FAQS about PAS 1192-5

To establish whether PAS 1192-5 applies to a built asset the Employer or the Asset Owner should apply the Security Triage process set out in the PAS (Clause 5). This will help determine the level of the security-minded approach required for the built asset, the associated asset information and any other asset information held pertaining to neighbouring built assets.

We have prepared a guidance document setting out questions which an organisation can ask of itself and its supply chain in order to understand what information it, or others, holds in relation to its built assets. The questions will also help in assessing the availability and accessibility of that information, and any associated potential impact on the security of the asset, its users or services. This guidance document is also available on the NPSA website.

Assuring the security of a built asset and related asset information requires a holistic approach - encompassing the aspects of people and process, as well as physical and technological security (see clause 4.3 of PAS 1192-5).

PAS 1192-5 deals specifically with the security-minded approach to building information modelling, digital built environments and smart asset management. However the policies, processes and procedures it specifies should, where appropriate, be cross-referenced to the other security management policies and plans which the employer or asset owner has in place, as well as relevant government guidance and codes of practice on wider security issues.

PAS 1192-5 is wider than Information Assurance as epitomised by international standards, e.g. ISO 27001, and the implementation of an information security management system (ISMS) to protect corporate business systems. The security-minded approach includes:

• physical and personnel security in relation to built assets, which are outside of the scope of an ISMS;
• the need to address safety risks and the long-term usability of built asset data; steps to reduce the risk of hostile reconnaissance against the built assets and the people that use them; and
• policies, processes and procedures that can function across a collaborative supply chain, rather than just within a single organisation.

• ISO 27001 sets out the information security requirements for an individual organisation.
• BIM and smart asset management, as well as future digital built environments, are inherently collaborative processes involving the sharing of large amounts of digital models, data and information between the broad range of organisations in a supply chain, from multinational companies to sole traders. In addition, requiring the application of ISO 27001 may be too onerous for many within this diverse range of enterprises, in particular SMEs and sole traders. It is recommended that the Cyber Essentials Scheme be adopted as a minimum cyber security standard (see clause 5.6 of PAS 1192-5).

The PAS is specifically aimed at Level 2 BIM, but it also provides a foundation to support the evolution of future digital built environments, for example intelligent buildings, infrastructure and Smart Cities. However it does not detail technical architectures for their implementation. In addition, although the processes contained within it may be applicable to other data management systems, this PAS does not specifically address issues relating to these systems.

The PAS has been developed to provide a specification for both the full range of sensitivities relating to built assets and asset types, e.g. a building, multiple buildings or infrastructure. This is why a generic approach has been adopted. A suite of additional guidance documents which will set out the specific application of the PAS to individual sectors is in preparation.

Suggested additional text to be included in the Employer’s Information Requirements where PAS 1192-5 is applicable is under preparation and will be available on the NPSA website.

The Information Manager exists only during the course of a project and is a role fulfilled by the supply chain. However, the Built Asset Security Manager is directly accountable to the Employer or Asset Owner for the design, implementation and operation of an appropriate security regime throughout the asset’s lifecycle.

The Built Asset Security Manager has a key role in security-minded delivery of projects. There is also a need for this function to continue throughout the lifecycle of a sensitive built asset in order to ensure appropriate and proportionate measures are maintained to protect asset information.

The Information Manager will have to work closely with the Employer’s Built Asset Security Manager in the delivery of the Built Asset Security Information Requirements (BASIR). (See clauses 6 & 10).

The Employer or Asset Owner needs to take appropriate security advice regarding the processing, storage and use of any sensitive data or information regarding its built asset where it is proposed that the cloud environment will be used. The term ‘cloud’ covers a diverse range of solutions and therefore the advice needs to address the cloud-specific risks as outlined in the PAS (clause 8.5).

NPSA are currently preparing BIM-specific cloud guidance to supplement the guidance on cloud security currently available on the Cabinet Office website (https://www.gov.uk/government/collections/cloud-security-guidance).

NPSA are developing a range of training packages which will cover basic security training through to the role based training for Built Asset Security Managers and Information Managers.