bacteremia with significant mortality risk.

For manufacturers whose products support Salmonella growth, your hazard analysis must address whether a thermal kill step is present and validated, whether post-lethality recontamination pathways exist, and whether your supplier approval program requires microbiological testing for high-risk ingredients. See CDC: About Salmonella Infection for current epidemiology.

Salmonella Typhi

Salmonella Typhi causes typhoid fever with a longer incubation period (6 to 30 days) and fatality rates of 10 to 30% in untreated cases. Most US cases are travel-related, but domestic transmission through contaminated produce and shellfish does occur, and an infected worker can shed the organism before a diagnosis is apparent.

Employee health policies must include reporting requirements for recent travel to endemic regions and physician-confirmed typhoid diagnosis. See CDC: About Typhoid Fever and Paratyphoid Fever for the full clinical picture.

Shigella spp.

Shigella is among the most infectious pathogens on the Big 6 list, with an infective dose as low as 10 to 200 organisms. The four species cause shigellosis (bloody diarrhea, fever, severe cramping), and S. dysenteriae type 1 can produce Shiga toxin leading to HUS. Transmission is fecal-oral through direct contact, contaminated water, or food handled by an infected person.

Even minimal fecal contamination from an employee who did not wash hands thoroughly represents a credible outbreak risk. Your employee hygiene program, restroom facility design, and handwashing monitoring are the primary defenses. See CDC: About Shigella Infection for current outbreak data.

Shiga Toxin-Producing E. coli (STEC)

STEC encompasses E. coli O157:H7 and the six non-O157 serogroups designated by USDA as adulterants in raw non-intact beef. All produce Shiga toxins capable of causing hemorrhagic colitis and, in 5 to 10% of cases, hemolytic uremic syndrome (HUS). Infective dose is extremely low (as few as 10 organisms), and children under 5 and the elderly face the highest risk.

For manufacturers processing ground beef, leafy greens, raw milk, or sprouts, STEC typically requires either a validated kill step or a formulation control validated to prevent growth. See CDC: About E. coli Infection (STEC) for serotype-specific surveillance data.

Hepatitis A

Hepatitis A virus (HAV) has an exceptionally long incubation period (15 to 50 days), meaning a food worker can contaminate product for weeks before any symptoms appear. HAV causes liver inflammation (jaundice, fatigue, nausea, abdominal pain), and in individuals with underlying liver disease it can cause acute liver failure.

Vaccination is the most effective long-term control for at-risk food workers. For manufacturers sourcing shellfish or produce from regions with poor sanitation infrastructure, your supplier verification program should include documented water quality data. See CDC: Hepatitis A for vaccination recommendations.

How Food Manufacturers Treat the Big 6 in FSMA Hazard Analysis

Mapping the Big 6 to Biological Hazards in Your Hazard Analysis

Under FSMA's Preventive Controls for Human Food rule, your hazard analysis must identify and evaluate known or reasonably foreseeable biological hazards for each ingredient and process step. The Big 6 pathogens are not automatically applicable to every facility; relevance depends on your raw materials, process, and customer. Your HACCP plan for food manufacturers should document which pathogens are reasonably foreseeable at which steps and why.

For each Big 6 pathogen identified as reasonably foreseeable, you need to determine whether it requires a preventive control, what that control is, and how you will monitor and verify it. Hazards controlled by a kill step get assigned as process CCPs; hazards controlled upstream are addressed through supply-chain preventive controls.

Preventive Controls That Address Big 6 Risk

The FDA FSMA Final Rule for Preventive Controls for Human Food identifies four categories of preventive controls that can address Big 6 hazards:

• Process controls: validated thermal processes (cook, pasteurize, retort), antimicrobial interventions, or acidification steps achieving required log reductions for target pathogens.
• Sanitation controls: cleaning and sanitizing procedures for food-contact surfaces, including validation of contact time, concentration, and surface compatibility.
• Supply-chain controls: supplier approval and verification procedures, including microbiological specifications, Certificates of Analysis, and audit requirements for raw materials that introduce Big 6 hazards.
• Allergen controls: allergen cross-contact procedures often share infrastructure with pathogen controls (dedicated equipment, sequencing, cleaning verification), so they belong in the same documentation layer.

