PAS 1085:2018

Manufacturing – Establishing and

implementing a security-minded
approach – Specification
Publishing and copyright information
The BSI copyright notice displayed in this document indicates when the document
was last issued.
© The British Standards Institution 2018. Published by BSI Standards Limited 2018.
ISBN 978 0 580 52421 9
ICS 03.100.50, 25.040.40, 35.030
No copying without BSI permission except as permitted by copyright law.

Publication history
First published May 2018
 PAS 1085:2018

Contents
Foreword...................................................................................................... ii

0 Introduction .............................................................................................. iv

1 Scope.......................................................................................................... 1

2 Normative references............................................................................... 1

3 Terms, definitions and abbreviations...................................................... 2

4 Manufacturing organization’s environment........................................... 8

5 Security governance................................................................................. 13

6 Assessing and managing security risks................................................... 17

7 Implementing the organization’s security strategy............................... 22

8 Assessing security of the supply chain.................................................... 26

9 Working with suppliers and customers.................................................. 29

10 Security of a manufactured item........................................................... 32

11 Data and information management...................................................... 33

12 Security-minded approach in relation to compliance with legislation

and other standards.................................................................................... 46

Bibliography ................................................................................................ 49

List of figures
Figure 1 – The manufacturing organization and its digital ecosystem.... iv
Figure 2 – Illustrative manufacturing organization with a supply chain.. v
Figure 3 – The manufacturing value chain................................................. vi
Figure 4 – Overview of security-minded manufacturing........................... vii
Figure 5 – Holistic approach to security...................................................... 9
Figure 6 – Establishing the organization’s context.................................... 14
Figure 7 – Security concepts and relationships........................................... 17
Figure 8 – Risk management approach...................................................... 20
Figure 9 – Supplier security triage process................................................. 27
Figure 10 – Generic data and information lifecycle................................... 34
Figure 11 – Security goals for the organization’s data and information.. 39
Figure 12 – Data and information security triage process......................... 41
Figure 13 – Personally identifiable information test................................. 42

© The British Standards Institution 2018 i

PAS 1085:2018

Foreword
This PAS (Publicly Available Specification) was sponsored by Innovate UK.
Its development was facilitated by BSI Standards Limited and it was published
under licence from The British Standards Institution. It came into effect on
31 May 2018.
Acknowledgement is given to Hugh Boyes of Bodvoc This PAS is not to be regarded as a British Standard.
Ltd., as the technical author and the following It will be withdrawn upon publication of its content in,
organizations that were involved in the development or as, a British Standard.
of this PAS as members of the steering group:
• Arup The PAS process enables a specification to be rapidly
developed in order to fulfil an immediate need
• B.H. Development
in industry. A PAS can be considered for further
• Bodvoc Ltd development as a British Standard, or constitute part
• BuroHappold Engineering of the UK input into the development of a European
• Centre for Process Innovation (CPI) or International Standard.
• Co-opted member
• Costain Group plc Use of this document
• Cranfield University
It has been assumed in the preparation of this PAS
• Digital Catapult that the execution of its provisions will be entrusted
• High Value Manufacturing Catapult (HVMC) to appropriately qualified and experienced people, for
• Innovate UK whose use it has been produced.
• The Manufacturing Technologies Association (MTA)
• National Cyber Security Centre (NCSC)
Presentational conventions
• Rockwell Automation
The provisions of this PAS are presented in roman
• Warwick Manufacturing Group (WMG)
(i.e. upright) type. Its requirements are expressed in
sentences in which the principal auxiliary verb is “shall”.
Acknowledgement is also given to the members of
a wider review panel who were consulted in the
Commentary, explanation and general informative
development of this PAS.
material is presented in italic type, and does not
constitute a normative element.
The British Standards Institution retains ownership
and copyright of this PAS. BSI Standards Limited as the
Where words have alternative spellings, the preferred
publisher of the PAS reserves the right to withdraw
spelling of the Shorter Oxford English Dictionary is used
or amend this PAS on receipt of authoritative advice
(e.g. “organization” rather than “organisation”).
that it is appropriate to do so. This PAS will be
reviewed at intervals not exceeding two years, and
Requirements in this PAS are drafted in accordance with
any amendments arising from the review will be
Rules for the structure and drafting of UK standards,
published as an amended PAS and publicized in Update
subclause G.1.1, which states, “Requirements should
Standards.
be expressed using wording such as: ‘When tested as
described in Annex A, the product shall ...’”. This means
that only those products that are capable of passing the
specified test will be deemed to conform to this PAS.

ii © The British Standards Institution 2018

 PAS 1085:2018

Contractual and legal considerations

This publication does not purport to include all the
necessary provisions of a contract. Users are responsible
for its correct application.

Compliance with a PAS cannot confer immunity from

legal obligations.

Particular attention is drawn to the following specific

regulations:
• Data Protection Act 1998 [1]
• Regulation (EU) 2016/679 of the European Parliament
and of the Council on the protection of natural
persons with regard to the processing of personal
data and on the free movement of such data, and
repealing Directive 95/46/EC (General Data Protection
Regulation) [2]
• Trade Union and Labour Relations (Consolidation) Act
1992 [3]
• Environmental Information Regulations 2004 [4]
• Freedom of Information Act 2000 [5]
• Freedom of Information (Scotland) Act 2002 [6]
• Computer Misuse Act 1990 [7]
• Control of Major Accident Hazards Regulations 2015 [8]
• Official Secrets Act 1989 [9]
• Re-use of Public Sector Information Regulations 2005 [10]

© The British Standards Institution 2018 iii

PAS 1085:2018

0 Introduction
An increasing use of digital technologies in the design,
manufacture, delivery, operation and disposal of
products, systems, assets and services has led to the
use of the terms digital manufacturing and industrial
digitalization. As a consequence, manufacturing
organizations typically exist within a complex digital
ecosystem as illustrated in Figure 1.

Figure 1 – The manufacturing organization and its digital ecosystem

The manufacturing organization exchanges increasing digital interaction introduces a number of

information, much of it in digital form, with a diverse
range of organizations in addition to handling
physical items. Such exchanges can occur using a
variety of technologies including email, electronic data
interchange (EDI), collaboration portals, digital object
libraries and direct connectivity between systems. Many
of these exchanges are achieved using information
and communications technologies (ICT), which can be
referred to as the Internet or the Internet of Things
(IoT). It is also important to consider the interactions
between these ICT and operational technologies (OT),
including the Industrial Internet of Things (IIoT). This
threats and opportunities to both an organization and
its stakeholders, including suppliers, customers and its
personnel.
For the purposes of this PAS the term digital also
encompasses processing of data and/or information
using machine learning, artificial intelligence
techniques and the adoption of technology that
enables smarter and more autonomous manufacturing
processes.

iv © The British Standards Institution 2018


All organizations are dependent to some degree on
a supply chain and unless they sell directly to their
customers or end users are part of a wider supply
chain as illustrated in Figure 2. For manufacturing
organizations, their supply chain is likely to include
organizations that provide:
• supplies or consumables, raw materials and any
equipment or systems and software used in the
manufacturing process;
• professional services, e.g. technical, financial and legal
services; and
• resourcing services, e.g. recruitment of personnel or
provision of temporary labour, sourcing of supplies,
raw materials, etc.
The manufacturing organization therefore needs to be
aware of and manage security risks relating to it and
those that might arise through its supply chain.
Figure 2 – Illustrative manufacturing organization with a supply chain
© The British Standards Institution 2018
PAS 1085:2018
Within a manufacturing organization there is a
value chain, which is based on a process view of
the organization’s operations and comprises a
set of activities that are performed to deliver its
manufactured outputs. Whilst an organization might
engage in hundreds of activities in the process of
converting inputs and resources into the manufactured
outputs, these activities can be classified generally as
either primary or support. Figure 3 illustrates a generic
value chain that comprises:
• primary activities, i.e. inbound logistics,
manufacturing operations, outbound logistics
and any product related service delivered to the
organization’s customers; and
• supporting activities, i.e. enterprise ICT equipment
and systems, OT, sales and marketing, resource
management and procurement, financial and legal
activities.
v
PAS 1085:2018
Figure 3 – The manufacturing value chain
NOTE 1 The organization’s supply chain forms part of
the organization’s overall value chain, e.g. through
supplies delivered via its inbound logistics processes and
the wider digital ecosystem.
NOTE 2 Organizations should consider the impact
of risks both downstream and upstream of their
operations and the potential need for additional
testing and/or verification of automated updates to
systems, software data and/or information.
The security issues that might affect a manufacturing
organization include:
• loss or theft of intellectual property (IP) and/or
commercially sensitive information;
• criminal acts, for example computer misuse, fraud,
sabotage, theft and vandalism;
• counterfeit supplies, including the potential effects of
counterfeiting when the organization’s products are
deployed or operated;
• cyber security incidents affecting all aspects of the
organization’s operations;
• accidental or deliberate alteration or corruption of
manufacturing information and/or software; and
• loss of sensitive customer or personal information.
In the past, many of these issues would have required
physical access to the manufacturing process or its
inputs and outputs, but with the increasing digital
connectivity of both manufacturers and their systems,
the threats now emanate from both local sources, and
those around the globe.
vi
The principles upon which drafting of this PAS was
undertaken were that:
a) the manufacturing organization’s security is
owned, governed and promoted at board-level;
b) security risks to the manufacturing organization,
its assets, manufacturing processes and outputs
are assessed and managed appropriately and
proportionately, including those specific to its
supply chain;
c) the manufacturing organization appreciates the
value of data and/or information it processes,
whether owned by itself or a third-party, and takes
steps to protect it across its lifetime;
d) where a manufactured item embodies digital
technology or information the manufacturer
ensures that the item is secure-by-design and
provides aftercare and incident response to ensure
that the item remains secure over its lifetime; and
NOTE It is the responsibility of the manufacturer
to provide information and communicate to the
customer and/or end user the lifetime support of the
products and/or systems, and any associated services.
e) the manufacturing organization works with its
supply chain to implement an appropriate and
proportionate level of security in the delivery of
the digitally manufactured items and any related
services and/or information.
NOTE In determining what is appropriate and
proportionate, the organization’s board-level
management should ensure that consideration
is given to the nature, likelihood and severity of
security threats and the potential impact(s) on the
organization and its stakeholders in the event that
the risk(s) occur.
© The British Standards Institution 2018
 PAS 1085:2018

An overview of the PAS’s security-minded approach to

manufacturing is provided in Figure 4, cross-referenced
to the relevant clauses.

