PAS 1192-5:2015 - Security-Minded Approach to BIM and Digital Built Environments
Incident Response and Lifecycle

PAS 1192-5:2015 - Security-Minded Approach to BIM and Digital Built Environments PASONE-6: Incident Management, Audit, Handover, Operational Phase, Decommissioning

Per PAS 1192-5:2015 lifecycle clauses: incident + audit + lifecycle management. Requirements include (a) operate Security Incident Management for BIM and built asset information including detection + triage + containment + recovery + lessons learned + (b) operate Audit and Assurance of the Security Minded Approach including periodic review + internal/external assurance + (c) maintain Security in Handover and Operational Phase including transition of security controls from construction to operations + asset management integration + (d) maintain Security in Decommissioning and Disposal including secure information disposal + media sanitisation + records management + (e) maintain governance + lifecycle management + continuous improvement + (f) integrate with organisational ISMS and asset management.

Maintained by Gerard BlokdykVerified against the published standard Control text last updated

What else in your programme already covers this

This control maps to 132 controls across 62 other frameworks. If you already hold one of them, the evidence you collected for it is the starting point here rather than new work.

NIST SP 800-53 Rev 5 · 5 controls

BSI IT-Grundschutz · 4 controls

  • BSI-14 Vulnerability scanning and management
  • BSI-18 Incident response planning and testing
  • BSI-20 Incident reporting and notification
  • BSI-21 Forensic analysis capabilities

ISO/IEC 30111:2019 · 4 controls

  • 30111-1 Scope
  • 30111-3 Terms and definitions
  • 30111-5.2 Vulnerability handling team
  • 30111-8.1 Post-release monitoring

API 1164 · 3 controls

  • API1164-17 Wireless and Field Communications
  • API1164-18 Field Device Security
  • API1164-19 Safety Instrumented Systems Interface

EASA Part-IS - Information Security in Aviation · 3 controls

  • IS.AR.215 Information Security Incident Response
  • IS.D.OR.225 External Reporting of Information Security Events
  • IS.I.OR.225 External Reporting

FFIEC IT Examination Handbook · 3 controls

  • FFIEC-23 Regulatory reporting requirements
  • FFIEC-24 Customer notification procedures
  • FFIEC-25 Post-incident review and improvement

IEC 62443 · 3 controls

  • IEC62443-16 Incident response plan for operational disruptions
  • IEC62443-17 Recovery plan for critical systems
  • IEC62443-20 Exercises and drills for OT incidents

ISO 22320:2018 · 3 controls

  • ISO-22320-5.2 Incident management process
  • ISO-22320-B Annex B: Incident management plan structure
  • ISO-22320-C Annex C: Incident management task examples

ISO/IEC 27019:2024 · 3 controls

  • ISO27019-16 Incident response plan for operational disruptions
  • ISO27019-18 Reporting obligations to authorities
  • ISO27019-20 Exercises and drills for OT incidents

NIST Cybersecurity Framework 2.0 · 3 controls

  • NIST-CSF-ID.IM-04 Incident response plans and other cybersecurity plans that affect operations are established, communicated, maintained, and improved
  • NIST-CSF-RC.RP-01 The recovery portion of the incident response plan is executed once initiated from the incident response process
  • NIST-CSF-RS.MA-01 The incident response plan is executed in coordination with relevant third parties once an incident is declared

NIST SP 1800-32 · 3 controls

Switzerland New Federal Act on Data Protection (nFADP/nDSG, 2023) · 3 controls

APPI · 2 controls

  • APPI-A41 Preparation and Handling of Pseudonymized Personal Information
  • APPI-A43 Preparation of Anonymized Personal Information

APRA CPS 234 · 2 controls

  • CPS234-21 Implementation of Information Security Controls
  • CPS234-25 Internal Audit Review of Information Security Controls

ASD Strategies to Mitigate Cyber Security Incidents · 2 controls

  • ASD37-31 Hunt to discover incidents (Very Good)
  • ASD37-33 Capture network traffic (Limited)

Bahrain PDPL · 2 controls

FFIEC Cybersecurity Assessment Tool (CAT) · 2 controls

  • CAT-D3-3 Corrective controls
  • CAT-D5-1 Incident planning and strategy

FTC GLBA Safeguards Rule (16 CFR Part 314) · 2 controls

  • FTC-Safeguards-IR-Plan-BoardReporting-FTC-Notification Written Incident Response Plan + Board Reporting + FTC Breach Notification (16 CFR 314.4(h), (i), (j))
  • FTC-Safeguards-ServiceProvider-Evaluation Service Provider Oversight + Program Evaluation + Personnel Training (16 CFR 314.4(d-g))

Federal Decree-Law No. 45 of 2021 on the Protection of Personal Data (UAE PDPL) · 2 controls

  • UAE-PDPL-Art.10 Data Protection Officer (DPO) (UAE PDPL Article 10)
  • UAE-PDPL-Art.18_19_20_21 Security measures, controller/processor relationship, DPIA (UAE PDPL Articles 18-21)

ISO/IEC 29147:2018 · 2 controls

  • 29147-5.6 Advisory Content and Quality
  • 29147-7.8 Remediation information

NIST SP 800-190 · 2 controls

Singapore Government Instruction Manual on ICT&SS Management (IM8) · 2 controls

  • IM8-RES.3 Incident Response
  • IM8-SEC.4 Vulnerability Management

South Korea ISMS-P · 2 controls

  • ISMSP-SYS-04 Vulnerability Management
  • ISMSP-SYS-05 Incident Response

South Korea PIPA · 2 controls

  • PIPA-CPO-DPO-Privacy-Officer-PIA-Personal-Information-Impact-Assessment-Articles-31-33 Korea PIPA CPO + DPO + Privacy Officer + PIA + Personal Information Impact Assessment + Articles 31-33
  • PIPA-Sensitive-Information-Unique-ID-Resident-Registration-Numbers-CCTV-Articles-23-24-25 Korea PIPA Sensitive Information + Unique ID + RRN + CCTV + Articles 23-25

