kSIST FprEN ISO 19650-5:2020

SLOVENSKI STANDARD oSIST prEN ISO 19650-5:2019 01-september-2019

Organizacija in digitalizacija informacij v gradbeništvu - Upravljanje informacij z

Organization and digitization of information about buildings and civil engineering works,

including building information modelling (BIM) - Information management using building

information modelling - Part 5: security-minded approach to information management

Spezifikation für Sicherheitsbelange von BIM, der digitalisierten Bauwerke und smarten

Organisation des informations concernant les ouvrages de construction -- Gestion de

l'information par la modélisation des informations de la construction (ISO/DIS 19650-

2003-01.Slovenski inštitut za standardizacijo. Razmnoževanje celote ali delov tega standarda ni dovoljeno.

All rights reserved. Unless otherwise specified, or required in the context of its implementation, no part of this publication may

be reproduced or utilized otherwise in any form or by any means, electronic or mechanical, including photocopying, or posting

on the internet or an intranet, without prior written permission. Permission can be requested from either ISO at the address

Foreword ..........................................................................................................................................................................................................................................v

Introduction ................................................................................................................................................................................................................................vi

1 Scope ................................................................................................................................................................................................................................. 1

2 Normative references ...................................................................................................................................................................................... 1

3 Terms and definitions ..................................................................................................................................................................................... 1

4 Establish the need for a security-minded approach using a sensitivity assessment

process ............................................................................................................................................................................................................................ 3

4.1 Understand the range of security risks .............................................................................................................................. 3

4.2 Identify organizational sensitivities ..................................................................................................................................... 4

4.3 Establish any third-party sensitivities ................................................................................................................................ 4

4.4 Record the outcome of the sensitivity assessment .................................................................................................. 5

4.5 Periodically review the sensitivity assessment .......................................................................................................... 5

4.6 Determine whether a security-minded approach is required ....................................................................... 5

4.7 The organization(s) shall record the outcome of the application of the security

triage process for each initiative, project, asset, product or service to which it

approach beyond protection of sensitive commercial and personal information. ...................... 6

4.8 Security-minded approach required .................................................................................................................................... 6

4.9 No security-minded approach required ............................................................................................................................ 7

5 Developing the security-minded approach .............................................................................................................................. 7

minded approach .................................................................................................................................................................................. 7

5.2 Commencing the development of the security-minded approach ............................................................. 8

6 Developing a security strategy ............................................................................................................................................................... 9

6.1 General ........................................................................................................................................................................................................... 9

6.2 Assess the security risk s ................................................................................................................................................................. 9

6.3 Develop security risk mitigation measures .................................................................................................................10

6.4 Document residual and tolerated security risks .....................................................................................................10

6.5 R eview of the security strategy .............................................................................................................................................11

7 Developing a security management plan .................................................................................................................................11

7.1 General ........................................................................................................................................................................................................11

7.2 Requirements relating to the provision of information to third parties ............................................12

7.3 Logistical security requirements ..........................................................................................................................................12

7.4 Managing accountability and responsibility for security ................................................................................13

7.5 Monit oring and auditing ..............................................................................................................................................................13

7.6 R eview of the security management plan ....................................................................................................................13

8 Developing a security breach/incident management plan ...................................................................................14

8.1 General ........................................................................................................................................................................................................14

8.2 Discovery of a security breach or incident ..................................................................................................................14

8.3 Containment and recovery ........................................................................................................................................................14

8.4 R eview following a security breach or incident ......................................................................................................15

8.5 R eview of the security breach/incident management plan ..........................................................................15

9 Working with appointed parties .......................................................................................................................................................15

9.1 Working outside formal appointments ...........................................................................................................................15

9.2 Measures contained in the appointment documentation ...............................................................................16

9.3 Post appointment award .............................................................................................................................................................16

9.4 End of appointment .........................................................................................................................................................................17

10 Compliance with other legislation and standards ..........................................................................................................17

Annex A (informative) Information on the security context.....................................................................................................18

Annex B (informative) Information on types of personnel, physical, and technical security

controls and management of information security .........................................................................................................20

Annex C (informative) Assessments relating to the provision of information to third parties ................24

Annex D (informative) Information sharing agreements .............................................................................................................26

Bibliography .............................................................................................................................................................................................................................28

ISO (the International Organization for Standardization) is a worldwide federation of national standards

bodies (ISO member bodies). The work of preparing International Standards is normally carried out

through ISO technical committees. Each member body interested in a subject for which a technical

committee has been established has the right to be represented on that committee. International

organizations, governmental and non-governmental, in liaison with ISO, also take part in the work.