Figure 4 – Overview of security-minded manufacturing

© The British Standards Institution 2018 vii

PAS 1085:2018

This page is deliberately left blank.

viii © The British Standards Institution 2018


1 Scope
This PAS specifies requirements for the security-minded
management of manufacturing organizations and the
associated value chain utilizing information, digital
technologies and associated control systems for the
design, production, operation, maintenance and
disposal of products and systems. These requirements
aim to protect organizational reputation and
liability, intellectual property, safety and security of
manufacturing assets, and the integrity and value of
the manufactured items.
It covers how to identify security threats throughout
the manufacturing value chain and product lifecycle:
design; manufacture (including processing and
mixing); commissioning and handover; operation and
maintenance; performance management; change
of use/modification; and disposal. It also addresses
security issues within the digital ecosystem that the
organization and its supporting supply chain operate.
This PAS covers the following elements of security:
people, physical, process and technological.
It explains the need for, and application of,
trustworthiness and security controls throughout
2 Normative references
The following documents, in whole or in part, are
normatively referenced in this document and are
indispensable for its application. For dated references,
only the edition cited applies. For undated references,
the latest edition of the referenced document
(including any amendments) applies.
Standards publications
BS ISO 55000:2014, Asset management – Overview,
principles and terminology
PAS 1192-5:2015, Specification for security-minded
building information modelling, digital built
environments and smart asset management
© The British Standards Institution 2018
PAS 1085:2018
a manufacturing value chain to deliver a holistic
approach encompassing: safety; authenticity;
availability (including reliability); confidentiality;
integrity; possession; resilience; and utility.
This PAS addresses the steps required to create and
cultivate an appropriate security mind-set and culture
within a manufacturing organization and across its
supply chain, including the need to monitor, audit and
evaluate effectiveness.
The approach outlined in this PAS is applicable to any
manufacturing organization and its ecosystem where
manufacturing information is processed and used in
digital form.
NOTE This PAS also aligns with the approach
advocated by the Centre for the Protection of National
Infrastructure (CPNI) for raising security-mindedness
across sectors.1)
The PAS is for use by senior executive managers,
operational managers, engineers, and operatives
in manufacturers of products and systems and their
associated supply chains and its ecosystem. It might also
be of use to insurers and trainers.
Other publications
[NR1] NATIONAL CYBER SECURITY CENTRE (NCSC).
Digital service security – Guidance. October 2016.
Available from: www.ncsc.gov.uk/guidance/digital-
service-security [viewed April 2018]
[NR2] CABINET OFFICE. Government Security
Classifications. Available from: www.gov.uk/
government/publications/government-security-
classifications [viewed April 2018]
1)
Further information is available from CPNI’s website:
https://www.cpni.gov.uk.
1
PAS 1085:2018
3 Terms, definitions and abbreviations
3.1 Terms and definitions
For the purposes of this PAS, the following terms and
definitions apply.
3.1.1 asset
item, thing or entity that has potential or actual value
to an organization
NOTE 1 An asset can be fixed, mobile or movable. It
can be an individual item, plant, a system of connected
equipment, a space within a structure, a piece of land,
an entire piece of infrastructure, an entire building, or
a portfolio of assets.
NOTE 2 An asset might also comprise data, information
in digital or in printed form, as well as an organization’s
internal processes.
NOTE 3 Digital information can be localized (i.e. based
on a single data source) or distributed (i.e. derived from
multiple data sources and/or locations).
NOTE 4 The value of an asset might vary throughout
its life and an asset might still have value at the end of
its life. Value can be tangible, intangible, financial and
non-financial.
[SOURCE: BS ISO 55000:2014, 3.2.1]
3.1.2 asset data
data relating to the specification, design, construction
or acquisition, operation and maintenance, and
disposal or decommissioning of an item, thing or entity
that has potential or actual value to an organization
[SOURCE: PAS 1192-5:2015, 3.1.2, modified]
3.1.3 asset information
information relating to the specification, design,
construction or acquisition, operation and maintenance,
and disposal or decommissioning of an item, thing
or entity that has potential or actual value to an
organization
NOTE Asset information can include design information
and models, documents, images, software, spatial
information and task or activity-related information.
[SOURCE: PAS 1192-5:2015, 3.1.2, modified]
3.1.4 context
circumstances that form the setting for an asset, event,
data and/or information, which allow its significance
and/or meaning to be better understood
2 © The British Standards Institution 2018
3.1.5 cyber hygiene
conditions and practices that serve to promote or
preserve cyber safety and security by individual system
users
NOTE Good cyber safety and security practices are not
dissimilar to good health practices related to infection
and disease control, i.e. taking appropriate steps to
prevent infection (e.g. malware), seeking advice in
the case of a suspected infection, and when infection
occurs, isolating it or taking steps to prevent further
spread.
3.1.6 data
series of marks, digital or analogue signals or encoded
characters stored or transmitted electronically
NOTE 1 Marks can include writing, printed characters or
graphics.
NOTE 2 There are alternative definitions of data;
this specific definition builds on that contained in
PAS 183:2017 and is being used in the context of
security-mindedness.
NOTE 3 Analogue data varies continuously and
relates to natural phenomena such as sounds, natural
light, river levels, waves and time. It can also include
images such as sketches, drawings and text which
have been produced by hand rather than using digital
technologies.
NOTE 4 Digital data is represented as binary digits (bits)
that have only two states, 0 and 1. These data can be
a digital representation of analogue data, captured
through a quantization process, or data that was
created in digital form, for example as a result of a
computer process or by entry using a human interface
device (keyboard, touchscreen, stylus, etc.).
NOTE 5 The distinction between data and information
is that data does not need to have any meaning
attached to it; data becomes information via context.
3.1.7 data controller
person who (either alone or jointly or in common with
other persons) determines the purposes for which and
the manner in which any personal data are, or are to
be, processed
NOTE 1 The wording of the definition given in the Data
Protection Act 1998 [1] (DPA) is due to be amended
by the General Data Protection Regulation (GDPR) [2]
Article 4(7).

NOTE 2 Whilst few manufacturers may fall within the
scope of the Security of Network and Information
Systems Directive (also known as the NIS Directive)
[11], data controllers should be aware of its objective
regarding managing security risks, protecting against
cyber attacks, detecting cyber security events and
minimizing the impact of cyber security incidents.
{SOURCE: Data Protection Act 1998 [1], Section 1(1)}
3.1.8 data sharing
provision of data from one or more organizations
to a third-party organization or organizations, the
reciprocal exchange of data between organizations,
or the sharing of data between different parts and/or
systems of the same organization
NOTE 1 There are two main types of data sharing:
a) systematic, routine data sharing where the
same data sets are shared between the same
organizations, or parts of an organization, for an
established purpose; and
b) exceptional, one-off decisions to share data, for
example, in unexpected or emergency situations,
the provision of medical or social care data to
emergency service first responders when they are
responding to an incident.
NOTE 2 Data sharing might take place implicitly as well
as explicitly with outsourced services via the use of
cloud services where appropriate security measures are
not in place.
{SOURCE: ICO’s Data Sharing Code of Practice [12],
May 2011, modified}
3.1.9 data and information sharing agreement (DISA)
set of rules to be adopted by the various organizations
involved in a data and/or information sharing operation
3.1.10 disclosure
action of making sensitive, classified or private data
and/or information known
3.1.11 hostile reconnaissance
activity of acquiring information about a target with
the view to planning to attack, compromise, disrupt or
destroy that target
NOTE 1 The target might be an individual, organization,
enterprise or built asset, in whole or in part.
NOTE 2 The planned hostile action might be physical or
cyber in nature.
NOTE 3 Reputational damage might result from such
physical or cyber hostile actions.
[SOURCE: PAS 1192-5:2015, 3.1.15]
© The British Standards Institution 2018
PAS 1085:2018
3.1.12 information
one or more data items that have a context and
therefore convey a message or meaning
NOTE 1 A string of characters might be referred
to generally as data; but if these characters are
understood by a person or a computer program (for
example, as someone’s name), then the characters
convey information. Information always involves the
presence of data in some format, on some medium,
which could be, for example, a physical document, a
document image on a screen, or the contents of an
electronic file.
NOTE 2 There are alternative definitions of
information, but from a security-mindedness
perspective the information’s context can increase the
sensitivity of the information.
3.1.13 information management
policies, processes, procedures and tasks applied to
the data and/or information across its lifecycle to
ensure its accuracy, authenticity, confidentiality,
integrity and utility
NOTE See also Figure 9 which illustrates the generic
data and information lifecycle.
[SOURCE: PAS 1192-5:2015, 3.1.17, modified]
3.1.14 information sharing
provision of information from one or more organizations
to a third-party organization or organizations,
the reciprocal exchange of information between
organizations, or the sharing of information between
different parts and/or systems of the same organization
NOTE 1 There are two main types of information
sharing:
a) systematic, routine information sharing where the
same information sets are shared between the
same organizations, or parts of an organization,
for an established purpose; and
b) exceptional, one-off decisions to share information,
for example, in unexpected or emergency
situations, the provision of medical or social care
data to emergency service first responders when
they are responding to an incident.
NOTE 2 Information sharing might take place implicitly,
as well as, explicitly with outsourced services via the use
of cloud services where appropriate security measures
are not in place.
{SOURCE: ICO’s Data Sharing Code of Practice [12],
May 2011, modified}
3
PAS 1085:2018
3.1.15 near-miss
incident in which a security incident is narrowly
avoided, either by chance or through deliberate action
3.1.16 need-to-know
grant of access to data and/or information relating to
assets for an individual or organization where such
access is necessary in order for them to perform their
role satisfactorily and safely
[SOURCE: PAS 1192-5:2015, 3.1.18, modified]
3.1.17 operational technology (OT)
hardware and software that detects or causes a change
through the direct monitoring and/or control of physical
devices, processes and events in the organization
3.1.18 organization
person or group of persons that has its own function
with responsibilities, authorities and relationships to
achieve its objectives
[SOURCE: BS ISO 55000:2014, 3.1.13]
3.1.19 pattern-of-life
identification of habits, routines and preferences
of individual(s) or group(s) that enable prediction
of future actions and/or behaviour
[SOURCE: PAS 185:2017, 3.1.31, modified]
3.1.20 pattern-of-use
identification of routine actions in the handling,
operation and management of assets
NOTE The pattern-of-use of assets could facilitate
malicious pattern-of-life analysis by increasing the
number of data and information sources that can
be combined.
[SOURCE: PAS 185:2017, 3.1.32]
4 © The British Standards Institution 2018
3.1.21 personal data
data which relates to a living individual who can be
identified:
a) from those data; or
b) from those data and other information which is
in the possession of, or is likely to come into the
possession of, the data controller,
and includes any expression of opinion about the
individual and any indication of the intentions of the
data controller or any other person in respect of the
individual
NOTE Under GDPR [2], Article 4(1), personal data
means “any information relating to an identified
or identifiable natural person (‘data subject’); an
identifiable person is one who can be identified,
directly or indirectly, in particular by reference to an
identifier such as name, an identification number,
location data, an online identifier or to one or more
factors specific to the physical, physiological, genetic,
mental, economic, cultural or social identity or that
natural person”. This definition comes into force from
25 May 2018.
{SOURCE: Data Protection Act 1998 [1], Section 1(1)}
3.1.22 personally identifiable information
also known as personal data
3.1.23 personnel
individual(s) employed by an organization, including
contractors or temporary staff used to fulfil roles that
are undertaken by that organization
[SOURCE: PAS 1192-5:2015, 3.1.22]
3.1.24 personnel security
system of policies, processes and procedures that seek
to mitigate the risk of workers (inside an organization)
exploiting their legitimate access to that organization’s
assets for unauthorized purposes
NOTE These measures might be applied to all personnel
that have access to, or use, the asset over its lifecycle,
including personnel employed within the supply chain
used to design, create, operate, decommission or
dispose of the asset.
3.1.25 physical security
multi-layering of different physical measures designed
to deter, detect or delay an attack

