# Cybersecurity Vulnerabilities in Off-Site Construction
## 5 Cybersecurity Frameworks and Management
### Security-Minded BIM in PAS 1192-5 and ISO 19650-5  
The PAS 1192-5 framework was established in May 2015 and was later withdrawn and replaced by the BN EN ISO 19650-5. However, it addressed the measures expected to form and cultivate appropriate safety and security attitudes and work culture across different stakeholders. This includes the need to observe and audit compliance. The approach applied in this framework was generalized for the most built asset or portfolio assets where data are created, stored, processed, and extracted in digital form. Its primary design was intended to support the development of cyber-physical systems. However, it lacked a detailed taxonomy that could be followed in its implementation. The adoption of the ISO 19650-5 regarding security focuses on the secure management of sensitive information that is acquired, generated, handled, and saved as part of, or regarding, any other initiative, design, resource, product, or service. Its main components are based on the Parkerian hexad [57; 58], which operates under confidentiality, integrity, availability, authenticity, possession, and utility. This takes an extended form of the original CIA model [59]. The ISO 19650 series is applicable throughout the entire project or enterprise's lifespan and encourages the adoption of data management technologies [60]. Furthermore, its relevance in the built environment aims at how entities should guard their commercial data and intellectual property. Compliance with other legislation and standards exists, and these include the following (the list is not exhaustive):  
1. Official Secrets Act 1989. 2. Computer Misuse Act 1990. 3. Data Protection Act 1998. 4. Environmental Information Regulation 2004. 5. Freedom of Information Act 2000. 6. Government Security Classifications. As such, the functioning of this system is restricted to basic security for digital systems and typical information environments. In the case of OSC, which works on a combination of cyber and physical systems, a more broadened approach is expected rather than a mere access-based focus. The Institute of Engineering Technology (IET) Code of Practice for Cybersecurity in the Built Environment (Cop-CSBE)  
The contents of this framework borrow from three pre-established security attributes, namely, the CIA model [59], the extended Parkerian hexad [58], and the [PERSON] model [61; 62], including resilience and safety aspects. Under this framework, safety is defined as avoiding injury and harm to individuals, the workspace, and the associated operating equipment. An example related to this would be an intrusion into the removable dust system and processing parameters of an additive manufacturing machine resulting in the development of highly flammable material and overheating the equipment. On the other hand, resilience improves a system's ability to transform, renew, and recover efficiently in the case of a cyber-attack. For an existing cyber-physical system, its resilience can be measured by how long it can endure the malfunction of communications and networking components before entire system failure [63]. This has been found to be critical for complex infrastructure where failure in one section is required to be isolated from the uncompromised zone. To preserve data, cloud storage can be considered; however, if the attack simultaneously affects the connectivity of the infrastructure, very little can be done. The Cop-CSBE fails to clearly define the attributes of the Parkerian hexad and CIA security models. Elements of this framework are given in Table 3.