Establishing a Dialogue about the Security of Digital Built Assets

Clarification of terminology and focus

A built asset may comprise a building, multiple buildings (e.g. on a site or campus), a portfolio or network of assets, or built infrastructure (e.g. roads, railways, pipelines, dams, docks, etc.) and may include associated land or water.

In this guidance, information refers to data or information relating to the specification, design, construction or acquisition, operation and maintenance, and disposal or decommissioning of an item, thing or entity that has potential or actual value to an organisation. Asset information can include design information and models, documents, images, software, spatial information and task or activity-related information.

A sensitive built asset is one where the built asset, as a whole or in part, may be of interest to a threat agent for hostile, malicious, fraudulent and/or criminal behaviours or activities.

A neighbouring built asset is classed as a built asset that shares a boundary (including beneath it or overhead) with the built asset under consideration, or that is in the neighbourhood of that built asset but physically separated by a public or private street, public or privately-owned open space or similar features.

Security of digital built assets

With the adoption of building information modelling (BIM) and the increasing use of digital technologies in the management of assets, whether buildings or infrastructure, there is a risk that loss or disclosure of information could impact on the safety, security and resilience of:

• personnel and other occupants or users of the built asset and its services;
• the built asset itself;
• asset information; and/or
• the benefits the built asset exists to deliver, whether social, environmental and/or commercial.

There is a need to identify and implement appropriate and proportionate measures to reduce the risks arising from such loss or disclosure, including where this relates to valuable commercial information and intellectual property.

In order to adopt an appropriate, holistic approach to the security of information about their built assets, the security manager and estates team need to understand what information is being created, processed, viewed and stored regarding their built assets, who has access to it and at what locations. This guidance helps to provide information to answer question such as:

• “How would we find out if our building had been modelled?”;
• "How do I know if a neighbouring property has modelled our assets?”; and
• “Which of our professional advisors might have digitally held information on our assets?”

Questions to consider

The following questions are intended to be answered as part of a discussion between the organisation’s security manager and those responsible for managing the organisation’s built assets.

1. Is the built asset a sensitive asset, in whole or in part?
2. Who is responsible for providing security advice regarding the built asset and the asset information?
3. Has any security advice been sought by the project sponsor?
4. In respect of its sensitive built assets, what asset information is held by the organisation, its advisors, consultants, and/or contractors?
5. In relation to the asset information:
   1. How current is the information;
   2. Does the level of detail held present a security risk;
   3. What, if any, of the information is accessible through open or public sources;
   4. Where is it stored and processed;
   5. Is any of the data creation, use, storage or processing occurring outside of the UK, and if so where;
   6. Who has access to it;
   7. What access rights do they have (create, read, update, and delete);
   8. What policies, processes and procedures are in place regarding the management and security of this information;
   9. What policies, processes and procedures are in place to manage access to the asset information?
6. Who is responsible for information management and information security of the asset information?
7. Where the organisation has multiple built assets, how is the asset information accessed across the organisation’s estate?
8. Is any asset information created, stored, viewed or processed on handheld devices and what, if any, security measures are employed to protect it?
9. Where the asset information is held or used by advisors, consultants, and/or contractors, at what locations is the information accessible?
10. Where scans or surveys of existing assets have been undertaken:
    1. Who has access to the scan data;
    2. Where is it used, stored and processed;
    3. How is the data transmitted between parties?
    4. What measures are in place or were taken to delete sensitive data from surveying equipment?
11. Are any of the IT systems that store, process or display the asset information accessible from outside of the organisation? If so what measures are in place to prevent unauthorised access to the systems?
12. What information, if any, has been supplied to neighbouring asset owners regarding the organisation’s assets?
13. Where information has been supplied to neighbouring asset owners:
    1. What information was supplied;
    2. When was it supplied;
    3. For what purpose was it supplied;
    4. What restrictions, if any, were placed on the use or disclosure of the information;
    5. What protective measures, if any, were required for the information;
    6. Have those protective measures been put in place?
14. Is there a risk management strategy in place, which includes:
    1. an assessment of the security risks to the built asset, including risks associated with the asset information;
    2. agreed mitigation measures;
    3. list of residual risks commensurate with the organisation’s risk appetite?
15. What information, if any, has been sought and received from neighbouring asset owners?
16. Where information has been received from neighbouring asset owners:
    1. What information was supplied;
    2. Is the information, as far as can reasonably be known, still current;
    3. What restrictions, if any, were placed on the use or disclosure of the information;
    4. What protective measures, if any, were required for the information;
    5. Have those protective measures been put in place?
17. What, if any, strategies and management plans are in place and how do they align with the requirements of BSEN ISO 19650-5?

Next steps

In light of answers to the questions in this guidance, your organisation should consider whether the availability and use of sensitive information has the potential to compromise the safety, security and resilience of the asset, its ability to function or a service provided from, or by, it.

BS EN ISO 19650-5, which is available for the British Standards website, details the approach to applying appropriate and proportionate measures to manage these security risks.

If there is any uncertainty as to whether:

• any of your built asset, in whole or in part, is sensitive;
• there is a need to protect particular asset information or information about a neighbouring built asset;
• there is a need for retrospective actions; or
• particular retrospective actions are appropriate
• it is recommended that you seek appropriate security advice.

Sources of further information

Depending on the nature, use or function of your built assets, there might be a number of sources of specialist security advice available to the employer or asset owner. This advice typically covers personnel, physical and cyber security. For sensitive built assets, advice will be available from a combination of NPSA, NCSC, NaCTSO and lead Government departments.

For other built assets, e.g. a high profile commercial building, the employer or asset owner’s built asset security manager, along with the police architectural liaison officer (ALO) (or in London, the crime prevention design advisor [CPDA]), who will be embedded in the Local Authority Planning Office, and where necessary, specialist security advisors (e.g. an appropriate member of the Register of Security Engineers and Specialists [RSES] ) should be able to assess the security threats and vulnerabilities to provide appropriate professional advice on security requirements and countermeasures.

RSES is sponsored by NPSA. The register was established to promote excellence in security engineering by providing a benchmark of professional quality against which its members have been independently assessed. Its members are engineers, applied scientists and specialists who apply their knowledge to securing the built environment and infrastructure.