3.1.26 processing
obtaining, recording or holding information or data or
carrying out any operation or set of operations on the
information or data, including:
a) organization, adaptation or alteration of the
information or data;
b) retrieval, consultation or use of the information
or data;
c) disclosure of the information or data by
transmission, dissemination or otherwise making
available; or
d) alignment, combination, blocking, erasure or
destruction of the information or data
NOTE Under GDPR [2], Article 4(2), processing
means “any operation or set of operations which is
performed on personal data or on sets of personal
data, whether or not by automated means, such as
collection, recording, organization, structuring, storage,
adaptation or alteration, retrieval, consultation,
use, disclosure by transmission, dissemination or
otherwise making available, alignment or combination,
restriction, erasure or destruction”. This definition
comes into force from 25 May 2018.
{SOURCE: Data Protection Act 1998 [1], Section 1(1)}
3.1.27 referential master data
set of permissible values to be used by other data fields
in shared data and/or shared information sets
NOTE Shared data is data that is subject to formal or
informal data sharing (see 3.1.8). Shared information
is information that is subject to formal or informal
information sharing (see 3.1.14).
3.1.28 related services
services provided in support of the specification,
procurement, configuration, installation, operation and
maintenance of a manufactured product and/or system
NOTE The services could be digital, physical or hybrid in
nature, for example:
a) physical service – the physical installation and
maintenance of the product or system;
b) digital – digital artefacts such as manuals or
websites providing information about the
products(s) and/or system(s) and/or service(s); or
c) hybrid – remote condition monitoring and fault
diagnostics for the product(s) and/or system(s).
© The British Standards Institution 2018
PAS 1085:2018
3.1.29 risk appetite
amount of risk that an organization is willing to seek or
accept in the pursuit of its long-term objectives
NOTE 1 Risk appetite might be set in relation to the
organization as a whole, for different groups of risks,
or at an individual risk level.
NOTE 2 In the manufacturing context, when
determining the risk appetite, the needs and
perspectives of all of the organizations involved should
be taken into account.
{SOURCE: Chartered Institute of Internal Auditors [13]}
3.1.30 risk capacity
resource(s), including financial, intangible and human,
which an organization is able to deploy in managing risk
NOTE The organization’s risk capacity is generally wider
in scope than the risk appetite of the organization as
it represents the limits beyond which the organization
could not cope in the event that the risk(s) occur(s).
For example, when seeking insurance cover, the
organization assesses what residual risk it is prepared
to accept, i.e. its risk appetite which might be reflected
in the excess payable if an insured event occurs, whilst
the level of cover purchased reflects the risk capacity
in respect of the insured risk(s). In assessing its risk
appetite and risk capacity an organization considers
both the gross risk and residual risk exposures, its
reliance on controls and other mitigations, and the
cost of implementing them in comparison to the
consequences of the risk materializing.
{Source: Chartered Institute of Internal Auditors [13]}
3.1.31 risk universe
full range of risks which could impact, either positively
or negatively, on the ability of the organization to
achieve its long-term aims
{SOURCE: Chartered Institute of Internal Auditors [13]}
3.1.32 sabotage
deliberate, malicious action carried out with the aim
of weakening, obstructing, disrupting, damaging or
destroying an asset, activity, service, organization or
other entity
NOTE Sabotage might also be conducted with the aim
of enabling the targeting of a secondary event that
occurs as a result of the original action for example, the
evacuation of a building arising from the sabotage of a
fire alarm.
5
PAS 1085:2018
3.1.33 security
state of relative freedom from threat or harm caused
by deliberate, unwanted, hostile or malicious acts,
including sabotage
{SOURCE: Engineering Council, 2016 [14]}
3.1.34 security incident
event or events during which the security of an asset,
organization or person is, or might be, compromised,
either accidentally or deliberately
NOTE 1 Security incidents can take a number of forms
including:
a) unauthorized harmful modification to, damage to
or destruction of a physical asset;
b) supply of counterfeit raw materials, ingredients,
physical and/or digital components, assemblies or
sub-systems;
c) loss or theft of documents, storage media, IT
equipment, attractive or valuable items;
d) loss, theft or unauthorized access to information
or data;
e) loss, compromise, unauthorized manipulation or
change of project or asset information;
f) unauthorized access to the built asset, or a
restricted access area within the built asset;
g) loss of keys, access control tokens, passes, etc.;
h) planting of bugs or other surveillance devices; and
i) unauthorized access to, misuse of, or fraudulent
use of ICT equipment or systems.
NOTE 2 A near-miss is an event in which a security
incident is narrowly avoided either accidentally or
through deliberate action.
3.1.35 security-minded
understanding and routine application of appropriate
and proportionate security measures in any business
situation so as to deter and/or disrupt hostile, malicious,
fraudulent and criminal behaviours or activities and
reduce the risk of security incidents
[SOURCE: PAS 1192-5:2015, 3.1.26, modified]
3.1.36 sensitive data
data, the loss, misuse or modification of which, or
unauthorized access to, could adversely affect the
privacy, welfare or safety of an individual or individuals;
compromise intellectual property or trade secrets of an
organization; cause commercial or economic harm to an
organization or country; and/or jeopardize the security,
internal and foreign affairs of a nation, depending on
the level of sensitivity and nature of the data
[SOURCE: PAS 1192-5:2015, 3.1.28, modified]
6 © The British Standards Institution 2018
3.1.37 sensitive information
information, the loss, misuse or modification of which,
or unauthorized access to, could adversely affect the
privacy, welfare or safety of an individual or individuals;
compromise intellectual property or trade secrets of an
organization; cause commercial or economic harm to an
organization or country; and/or jeopardize the security,
internal and foreign affairs of a nation, depending on
the level of sensitivity and nature of the information
[SOURCE: PAS 1192-5:2015, 3.1.28, modified]
3.1.38 sensitive personal data
personal data consisting of information as to:
a) racial or ethnic origin of the data subject;
b) his political opinions;
c) his religious beliefs or other beliefs of a similar
nature;
d) whether he is a member of a trade union;
NOTE Within the meaning of the Trade Union and
Labour Relations (Consolidation) Act 1992 [3].
e) his physical or mental health or condition;
f) his sexual life;
g) the commission or alleged commission by him of
any offence; or
h) any proceedings for any offence committed or
alleged to have been committed by him, the
disposal of such proceedings or the sentence of any
court in such proceedings
NOTE Sensitive personal data under the DPA [1] will
be defined as special categories of personal data
under GDPR [2] and this will extend the range of
personal data within this category. Under Article
9, the definition encompasses data which reveals
“racial or ethnic origin, political opinions, religious or
philosophical beliefs, or trade union membership, and
the processing of genetic data, biometric data for the
purpose of uniquely identifying a natural person, data
concerning health or data concerning a natural person’s
sex life or sexual orientation”. This definition comes
into force from 25 May 2018.
{SOURCE: Data Protection Act 1998 [1], Section 2}

