ISO 19650-5:2020 ビルディングインフォメーションモデリング（BIM）を含む、ビルディングおよび土木工事に関する情報の整理とデジタル化—ビルディングインフォメーションモデリングを使用した情報管理—パート5：情報管理へのセキュリティ志向のアプローチ | ページ 6

3.1

asset

item, thing or entity that has potential or actual value to an organization

Note 1 to entry: An asset can be fixed, mobile or movable. It can be an individual item of plant, a vehicle, a system of connected equipment, a space within a structure, a piece of land, an entire piece of infrastructure, an entire building, or a portfolio of assets including associated land or water. It can also comprise information in digital or in printed form.

Note 2 to entry: The value of an asset can vary throughout its life and an asset can still have value at the end of its life. Value can be tangible, intangible, financial or non-financial.

[SOURCE:ISO 55000:2014, 3.2.1, modified — The original notes 1, 2 and 3 to entry have been removed; new notes 1 and 2 to entry have been added.]

3.2

crowded place

location or environment to which members of the public have access that can be considered more at risk from a terrorist attack by virtue of its crowd density or the nature of the site

Note 1 to entry: Crowded places can include: sports stadia, arenas, festivals and music venues; hotels and restaurants; pubs, clubs, bars and casinos; high streets, shopping centres and markets; visitor attractions; cinemas and theatres; schools and universities; hospitals and places of worship; commercial centres; and transport hubs. They can also include events and public realm spaces such as parks and squares.

Note 2 to entry: A crowded place will not necessarily be crowded at all times — crowd densities can vary and can be temporary, as in the case of sporting events or open-air festivals.

3.3

metadata

data about data

3.4

need-to-know

legitimate requirement of a prospective recipient of information to know, to access, or to possess sensitive information (3.11)

3.5

risk appetite

amount and type of risk that an organization is willing to pursue or retain

[SOURCE:ISO 22300:2018, 3.202]

3.6

safety

state of relative freedom from threat (3.13) or harm caused by random, unintentional acts or events

3.7

security

state of relative freedom from threat (3.13) or harm caused by deliberate, unwanted, hostile or malicious acts

3.8

security breach

infraction or violation of security (3.7)

[SOURCE:ISO 14298:2013, 3.30]

3.9

security incident

suspicious act or circumstance threatening security (3.7)

3.10

security-minded

understanding and routinely applying appropriate and proportionate security (3.7) measures in any business situation so as to deter and/or disrupt hostile, malicious, fraudulent and criminal behaviours or activities

3.11

sensitive information

3.12

residual risk

risk that remains after controls have been implemented

[SOURCE:ISO 16530‑1:2017, 3.52]

3.13

threat

potential cause of an incident which may result in harm

3.14

top management

person or group of people who directs and controls an organization at the highest level

Note 1 to entry: Top management has the power to delegate authority and provide resources within the organization.

Note 2 to entry: In the context of this document, management should be regarded as the function, not the activity.

[SOURCE:ISO 9000:2015, 3.1.1, modified — The original notes 2 and 3 to entry have been removed; new note 2 entry has been added.]

3.15

vulnerability

weakness that can be exploited to cause harm