When the Big 6 Are "Reasonably Foreseeable" vs. Controlled by Raw-Material Specification

Your food safety plan needs to be explicit about which hazards are controlled by your process and which are managed by raw-material specifications from verified suppliers. If you receive a heat-treated ingredient with a validated 5-log Salmonella reduction, you may rely on the supplier's control, but only if your supplier approval program and verification activities are documented and functional. The FSMA 204 traceability rule requires that for foods on the Food Traceability List, lot codes link your finished product back to the specific raw material lot received.

See how a structured food safety plan keeps Big 6 hazards documented end-to-end: food safety plan

HACCP CCPs and Programs That Control the Big 6

Thermal CCPs

Thermal processing is the most validated kill step for all six Big 6 pathogens. The seven HACCP principles require you to establish critical limits, monitoring procedures, corrective actions, verification activities, and record-keeping for every CCP. For a thermal CCP targeting Salmonella in cooked poultry, that means a time-temperature combination tied to a regulatory standard, continuous temperature monitoring with calibrated instruments, and a corrective action procedure for every deviation. See critical control point examples for real-world CCP configurations across product categories.

Your critical limit must be pathogen-specific, since a 7-log reduction of Salmonella in ready-to-eat poultry requires different parameters than a 5-log reduction of E. coli O157:H7 in ground beef. Your process authority validation data, not generic published tables, should drive your CCP parameters.

Post-Lethality Contamination Controls

A validated kill step is only protective if your post-lethality environment does not reintroduce the pathogen. Physical separation of raw and ready-to-eat areas, unidirectional product flow, and verified clothing change protocols are the structural prerequisites. Your GMP audit checklist should cover these as observable compliance items, and the deeper documentation framework belongs in your GMP in the food industry program.

Pair your written handwashing and glove-change procedures with observable monitoring (sign-off logs, camera coverage in high-risk zones) and document the results. An unmonitored requirement in your SOP is not a control.

Environmental Monitoring Program (EMP) Parallels

While your formal Environmental Monitoring Program is typically designed around Listeria monocytogenes, the zone-by-zone swabbing framework applies equally well to detecting Salmonella and STEC. Your EMP should include food-contact surfaces, near-food-contact surfaces, and environmental niches known to harbor pathogens: drains, floor-wall junctions, conveyor belt undersides, and condensate collection points. See essential food safety testing methods for method selection and sampling frequency guidance.

A zone 1 or zone 2 positive for any Big 6 pathogen should trigger an immediate corrective action including hold-and-test of potentially affected product, root cause investigation, and enhanced monitoring. Document every positive, every corrective action, and every re-test result.

Supplier Approval and Certificate of Analysis Checks

Many Big 6 hazard entries will be controlled upstream through your supplier approval program. A raw nut butter with Salmonella risk, a spice blend with outbreak history, or a produce ingredient from a region with water quality concerns all require ongoing supplier-level verification, not just a one-time approval. Your program should specify the frequency of microbiological testing, organisms targeted, acceptance criteria, and consequences of non-conformance. See food traceability for how traceability infrastructure supports your supplier verification records.

Need a HACCP plan template that already accounts for biological hazards? Start with the free HACCP plan template

For a platform that integrates CCP monitoring records with your supplier approval documentation, see HACCP compliance software.

Employee Illness Reporting and Exclusion: The Operational Core of the Big 6

What Food Employees Must Report (FDA Food Code §2-201)

The FDA Food Code §2-201.11 requires food employees to notify the person-in-charge when they experience or have been diagnosed with any of the following:

• A diagnosis of infection with Norovirus, Salmonella Typhi, Shigella spp., STEC, Hepatitis A, or Nontyphoidal Salmonella.
• Symptoms including diarrhea, vomiting, jaundice, sore throat with fever, or infected cuts or lesions on hands or wrists that are not properly covered.
• Exposure to or suspicion of causing any confirmed outbreak involving the Big 6.
• Recent household exposure to a diagnosed case of any of the Big 6.

