BuildBuild: Friday night…
Marked
Sam, the firm's information manager, marks the control room drawings as sensitive. Only the people who need them can open them, and only in the Site Office.
Stage 5 · Build it · Stop 10 of 13 · The right way
It got out
The back alley's bill so far: 128 weeks · See the bill
The right way
The site gate
The engineer works from home, logged in to the Site Office. Nothing leaves it. An unknown address asks for the drawings and is turned away. Both are recorded.
In useIn use: Opening day…
Opening offers
The screens show the opening offers and the speakers play the welcome. Thousands of shoppers have a completely ordinary morning, and never know why.
Nothing markedEmailed home, forwarded, posted online, and every screen in the mall says PAY UP.
The site gateMarked, limited, turned away and recorded, and a boring opening day.
Now there is: The site gate (access control, the security-minded approach): sensitive information marked, access limited, and a record of who could see it.
What's going on here
Some information is dangerous in the wrong hands, and a shopping centre where thousands of people gather every day is exactly the kind of thing someone might want to interfere with. Marking what's sensitive, limiting who can open it, keeping it inside the Site Office and recording who had access means a leak is unlikely, and if one happens, everyone knows who to tell.
New at this stop
- The site gate
- Who can get into the Site Office, and what they can see once they're in. (Access control.)
In the town See it in the town: How The Glasshouse is controlled. Who gets to see it?
The control room drawings are the most sensitive information in the Site Office, and the site gate decides who gets in and what they can open. Marked and limited, they can be worked on from a kitchen table without ever leaving the Site Office, and anyone turned away is recorded on the trail. Unmarked, they travel by email to a personal inbox, then to another firm, then to people nobody invited. If something does slip out, everyone needs to know which door to knock on in Client Town.
Fix it Sensitive drawings already out? Mark them, then gate them.
- List the drawings you'd least want on the internet.
- Mark them sensitive and limit who can open them.
- Agree who tells the client, and how fast, if one leaks.
A note for the information manager: Ask the client for its security rules at the start, because what counts as sensitive is the owner's call, and the gate should match it.
Try it on your job
On your job, which drawings would you not want on the internet? Who can open them today?
ISO 19650 From the drawing to the site gate
| ISO 19650 says | Means | In the town |
|---|---|---|
| Security-minded approach | Managing information about a built asset with its security risks in mind, in proportion to what could go wrong | The whole idea of this stop |
| Security triage process | Deciding whether an asset or its information is sensitive enough to need extra protection | Marking the control room drawings |
| Access control in the common data environment (CDE) | Limiting who can see and change each piece of information, and keeping a record of who did | The site gate |
| Security breach and incident management | An agreed plan for spotting, reporting and responding to a leak | Knowing who to tell, and telling them |
Based on the ISO 19650 series: the ideas come from the standard; the plain-English wording, examples and advice are InfoTown's. ISO 19650 and its UK National Annex are © ISO and BSI. You'll hear the same language across the industry. Read more for free in the Information Management Initiative (IMI) Framework guidance from BSI and nima. For the full requirements, use the standard itself.