3.1.39 service
work done to meet some administrative, general,
or user or customer need
NOTE Within the manufacturing context, a system
supplying a user or customer need includes logistics,
communications, utilities and product or system
support.
3.1.40 stakeholder
third parties such as persons, personnel, or
organizations that have a legitimate interest in the
organization’s manufacturing activities, and/or the
products, systems and any related services it delivers
NOTE The reference to persons encompasses people
affected by the manufacturing operations, customers
of the manufacturer, and any users or people affected
by use of the manufacturer’s products, systems and any
related services.
3.1.41 suitably qualified and experienced person
person who can demonstrate that they have:
a) sufficient evidence, from education, training and/or
experience, to demonstrate:
1) knowledge and understanding of the security
threats and vulnerabilities affecting the
organization, its products and/or services, and
any related services;
2) a detailed understanding of appropriate
and proportionate security controls and
countermeasures; and
3) practical experience of specifying and
managing the implementation of security
controls and countermeasures;
b) sound knowledge of security risk identification,
analysis, evaluation and treatment; and
c) the ability to advise management on the
implementation of security requirements and
security practices for assets that might be subject
to significant and enduring security threats,
opportunities and vulnerabilities
NOTE The organization should undertake appropriate
due diligence to verify the qualifications, training and/
or experience of individuals to ascertain their suitability
for the role, for example, looking for evidence that
the individual has relevant experience. Membership of
a relevant professional body, supported by evidence
of up-to-date risk and security-related continuing
professional development might be appropriate
indications of relevant qualifications and experience.
© The British Standards Institution 2018
PAS 1085:2018
3.1.42 supply chain
network of organizations, directly or indirectly
interlinked and interdependent, resources, activities
and technology involved in the creation and sale of
products and/or systems, and any related services, from
the delivery of source material(s) from the supplier(s) to
the manufacturing organization, through to eventual
delivery to the end user
3.1.43 system
group of interacting, interrelated, or interdependent
elements forming a complex whole
NOTE A system can include physical, digital, process and
human elements.
3.1.44 threat
potential cause of an incident which might result in
harm to an asset(s), individual(s), and/or organization(s)
3.1.45 threat actor
person or organization that can adversely act on assets
3.1.46 vulnerability
weakness that can be exploited by one or more threats
3.2 Abbreviations
For the purposes of this PAS the following
abbreviations apply.
DISA data and information sharing agreement
EDI electronic data interchange
GDPR General Data Protection Regulation
ICO Information Commissioner’s Office
ICT information and communications technology
OT operational technology/technologies
SaaS software as a service
SCSMP supply chain security management plan
SIMP security incident management plan
SMP security management plan
SyOpPs security operating procedures
7
PAS 1085:2018
4 Manufacturing organization’s environment
4.1 Understanding the need for security
in manufacturing
The organization’s board-level management shall
research, document and demonstrate an understanding
of the range of potential security issues that are
applicable to its business, assets, personnel and
the environments and ecosystems in which its
manufactured products, systems and/or related services
are or might be used.
NOTE 1 Security operates on a number of levels ranging
from national security issues (e.g. the protection against
terrorism, tackling organized crime and detecting
hostile acts by nation states), to preserving the value,
longevity and ongoing use of an enterprise’s assets,
whether tangible (e.g. a factory or physical stock), or
intangible (e.g. preventing the loss or disclosure of
intellectual property and nationally or commercially
sensitive information). It also includes the handling
of privacy issues (e.g. the protection of personally
identifiable information).
NOTE 2 Good security can offer competitive advantage
to the manufacturing organization by protecting their
key assets and engendering trust by their stakeholders
and owners or users in the products, systems and
related services that are provided. For those involved
in the design and delivery of new or modified
products or services or the systems that use them, it
can also provide competitive global positioning in an
international market.
NOTE 3 Good security requires holistic risk assessment
and applying the principles of proportionality to
achieve an appropriate balance of the costs and
constraints associated with protecting an asset versus
the impact that its loss, compromise or failure can
have on the organization and the organization’s
stakeholders.
NOTE 4 It is important to recognize that once data
and information has been published on the internet,
or otherwise made publicly available, it is virtually
impossible to delete, destroy, remove or secure all
copies of the released data and information. In
addition, the release of aggregated, apparently
innocuous data and information can result in
exposing sensitive or security information. Therefore,
appropriate checks should be made before any data
and/or information is made widely available.
8 © The British Standards Institution 2018
4.2 Holistic approach to digital
manufacturing security
4.2.1 The organization’s board-level management shall
appreciate that effective security requires a holistic
approach, as illustrated in Figure 5 that addresses
security in respect of the following aspects as a
minimum:
a) people, i.e. the personnel that have access to the
organization’s assets;
b) physical, i.e. the physical environment in which the
organization’s assets are designed, created, used,
stored, and transported;
c) processes, i.e. the business processes used to:
1) acquire, transport, store, manage, maintain,
and dispose of the organization’s assets;
2) design the product(s) and/or system(s) and any
related service(s);
3) manage the classification and sharing of data
and information, both within the organization
and with its supply chain, professional advisers,
customers and potential customers; and
d) technology, i.e. the design, operation, maintenance
or support, decommissioning and disposal of
electronic storage media, ICT equipment and
systems, and the OT used by the organization.
NOTE Effective security reduces security risks to the
lowest reasonably practicable level having due regard
for the severity and likelihood of risks both individually
and in combination and their impact on both the
organization and its stakeholders. When assessing and
treating risks, organizations should focus on developing
and adopting appropriate and proportionate controls
or countermeasures rather than focusing primarily on
adopting specific physical or technological measures.
 PAS 1085:2018

Figure 5 – Holistic approach to security

  

 

 
 
!
  

 
 
!
 
 


 


  

 
!
 



  
   

   

 


    

 



 



 
 
  
!

 

NOTE The eight security goals (confidentiality, availability, safety, resilience, possession, authenticity, utility and
integrity) are applicable across the four security domains (people, physical, process and technical). For example,
the physical composition of a digital processing system can affect the integrity of the data and/or information
it processes, which can result in a loss of availability of a safety critical process leading to potential harm to the
vehicle’s user or to a pedestrian.

4.2.2 The organization’s board-level management shall
be aware of the cyber-physical security risks that arise
where digital assets and processes have an impact on
the physical characteristics of a manufactured asset
associated with a product or service.
4.3 Digital manufacturing security issues
4.3.1 Loss or disclosure of intellectual property
The organization’s board-level management shall
research, document and demonstrate an understanding
of the need to protect its own and others’ intellectual
property, which it holds, or which might be developed,
and shall assess and record the potential consequences
of the loss of, unauthorized access to, or improper use
or re-use of that information.
NOTE 1 Intellectual property encompasses a range of
material, including trade secrets, proprietary processes,
technical specifications and detailed calculations or
methodologies. Organizations often invest heavily in
the development of intellectual property and through
its use, licensing and sale can deliver significant
commercial and economic benefits. The piracy, theft
or unauthorized use of intellectual property can be
damaging to the organization and a country’s economy
as a whole.

© The British Standards Institution 2018 9

PAS 1085:2018
NOTE 2 Some intellectual property is sensitive
information that can be used to manifest a physical
result in a manufactured object, in which case it
irretrievably crosses the cyber-physical boundary. This
behaviour has some, but not all, of the characteristics
of disclosure, and should be taken into account when
considering the protection of intellectual property.
The sensitive data and/or information might include
or reflect:
a) the composition or treatment of materials used in
its manufacture;
b) proprietary aspects of the manufacturing process;
and
c) where the object contains digital elements, the
design and operation of those elements.
NOTE 3 Consideration should be given to the protection
of intellectual property from loss, unauthorized access,
or improper use or re-use. Scenarios to be considered
might include:
a) development and use of intellectual property
within the organization;
b) collaboration with third-parties, including
universities and research institutes, through the
lifecycle of the intellectual property;
c) disclosure of intellectual property to third-
parties, including professional advisers and the
organization’s supply chain;
d) publication or presentation of data and/or
information relating to the intellectual property,
for example in white papers, conference or trade
publications; and
e) disclosure of intellectual property due to accessible
characteristics of a product, system or service itself.
4.3.2 Criminal and malicious acts
The organization’s board-level management shall
research, document and demonstrate an understanding
of the need to protect from criminal acts its own
personnel and others’:
a) assets; and
NOTE 1 Potential threats to the organization’s
assets include theft, damage and sabotage. The
physical security of the assets should be considered
throughout their lifecycle.
NOTE 2 Where the assets are digital (for example,
electronic files, designs, databases, etc.) or
where the assets are systems that depend on ICT
equipment and systems and/or the OT, there are
increased business risks arising from malicious acts
caused by a range of external and insider threats,
such as damage caused by malware, hackers or
disaffected personnel.
10
b) operations.
NOTE 1 The increasing use of email, EDI,
collaborative platforms, websites and supplier
portals to share information, place and track
orders and/or deliveries, submit invoices, manage
enquiries, and to monitor, manage and/or
maintain deployed products or systems can provide
opportunities for malicious use of these channels
to commit fraud, gain unauthorized access to
information and/or allow the spread of malware.
There is increased business risk arising from loss,
misuse or incorrect allocation of user credentials
(for example through failure to verify the identity
of a new user).
NOTE 2 Widespread use of digital and information
technologies and the outsourcing of business
operations creates increased business risks which
could manifest themselves as loss of availability,
functionality or performance, or the loss or
corruption of digital artefacts, and the physical
products that directly depend on them, including
those manufactured using them.
4.3.3 Counterfeit and contaminated supplies
The organization’s board-level management shall
research, document and demonstrate an understanding
of the need to apply due diligence to reduce the risk of
obtaining counterfeit, maliciously or fraudulently sub-
standard, or contaminated items when purchasing assets,
including raw materials, ingredients or manufactured
items that are used in its own manufactured products or
systems and any related services.
NOTE 1 The provenance of raw materials, ingredients,
manufactured supplies and assets, and the integrity of
the supply chain and logistics services used to handle
them are both important if an organization is to reduce
the risk of inferior, counterfeit or contaminated items
entering their supply chain or facility. This might be as
a result of the actions or inaction of a supplier or as a
result of substitution in the sales and supply chain, for
example where supplies are purchased as grey imports,
i.e. outside of the authorized supply and distribution
channels used by the original manufacturer or
material supplier.
NOTE 2 Counterfeit and contaminated supplies
are those which are deliberately and fraudulently
mislabelled or described with respect to their identity,
composition and/or source. Counterfeiting can apply
to both branded and generic materials or products and
the counterfeit might include elements:
• with the correct or incorrect ingredients/components;
• with or without insufficient key ingredients/
components; or
• with fake packaging.
© The British Standards Institution 2018

4.3.4 Loss or disclosure of commercially sensitive
information
The organization’s board-level management shall
research, document and demonstrate an understanding
of the need to protect pricing, price sensitive or market
sensitive data and/or information, especially during
a tender, procurement or merger and acquisition
processes, and shall understand the potential
consequences of the loss of, or unauthorized access to,
that information.
NOTE 1 In competitive markets, there is a need to
address the risks of commercial espionage, including
measures to prevent the loss of, or unauthorized access
to, pricing or price sensitive data. Failure to provide
adequate protection of sensitive information during
tendering processes can damage both purchasers
and suppliers.
NOTE 2 During preliminary discussions, negotiations
and due diligence phases of a merger or acquisition,
the organization might be required to disclose
sensitive information relating to its business and
manufacturing operations and its intellectual property.
The organization’s board-level management should
be aware of the risk of this information being
compromised or issued, particularly in the event
that the merger or acquisition does not proceed
to completion.
NOTE 3 In situations where professional advisers
(for example lenders, financial advisers, accountants,
legal advisers, patent agents, etc.) are involved in a
transaction, for example supporting the negotiation
of a major sale or acquisition, appropriate and
proportionate protection of any sensitive information
held or accessed by the advisers should be addressed
in the advisers’ contracts, including remedies available
in the event of loss or compromise of the information
whilst in the possession or control of the advisers.
4.3.5 Release of personally identifiable information
The organization’s board-level management shall
research, document and demonstrate an understanding
of the need to safeguard personally identifiable
information, in particular when responding to requests
for information under Environmental Information
Regulations [4] or where applicable the Freedom of
Information Act [5 and 6].
NOTE 1 At a minimum, all manufacturing organizations
are likely to hold personally identifiable information
about their current, former and potential new
personnel. Depending on the nature of the products
or systems manufactured by the organization, it might
also hold personally identifiable information about
stakeholders, for example information about:
• suppliers, professional advisers;
© The British Standards Institution 2018
PAS 1085:2018
• customers or end users of directly purchased items; and
• customer/user data and/or information relating to
warranty or support enquiries.
NOTE 2 Unauthorized access to personally identifiable
information can enable more targeted social
engineering and phishing attacks.
NOTE 3 Increasingly manufactured products, systems
and related services handle personal data and/or
information, so should be designed with the privacy
requirements and responsibilities of their users/owners
and operators in mind.
NOTE 4 The objectives of the Security of Network
and Information Systems Directive (also known as the
NIS Directive) [11] and its supporting principles are
relevant when considering the protection of data and
information, and/or seeking to reduce the risk and
impact of cyber-attacks.
4.3.6 Pattern-of-use information
The organization’s board-level management shall
research, document and demonstrate the need to
safeguard pattern-of-use information, which might be
used as a source of intelligence regarding the:
a) use of its manufacturing equipment;
NOTE The move towards servitization of assets,
e.g. power-by-the-hour rental of generators, and
the use of remote monitoring to support predictive
maintenance, remote diagnostics and reactive
support contracts might result in significant
volumes of sensitive pattern-of-use data being
collected, processed and stored by third-parties.
b) operation of its supply chain; and
NOTE Analysis of delivery patterns, volumes, etc.
can reveal commercially sensitive information
about the operation of a plant, or the preparations
for launch of a new product, etc.
c) location and use of manufactured artefacts once
deployed and in operation.
NOTE The presence or absence of telemetry data
from industrial systems, plant and machinery
can provide market sensitive information about
the state of a plant or site and its readiness for
production.
NOTE Pattern-of-use information can assist a hostile
or malicious party when they are performing hostile
reconnaissance by revealing data and information
about how a process, system or manufactured artefact
operates, frequency and duration of use, and in some
cases the location at which it is being used.
11
PAS 1085:2018

