ISO 19650-5:2020
Organization and digitization of information about buildings and civil engineering works, including building information modelling (BIM) — Information management using building information modelling — Part 5: Security-minded approach to information manage
This document specifies the principles and requirements for security-minded information management at a stage of maturity described as "building information modelling (BIM) according to the ISO 19650 series", and as defined in ISO 19650-1, as well as the security-minded management of sensitive information that is obtained, created, processed and stored as part of, or in relation to, any other initiative, project, asset, product or service.
It addresses the steps required to create and cultivate an appropriate and proportionate security mindset and culture across organizations with access to sensitive information, including the need to monitor and audit compliance.
The approach outlined is applicable throughout the lifecycle of an initiative, project, asset, product or service, whether planned or existing, where sensitive information is obtained, created, processed and/or stored.
This document is intended for use by any organization involved in the use of information management and technologies in the creation, design, construction, manufacture, operation, management, modification, improvement, demolition and/or recycling of assets or products, as well as the provision of services, within the built environment. It will also be of interest and relevance to those organizations wishing to protect their commercial information, personal information and intellectual property.
| Get this standard | Prices exclude GST | |
|---|---|---|
| PDF ( Single user document) |
$301.00 NZD
|
|
| HardCopy |
$346.00 NZD
|
|
| Networkable PDF |
Price varies
|
Foreword
Introduction
1 Scope
2 Normative references
3 Terms and definitions
4 Establishing the need for a security-minded approach using a sensitivity assessment process
4.1 Undertaking a sensitivity assessment process
4.2 Understanding the range of security risks
4.3 Identifying organizational sensitivities
4.4 Establishing any third-party sensitivities
4.5 Recording the outcome of the sensitivity assessment
4.6 Reviewing the sensitivity assessment
4.7 Determining whether a security-minded approach is required
4.8 Recording the outcome of the application of the security triage process
4.9 Security-minded approach required
4.10 No security-minded approach required
5 Initiating the security-minded approach
5.1 Establishing governance, accountability and responsibility for the security-minded approach
5.2 Commencing the development of the security-minded approach
6 Developing a security strategy
6.1 General
6.2 Assessing the security risks
6.3 Developing security risk mitigation measures
6.4 Documenting residual and tolerated security risks
6.5 Review of the security strategy
7 Developing a security management plan
7.1 General
7.2 Provision of information to third parties
7.3 Logistical security
7.4 Managing accountability and responsibility for security
7.5 Monitoring and auditing
7.6 Review of the security management plan
8 Developing a security breach/incident management plan
8.1 General
8.2 Discovery of a security breach or incident
8.3 Containment and recovery
8.4 Review following a security breach or incident
9 Working with appointed parties
9.1 Working outside formal appointments
9.2 Measures contained in appointment documentation
9.3 Post appointment award
9.4 End of appointment
Annex A (informative) Information on the security context
Annex B (informative) Information on types of personnel, physical, and technical security controls and management of information security
Annex C (informative) Assessments relating to the provision of information to third parties
Annex D (informative) Information sharing agreements
Bibliography
Keep me up-to-date
Sign up to receive updates when there are changes to this standard
Related Information
Similar Standards
-
BIP 2197
The essential guide to Eurocodes transition
-
BIP 2207:2010
Building information management, A standard framework and guide to BS 1192
-
BS 6100-0:2010
Building and civil engineering. Vocabulary, Introduction and index
-
BS 6100-3:2007
Building and civil engineering. Vocabulary, Civil engineering. General
Foreword
Introduction
1 Scope
2 Normative references
3 Terms and definitions
4 Establishing the need for a security-minded approach using a sensitivity assessment process
4.1 Undertaking a sensitivity assessment process
4.2 Understanding the range of security risks
4.3 Identifying organizational sensitivities
4.4 Establishing any third-party sensitivities
4.5 Recording the outcome of the sensitivity assessment
4.6 Reviewing the sensitivity assessment
4.7 Determining whether a security-minded approach is required
4.8 Recording the outcome of the application of the security triage process
4.9 Security-minded approach required
4.10 No security-minded approach required
5 Initiating the security-minded approach
5.1 Establishing governance, accountability and responsibility for the security-minded approach
5.2 Commencing the development of the security-minded approach
6 Developing a security strategy
6.1 General
6.2 Assessing the security risks
6.3 Developing security risk mitigation measures
6.4 Documenting residual and tolerated security risks
6.5 Review of the security strategy
7 Developing a security management plan
7.1 General
7.2 Provision of information to third parties
7.3 Logistical security
7.4 Managing accountability and responsibility for security
7.5 Monitoring and auditing
7.6 Review of the security management plan
8 Developing a security breach/incident management plan
8.1 General
8.2 Discovery of a security breach or incident
8.3 Containment and recovery
8.4 Review following a security breach or incident
9 Working with appointed parties
9.1 Working outside formal appointments
9.2 Measures contained in appointment documentation
9.3 Post appointment award
9.4 End of appointment
Annex A (informative) Information on the security context
Annex B (informative) Information on types of personnel, physical, and technical security controls and management of information security
Annex C (informative) Assessments relating to the provision of information to third parties
Annex D (informative) Information sharing agreements
Bibliography