ISO collaborates closely with the International Electrotechnical Commission (IEC) on all matters of

The procedures used to develop this document and those intended for its further maintenance are

described in the ISO/IEC Directives, Part 1. In particular the different approval criteria needed for the

different types of ISO documents should be noted. This document was drafted in accordance with the

editorial rules of the ISO/IEC Directives, Part 2 (see www .iso .org/directives).

Attention is drawn to the possibility that some of the elements of this document may be the subject of

patent rights. ISO shall not be held responsible for identifying any or all such patent rights. Details of

any patent rights identified during the development of the document will be in the Introduction and/or

Any trade name used in this document is information given for the convenience of users and does not

For an explanation on the voluntary nature of standards, the meaning of ISO specific terms and

expressions related to conformity assessment, as well as information about ISO's adherence to the

World Trade Organization (WTO) principles in the Technical Barriers to Trade (TBT) see the following

This document was prepared by Technical Committee ISO/TC 59, Buildings and civil engineering works,

Subcommittee SC 13, Organization and digitization of information about buildings and civil engineering

A list of all parts in the ISO 19650- series, published under the general title Organization and digitization

of information about buildings and civil engineering works, including building information modelling (BIM),

The built environment is experiencing a period of rapid evolution. It is anticipated that the adoption

of digital engineering, including building information modelling (BIM), and the increasing use of

digital technologies in the design, construction, manufacture, operation and management of assets or

products, as well as the provision of services, within the built environment will have a transformative

effect on the parties involved. It is likely that in order to increase effectivity and efficiency, initiatives

or projects that are developing new assets or solutions, or modifying or managing existing ones, must

become much more collaborative in nature to increase effectivity and efficiency. Such collaboration

requires more transparent, open ways of working, and, as much as possible, the appropriate sharing

Digital built environments will need to deliver future fiscal, financial, functional, sustainability and

growth objectives. This is likely to have an impact on procurement, delivery and operational processes

including far greater cross-discipline and sector collaboration, significantly increasing the availability

The use of computer-based technologies is already supporting new ways of working, such as the

development of off-site, factory-based fabrication and on-site automation. Sophisticated cyber-physical

systems, by using sensors (the cyber or computation element) to control or influence physical parts

of the system, are able to work in real-time to influence outcomes in the real world. It is anticipated

that such systems will be used to achieve benefits such as increases in energy efficiency and better

asset lifecycle management by capturing real-time information about asset use and condition. They

can already be found in transportation, utilities, infrastructure, buildings, manufacturing, health care

and defence, and when able to interact as integrated cyber-physical environments, could be used in the

As a consequence of this increasing use of, and dependence on, information and communications

technologies there is a need to address inherent vulnerability issues, and therefore the security

implications that arise, whether for built environments, assets, products, services, individuals or

This standard provides a framework to assist organizations in understanding the key vulnerability

issues and the nature of the controls required to manage the resultant security risks to a level that

is tolerable to the relevant parties. Its purpose is not in any way to undermine collaboration or the

benefits that digital engineering techniques such as BIM, other collaborative work methods and digital

While information security requirements for an individual organization are set out in ISO/

IEC 27001, digital engineering generally involves the sharing of information between a broad range

of organizations. ISO/IEC 27001 therefore cannot be applied to these organizations as a whole. This

standard encourages the adoption of a security-minded, risk-based approach that can be applied across,

as well as within organizations. The appropriate and proportionate nature of the approach also has the

benefit that measures should not prohibit the involvement of small and medium-sized enterprises in

The security-minded approach can be applied throughout the lifecycle of an initiative, project, asset,

product or service, whether planned or existing, where sensitive information is obtained, created,

Figure 1 shows the integration of this security-minded approach with other organizational strategies,

policies, plans and information requirements for the digitally-enabled delivery, maintenance and

Implementation of the measures outlined in this standard will assist in reducing the risk of the loss,

misuse or modification of sensitive information that could impact on the safety, security and resilience

of assets, products, the built environment, or the services provided by, from or through them. It will

also assist in protecting against the loss, theft or disclosure of commercial information, personal

information and intellectual property. Any such incidents can lead to significant reputational damage,

impacting through lost opportunities and the diversion of resources to handle investigation, resolution

and media activities, in addition to the disruption of, and delay to, day-to-day operational activities.