4.3.7 Aggregation of data and/or information

For sensitive or potentially sensitive assets, the
organization’s board-level management shall require
that advice is sought to gain an understanding of
the increased risks and sensitivity that occur through
aggregation of data and/or information.
NOTE 1 Sources of advice can include suitably qualified
and experienced persons within the organization and/
or specialist security advisers outside the organization.
NOTE 2 Aggregation can occur through manual
or automated processes and refers to where data
is collected and collated, and possibly analysed
to allow meaningful and useful interpretation of
initially isolated or independent facts or data. It has
the potential to increase the business impact of any
compromise, whether accidental or intentional. The
data aggregation risks can arise from:
a) aggregation by accumulation, where the volume
of data and/or information stored together
increases the level of impact that would occur if
it was compromised;
b) aggregation by association, where the association
of different types of data and/or information,
which in themselves have little or no impact when
compromised, when associated together, have a
higher level of impact;
c) a combination of accumulation and association; or
d) disclosure of too much data and/or information,
e.g. in response to a public access request or media
enquiry, allowing a third-party to draw inferences
from the disclosed material or create unplanned
associations.
NOTE 3 Individual facts, data or information items
might not create a harmful situation, but through
aggregation could allow a hostile party to develop a
better understanding and more comprehensive picture
regarding the operation of the organization, its supply
chain, customer, professional advisers and the use of
items it manufactures.
NOTE 4 The increased connectivity and servitization
of products and systems, contribute to the potential
security issues arising from aggregation of data and/or
information regarding the use, location, deployment,
etc. of products and systems. Particular care is required
with complex products and/or systems where there
might be multiple feeds of data and/or information to
both the organization and some of it suppliers.

12 © The British Standards Institution 2018


5 Security governance
5.1 Establishing context
5.1.1 The organization’s board-level management
shall own, manage and govern security within the
organization and in relation to its supply chain,
by adopting a security-minded approach that is
documented in a security strategy. It shall apply to
its business and manufacturing operations, including
manufacturing systems-related assets, and to the
products, systems and/or related services that it delivers.
5.1.2 To fulfil the requirements set out in 5.1.1, the
organization’s board-level management shall establish
the organization’s context, as illustrated in Figure 6 by:
a) identifying, assessing and documenting security
requirements arising from legislation, regulations
and standards applicable to its operations and the
products and/or systems that it manufactures, and
any related services provided;
NOTE 1 Some security requirements can arise
from the organization’s role within a supply chain,
for example where an organization is regularly
shipping substantial volumes of air cargo it can
apply to become a regulated agent, providing
its operations meet specific security criteria. This
eliminates the need for further searching or
screening on receipt of the cargo at the airport,
thus facilitating the smooth passage of cargo to
its destination.
NOTE 2 If the organization operates in, and/or
its manufactured products are used in, multiple
jurisdictions, there might be a complex portfolio
of requirements that need to be satisfied.
b) researching and documenting the:
1) operating and business environments within
which its business, supply chain, manufacturing
facilities operate, and in which its products,
systems and related services are and might be
used in future;
NOTE This should consider the political,
economic (both financial and competitive),
social, technological, legal (including
jurisdiction, legislation and regulatory) and
environmental factors that affect or could
affect the organization, but specifically focus
on security-related aspects.
© The British Standards Institution 2018
PAS 1085:2018
2) threat landscape, based on the organization’s
scope as determined in accordance with 5.2
and taking into account known and potential
security risks, vulnerabilities and threat actors;
NOTE Depending on the scope of the
organization’s activities the above factors
might need to be addressed at international,
national, regional and/or local levels.
c) identifying, assessing and documenting the
needs and expectations of its stakeholders
regarding the security of the organization and
its manufactured items;
d) identifying, assessing and documenting the
organization’s plans and objectives, the key
drivers and trends having impact on them, and
the potential security implications;
e) establishing, documenting and maintaining a
record of the organization’s:
1) scope (see 5.2);
NOTE The organization’s scope encompasses
the nature and scale of its past, present
and planned or foreseeable business and
manufacturing activities. The scope also
determines its current and future security
liabilities. Past business activities are relevant
as they might result in latent liabilities,
for example:
i) security liabilities arising from known or
emergent vulnerabilities;
ii) product liabilities arising from defects in
the manufacturing process, including any
associated digital artefacts;
iii) service liabilities arising from failures,
including non-availability of any
manufacturing related services; and
iv) professional indemnity liabilities arising
from negligent or defective delivery of
design or advisory services.
2) governance approach (see 5.3);
3) security context; and
NOTE The security context is determined by:
i) external factors such as legislation,
regulation and standards, the
organization’s operating and business
environments, the threat landscape, and
stakeholder needs;
13
PAS 1085:2018
ii) internal factors such as the organization’s
plans and objective, its scope of
operations; and
iii) the nature and use to which its
manufactured items are put, the
security threats to which it and similar
organizations are exposed, and the nature
of vulnerabilities in the products or systems
it manufactures.
4) risk appetite (see 5.4).
NOTE Where an organization has existing
products, systems or services in use the
security context relates to historic, current
and emergent security issues. For example,
where a legacy product is still in use and
a security vulnerability emerges, which
if exploited would have serious safety or
security consequences, the organization might
have a legal responsibility to mitigate the
vulnerability.
Figure 6 – Establishing the organization’s context
NOTE The concept of a holistic security-minded approach is described in 4.2.
14
5.1.3 The organization’s security strategy shall:
a) be aligned with the organization’s broader mission
and objectives;
b) be consistent with and supportive of the
organization’s context as determined in 5.1.2;
c) establish the security goals in respect of:
1) the business architecture and its through-life
management of the organization, its data,
information, products, systems, services,
processes and structures;
2) capability development through security
awareness initiatives, training and development
so that personnel can acquire and maintain
awareness and competence to fulfil their roles in
a security-minded fashion and contribute to an
effective security culture; and
3) management of security risks across the
organization, its supply chain, customers and
the users or operators of its products, systems
and/or related services;
© The British Standards Institution 2018

d) establish the need for and scope of a reporting
system used to inform the organization’s board-
level management of the effectiveness of security
measures, including handling of security incidents
and any subsequent mitigation activities or
improvement initiatives;
e) set out the process that is to be regularly used to
review and maintain the organization’s security to
reflect changes in the security context through:
1) implementation of new or amended
legislation, regulation and standards;
2) developments in: and
i) the organization’s structure, processes,
business plans and objectives;
ii) its data, information, products, systems,
services;
iii) the operating environment for the
business and its products and/or systems,
and any related services; and
iv) stakeholder needs;
3) changes to the security threat landscape, for
example emerging threat actors, threats,
opportunities and vulnerabilities;
f) be reviewed at least annually or earlier if there are:
1) significant changes to any of the items listed in
5.1.3e); or
2) following a security incident, or a near miss
(i.e. a narrow avoidance of a security incident).
5.1.4 The organization’s board-level management shall
ensure that its business plans and strategies are aligned
to the organization’s security strategy.
NOTE For example, if the organization’s human
resource strategy involves employment of contractors
to fill certain roles or give flexibility to meet varying
demand, then the security strategy should address
the need to have appropriate policies, processes and
procedures in place to manage security vetting of
contractors employed in sensitive roles.
5.2 Determining the organization’s scope
5.2.1 The organization’s board-level management
shall establish, document and maintain a record of
the organization’s scope, which as a minimum shall
comprise an overview of the:
a) organization’s assets, both physical and digital;
b) organization’s current operations, to include:
1) the locations at which it operates;
© The British Standards Institution 2018
PAS 1085:2018
2) the organization’s ICT equipment and systems,
including any outsourced or externally hosted
components;
3) the organization’s OT;
NOTE The organization’s OT, at a minimum,
comprises the organization’s manufacturing
systems and might also include systems used to
secure and control the manufacturing and/or
storage environments.
c) type of items manufactured, encompassing:
1) items likely to still be in use, but no longer
manufactured;
2) currently manufactured items and services
associated with them;
3) planned new manufactured items and services
associated with them; and
4) any services offered in support of 5.2.1c) 1)
and 2).
NOTE The purpose of this activity is for the
business to make decisions about what markets
it wishes to operate in. Depending on the nature
of the manufacturer’s products, systems and any
related services moving into different markets or
territories may change the security threats that the
organization is exposed to.
d) organization’s supply chain, to include suppliers of:
1) raw materials or ingredients;
2) physical products (e.g. components, sub-
assemblies, systems and equipment) which are:
i) incorporated in the manufactured items;
ii) used during the manufacture, storage,
shipping and maintenance of the
manufactured items; and
NOTE An appropriate and proportionate
approach is required, for example, the
arrangements for storage or shipping
may not be an issue unless they involve
specific handling conditions and packaging
to: protect very fragile items; prevent
contamination; deter, prevent and/or detect
any interference with the shipped items.
iii) used to manage the manufacturing
processes;
3) digital products/artefacts that are used by or to
manufacture, shipped with or incorporated in
the items listed in 5.2.1d) 2).
NOTE See 8.2 regarding understanding the
organization’s supply chain
15
PAS 1085:2018
5.3 Security governance and
management
5.3.1 The organization’s board-level management shall
establish a structure to manage the organization’s
security-related requirements, which is commensurate
with the documentation specified in 5.1.2b).
5.3.2 The security management responsibilities within
the organization’s board-level management shall:
a) set out the personal accountability of board-level
managers for the ownership and management of
security risks;
b) where applicable, the arrangements for delegation
within the organization of responsibility, but not
accountability, for security of specific processes,
assets, products, systems and services; and
c) establish the arrangements for the periodic
review and, where necessary, updating of security
management responsibilities to reflect changes to
the organization, its business processes, operations
and assets.
NOTE The organization’s board-level management
might consider that an annual or biennial review
is appropriate and proportionate, but with the
option to conduct ad hoc reviews in the event
of serious security incidents and/or prior to
any significant changes to the organization, its
operations, products and/or services, and any
related services.
5.3.3 Where the organization’s board-level management
agrees to delegate specific security responsibilities,
this shall be documented however, accountability shall
remain with the board-level managers.
16
5.4 Determining the risk appetite
The organization’s board-level management shall
establish, document and maintain a record of the
organization’s risk appetite in a statement that:
a) establishes direct links to the organization’s plans
and objectives;
b) recognizes the organization has a portfolio of
objectives, manufactured items, services and
projects;
c) establishes a risk management strategy through
allocation of resources, including people, the use of
processes and the architecture and operation of the
organization’s physical and technical infrastructure;
d) provides clarity and precision to enable
communication of its risk appetite throughout the
organization;
e) sets acceptable tolerances and parameters for risk;
f) specifies the frequency of regular reviews and
updates to the statement to address changes in
the risk universe and the organization’s risk
capacity; and
g) establishes the monitoring and assurance policies,
processes and procedures required to ensure
effective and consistent application of the risk
management strategy.
© The British Standards Institution 2018

