Small businesses · Cleaning and janitorial services
What a cleaning company has to keep up with, and who does it.
A bloodborne pathogens plan written for cleaning crews, the chemical safety program, the bond your commercial clients ask about, and the paperwork for every new hire. Arikano works out which of these are yours, drafts the written programs and keeps the dates. You approve it.
- Rules for every cleaning company
- 16
- Rules depending on how you work
- 20
- Practices Arikano recommends
- 14
- Documents Arikano drafts
- 18
Review status. Not yet reviewed. No credentialed professional has reviewed the rules on this page so far. Each rule names the regulation it comes from, so you can check it yourself.
Where to start
The heaviest items on a new cleaning company’s list.
Bloodborne pathogens plan for cleaning crews
Cleaning restrooms, handling waste, picking up sharps somebody left behind — OSHA treats that as reasonably anticipated exposure, and this is a routinely cited standard in this trade.
OSHA · 29 CFR 1910.1030(c)(1)
Workers’ compensation coverage in force
If someone gets hurt on the clock this is what pays their medical bills and their wages. Going without it where your state requires it is not a fine — in most states it is a criminal offense and you become personally liable for the claim.
State law · State workers’ compensation act (varies by state; Texas is the only state where coverage is elective for a private employer)
State unemployment insurance account registered
The account your state unemployment contributions are paid into — every state runs a program and every covered employer registers with it, usually with the labor or workforce department rather than the revenue one. It is worth getting right early for a reason that is not obvious: your contribution rate is experience-rated, so the claims filed against this account in your first years set what you pay for years afterwards. Register before your first payroll. The wage base and the new-employer rate are set by your state and change, so take both from the state.
State law · State unemployment insurance statute (each state its own). 26 U.S.C. §3302 gives an employer a credit against Federal Unemployment Tax Act liability for contributions paid into a certified state unemployment fund, which is why every state operates a programme and a covered employer registers with it
For every cleaning company
What applies from day one.
Each rule with the regulation it comes from, and how often Arikano checks it again. Items marked “Arikano guidance, not a law” are practices Arikano recommends, not rules. The few that wait until you have employees say so.
Workers’ compensation coverage in force
If someone gets hurt on the clock this is what pays their medical bills and their wages. Going without it where your state requires it is not a fine — in most states it is a criminal offense and you become personally liable for the claim.
Once you have employees
State unemployment insurance account registered
The account your state unemployment contributions are paid into — every state runs a program and every covered employer registers with it, usually with the labor or workforce department rather than the revenue one. It is worth getting right early for a reason that is not obvious: your contribution rate is experience-rated, so the claims filed against this account in your first years set what you pay for years afterwards. Register before your first payroll. The wage base and the new-employer rate are set by your state and change, so take both from the state.
State income tax withholding account registered
The account you withhold your employees’ state income tax into and remit from. You register with your state’s revenue department, usually online and usually free, and you need your EIN in hand to do it. Register before your first payroll, not after: the penalty is normally for remitting late, and you cannot remit to an account that does not exist. A few states have no wage income tax and therefore no withholding account — if yours is one of them, waive this and keep the state unemployment insurance account, which every state has.
Fatality and severe-injury reporting procedure
A death is eight hours. An in-patient hospitalization, an amputation or the loss of an eye is twenty-four. That clock runs whether or not you are exempt from keeping the 300 log, and whether or not anyone in the office knows the number to call.
Certificate of occupancy for the premises
If you are taking a space that staff or customers will use, the building official signs off that it may be occupied for what you intend to do in it — and a new certificate is normally required when the USE changes, even if nothing is built. That is the one that catches people: a unit that was a shop is not automatically an approved kitchen, a gym or a clinic, and the landlord’s existing certificate does not transfer to your use. Find out before you sign, because the work it takes to pass is the tenant’s problem and the rent starts either way. If you work from home or out of a vehicle, waive this one.
Local business license or business tax registration
Your city or county almost certainly wants its own registration on top of anything the state issued, and the two are unconnected — a perfectly formed LLC with every state account open can still be trading unlawfully in its own city. Check the city AND the county, because plenty of businesses owe both, and check the zoning at the same time: a license is routinely refused on the ground that the use is not allowed at that address, which is a much cheaper thing to discover before you sign a lease. Record the expiry printed on the license; the renewal interval and the fee are set locally and vary between neighboring towns.
Bloodborne pathogens plan for cleaning crews
Cleaning restrooms, handling waste, picking up sharps somebody left behind — OSHA treats that as reasonably anticipated exposure, and this is a routinely cited standard in this trade.
