Explore how ISO 19650-5 introduces a security-minded approach to BIM, helping organizations protect sensitive information, manage risks, and secure information across the asset lifecycle.
The Architecture, Engineering, Construction, and Operations (AECO) industry is becoming increasingly digital.
Building Information Modelling (BIM), Common Data Environments (CDEs), cloud collaboration, digital twins, Internet of Things (IoT) devices, automation, connected assets, and increasingly sophisticated information models have fundamentally changed how projects and built assets are designed, delivered, operated, and maintained.
This digital transformation creates enormous opportunities.
It also creates a less glamorous companion: information risk.
A detailed BIM model can contain far more than geometry. It may reveal the configuration of an asset, locations of critical equipment, access arrangements, security systems, infrastructure connections, operational patterns, spaces, systems, asset data, and relationships between components.
Information that is extremely useful to a project team can also become sensitive when accessed, combined, interpreted, or manipulated by the wrong party.
This is where ISO 19650-5:2020 — Organization and digitization of information about buildings and civil engineering works, including building information modelling (BIM) — Information management using building information modelling — Part 5: Security-minded approach to information management becomes important.
Rather than treating security as something belonging exclusively to the IT department, ISO 19650-5 introduces a security-minded approach to information management throughout the lifecycle of projects, assets, products, and services.
“ISO 19650-5 brings security-minded thinking into BIM and information management.”
ISO 19650-5 is part of the wider ISO 19650 series for information management using BIM.
Its focus is the security-minded management of sensitive information.
The standard recognizes a basic reality of modern construction: organizations increasingly depend on interconnected digital information, technologies, systems, and collaborative workflows.
A project may involve the client, consultants, contractors, specialist subcontractors, manufacturers, operators, facility managers, technology providers, and numerous other stakeholders. Information can therefore travel across organizational boundaries throughout the project and asset lifecycle.
ISO 19650-5 provides a framework for understanding the vulnerabilities created by this environment and establishing appropriate and proportionate controls to manage the resulting security risks.
Importantly, its purpose is not to prevent collaboration.
Locking every BIM model in a digital dungeon and giving one mysterious administrator the key would certainly restrict information risk—but it would also make BIM rather useless.
The goal is therefore proportionate security: protecting what genuinely requires protection while allowing appropriate information to remain available to the people who legitimately need it.
ISO 19650-5 describes being security-minded as understanding and routinely applying appropriate and proportionate security measures in business situations to deter or disrupt hostile, malicious, fraudulent, or criminal activities.
The important words are appropriate and proportionate.
Not every project, asset, system, or information container carries the same security implications.
A BIM model containing highly sensitive information about a major transportation hub, government facility, utility network, stadium, healthcare facility, or critical infrastructure asset should not necessarily be treated in the same way as publicly available marketing information about a conventional development.
The security approach therefore begins by understanding what needs protection, why it needs protection, what threats exist, which vulnerabilities could be exploited, and what the consequences could be.
“A security-minded approach connects threats and vulnerabilities with proportionate risk mitigation.”
One of the foundational concepts within ISO 19650-5 is determining whether an initiative, project, asset, product, service, or associated information should be considered sensitive.
Certain built assets naturally require greater consideration.
These may include critical national infrastructure, defence or law-enforcement facilities, diplomatic assets, commercially sensitive facilities, locations containing valuable materials, nationally significant landmarks, crowded places, or assets hosting events of security significance.
But sensitivity is not restricted to secret government buildings with suspiciously thick concrete walls.
An asset, product, or service may also be sensitive when compromising it could significantly affect its integrity, safety, security, resilience, or ability to function.
The potential impact on individuals, communities, privacy, commercial information, intellectual property, and third-party information also matters.
Where uncertainty exists, ISO 19650-5 recommends seeking competent security advice.
The outcome of the sensitivity assessment should then be recorded—even when the assessment concludes that no sensitivity has been identified.
ISO 19650-5 introduces a security triage process to help organizations determine whether the formal security-minded approach described by the standard is required.
This prevents organizations from applying heavyweight security processes indiscriminately.
Where an initiative, project, asset, product, or service is identified as sensitive—or where sensitive third-party information will be held—the organization should develop and implement an appropriate and proportionate security-minded approach.
Where sensitivity is not identified, organizations should still consider whether applying security-minded principles creates business benefits.