6 Assessing and managing security risks
NOTE When identifying security risks, it is appropriate
to consider them from a number of perspectives,
including:
• operational, i.e. the potential impact on the business
through disruption of business and/or manufacturing
activities, reputational damage;
• confidentiality and privacy, i.e. the loss of or
unauthorized access to sensitive information and/or
personally identifiable information;
• safety, i.e. the potential harm to individuals, assets or
the environment arising from the failure, in whole or
in part, or misuse of manufacturing-related systems
or the manufactured products and/or systems and any
related services;
• financial, i.e. the costs associate with managing and
responding to a security incident, any subsequent
legal costs, fines, etc., and the potential loss of
income or profit as a result of diverting resources
during a security incident response;
Figure 7 – Security concepts and relationships
© The British Standards Institution 2018
PAS 1085:2018
• legal, arising from non-compliance with legislation or
regulations, e.g. data protection; and
• third-parties, arising from harm caused to one or
more third-parties, for example spreading malware
to third-party products or systems, provision of
inaccurate or misleading data and/or information
leading to corruption of databases, etc.
6.1 Security risk management approach
6.1.1 The organization’s board-level management shall
establish, document and operate an appropriate and
proportionate approach to security risk management.
6.1.2 The organization’s risk management processes
shall encompass identification, categorization,
prioritization and treatment of security risks.
6.1.3 The organization shall acquire knowledge of the
concepts and relationships illustrated in Figure 7 as
they relate to the organization’s assets, particularly its
manufacturing-related assets, and the manufactured
products and/or systems, and any related services.
17
PAS 1085:2018
6.1.4 The security risks to be considered shall include
those to the organization’s:
a) business operations, critical assets and functions;
b) manufacturing assets;
c) manufactured products and/or systems and any
related services;
d) supply chain, considering both the suppliers and
the materials or services they supply; and
e) to others arising from a failure to implement
appropriate and proportionate security measures in
respect of 6.1.4a) to d).
NOTE 1 There is a complex relationship between safety
(hazards) and security (threats) in all cyber-physical
products and systems. Both can result in adversity.
Products and/or systems, and any related services, are
unlikely to be safe if not appropriately secured. The
organization should aim to reduce the risk of a threat
actor exploiting a vulnerability that could result in
damage to the manufactured products and/or systems,
other assets or the environment, or result in serious injury
or death as a consequence of the failure or misuse of the
manufactured items or manufacturing-related assets.
NOTE 2 In December 2014, the German government
released an annual report, in which they noted that
a threat actor had infiltrated a steel manufacturing
facility by using a spear phishing email to gain access to
the corporate network and then moved into the plant
network. According to the report, the threat actor was
able to cause multiple components of the system to
fail. This security incident specifically impacted critical
process components to become unregulated, which
resulted in massive physical damage to the asset.2)
6.2 Asset-based risk register
6.2.1 The organization’s board-level management shall
develop, document and maintain an asset-based risk
register, which encompasses the known security risks
to an organization’s assets as defined in 6.1.4, and
where the scope of the risk assessment for the assets is
consistent with:
a) the security context of the organization; and
b) the security strategy that has been approved by
organization’s board-level management.
NOTE In considering known risks this should be
interpreted as encompassing the security risks which it
could reasonably be judged to affect the items listed
in 6.1.4. For example, if the organization is delivering
a web-based customer support service, it would be
reasonable to expect that the website has addressed
known technical vulnerabilities including, for example,
the OWASP 3) top 10 web application vulnerabilities.
2)
For further information on this incident see: https://ics.sans.org/
media/ICS-CPPE-case-Study-2-German-Steelworks_Facility.pdf [15].
3)
See: www.owasp.org [16].
18
6.2.2 The asset-based risk register, shall be developed
using the approach outlined in Figure 8, where the key
steps are:
a) to identify and decompose organization’s assets to
an appropriate level;
NOTE 1 In a similar manner to techniques such as
Failure Mode Effects Analysis (FMEA) there is likely
to be a need to decompose complex or hybrid
assets into their constituent parts. For example, in
a cyber-physical system there is a need to consider
the risks associated with the physical elements, the
cyber (digital elements) and their combination. The
decomposition might therefore consider the risk
of vandalism or malicious damage to key physical
components as well as the threats arising from hackers
or malware that affect the digital control systems.
NOTE 2 When considering what is an appropriate
level to decompose the assets to, the objective is to
identify the lowest level at which risk is going to be
managed. For example, when considering an office
computer, the minimum decomposition might be
applications, operating system, processing hardware
and any networking or communications connectivity.
Depending on the nature of its use and the sensitivity
of any data and/or information processed on it,
additional decomposition might be required to cover
data storage and any access control mechanisms.
b) to asses and identify for each asset:
1) its criticality and the impact of:
i) its loss, corruption or compromise;
ii) its failure, either partially or as a whole;
iii) its misuse or abuse (whether unintentional
or malicious); and
iv) its incorrect operation on the
manufactured item;
2) its vulnerabilities;
3) its hazards; and
4) potential threats and opportunities;
c) to assess and determine the attractiveness of each
asset to specific threat actors by considering their
motivation and capability; 
d) to use the information gathered in 6.2.2a) to c),
to synthesize and prioritize the potential risks to
the organization, its manufacturing processes, its
manufactured products and/or systems, and any
related services;
e) to consider the security risks that arise through
the composition, integration and/or interaction of
components, sub-systems and systems, and where
appropriate their interaction as systems-of-systems;
NOTE The composition, integration and/
or interaction risks arise from the selection
of elements and how they are integrated.
Complementary weaknesses in two or more
products that are being integrated can significantly
increase the risks of exposure of the combined
vulnerability and subsequent exploitation.
© The British Standards Institution 2018

f) to consider risks arising from data and/or
information aggregation:
1) within the organization; and
2) through the data and/or information
generated and/or processed by its products
and/or systems, and any related services;
NOTE See 4.3.7 for further information on
aggregation of data and/or information, and
11.2 regarding aggregation of public/published
data and/or information.
g) to take each of the risks in turn, as part of an
iterative process considering the acceptability of
the risk, taking into account:
1) the available risk capacity of the organization;
NOTE The organization’s risk appetite
is determined when considering the
organization’s context.
2) the combinational effects of risks; and
NOTE Combinational effects occur where
there is a linear path of negative events. In
the context of a cyber incident, this is often
called an “attack path”. For example, in the
security incident involving loss of customer
card data from Target stores,4) the supplier’s
use of a home anti-virus product failed to
detect password logging malware attached
to an email, which allowed capture of the
login credentials for Target’s supplier portal,
and the poor configuration, use of default
passwords and failure to apply security patches
allowed the criminals to install malware
on the company’s point of sale systems,
thus harvesting information on some 40
million consumer credit and debit cards. This
combination of risks created the environment
that made the attack possible.
3) the cascading effects of risks;
NOTE 1 Cascading effects occur where there is
a non-linear path of events occurring, including
amplification and subsidiary negative events
or outcomes. The cascade effect is particularly
likely to occur in complex systems, i.e. systems
of systems, where there is not a simple linear
relationship between systems or sub-systems.
In these cases, rather than the effect of
the risk spreading in a simple longitudinal
fashion, instead the effect spreads like a ripple
affecting multiple assets that might not be
directly connected to each other.
4)
US Senate Report on the incident. Available from: www.
commerce.senate.gov/public/_cache/files/24d3c229-4f2f-405d-
b8db-a3a67f183883/23E30AA955B5C00FE57CFD70962159
2C.2014-0325-target-kill-chain-analysis.pdf [17].
© The British Standards Institution 2018
PAS 1085:2018
NOTE 2 It is important that risks are not
considered in isolation. In a complex
manufacturing process or environment there
might be considerable interaction between
risks. For example, a manufacturing system
might include a digital component that has
a known vulnerability. A risk assessment
concludes this to be of low risk as the system is
behind the enterprise’s firewall. However, the
risk of the known vulnerability being exploited
is likely also to be contingent on the protection
of any remote diagnostic capability with the
factory, the policies regarding the use of
removable media, bring your own devices and
the handling of email attachments.
h) where a risk is considered to be acceptable, review
and update the organization’s risk capacity to
reflect the risk being carried;
i) where a risk is considered unacceptable:
1) identify and assess potential mitigation
measures;
2) select and apply as appropriate;
3) record the risk treatment; and
4) return the residual risk to the identification
and analysis stage;
j) to consider for the portfolio of risks: and
1) the nature of the threat environment(s);
2) an appropriate and proportionate frequency
for the scheduling of risk reviews to re-
evaluate the risk portfolio; and
NOTE The organization’s board-level
management might consider that annual
or biennial reviews are sufficient, however
the frequency should be determined by how
dynamic the threat environment is.
3) the triggers that would prompt an ad hoc
review of some or all of the risk portfolio;
NOTE Triggers can include: the emergence of a
new threat actor; changes in the security context;
identification of new/emerging vulnerabilities;
and identification or publication of new exploits
enabling easier access to vulnerabilities or
increasing their impact.
k) to maintain situational awareness by monitoring:
1) risks and opportunities;
2) emerging threats and vulnerabilities; and
3) the organization’s scope and security context.
19
PAS 1085:2018

