Skip to content
BIMpedia
Chapter 5 · Lesson 1 of 4Topic: ISO 19650 basics

Security-minded information management

Some assets are sensitive: information about them could help someone cause harm. ISO 19650-5 asks the appointing party to find out first, and if so, to control who sees what. Most projects need only the first question; a few need all of it.

4 min read3 quiz questions
Skip to the quiz
  • Watch out
  • What it costs
  • Experienced readers
  • Remember
  • In BIMpedia
Mayainformation manager
Even if you do this every day, watch for this: Aggregation. One drawing of a plant room is harmless; the full federated model with the security systems, the access routes and the occupancy schedule, in one shared link, is not. Assess what the information reveals together, not file by file.

BIM makes information easy to share. For most buildings that's the point. For some, such as a water treatment works, a data centre, a prison, a government building or a stadium, the same detailed information could help someone cause harm. ISO 19650-5 sets out a security-minded approach: proportionate, starting with one question.

Is a security-minded approach needed?
  1. 1
    Assess sensitivityMandatory

    Could information about this asset, its users or its contents help someone cause harm or loss?

    Output: A sensitivity assessment

    Gate: Decided: sensitive, or not
  2. 2
    Set the strategy

    Who owns security, which risks matter, what may never be shared.

    Output: Security strategy and management plan

    Gate: A named person is responsible
  3. 3
    Put it in appointmentsMandatory

    Security information requirements go into every tender and appointment.

    Output: Security requirements in the EIR and protocol

    Gate: Every appointed party has agreed to them
  4. 4
    Control and respond

    Need-to-know access in the CDE, care with publishing, and a plan for a breach.

    Output: Access rules and a breach plan

    Gate: Tested once, before it is needed

The appointing party asks these questions first; only a sensitive asset needs the full set of plans.

Start with the question

Before tender, the appointing party assesses sensitivity: could information about this asset, the people who use it or what it contains be used to cause harm, disruption or loss? Consider the asset itself, its neighbours and any services it supports. For an ordinary office the answer is often no, recorded with its reasons. That record matters too.

Basics

The approach is about need to know. Designers still share models; contractors still get drawings. What changes is who can see which parts, what may be published, and what happens if something leaks. See the Pedia entry on the security-minded approach for the parts of the standard.

If the asset is sensitive

  • A security strategy and management plan: who is responsible (often a named security lead for the asset), which risks matter, what must never be shared, and how information is classified by sensitivity.
  • Requirements in every appointment: security information requirements sit in the EIR and the information protocol, so every supplier and subcontractor is bound by them and prices them.
  • Need-to-know access in the CDE: sensitive containers in restricted areas; access granted by role and reviewed when people leave; downloads logged.
  • Care with publishing: planning applications, marketing images, case studies, recruitment posts, drone photos and site hoardings are all ways information leaves the project.
  • A breach plan: who is told, who decides, what is withdrawn or changed. Test it once, on paper, before it is needed.
Story · The open link
How it goes wrong

To save time, the lead designer shares the federated model of a new court building with every subcontractor through a single view-only link. The model includes the security systems, cell locations and the secure routes between them. A link forwarded twice ends up with a supplier nobody appointed.

How it goes right

The sensitivity assessment marked the building as sensitive. Security systems and secure routes live in a restricted container visible only to the security consultant and the security installer. Everyone else federates a version without them. Links expire, and access is reviewed monthly.

Mayainformation manager
Your turn. Give it about 15 min and work it out on your own before you open the model answer: that is where it sticks.
Exercise: Triage a water treatment works 15 min

A water company is upgrading a treatment works that supplies a city. List five pieces of project information, decide whether each is sensitive, and say how you would control it.

Key takeaways

  • ISO 19650-5 starts with a sensitivity assessment by the appointing party: could information about this asset, its users or its contents be used to cause harm or loss?
  • If yes, it sets a security strategy and management plan, puts security requirements into every appointment and limits access to need-to-know.
  • The risk often comes from aggregation (many harmless pieces together) and from publishing: planning portals, marketing images, social media, drone photos.
  • A breach plan says what to do when sensitive information leaks; test it once before it is needed.

Your notes

Related tool

Write the client’s exchange information requirements as a register and check the BEP answers each one.

Open EIR Builder →

Check yourself

3 questions · 2 right to complete
  1. 1. A hospital is being designed. Which information most needs a security-minded approach?
  2. 2. Who carries out the sensitivity assessment?
  3. 3. A contractor posts drone photos of a data centre's roof plant on social media. What should have stopped it?
0 of 3 answered
PreviousMobilisationNextThe operational phase

Discussion

Open on the forum ↗