UK Defence Standard 05-138 - Cyber Security for Defence Suppliers · 2 controls

  • D.1 Incident Response Planning
  • D.2 Incident Reporting

US Gramm-Leach-Bliley Act (GLBA) - Higher Education Safeguards Rule · 2 controls

US Maritime Transportation Security Act (MTSA) and USCG Cybersecurity Requirements · 2 controls

  • CYB-5 Cyber Incident Response Plan
  • USMTSA-2 Cybersecurity Assessment and CSO Designation

APRA CPS 230 Operational Risk Management · 1 control

  • CPS230-13 Board Accountability for Operational Risk Management

ASIS SPC.1-2009 - Organizational Resilience Standard · 1 control

  • 4.4.7 Emergency and Incident Response

Annex 11 to EU GMP - Computerised Systems · 1 control

Barbados Data Protection Act 2019 · 1 control

  • BB-DPA-20 Sections 50-60 - Registration and Responsibilities

CISA Cross-Sector Cybersecurity Performance Goals (CPG) 2.0 · 1 control

  • CPG-5.A Vulnerability Disclosure Program

COSO Internal Control - Integrated Framework (2013) · 1 control

  • CA-12 Deploys Through Policies and Procedures

Canada ITSG-33 - IT Security Risk Management · 1 control

  • CA-ITSG33-SC-01 Security Control Catalogue

ISO 28001:2007 Supply Chain Security Management · 1 control

  • ISO28001-PC-04 Supply Chain Continuity Planning

ISO/IEC 20000-1:2018 · 1 control

  • ISO20000-11 Incident management

ISO/IEC 27010:2015 · 1 control

  • 27010-16.1 Continuity of Sharing

ISO/IEC 27011:2024 · 1 control

  • 27011-8.5 Vulnerability and malware management

ISO/IEC 27043:2015 · 1 control

  • ISO27043-25 Technical vulnerability management

ISO/IEC 27400:2022 · 1 control

  • 27400-6.5 Security monitoring and incident response

ISO/IEC 29134:2023 · 1 control

  • 29134-9.2 Report findings and recommendations

ISO/SAE 21434 · 1 control

  • ISO21434-25 Technical vulnerability management

ITIL 4 · 1 control

  • ITIL4-11 Incident management

Kuwait National Cybersecurity Framework · 1 control

NFPA 1600 - Standard on Continuity, Emergency, and Crisis Management · 1 control

  • NFPA1600-6.3 Emergency Response Operations

NIST Privacy Framework · 1 control

  • NISTPF-8 Protect-P Information Protection Processes (PR.PO-P)

NIST SP 800-124 Revision 2 - Guidelines for Managing the Security of Mobile Devices · 1 control

Nevada Gaming Control Board Cybersecurity Requirements · 1 control

  • NGCB-6 Incident Response, 72-Hour NGCB Notification, and Independent Investigation

OWASP SAMM · 1 control

  • OWASPSAMM-4 Verification: Architecture Assessment, Requirements-Driven Testing, Security Testing

Papua New Guinea National Cybersecurity Policy & Cybercrime Act (2016) · 1 control

  • PNGCYBER-4 Incident Response, Investigation, Evidence Preservation, Data Retention

Personal Data Act (personopplysningsloven) · 1 control

  • NORWAY-8 Breach Notification, Complaints, Compliance, Enforcement

Privacy Act 1988 (Australia) · 1 control

  • AUPRV-7 Notifiable Data Breaches (NDB) Scheme, Incident Response

Privacy Act 2020 · 1 control

  • NZPRV-7 Notifiable Privacy Breach Scheme

Protective Security Policy Framework (PSPF) Release 2026 · 1 control

  • PSPF24-1 Security Culture, Governance, Risk Management

Singapore Cybersecurity Act 2018 · 1 control

  • SGCYBER-1 Critical Information Infrastructure (CII) Designation and Registration

TEFCA - Trusted Exchange Framework and Common Agreement · 1 control

  • TEFCAREC-1 Common Agreement Conformance and Onboarding

Turkey KVKK · 1 control

  • TURKEYKVKK-2 Information Notice and Data Subject Rights

UK Open Banking Standard · 1 control

  • OB-OPS.4 Incident Management

UN Guiding Principles on Business and Human Rights (UNGPs) · 1 control

  • UNGPBHR-2 Pillar II: Corporate Responsibility to Respect Human Rights

US EPA Safe Drinking Water Act (SDWA) - Cybersecurity Requirements · 1 control

  • USSDWA-2 Cybersecurity Practices (Assessment, Access, Network, IR)

Vietnam Law on Cybersecurity (No. 116/2025/QH15) · 1 control

  • VIETNAMCYBER-2 Prohibited Acts (Access, Interception, Forgery, Content)

Voluntary Principles on Security and Human Rights (VPs) · 1 control

  • VPSHR-3 Implementation Guidance and Reporting

Every mapping shown was judged rather than inferred from wording similarity, and the ones that failed review are published too. See the coverage reports and what was rejected.

Query this from an agent

The graph holds this control, the 132 it maps to, and the evidence behind each claim, over MCP and REST.

MCP endpointAll PAS 1192-5:2015 - Security-Minded Approach to BIM and Digital Built Environments controls