Figure 8 – Risk management approach

20 © The British Standards Institution 2018


6.2.3 The asset-based risk register shall contain:
a) a list of the organization’s:
1) business assets; and
2) manufacturing-related assets;
NOTE The use of the term asset in Clause 6 includes
asset data and asset information and inventory or
stock items that are available but not yet in use.
b) appropriate and proportionate decomposition of
the assets listed in 6.2.2a) to the level at which they
are supplied to, purchased, licensed or created by
the organization;
c) contain the risks related to: and
1) the organization;
2) its supply chain;
3) its manufacturing-related assets; and
4) its manufactured products and/or systems, and
any related services;
d) allow separation and analysis of the risks by:
1) the categories listed in 6.2.2a), taking into
account the decomposition required in 6.2.2b);
2) individual suppliers in its supply chain;
3) where known, the products, systems or services
in which the manufactured items, and any
related services, are used or installed; and
4) customers, where the organization is not
selling its products, systems or services to the
end consumer.
NOTE Where the organization is selling its
products, systems or services to a systems
integrator, manufacturer or assembler, it is
the identity of this third-party that should be
recorded so that they can be notified of any
future security issues.
6.2.4 For each risk in the asset-based risk register, the
following shall be recorded:
a) a unique risk identifier;
b) a name or title for the risk;
c) the asset(s) affected by the risk;
d) the scope of the risk, including details of the possible
risk event(s) and their size, type and number;
NOTE The scope of the risk determines the
boundaries of the impact, for example whether
the risks affects multiple items as it arises from
a component within them, for example a defect
in an integrated circuit, circuit board or piece
of software.
© The British Standards Institution 2018
PAS 1085:2018
e) the stakeholders, both internal and external,
and their expectations in the event that a risk
event occurs;
f) the risk evaluation, including the likelihood of an
event occurring and its magnitude, and potential
impact or consequence should the risk materialize
at the assessed level;
g) any loss experienced, for example information from
previous incidents and any prior experience of loss
events related to this risk;
h) risk tolerance or limit for the risk, i.e. the
acceptable loss potential or financial impact in the
event that a risk event occurs, and any targets for
controlling the risk or limiting performance impact;
i) the risk response, treatment and controls, i.e. the
mechanisms to be used to manage the risk and
control its impact and the mechanisms to be used
to monitor and review their performance;
j) the potential optimizing of risk management
across the portfolio of risks, i.e. the potential
for cost-effective risk reduction or modification,
timescales and responsibility for implementation; and
k) the ownership of the risk, i.e. who is responsible for
monitoring compliance with any controls and the
risk management strategy.
NOTE Unless explicitly delegated as part of the
security strategy, the risk owner should be a
board-level manager.
NOTE The consequences or impact of a risk materializing
can be negative (i.e. hazard risks), positive (i.e.
opportunity risks) or might result in further uncertainty.
6.2.5 The information contained in the asset-based
risk register, either in whole or in part, is sensitive
information and access to it shall be managed on a
need-to-know basis, with security measures implemented
that are appropriate to the level of risk, with regard to
its creation, storage, distribution and use.
21
PAS 1085:2018
7 Implementing the organization’s security strategy
7.1 General
To give effect to the organization’s security strategy
(see 5.1), the organization’s board-level management
shall develop, document, implement and maintain a
security management plan that addresses the specific
security objectives in the organization’s security
strategy and the controls required to treat the risks
identified in the organization’s asset-based risk register.
7.2 Security management plan (SMP)
7.2.1 The SMP shall apply across all of the organization’s
activities, in particular in respect of:
a) management and sharing of data and information
(see Clause 11);
b) the development and delivery of new
manufacturing assets or processes;
c) the operation of existing business and
manufacturing assets and processes in the
organization’s digital ecosystem;
d) the organization’s manufactured products, systems
and/or related services; and
e) the decommissioning, and transfer or disposal
of manufacturing-related assets when no longer
required by the organization.
7.2.2 The SMP shall cover the people, processes,
physical and technological aspects of the organization’s
operations by addressing the following elements:
a) policies which set out the security-related business
rules derived from the security strategy;
b) processes which:
1) are derived from the security policies;
2) provide or enable the controls required in the
asset-based risk register; and
3) provide guidance on their consistent
implementation throughout the lifecycle of the
asset;
c) procedures that comprise the detailed work
instructions relating to repeatable and consistent
mechanisms for the implementation and
operational delivery of the processes and controls;
d) the monitoring and auditing requirements that are
to be used to measure effectiveness of the plan and
compliance with policy, processes and procedures;
22
e) the mechanisms for reviewing and updating the
SMP and related documents;
f) a security incident management plan (see 7.3); and
g) a supply chain security management plan (see 7.4).
NOTE Depending on the size and/or nature of the
organization the SMP might be a single document
containing all of the elements listed above or it might
be an overarching document that references a suite of
documents covering the elements.
7.3 Security Incident Management Plan
(SIMP)
7.3.1 The SIMP is intended to enable an effective and
coordinated response to incidents and shall include:
a) a summary of the risk assessment of potential risks
in the event of a security incident;
NOTE The risks should be recorded in the asset-based
risk register, and only a brief summary provided in
this plan.
b) the policy, processes and procedures to be followed
in the event of an actual or suspected security
incident, which shall include:
1) the forensic readiness measures required to
enable, when required, the capture of forensic
information about an incident for use by law
enforcement, and/or detailed analysis of the
root causes of the incidents;
2) the process to be followed on the discovery or
suspicion of an incident;
3) the process to be followed on identification of
a near-miss;
4) business continuity measures required in the event
of failure, impairment or non-availability of:
i) the manufacturing-related assets; and
ii) any systems providing or supporting
services associated with the manufactured
products and/or systems;
© The British Standards Institution 2018
 PAS 1085:2018

5) any manufactured products and/or systems
outside of the organization’s premises that are
affected by a security incident;
NOTE The extent to which the manufacturer
might be required to provide this depends on
the nature of the manufactured items, the
warranty and contractual provisions and might
also be determined by legislation or regulation
applicable in the jurisdiction in which the
manufactured items are located and/or used.
6) notification by a third-party of a security
incident concerning the organization’s
manufactured products and/or systems, or
related services;
NOTE Examples of potential third-parties
include: a supplier to the organization; or
a customer of the organization (where the
manufactured items or related services are not
supplied directly to an end user); or the end
user(s) of the organization’s manufactured
products and/or systems, or related services.
7) the disaster/incident recovery actions required
in the event of serious failure scenarios
affecting or likely to affect; and
i) the manufacturing-related assets; and
ii) any systems providing or supporting
services associated with the manufactured
products and/or systems;
e) the review process to be followed after a security
incident, or near miss, including:
1) the process for assessing the ongoing risk;
2) the process for evaluating the incident and
the response;
3) a review of any hosting or cloud service
provider’s, or other outsourced service
provider’s incident management plan where
applicable;
4) the need for changes to the contractual
provisions to handle security incidents caused
by a professional advisor, contractor or
supplier; and
5) the mechanisms for reviewing and updating
the SIMP.
7.3.2 Access to any part of the SIMP which
details sensitive information (for example, risks
to the organization, its function, processes,
manufacturing-related assets, personnel and
third-parties) shall be managed on a strict
need-to-know basis, with the information contained
within it subject to security measures with regard to
its creation, storage, distribution and use.
7.3.3 For those elements of the SIMP which address
policies, processes and procedures relating to incidents
the initial business continuity actions shall be:

8) steps to be taken to contain and recover from a) written so that, as far as is practicable, they do not
the event. contain sensitive information;

c) the arrangements where applicable to access b) made available to all relevant personnel; and
data and logs on affected or potentially affected c) periodically rehearsed, to maintain awareness and
manufacturing-related systems used by the to test their effectiveness.
organization, including:
1) what can be accessed and why;
7.4 Supply Chain Security Management
2) how the data and/or logs are to be used;
Plan (SCSMP)
3) under what circumstances they can be
accessed; 7.4.1 The organization’s board-level management shall
4) who is authorized to access the data and/or logs; develop, document, implement and maintain a SCSMP
that defines the contractual and operational measures
5) how the data and/or logs are to be protected;
required for the adoption of an appropriate and
and
proportionate security-minded approach throughout
6) the arrangements for the secure deletion of the organization’s supply chain.
the data and/or logs when no longer required.
d) where, in accordance with 7.3.1b) 4), the
organization is required to assist the owner and/
or user of a manufactured product and/or system,
and any related service, the arrangements where
applicable to access data and logs as specified in
7.3.1c); and