The person-in-charge receives this information and makes the determination to exclude or restrict the employee from food-contact activities.

Exclusion vs. Restriction: A Decision Tree

Knowing when to exclude versus restrict a symptomatic employee prevents both over-reaction and under-reaction:

• Exclude when the employee has a diagnosed Big 6 infection or is symptomatic with vomiting, diarrhea, or jaundice. Remove from all food-handling roles and food-contact surfaces immediately.
• Restrict when the employee has symptoms that suggest infection but no confirmed diagnosis, or has an infected wound that can be effectively covered. The employee may perform non-food-contact work until cleared.
• Reinstate when a licensed health practitioner provides written clearance, or when the employee has been symptom-free for the required period (for Norovirus, at least 48 hours after the last symptom), and the person-in-charge documents the reinstatement decision.

Documentation: The FDA Form 1-B Conditional Employee or Food Employee Reporting Agreement

The FDA provides a model reporting agreement in the FDA Employee Health and Personal Hygiene Handbook (PDF) that covers the Big 6 disclosure requirements. Having employees sign this form at hire and annually creates a documented acknowledgment of their reporting obligations. Keep signed agreements in your employee health files alongside illness reports, exclusion decisions, and reinstatement records, since those records are how your food safety culture becomes visible and verifiable to auditors.

GFSI Scheme Requirements: How SQF, BRCGS, and FSSC 22000 Operationalize the Big 6

SQF 9 Personnel Hygiene and Visitor Controls

SQF Edition 9 §11.3 requires a written employee health policy referencing reportable conditions (including the Big 6), training evidence, and records of exclusion decisions. Visitors and contractors must also acknowledge your hygiene requirements before entering production areas. Auditors will look for all three elements as a package.

BRCGS Food Safety v9 §7 Personal Hygiene Clauses

BRCGS Food Safety Issue 9 §7 specifies mandatory illness reporting, exclusion procedures for symptomatic employees, and hygienic practices for all personnel with food-area access. Auditors routinely request illness and exclusion records as certification evidence, and the standard requires your employee hygiene policy to be communicated in a language all staff understand.

FSSC 22000 v6 and ISO/TS 22002-1 PRP Linkages

FSSC 22000 Version 6 incorporates ISO/TS 22002-1:2009 as the sector-specific PRP standard, and Section 13 covers personnel hygiene, including illness reporting and exclusion of infected personnel. Your food safety management system documentation must include a personnel hygiene PRP that maps to these requirements and provides objective evidence of implementation.

Codex Alimentarius General Principles of Food Hygiene as the Global Baseline

All of these scheme requirements trace back to the Codex Alimentarius CXC 1-1969 General Principles of Food Hygiene, which establishes that persons carrying a disease likely to be transmitted through food should be excluded from food handling. Codex is the baseline the WHO, WTO, and national regulatory agencies reference when setting food safety standards. For a deeper overview of how these standards connect, see the FSQA (food safety & quality assurance) guide.

2025-2026 Update: Why the Big 6 Matter More Right Now

CDC FoodNet Surveillance Cutbacks (Aug-Sep 2025)

In August and September 2025, the CDC scaled back its FoodNet active surveillance program, reducing the case-finding infrastructure that historically provided the earliest signal for emerging outbreaks. Your plant-level programs (environmental monitoring, finished product testing, supplier verification) carry more weight when federal detection is slower.

April 2025 Burden Estimates

In April 2025, CDC updated its national burden estimates to approximately 10 million annual illnesses from the top six foodborne pathogens. Norovirus leads by case count; Nontyphoidal Salmonella leads for hospitalization and death among bacterial pathogens. Both overlap with the FDA Big 6.