Baseline controls may remain necessary for personal information, commercial information, cybersecurity, fraud prevention, contractual obligations, and regulatory compliance.
In other words, “not sensitive” does not mean “security has left the building.”
“Security triage helps determine the level of security-minded management required.”
Security cannot survive on vague statements such as “everyone is responsible.”
Everyone may contribute to security, but accountability still needs a name attached to it.
ISO 19650-5 requires appropriate governance, accountability, and responsibility arrangements.
Top management plays an important role in defining accountability for the security-minded approach. Where several organizations collaborate, formal governance mechanisms should establish leadership, responsibilities, accountabilities, and organizational relationships.
Responsible individuals may need to provide a holistic understanding of security threats and vulnerabilities, guide risk management, develop security strategies, support security management plans, embed requirements into procurement and appointment documentation, promote a security-minded culture, brief third parties, and support monitoring, auditing, and testing.
Specific tasks may be delegated—for example, personnel security to HR, cybersecurity to IT, or physical security to asset or facilities management—but overall responsibility still needs to remain clear.
Once a security-minded approach is required, the organization develops a security strategy.
The strategy connects the sensitivity assessment with practical risk management.
It should consider threats, vulnerabilities, potential harm, likelihood, mitigation measures, tolerated risks, residual risks, governance arrangements, and mechanisms for future review.
The assessment needs to recognize that security threats can originate from multiple directions.
Threat actors could include criminals, hackers, malicious insiders, commercial espionage actors, activists, or other hostile parties.
Vulnerabilities may be physical, technological, procedural, organizational, or human.
This is particularly important because information security is not purely a software problem.
A technically secure CDE can still be undermined by weak access controls, careless information sharing, poor staff awareness, inappropriate permissions, compromised devices, or badly managed organizational processes.
The human being remains a remarkably creative cybersecurity variable.
“The security strategy establishes how security risks will be assessed, mitigated, tolerated, and reviewed.”
The strategy establishes direction. The security management plan turns that direction into operational controls.
ISO 19650-5 expects the plan to enable agreed mitigation measures to be implemented consistently and holistically.
It can address security policies, processes, security information requirements, responsibilities, third-party information sharing, logistical security, monitoring, auditing, security breach management, and mechanisms for reviewing and updating the plan.
The security management plan also becomes important when developing procurement and appointment requirements.
This creates an important connection between information security and project delivery.
Security is no longer merely an internal corporate policy sitting somewhere on a server gathering digital dust. Relevant requirements become part of how consultants, contractors, suppliers, and other appointed parties are selected and managed.
One particularly valuable concept in ISO 19650-5 is that information security should be considered throughout the information lifecycle.
That lifecycle includes:
Capture → Acquisition → Maintenance → Synthesis → Usage → Archival → Publication → Purging
Information therefore needs protection beyond its original creation.
Consider a BIM dataset.
It may initially be captured from surveys, developed within authoring tools, enriched with asset information, federated with other models, exchanged through a CDE, used for construction, archived for operational purposes, partially published, and eventually removed when retention requirements expire.
Security considerations can change at every stage.
This lifecycle perspective is especially relevant to BIM because project information rarely sits politely in one software application. It moves, transforms, combines, multiplies, and occasionally develops a mysterious collection of filenames ending in “FINAL_FINAL_REV3.”
“Security requirements should follow information throughout its entire lifecycle.”
One of the more sophisticated ideas within ISO 19650-5 concerns aggregation risk.
Individual pieces of information may appear harmless when viewed separately.
When combined, however, they may reveal something sensitive.
For example, several datasets could collectively expose asset configurations, infrastructure relationships, operational routines, access patterns, system dependencies, or information about individuals.
Aggregation can occur through accumulation—where the volume of information increases the potential impact of compromise—or through association, where different datasets become more sensitive when connected.
This matters enormously in BIM.
Federated models, GIS platforms, asset databases, digital twins, IoT systems, CDEs, and integrated asset-management environments are designed precisely to connect information.
Integration creates value, but integration can also create new security implications.
ISO 19650-5 also considers technological security.
Organizations should consider cybersecurity controls for systems capturing, processing, and storing sensitive information, including vulnerability assessment and penetration testing where appropriate.
Other considerations include system interconnections, systems controlling physical assets, interoperability, resilience, configuration management, change control, secure disposal, access removal, and long-term information retention.
