Digital built assets and environments
Published 2 November 2020
© Crown copyright 2020
This publication is licensed under the terms of the Open Government Licence v3.0 except where otherwise stated. To view this licence, visit nationalarchives.gov.uk/doc/open-government-licence/version/3 or write to the Information Policy Team, The National Archives, Kew, London TW9 4DU, or email: psi@nationalarchives.gov.uk.
Where we have identified any third party copyright information you will need to obtain permission from the copyright holders concerned.
This publication is available at https://www.gov.uk/government/publications/crowded-places-guidance/digital-built-assets-and-environments
1. Introduction
A built asset may comprise a building, multiple buildings (e.g. on a site or campus), a portfolio or network of assets, or a built infrastructure (e.g. roads, railways, pipelines, dams, docks, etc.) and may include associated land or water.
Digital built assets and environments generate digital representations of, and data / information about, physical and functional aspects of a built asset. The effective management and security of such assets requires a cross-sector collaborative approach, which has traditionally been seen within the architectural, engineering and construction industries. This approach involves a more transparent, open way of working, the sharing of detailed models and large amounts of digital asset information.
Asset information refers to data / information relating to the specification, design, construction / acquisition, operation and maintenance, and disposal / decommissioning of an item, thing or entity that has potential or actual value to an organisation. Asset information may include design information and models, documents, images, software, spatial information and task or activity-related information.
The planning, design, construction, operation and maintenance of built assets is increasingly making use of digital engineering and placing greater reliance on digital technologies. It is important that security managers understand the inherent vulnerability issues which may result. These vulnerabilities may present in number of ways, including through the unauthorised, or malicious use of authorised access to systems.
This may subsequently cause:
- a compromise to the safety, security and resilience of personnel and other occupants / users of the built asset and its services
- the built asset itself
- asset information
- a compromise to the benefits the built asset exists to deliver, be they societal, environmental and / or commercial.
Policies and processes should therefore be in place to encourage the adoption of appropriate and proportionate controls if the trustworthiness and security of digital built assets is to be maintained.
2. Security of digital built assets
The models and the associated databases will likely contain significant amounts of aggregated information about a built asset.
Such Information may include:
- its design and associated specifications
- the construction process
- component assets, their precise location and interconnectivity
- product data about component assets including specification, design and maintenance information
- the services or function the built asset provides
- its occupants or users
- operational and management procedures, including those relating to safety and security
Alongside developments in digital engineering, there is a drive to make public data more easily accessible, unless there are clear and specific reasons not to do so. This is likely to increase the amount of information available in the public domain.
The use of Building Management Systems (BMS) is already commonplace. However, with technology used by most BMS and third party systems starting to converge, the increasing use of Internet Protocol (IP) networks by systems to communicate internally and with the outside world, and the use of commercial off-the-shelf IT products, software and operating systems as key components, a number of potential vulnerabilities are created.
3. PAS 1192 – 5:2015
Access to any of the types of information and systems described above would greatly assist those engaged in a range of criminal activity, espionage and terrorism. In order to understand and address those potential vulnerabilities, the Centre for the Protection of National Infrastructure (CPNI) and the British Standards Institution (BSI) have produced guidance, PAS 1192 – 5:2015, Specification for security-minded building information modelling, digital built environments and smart asset management.
The standard sets out effective and proportionate ways to enable the safe and secure sharing and publication of digital asset information. It is supported by a suite of related guidance documentation available on the CPNI website.