OSHA 300 log maintained
Every recordable injury has to be on the log within 7 days; the platforms pull the totals straight from it.
With 11 or more employees
OSHA 300A summary posted (Feb 1 – Apr 30)
The prior year’s summary must be signed and posted where crews can see it from February through April.
With 11 or more employees
Form I-9 on file for every employee
Section 1 within the first day of work, section 2 within three business days, and the file kept for three years after hire or one year after they leave — whichever is later. An audit counts forms, not intentions.
Once you have employees
PPE assessment and program
Before you hand out gloves and glasses the rule wants you to have walked the work, written down what can hurt someone, and signed and dated the assessment. The certificate is the part that gets cited, not the gear — and it is the proof an inspector or a client asks for.
Sales and use tax permit, or a note that you owe none
If you sell anything your state taxes you register for a permit before the first sale, not before the first return — collecting tax without one is its own offense in several states, and so is failing to collect. What counts as taxable is set state by state and is not obvious: almost every state with a sales tax taxes goods, a good many tax some services, and a few tax neither because they have no sales tax at all. This is a question a founder cannot answer from first principles, so look it up once with your state’s revenue department and record either the permit or the answer that you owe none.
Annual safety refresher
Everyone should be retrained at least once a year; the training records prove it.
New-hire safety orientation
Everyone new should learn the hazards, the exits and who to tell before their first day of work, and anyone who checks your program asks whether they did.
Employer Identification Number on file
Your business tax ID. You cannot run payroll, open a business account or file a return without it, and it is free from the IRS.
General liability policy in force
No statute makes you carry this — your landlord, your hiring clients and most contracts do. One trip-and-fall claim against an uninsured business is the whole business.
Fire safety / emergency action plan
Where the exits are, who counts heads, who calls it in. Extinguishers on the wall are enough to trigger it. At ten employees or fewer OSHA lets you brief everyone out loud instead of writing it down — keep it on paper anyway, because the written version is the one an inspector, an insurer or a client asks to see.
OSHA "It’s the Law" poster displayed
Federal law says the poster has to hang where your crew actually sees it — a break room wall, not a binder. It is free from OSHA and it is the cheapest citation you will ever avoid.
Janitorial (employee dishonesty) bond
Offices, schools and retail clients hand you their keys and then ask who covers them if something goes missing. It is cheap and it is on most commercial bid checklists.
OSHA ITA electronic submission
At twenty to 249 employees in an industry OSHA designates — or 250 and up in any industry that keeps the log — you likely have to submit the 300A through OSHA’s Injury Tracking Application by March 2. At 100 or more in the industries listed for it, the case data from the 300 and 301 go in as well.
With 20 to 249 employees
Depending on how you work
Arikano asks before it adds these.
Each question is asked the way Arikano asks it when you start. A yes adds the rules under it; a no keeps them off your list. It also asks 6 less common questions that rarely apply to cleaning and janitorial companies.
Does anyone drive for work — a company truck, a van, or their own car between job sites?If yes: 1 practice
Commercial auto cover for business driving
A personal policy excludes business use, so the claim from a crash between job sites can be denied outright. This is a contract and prudence question, not a federal one — the DOT minimums are a separate row and only bite on commercial vehicles.
Do you bring in subs or 1099 crews to do any part of the work?If yes: 1 practice
Subcontractor management program
Clients hold you responsible for the subs you bring; they want to see how you qualify and oversee them.
Do you use anything that arrives with a safety data sheet — solvents, fuels, adhesives, strong cleaners?If yes: 2 rules
Hazard Communication program
If anything you use arrives with a safety data sheet, you owe a written program: the chemical list, the sheets on hand, the labels and who was trained. It is OSHA’s most-cited standard almost every year, and the first written program an inspector, an insurer or a client asks to see.
Hazard Communication training current
The program is half of it. Everyone working around those chemicals has to be trained before they start and again whenever a new hazard walks in the door.
Do you hold a federal contract, sub on one, or bid for federal work?If yes: 3 rules
SAM.gov registration active
This is the one to never let lapse. An expired registration does not just stop you bidding — the government cannot pay you on the contracts you already have, and contractors normally find out when an invoice bounces. It renews every year and the renewal is easy to miss, so put the expiry on the calendar and give it an owner by name.
Unique Entity Identifier (UEI) on file
The twelve-character identifier SAM.gov issues for your business — this is the federal one. It replaced the DUNS Number for federal use in April 2022, so if a form or a prime is still asking you for a DUNS to identify you to the government, the UEI is what they actually need. You get it with your SAM registration; keep it where whoever fills in bid forms can find it.