Systems handling sensitive information should, wherever possible, be secure by default.
The standard also highlights characteristics organizations should consider when assessing software systems, including confidentiality, availability, safety, resilience, possession, authenticity, utility, and integrity.
These concepts become increasingly significant as BIM connects with IoT devices, digital twins, smart buildings, automation, and cyber-physical systems.
Before implementing IoT or other distributed technologies, organizations should understand the proposed security architecture, assess whether it meets organizational requirements, evaluate security risks against risk appetite, and implement proportionate mitigation measures.
“Connected assets expand both digital capability and the security landscape.”
Construction projects depend on information exchange, so ISO 19650-5 pays considerable attention to third-party sharing.
Before sensitive information is shared, organizations should assess who needs access, why the information is required, whether sharing is proportionate, whether there is legal authority to share it, and whether the receiving party can manage it appropriately.
For work occurring outside formal appointments—such as tendering—information sharing agreements may be necessary before sensitive information is released.
These agreements can establish the purpose of sharing, recipients, information quality, permitted uses, protection requirements, security obligations, retention, purging, auditing, and breach-notification procedures.
If a security breach occurs or information is being handled contrary to the agreement, sharing may need to be suspended while the issue is investigated and mitigated. If the problem cannot be satisfactorily resolved, the agreement and information sharing may need to be terminated.
This is a powerful reminder that BIM collaboration should never mean uncontrolled information distribution.
Even well-designed controls cannot guarantee that incidents will never happen.
ISO 19650-5 therefore requires organizations adopting the approach to consider a security breach/incident management plan.
The plan should establish how breaches or incidents are discovered, reported, contained, investigated, and recovered from.
Organizations should determine who must be contacted, how affected parties are identified and notified, how regulators or third parties are handled, and what business-continuity and recovery measures are required.
A particularly important requirement concerns forensic evidence.
Where evidence may be required for law-enforcement purposes, physical and digital evidence should generally be preserved before recovery actions are undertaken, unless immediate action is critical to life.
Why?
Because enthusiastic recovery efforts can accidentally modify, contaminate, or destroy the very digital evidence needed to understand what happened.
After containment and recovery, organizations should assess ongoing risk, identify root causes, consider countermeasures, evaluate residual and newly created risks, and update relevant policies and processes.
For construction professionals, ISO 19650-5 changes the conversation from:
“Can this person access the information?”
to:
“Does this person need this information, what could happen if it is compromised, and what controls are proportionate to that risk?”
That distinction matters.
Modern construction projects generate huge volumes of structured and unstructured information. BIM models, drawings, schedules, specifications, asset registers, photographs, point clouds, surveys, technical reports, CDE records, IoT data, operational information, and digital twins can collectively describe an asset with extraordinary precision.
ISO 19650-5 helps organizations manage that information without destroying the collaborative benefits BIM was created to deliver.
It encourages teams to think systematically about sensitivity, threats, vulnerabilities, risk appetite, mitigation, access, information sharing, appointments, technology, personnel, physical security, incidents, and lifecycle management.
“Security-minded information management extends across the entire project delivery ecosystem.”
ISO 19650-5 is not simply a cybersecurity standard wearing a BIM hard hat.
Its scope is broader.
It recognizes that security in the digital built environment emerges from the interaction between people, processes, physical environments, technology, organizations, and information.
As BIM develops toward connected digital twins, smart infrastructure, IoT-enabled assets, automation, AI-assisted information management, and increasingly integrated project ecosystems, that perspective becomes even more relevant.
The fundamental lesson is straightforward:
More information creates more capability—but capability without appropriate control can create vulnerability.
The goal is therefore not to share less information simply because information carries risk. Nor is it to protect everything with the same level of security.
The goal is to understand what is sensitive, why it is sensitive, who genuinely needs it, what could go wrong, and what proportionate controls are required throughout its lifecycle.
That is the heart of the security-minded approach to information management established by ISO 19650-5:2020.
And in an industry rapidly moving from drawings and documents toward interconnected digital representations of real-world assets, that mindset is becoming less of a specialist concern and more of a core BIM and information management competency.
Link copied
Rate this post
Please log in to rate and comment. Login
Please log in to rate and comment. Login
No courses found.
0 Comments
No comments yet.