A security-minded approach – ISO 19650-5 in practice (part 1) 

We live in interesting times. For several years now the eastern border of the European Union has been the scene of activity kept below the threshold of open conflict: sabotage of railway and energy infrastructure, damage to cables and pipelines on the Baltic seabed, arson attacks on retail premises and warehouses, drones over airports and industrial plants, and the recruitment of ordinary people to carry out single tasks. In parallel there is pressure online – hospitals, water utilities, local authorities and energy companies report incidents on a regular basis, from ransomware to attempts to reach control systems. What all of this has in common is reconnaissance: before anyone targets a physical asset, they have to gather information about it. That information is created during design and operation, and it lives in the CDE and in other information management systems. 

The first four parts of the ISO 19650 series describe how to manage information: what concepts to use, how to run the process of producing information models, and how to exchange information between parties. Part 5 answers a different question – how to protect assets and information. What is being protected here is, in equal measure, sensitive information and the safety, security and resilience of the assets, products and services themselves, together with the people who use them. 

The two objects of protection are linked in both directions. Information about a built asset – design documentation and models, operational and maintenance data, or sensor readings from a BMS – can be a route of access to the asset itself. It reveals weak points in security, system configuration, and patterns of use of the asset and of the behaviour of its users. Information therefore makes it possible to identify the moment when an asset is least closely watched. 

The relationship also works the other way round: physical access to a building or a construction site gives access to computers, IT infrastructure and documents, and with them to information that may be valuable. This is why the standard requires security measures to be considered as a whole, covering personnel, physical security, technology and information management. 

Key concepts: security is not the same as safety 

The standard separates two concepts that sound similar in everyday use. Security (3.7) is the state of relative freedom from threat or harm caused by deliberate, unwanted, hostile or malicious acts. Safety (3.6) concerns accidental and unintended events. Part 5 deals only with deliberate acts – theft, sabotage, economic espionage, hostile reconnaissance. It is also not to be confused with a standard about health and safety on the construction site. 

The second organising concept is sensitive information (3.11): information whose loss, misuse, modification or unauthorised access may harm the privacy, safety or security of individuals, infringe intellectual property or trade secrets, cause commercial or economic damage, or threaten the security and affairs of a state. The definition is broad, and it is what triggers the rest of the document – without identified sensitive information, the remaining clauses do not apply. 

Two mechanisms from Annex A are also worth noting. The first is hostile reconnaissance: a hostile party looks for information about physical vulnerabilities, system configuration, ways of working and behavioural patterns, before the organisation has had time to introduce preventive measures. The second is aggregation, that is the growth in risk as more information is held together. This applies even to information that appears harmless in isolation, because in combination it can constitute sensitive information. 

Does ISO 19650-5 apply to me at all? 

Clause 4 opens with a question that has to be answered before any process is started: is a security-minded approach needed in this particular case. The answer comes from the sensitivity assessment, followed by the security triage process – abbreviated in the standard to “ST”. 

The sensitivity assessment is a task for top management and runs in four steps: understanding the extent of the security risk, identifying the organisation’s own sensitivities, establishing third-party sensitivities, and recording the outcome. Every outcome is recorded, including one stating that no sensitivity was found (it is also worth remembering that the record itself may be sensitive information). 

The criteria for treating an asset as sensitive (4.3.2) cover national critical infrastructure, sites with defence, law enforcement, national security or diplomatic functions, commercial premises producing or storing high-value materials, money, pharmaceuticals, chemicals and gases, visitor attractions, and crowded places. 

The phrase “in whole or in part” matters here. Very often only selected elements are sensitive: particular systems, designated zones of a building, individual processes. 

For clients across the European Union, the criteria in clause 4.3.2 have stopped being an abstraction. Directive (EU) 2022/2557 on the resilience of critical entities – the CER Directive – required Member States to identify their critical entities by 17 July 2026, after adopting a national resilience strategy and a national risk assessment. Once notified of designation, an entity has around ten months before the substantive obligations begin to apply: carrying out its own risk assessment, implementing technical, security and organisational measures set out in a resilience plan, notifying disruptive incidents, and appointing a point of contact for the competent authority. Those measures span physical protection, personnel and the resilience of information systems – precisely the areas described in Annex B to ISO 19650-5. The directive also reaches into the supply chain: a designated entity has to be able to demonstrate that its suppliers meet the same standard. A design office, a main contractor and a CDE provider working for an operator of critical infrastructure therefore become part of that chain. 

The security triage itself comes down to two questions: is our asset or information sensitive, and do we have access to non-public information belonging to another organisation that is itself sensitive. The combinations produce four outcomes. ST1 covers both our own information and that of others, ST2 only our own, ST3 only that of others – which happens when our own project is not sensitive but sits next to a critical asset. ST4 means that a full approach is not required, but sensitive commercial information and personal data are always protected. The standard also recommends applying ordinary measures against fraud and cyber security incidents in every case. 

What next? 

The result of the triage answers the question of whether, and to what extent, the remaining clauses of the standard apply. In the second part of the Guide we look at what to do with that result: who is responsible for the security-minded approach, which three documents the standard describes, from which four perspectives security measures are selected, and how to pass the requirements on to tenders, contracts and the common data environment. 

This article is part of the ISO 19650 Guide series, produced under the patronage of BSI (British Standards Institution), which sheds light on the importance of standardisation in line with the ISO 19650 series. Want to know more about BIM and ISO 19650? Follow our blog or sign up for training. 

Source: ISO 19650-5:2020; Directive (EU) 2022/2557 on the resilience of critical entities (CER).