Security management plan – ISO 19650-5 in practice (part 2)

The security triage, which closed the first part of this guide, answers the question of whether to protect our assets and information, and to what extent. This part deals with who is to do it, in which document the arrangements are recorded, and how to enforce them on suppliers of products and services. In other words, with the content of clauses 5–9 and annexes B, C and D of ISO 19650-5. 

An attacker always prepares for an attack. It starts with gathering information, and the task is naturally easier when an organisation does not itself know who has been given access to information about the asset, or for how long. In the current situation on the eastern border of the EU, where industrial plants, transport hubs and technical infrastructure are becoming targets, a gap like that can be costly. It may turn out to be very costly indeed. 

Accountability stays, responsibility can be delegated 

Clause 5 draws a distinction between two kinds of responsibility. Top management appoints a person accountable for implementing the approach, and that accountability cannot be transferred. It can, however, appoint one or more people responsible for day-to-day tasks. Specific duties may be delegated further: personnel security to HR, cyber security to the IT manager, physical security to the facility manager, and so on. The security lead is a function rather than a job title – in smaller organisations it is held by someone who also has other duties. 

Three security documents 

Clauses 6–8 describe the documentation, with each document answering a different question. 

The security strategy answers “why and what”: a record of the security triage outcomes, the arrangements for roles, the assessment of security risks, the possible and the selected mitigation measures, a summary of tolerated and residual risks, and the review mechanisms. It is approved by top management. There is a certain paradox here: the strategy is itself sensitive information, because it describes the organisation’s weak points, so access to parts of its content is managed on a need-to-know basis. 

The security management plan answers the question “how”: policies, processes, security information requirements, rules for sharing information with third parties, logistics security requirements, the allocation of roles, monitoring and audit requirements, and review mechanisms. 

The security breach and incident management plan forms part of the main plan. It sets out what events may occur and what they could mean for the organisation, who to contact immediately after detection, how to notify the parties affected, how to limit the damage and restore normal operation, and what to examine in the post-incident review. It also covers near misses. 

When it comes to recovery – returning to the state that existed before the breach – one rule is easy to forget in the rush: if evidence is needed for law enforcement, it is secured before recovery begins. Recovery can destroy or contaminate digital forensic material. The only exception is action necessary to protect life. 

The supply chain 

Clause 9 passes the requirements on to suppliers as early as the tender stage. Information reaches many parties at that point, most of which will not be selected, which is why an information sharing agreement is put in place before anything is released – one that also sets out how the data is to be stored, deleted and destroyed once the procedure is over. 

Here is an example from our own back yard. Bidding once as a potential subcontractor, we were given access to the complete technical documentation of a hospital – with no protective measures, no confidentiality agreement, and no question about who on our side would receive that access. Nor did anyone later ask for the files to be deleted. It would be hard to find a better illustration of what clause 9 is meant to prevent: information about a built asset ended up with an organisation that did not win the procedure and had no obligation whatsoever to handle it in any particular way. Fortunately, we had no bad intentions. 

The appointment documentation should include provisions supporting the policies from the security management plan, together with the actions that apply after the work is completed. The requirements cascade down through further tiers of sub-appointments, and the appointing party retains the right to review security measures at each of those tiers. The phase closes with demobilisation – the return, secure storage, deletion or destruction of information, together with verification that the procedures were in fact carried out. 

Annex D sets out recommendations for an information sharing agreement: the purpose of sharing, the recipients and the circumstances of access, the type and quality of the information, permitted and prohibited use, user management, retention and permanent erasure, the duty to notify a breach, and sanctions. An agreement of this kind makes it possible to extend the provisions of the security management plan to parties with whom we have no formal appointment. 

Summary 

ISO 19650-5 gives guidance on the successive steps to take in order to improve the security of our assets and of the information about them. First we establish what is sensitive and to what extent. Then we appoint the person accountable and describe the approach in the strategy. Next we turn the strategy into policies and processes. We add a scenario for a breach and carry the whole thing through into contracts with suppliers – from the tender all the way to withdrawing access once the work is done. 

We keep our fingers crossed that you never have to respond to any of these threats. To sleep more soundly, though, share information wisely and stay safe! 

This article is part of the ISO 19650 Guide series, produced under the patronage of BSI (British Standards Institution), which sheds light on the importance of standardisation in line with the ISO 19650 series. Want to know more about BIM and ISO 19650? Follow our blog or sign up for training. 

Source: ISO 19650-5:2020.