Risk assessment frameworks for accidental and intentional indoor chemical and biological air contamination have been proposed, but their quantitative application to individual buildings for the purpose of selecting and designing new or remedial control measures is limited. Requirements for a building-specific quantitative risk assessment focused on heating, ventilation, and air-conditioning systems are discussed, including definition of appropriate performance measures, selection of event scenarios, modeling of appropriate transport phenomena, occupant exposure and dose-response, and evaluation of the impact of uncertainty and sensitivity on the risk assessment. It is shown that frequently referenced performance metrics such as average concentration of an agent can yield misleading conclusions and that, in general, either distributions of exposure or estimates of casualties are needed. The lack of entirely satisfactory criteria for HVAC system selection and design is noted. Options for modeling indoor contaminant transport are reviewed. Multizone models are recommended as providing the best overall combination of transport modeling capabilities in their current state of development, although they have significant limitations, which are discussed. An example based on modeling of a hypothetical residence hall is used to illustrate the concepts presented, including overall uncertainty associated with estimates of dose and infections in the release of an infectious agent.