Chapter 5 recap

Beyond delivery

The key takeaways from this chapter’s 4 lessons.

Security-minded information management

ISO 19650-5 starts with a sensitivity assessment by the appointing party: could information about this asset, its users or its contents be used to cause harm or loss?
If yes, it sets a security strategy and management plan, puts security requirements into every appointment and limits access to need-to-know.
The risk often comes from aggregation (many harmless pieces together) and from publishing: planning portals, marketing images, social media, drone photos.
A breach plan says what to do when sensitive information leaks; test it once before it is needed.

In operation, the owner or operator is the appointing party; its requirements (OIR, then AIR) define the asset information model (AIM).
Trigger events, planned or not, start information work: a repair, a replacement, an inspection, an alteration, a disposal.
Each operational appointment carries the relevant part of the AIR and an asset information protocol, and its information is checked and accepted into the AIM.
At handover, the project information model is checked and accepted into the AIM; that's the start of the operational phase, not the end of the project.

Write safety information into the requirements like any deliverable: what, by whom, in what form, at which milestone.
Designers' significant and residual risks are linked to the elements they concern, so they travel with the model to the contractor and the operator.
The health and safety file is planned as containers and asset data from the start, and checked at each milestone, not compiled at practical completion.
Some safety information is also security-sensitive; agree where the two meet.

Soft landings involve the end users and operators from briefing to the first years of use (in the UK: BS 8536 and Government Soft Landings).
The operator's needs go into the OIR and AIR early, so the information delivered is what they will use.
Handover is prepared and rehearsed: test data loads, training on the real systems, readiness reviews before completion.
Aftercare is planned as information too: what is measured (energy, comfort, faults), by whom, how often, and where the results are kept.