How Weakened Federal Surveillance Shifts More Risk onto Plant-Level Programs

When surveillance capacity is reduced, outbreak attribution takes longer, contaminated product stays in distribution longer, and recalls are larger when they occur. The practical response: run higher EMP sampling frequencies, tighter supplier CoA review cycles, faster internal escalation when environmental results trend upward, and more rigorous employee health screening. The WHO: Food Safety fact sheet estimates 600 million global foodborne illness cases annually, much of it below the threshold of any single country's detection system.

Frequently Asked Questions

Q: What are the Big 6 foodborne pathogens?

A: The Big 6 foodborne pathogens are Norovirus, Salmonella (Nontyphoidal), Salmonella Typhi, Shigella spp., Shiga toxin-producing E. coli (STEC), and Hepatitis A. All six are identified in FDA Food Code §2-201.11 as requiring mandatory reporting, restriction, or exclusion of infected or symptomatic food employees. The list is specifically tied to the risk infected food workers pose when handling ready-to-eat foods.

Q: Which of the Big 6 is a virus?

A: Two of the Big 6 are viruses: Norovirus and Hepatitis A. The other four (Salmonella Nontyphoidal, Salmonella Typhi, Shigella spp., and STEC) are bacteria. This distinction matters operationally because viral pathogens are not killed by antibiotics and often require higher sanitizer concentrations or contact times for surface inactivation.

Q: What is true about the Big 6 foodborne pathogens?

A: The Big 6 are the six pathogens the FDA has designated as requiring immediate employee exclusion or restriction. They are not the only pathogens capable of causing serious foodborne illness. The Big 6 framework is about employee illness management, not an exhaustive hazard list for your food safety plan.

Q: Are the Big 6 the only pathogens that can be transmitted through food?

A: No. Dozens of pathogens can be transmitted through food, including Listeria monocytogenes, Campylobacter jejuni, Clostridium botulinum, Bacillus cereus, and many others. Your FSMA hazard analysis must consider all known or reasonably foreseeable biological hazards for your specific products and processes, which will typically extend well beyond these six.

Q: What six pathogens make up the Big Six?

A: The six pathogens are: Norovirus (virus), Salmonella Nontyphoidal (bacterium), Salmonella Typhi (bacterium), Shigella spp. (bacterium), STEC including O157:H7 and non-O157 serogroups (bacterium), and Hepatitis A virus. All six appear in FDA Food Code §2-201.11 and require exclusion of infected or symptomatic food employees from food-contact activities.

Q: How is the Big 6 different from the CDC's top burden pathogens?

A: The FDA Big 6 is an employee illness exclusion framework based on transmission risk and severity; the CDC's top-burden list ranks pathogens by total illness, hospitalization, and death nationally. Only Norovirus and Nontyphoidal Salmonella appear on both. Pathogens like Campylobacter with enormous public health burden are absent from the FDA Big 6 because infected-food-worker transmission risk drove FDA's criteria, not total case counts.

Q: Do FSMA, SQF, BRCGS, and FSSC 22000 reference the Big 6?

A: FSMA does not use the term "Big 6" directly, but the FDA Food Code is the source of the list and informs FSMA's employee health provisions. SQF 9, BRCGS Issue 9, and FSSC 22000 v6 all require exclusion of employees with reportable illness conditions. Auditors across all three schemes expect documented employee health policies, signed reporting agreements, and exclusion records.

From Awareness to Control: How Allera Helps Manufacturers Manage Biological Hazards

Knowing which pathogens are on the Big 6 list is step one. The harder work is building documentation infrastructure that demonstrates your program is functioning: hazard analysis records, employee health logs capturing illness reports and exclusion decisions, and CCP monitoring records showing your kill steps operate within critical limits.

food quality management software centralizes your hazard analysis, CCP monitoring logs, and employee health records in one platform. When a corrective action is triggered by a CCP deviation or environmental positive, the record is created, assigned, and closed in the same system. For teams maintaining a HACCP system, HACCP compliance software provides the specific record structure auditors expect.

The goal is a food safety culture where people report problems early and the system catches hazards before they reach consumers. To see how Allera supports that from hazard analysis through CCP monitoring and employee health documentation, book a 30-minute walkthrough.