CAGE code on file
The Commercial and Government Entity code the Defense Logistics Agency assigns to your business — it comes with your SAM registration and goes on contracts, invoices and DoD paperwork. It carries its own expiry date, so record the date printed on yours rather than assuming it runs with the SAM renewal.
Did you set up an LLC, corporation or partnership with your state, rather than working under your own name?If yes: 3 rules
Formation document filed with the state
The filing that brings the company into existence — articles of organization for an LLC, articles or a certificate of incorporation for a corporation, a certificate of limited partnership for an LP. Until it is accepted there is no company: no liability shield, no business bank account, and nothing for the IRS to issue an EIN to. Keep the stamped copy the state sends back, because your bank, your insurer and every state tax account will ask for it. The fee and the processing time are set by your state and change, so take both from your own Secretary of State rather than from anybody’s summary.
State entity registration current (periodic report filed)
The filing that keeps your LLC or corporation alive with the state. Miss it long enough and the state administratively dissolves the entity: the company stops existing, your liability shield goes with it, and reinstatement costs more than the filing ever did. How often it is due varies by state — annual in most, biennial in several, and some states key it to your formation anniversary rather than a common date — so look up your own state’s interval and put the date it gives you on the record.
Registered agent on file with the state
The person or company at a real street address in your state who is legally allowed to accept a lawsuit on your behalf. If the address on file is a former accountant or an office you moved out of, you can be sued and lose by default without ever hearing about it — and a state that cannot reach your agent can dissolve the entity on that ground alone. Check it every time you move, and whenever the agent changes.
Does anyone climb into tanks, vaults, manholes, pits or crawl spaces?If yes: 1 rule
Permit-required confined space program
Tanks, vaults, manholes, pits. More than half the people who die in them are the ones who went in after someone else. The program is the permit, the attendant and the rescue plan — all three before anybody climbs in.
Do you dig, trench, grade or otherwise break ground on a site?If yes: 1 rule
Stormwater permit and SWPPP
Break ground on an acre or more and the runoff becomes a permitted discharge: you file for coverage under the construction general permit and keep a stormwater pollution prevention plan on the site. Smaller sites get pulled in when they are part of a larger common plan of development.
Does anyone work on or near live electrical parts — panels, circuits, or equipment that is still powered?If yes: 2 rules
Electrical safety program
Live parts are de-energized before anyone works on them unless that is infeasible or adds hazards, only qualified people work on anything still live, and the lockout and tagging procedures for circuits are kept in writing. Many hiring clients also require NFPA 70E arc flash rules on top of OSHA.
Electrical safe work practices training current
Anyone facing a shock risk is trained in the safe work practices for their job, and qualified people also in telling live parts apart, finding their voltage and keeping the right clearance.
Do you hold anyone’s medical or patient information — treatment, diagnoses, or insurance claims?If yes: 5 rules
HIPAA security risk analysis
The first thing OCR asks for after a breach, and the thing almost nobody has. It is a written, dated assessment of where patient information lives and what could reach it — and it has to be revisited, not framed.
HIPAA policies and procedures in writing
Who may look at a record, how it is stored and sent, what happens in the first 24 hours of a breach. The rule requires it written down and kept for six years from the last date it was in effect.
Business associate agreements on file for every vendor
Before a billing company, records system, IT firm or any other vendor handles your patients’ information, you need its written promise to protect it — a business associate agreement. A list of every such vendor, with the signed agreement for each, is how you show you know who they are. Arikano does not sign these agreements, so patient information stays out of it.
Breach log kept, and small breaches reported each year
Every privacy incident is logged and judged against the four-factor test. The people affected by a breach are told within 60 days of its discovery. Breaches of fewer than 500 people are reported to HHS once a year, within 60 days after the year ends, so the log is what that report is built from. It holds counts and kinds of information, never patients’ names.
HIPAA workforce training current
Everyone who can see patient information has to be trained on your own policies — new starters as part of onboarding, everyone else whenever the policies change.
Do any of your clients check you through ISNetworld, Avetta or Veriforce, or review your safety paperwork before you can start work for them?If yes: 8 practices
Written safety program (what clients call an HSE policy)
Every hiring client and every platform questionnaire starts by asking for your written safety program.
Drug and alcohol policy
Most owner-clients will not badge a crew without a written testing policy on file.
EMR letter on file for this year
Platforms and clients ask for the current experience modification rate; a stale letter reads as a gap.