Further, where incidents do occur and information has been made publicly available, it is virtually

impossible to recover all of that information or to prevent ongoing distribution.

D Activities undertaken during the operational phase of assets (see also ISO 19650-3)

E Activities undertaken during the delivery phase of the asset (see also ISO 19650-2)

Figure 1 — The integration of the security-minded approach within the wider BIM process

This standard specifies the principles and requirements for security-minded information management

at a stage of maturity described as “building information modelling (BIM) according to the ISO 19650-

series”, as well as the security-minded management of sensitive information that is obtained, created,

processed and stored as part of, or in relation to, any other initiative, project, asset, product or service.

It addresses the steps required to create and cultivate an appropriate and proportionate security

mindset and culture across organizations with access to that information, including the need to monitor

The approach outlined is applicable throughout the lifecycle of an initiative, project, asset, product or

service, whether planned or existing, where sensitive information is obtained, created, processed and/

This standard is intended for use by any organization who is involved in the use of digital engineering

and related technologies in the creation, design, construction, manufacture, operation, management,

modification, improvement, demolition and/or recycling of assets or products, as well as the provision

of services, within the built environment. It will also be of interest and relevance to those organizations

who wish to protect their commercial information, personal information and intellectual property.

The following documents are referred to in the text in such a way that some or all of their content

constitutes requirements of this document. For dated references, only the edition cited applies. For

undated references, the latest edition of the referenced document (including any amendments) applies.

ISO 19650-1:2018, Organization and digitization of information about buildings and civil engineering

works, including building information modelling (BIM) — Information management using building

ISO 19650-2:2018, Organization and digitization of information about buildings and civil engineering

works, including building information modelling (BIM) — Information management using building

ISO 19650-3:2019, Organization of information about construction works — Information management

ISO and IEC maintain terminological databases for use in standardization at the following addresses:

Item, thing or entity that has potential or actual value to an organization[SOURCE: ISO 55000:2014].

Note 1 to entry: An asset can be fixed, mobile or movable. It can be an individual item of plant, a vehicle, a system

of connected equipment, a space within a structure, a piece of land, an entire piece of infrastructure, an entire

building, or a portfolio of assets including associated land or water. It can also comprise information in digital or

Note 2 to entry: The value of an asset can vary throughout its life and an asset can still have value at the end of its

location or environment to which members of the public have access that can be considered more at

risk from a terrorist attack by virtue of its crowd density or the nature of the site

Note 1 to entry: Crowded places can include: sports stadia, arenas, festivals and music venues; hotels and

restaurants; pubs, clubs, bars and casinos; high streets, shopping centres and markets; visitor attractions;

cinemas and theatres; schools and universities; hospitals and places of worship; commercial centres; and

transport hubs. They can also include events and public realm spaces such as parks and squares.

Note 2 to entry: A crowded place will not necessarily be crowded at all times – crowd densities can vary and can

legitimate requirement of a prospective recipient of information to know, to access, or to possess any

the state of relative freedom from threat or harm caused by random, unintentional acts or events

the state of relative freedom from threat or harm caused by deliberate, unwanted, hostile or

the understanding and routine application of appropriate and proportionate security measures in any

business situation so as to deter and/or disrupt hostile, malicious, fraudulent and criminal behaviours

information, the loss, misuse or modification of which, or unauthorized access to, could:

— adversely affect the privacy, welfare or safety of an individual or individuals;

person or group of people who directs and controls an organization at the highest level

Note 1 to entry: Top management has the power to delegate authority and provide resources within the

Note 2 to entry: In the context of this standard, management should be regarded as the function, not the activity

4.1.1 The top management of an organization creating, managing, operating, disposing or re-

purposing an initiative, project, asset, product or service shall determine the range of security risks that

arise through greater availability of information, integration of services and systems, and the increased

NOTE Information on the types of security risks that should be considered are contained in Annex A.

a) initiating a project to develop a new asset(s), product(s) or service(s) or modify/enhance an

the top management of those organizations shall determine the range of security risks that arise

through greater availability of information, integration of services and systems, and the increased

NOTE 1 Such an arrangement of multiple organizations can occur in a city/community, a large, multi-purpose

NOTE 2 Information on the types of security risks that should be considered are contained in Annex A.