Incident investigation procedure
Questionnaires ask how you investigate incidents and track corrective actions; a written procedure answers it.
Disciplinary program
Platforms ask how safety violations are handled; a written progressive-discipline program answers it.
D-U-N-S Number on file (commercial credit)
Dun & Bradstreet’s number for your business credit file — not a government identifier and not required by any law. Suppliers running a credit check, trade-credit and net-terms applications, and some private vendor-onboarding portals still ask for it, and the file exists whether or not you have ever looked at it. Worth claiming so you can see what it says about you. For federal work the identifier is the UEI, not this.
Cybersecurity / information security
Some larger clients now ask for it on the questionnaire; low priority for most crews.
Infectious disease plan
A leftover questionnaire item; keep a short plan on file so the question never blocks a submission.
Do you take work for a city, county, school district, transit authority or state agency?If yes: 1 rule
Certified payroll filed weekly on public work
Public work means prevailing wage, and prevailing wage means a signed payroll statement every week for every week you were on site. Late filings hold your payment, not just your paperwork.
Does anyone repair, service or unjam machinery — not just plug-in tools — that could start up or release stored energy while their hands are in it?If yes: 1 rule
Lockout / tagout program
Machine-specific written procedures for every piece of equipment that can start or release stored energy while somebody has their hands in it. This is the standard that kills maintenance people. If nobody here ever services equipment like that, waive it and say so.
Does anyone work six feet or more off the ground — roofs, scaffolds, ladders, lifts?If yes: 1 rule
Fall protection program
Falls are the single largest killer on a job site and the most-cited standard OSHA has. Six feet in construction, four in general industry — above that line you need a plan, the right gear and people trained to use it.
By state
What changes in Texas, Florida, California, New York and Georgia.
Rules a state adds on top of the list above, for cleaning and janitorial companies. Arikano adds the ones for your state once you tell it where you work.
Texas
Arikano has no rules written only for cleaning and janitorial companies in Texas yet. Everything listed above still applies there.
Florida
Arikano has no rules written only for cleaning and janitorial companies in Florida yet. Everything listed above still applies there.
California
Injury and illness prevention program (California)
California requires every employer to keep a written Injury and Illness Prevention Program: who is responsible for safety, how hazards are found and fixed, how injuries are looked into and how people are trained. With fewer than 10 employees you may give the general safe-work instructions out loud, but the program itself is written — and it is the first thing a Cal/OSHA inspector, a hiring client or a platform review asks to see.
Heat illness prevention plan (California)
California wants this one in writing, in English and in the language most of your crew speaks, kept at the worksite where an inspector can ask for it: water, shade, what happens when it gets hot, what you do when somebody goes down, and how new people are brought up to the heat. It can live inside your injury and illness prevention program or stand alone. It reaches every outdoor place of employment in the state, so if nobody on your payroll ever works outdoors, waive it — but waive it deliberately.
Cal/OSHA serious injury reporting procedure (California)
California is tighter than the federal clock and this is where people get caught. Any serious injury or illness, or a death, is reported to Cal/OSHA immediately — meaning as soon as practically possible and in no event more than eight hours after you knew or would have known. Federal OSHA allows twenty-four hours for a hospitalization; California does not. Exigent circumstances you can demonstrate stretch it, and no further than twenty-four hours. Whoever answers the phone at 6am needs to know the number and the deadline.
Workplace violence prevention plan (California)
Since July 2024 almost every California employer owes a written workplace violence prevention plan and a violent incident log alongside it. The plan names who runs it, how employees help build it, how incidents get reported and investigated, and what you did about the hazards you found. Healthcare covered by the Cal/OSHA healthcare violence standard is out, and so is a site with fewer than ten people at any one time that the public cannot walk into — but only if that site is already compliant with its injury and illness prevention program.
Workplace violence prevention training current (California)
The plan is half of it. Everyone gets trained when the plan is first written and again every year after: what the plan says, how to report an incident without it coming back on them, the hazards specific to their own job, and a live chance to ask questions of somebody who actually knows the plan. New hazards or a changed plan trigger training again.
New York
Arikano has no rules written only for cleaning and janitorial companies in New York yet. Everything listed above still applies there.
Georgia
Arikano has no rules written only for cleaning and janitorial companies in Georgia yet. Everything listed above still applies there.
What Arikano drafts
The documents, drafted for your cleaning company.
Each is drafted with your company’s name and details and waits for your approval. Nothing counts as done until you approve it.
Fall Protection Program
If the answer is yes to: Does anyone work six feet or more off the ground — roofs, scaffolds, ladders, lifts?
Hazard Communication (HazCom)
If the answer is yes to: Do you use anything that arrives with a safety data sheet — solvents, fuels, adhesives, strong cleaners?
Injury & Illness Prevention Program (IIPP)
Covers: Written safety program (what clients call an HSE policy)
Required in California. Elsewhere, if the answer is yes to: Do any of your clients check you through ISNetworld, Avetta or Veriforce, or review your safety paperwork before you can start work for them?
Lockout / Tagout Program
If the answer is yes to: Does anyone repair, service or unjam machinery — not just plug-in tools — that could start up or release stored energy while their hands are in it?
Permit-Required Confined Space Program
If the answer is yes to: Does anyone climb into tanks, vaults, manholes, pits or crawl spaces?
Electrical Safety Program
If the answer is yes to: Does anyone work on or near live electrical parts — panels, circuits, or equipment that is still powered?
HIPAA Policies & Procedures
If the answer is yes to: Do you hold anyone’s medical or patient information — treatment, diagnoses, or insurance claims?
Bloodborne Pathogens Plan (cleaning crews)
For every cleaning company
Drug & Alcohol Policy
If the answer is yes to: Do any of your clients check you through ISNetworld, Avetta or Veriforce, or review your safety paperwork before you can start work for them?
PPE Assessment & Program
For every cleaning company
Business Associate Inventory
Covers: Business associate agreements on file for every vendor
If the answer is yes to: Do you hold anyone’s medical or patient information — treatment, diagnoses, or insurance claims?
HIPAA Breach Log
Covers: Breach log kept, and small breaches reported each year
If the answer is yes to: Do you hold anyone’s medical or patient information — treatment, diagnoses, or insurance claims?
Stormwater Pollution Prevention Plan
Covers: Stormwater permit and SWPPP
If the answer is yes to: Do you dig, trench, grade or otherwise break ground on a site?
Fire Safety / Extinguisher Program
Covers: Fire safety / emergency action plan
For every cleaning company
Disciplinary Program
If the answer is yes to: Do any of your clients check you through ISNetworld, Avetta or Veriforce, or review your safety paperwork before you can start work for them?
Subcontractor Management
If the answer is yes to: Do you bring in subs or 1099 crews to do any part of the work?
Cybersecurity & Info Security
Covers: Cybersecurity / information security
If the answer is yes to: Do any of your clients check you through ISNetworld, Avetta or Veriforce, or review your safety paperwork before you can start work for them?
COVID-19 / Infectious Disease
If the answer is yes to: Do any of your clients check you through ISNetworld, Avetta or Veriforce, or review your safety paperwork before you can start work for them?
Questions
Asked about cleaning and janitorial companies.
What does a cleaning company have to keep up with?
16 rules apply to every cleaning company, starting with these: Bloodborne pathogens plan for cleaning crews; Workers’ compensation coverage in force; State unemployment insurance account registered. Arikano also recommends 4 practices for every cleaning company; those are its own guidance, not a law, and the page marks them that way. Another 20 rules and 10 practices Arikano recommends depend on how you work. Arikano asks first, with questions like “Does anyone drive for work — a company truck, a van, or their own car between job sites?”, and adds them only when the answer is yes.
Which documents does Arikano draft for a cleaning company?
For every cleaning company: Bloodborne Pathogens Plan (cleaning crews), PPE Assessment & Program and Fire Safety / Extinguisher Program. 15 more depend on your state or on how you answer Arikano’s questions: Fall Protection Program, Hazard Communication (HazCom), Injury & Illness Prevention Program (IIPP), and 12 more. Each one is drafted with your company’s details and waits for your approval before it counts.
Has a professional reviewed these rules?
Not yet. None of the rules on this page has been reviewed by a credentialed professional so far. Each rule is listed with the regulation it comes from, so you can check it yourself. The practices Arikano recommends are marked as its own guidance, not a law.
Small businesses
Other lines of work.
- Restaurants25 rules · 7 documents Arikano drafts
- Hair and nail salons24 rules · 8 documents Arikano drafts
- Tattoo and piercing studios25 rules · 8 documents Arikano drafts
- Home health agencies46 rules · 13 documents Arikano drafts
- Medical clinics35 rules · 12 documents Arikano drafts
- Staffing agencies35 rules · 18 documents Arikano drafts
- Auto repair shops30 rules · 8 documents Arikano drafts
- Manufacturers and machine shops50 rules · 19 documents Arikano drafts
Arikano does your compliance work. You approve it.
Start with your own cleaning company: what applies to you, what is missing, and the first drafts.