© The British Standards Institution 2018 23

PAS 1085:2018
7.4.2 The SCSMP shall address the through-life security
management of suppliers (i.e. professional advisers,
contractors, service providers and OEMs) including:
a) the processes and procedures based on the
requirements set out in Clause 8 for:
1) mapping of the organization’s supply chain to
the level of individual contracts;
2) security risk profiling each contract to assess
the potential level of risk; and
3) identification of the baseline security measures
expected for a supplier with a given security
risk profile;
NOTE The organization’s baseline security
measures for suppliers with differing security
risk profiles should be specified at a high-level
in the organization’s security strategy and
specified in detail in its SMP. The approach set
out in Annex A of DEF STAN 05-138 [18] might
inform the organization’s development of their
own measures.
b) the pre-contract due diligence/accreditation/
assurance requirements regarding the security
culture and security management strategy of
suppliers and potential suppliers;
c) the security requirements that are to be addressed
in suppliers’ contracts;
NOTE 1 Legal advice should be sought regarding
the wording used to address the security
requirements in suppliers’ contracts.
NOTE 2 For example:
1) adoption of appropriate and proportionate
measures to mitigate risk; and
2) the provision, where relevant, of risk
management information regarding the
supplier’s products, systems or services.
d) the audit and compliance monitoring arrangements,
including handling of security incidents;
e) contract exit and termination arrangements;
f) guidance on the use of Data and Information
Sharing Agreements (DISA) (see 11.7) relating to
the exchange or supply of data and/or information:
1) relating to manufacturing-related assets,
manufacturing processes and intellectual
property;
2) individual manufactured products and/or
systems, and any related services; and
3) the organization’s structure, business plans
and personnel;
NOTE The use of DISAs is applicable to suppliers,
potential suppliers and other third-parties in
respect of both information supplied and received
by the organization.
24
g) requirements for additional or further security
awareness training and the right to audit to
confirm that the training is being delivered; and
h) identification of high-risk roles or positions.
7.5 Organization’s security program
7.5.1 To facilitate a consistent organization-wide
approach to security, the organization’s board-level
management shall establish and maintain a security
program, that:
a) is aligned to the security strategy (see 5.1);
b) supports the SMP (see 7.2);
c) develops and periodically reviews the
organization’s security objectives;
d) plans and implements the steps to achieve these
objectives;
e) monitors the implementation of the plan and
fulfilment of the objectives;
f) assigns and manages ownership of the objectives and
any implementation plans to achieve them; and
g) monitors the threat landscape.
7.6 Organization’s security culture
7.6.1 The organization’s board-level management
shall embed a security culture within its personnel and
suppliers in accordance with 7.6.2 to 7.6.6.
7.6.2 The organization’s board-level management
shall provide general security awareness training to
all personnel, which as a minimum addresses the
following topics:
a) cyber hygiene;
b) protection of data and information, including
policies, processes and procedures related to
sharing with third-parties or publication of data
and/or information about manufacturing-related
systems; and
c) the organization’s policies, processes and
procedures regarding the security of its ICT
equipment and systems and the OT.
7.6.3 The organization’s board-level management
shall identify roles with a high security risk profile
in the lifecycle of its manufacturing-related processes
and systems, and any additional security measures
training that might be required by personnel occupying
these roles.
NOTE This relates to the manufacturing of the
organization’s products and/or systems. Any ongoing
services related to the products and/or systems are
addressed in 7.6.4.
© The British Standards Institution 2018
 PAS 1085:2018

7.6.4 Where applicable, the organization’s board-level

management shall identify roles with a high security
risk profile in in the lifecycle of its manufactured
products and/or systems, and any related services, and
any additional security measures and training that
might be required by personnel occupying these roles.
NOTE The applicability of 7.6.4 should be determined
by the nature of the manufactured items and their
use. For example, where the organization is providing
a service related to one of its products or systems and
that service stores or processes sensitive information,
such as personally identifiable information, the system
administrators would be high-risk roles as they have
access to personal data.

7.6.5 The organization’s board-level management shall

ensure that personnel occupying high-risk roles, as
identified in 7.6.3 and 7.6.4 are:
a) aware of their security responsibilities;
b) have access to and been trained in the use of the
Security Operating Procedures (SyOpPs) required
to fulfil their role and responsibilities;
NOTE The use of SyOpPs can help to define the
security context and facilitate the security training
and awareness of personnel in high-risk roles.
c) accountable for their security-related behaviour;
and
d) in receipt of any additional briefing or training so
that they can fulfil their role in a security-minded
manner.

7.6.6 The organization’s board-level management shall

establish, document and operate policies, processes and
procedures such that all new designs are conceived and
implemented using a product and/or service lifecycle
that is secure-by-default.

© The British Standards Institution 2018 25

PAS 1085:2018
8 Assessing security of the supply chain
8.1 Treatment of supply chain security
risks
The organization’s board-level management shall treat
supply chain security risks as being an extension of
existing arrangements to mitigate security risks within
the organization itself.
8.2 Understanding organization’s supply
chain
8.2.1 The organization’s board-level management shall
research, document, demonstrate and maintain an
understanding of its supply chain taking into its own
position within the multi-tiered value chain that exists
between raw materials or ingredients and the delivery
to an end user or customer of manufactured products
and/or systems, and any related services.
NOTE Most supply chains are multi-tiered in nature
where a manufacturer has an upstream element
(suppliers providing raw materials, products, systems
or services to support its business and manufacturing
operations) and downstream element (the demand for
the organization’s manufactured products or systems
and any related services from its customers).
8.2.2 When undertaking the analysis specified in 8.2,
the organization’s board-level management shall as
a minimum cover its existing suppliers of, and when
undertaking new procurements, the potential
suppliers of:
a) security or security-related systems and/or security
services;
b) ICT equipment and systems, and related services
that process, or might in future, process sensitive
data and/or information;
c) manufacturing and manufacturing-related systems
that currently, or might in future, process sensitive
information and/or are used in the production of
sensitive components, products and/or systems, or
the delivery of any related services;
d) raw materials or ingredients, physical products
(e.g. components, sub-assemblies, systems and
equipment) and digital products/artefacts; and
e) professional, business and support services used by
the organization.
26
8.2.3 The organization’s board-level management shall
adopt an appropriate and proportionate approach to
the mapping of its supply chains taking into account
the nature of the materials or services being supplied
and their criticality to the security of the:
a) organization and its operations; and
b) organization’s products and/or systems and any
related services.
8.2.4 Depending on the nature of each upstream
contract, i.e. the supply to the organization, it might be
necessary to obtain information from the supplier, or
potential supplier, to allow decomposition and security
risk assessment of the supplier’s own inputs into the
contracts, including organizations that support the
supplier’s operations.
NOTE For example, if the organization is supplying
sensitive data and/or information to a supplier who
is processing it in a cloud-based software-as-a-service
(SaaS), the organization should consider applying the
NCSC’s Guidance on Cloud Security [19] to assess the
level of risk this processing might pose in respect of
the sensitive data and/or information. This assessment
requires information about the SaaS provider’s
technology, hosting and security arrangements.
8.2.5 The organization’s approach to supplier security
risk assessment shall as a minimum apply the security
triage process outlined in Figure 9 to identify whether
there is a need for further risk assessment of each
current supplier and any prospective suppliers.
NOTE The objective of this triage process is to identify
suppliers that might create vulnerabilities that affect
the organization, its manufacturing operations and its
products and/or systems and any related services.
© The British Standards Institution 2018

Figure 9 – Supplier security triage process
8.2.6 If the outcome of the security triage process
in 8.2.5 is a requirement for further risk assessment of
the supplier or prospective supplier, the organization’s
board-level management shall:
a) apply the risk management approach outlined in
accordance with Clause 6 to any affected assets;
b) record the outcome of the assessment(s) in the
asset-based risk register; and
c) apply any controls or countermeasures required to
reduce the risk to an acceptable level.
NOTE 1 When assessing the supplier-related risks the
organization should take account of:
a) the nature of any sensitive data and/or information
provided or processes by the supplier and the
impact to the organization and its stakeholders if it
were compromised;
© The British Standards Institution 2018
PAS 1085:2018
b) whether the fact that a supplier has a relationship
with the organization might increase the risk of
the supplier being targeted by an adversary so as
to obtain information about the organization, its
products and/or systems and any related services,
or about its customers;
c) the impact to the organization and its customers
if the availability, integrity, provenance or quality
of sensitive raw materials or ingredients, physical
products (e.g. components, sub-assemblies, systems
and equipment) and digital products/artefact were
compromised either accidentally or deliberately;
d) whether the supplier has administrative or similar
privileged access to the organization’s enterprise
ICT or manufacturing systems, either on-site,
remotely or as part of a hosted or cloud-based
service;
27
PAS 1085:2018

e) whether the supplier has unsupervised physical

access to the organization’s site(s), premises,
enterprise ICT or manufacturing systems; and
f) whether the supplier has electronic access to
systems when on-site or working remotely, and the
nature of such access.
NOTE 2 The security measures should encompass
personnel, physical, process and technological aspects,
the details of which should be informed by the level
of the risk profile and the specifics of the risks that are
being mitigated.
NOTE 3 The UK Ministry of Defence operates a supplier
risk assessment process, where the cyber security
requirements for various risk profiles are set out in
Annex A of DEF STAN 05-138 [18]. The approach set
out in this Annex might inform the organization’s
development of its own supplier security requirements.

8.3 Reviewing supply chain security risks

The organization’s board-level management shall
periodically review the supplier security risks in light of
changes in:
a) the overall threat landscape;
b) its suppliers;
c) its operations, including its manufacturing
systems; and
d) its manufactured products and/or systems, and
any related services.
NOTE The frequency of the periodic review should be
determined by how rapidly the items listed in 8.3a)
to d) are changing. For example, a dynamic threat
landscape, and/or frequent changes of suppliers
and/or addition of new suppliers, and/or changes to
operation and/or manufactured items would require
more frequent reviews. The organization’s board-level
management should consider the frequency of such
changes when setting the periodicity of reviews.

28 © The British Standards Institution 2018


9 Working with suppliers and customers
9.1 Working outside formal contracts
The organization’s board-level management shall take
a security-minded approach when working outside
formal contracts (for example, in pre-contract dealings
with a potential supplier or customer) in relation to
the access given to data and information relating to
the organization, its manufacturing operations and
its manufactured products, and/or systems and any
related services.
9.2 Bidding to supply products and/or
systems and any related service
9.2.1 The organization’s board-level management shall
apply a security-minded approach in responding to
pre-qualification processes, requests for quotations
or tenders so as to protect sensitive information and
prevent disclosure of information that might be used to
infer sensitive information.
9.2.2 Where a procurement process requires submission
of sensitive information, the organization’s board-level
management shall consider the risks associated with
disclosing such information and formally evaluate and
record this risk assessment.
9.2.3 Depending on the potential impact of the risk on
the organization, its existing customer base and the
products and/or systems and any related services, the
organization’s board-level management shall determine
what controls or countermeasures are required to
manage the risks identified in 9.2.2.
NOTE Measures can include requiring the third-party
to enter into binding non-disclosure or confidentiality
undertakings, limiting access to specific intellectual
property, requiring the return or certified destruction
of material, data and/or information supplied, etc.
9.3 Procurement
9.3.1 When tendering or re-tendering contracts and the
tender process requires sharing or disclosure of sensitive
data and/or information, the organization’s board-level
management shall require that the sensitive data
and/or information is separated and suitably protected
while ensuring sufficient data and/or information is
available to facilitate the transaction.
© The British Standards Institution 2018
PAS 1085:2018
NOTE 1 This separation and protection exercise might
include: redaction or removal of space, room, product
or system labels; removal of information regarding
sensitive features, uses of protective measures; and
provision of aggregated data rather than providing
access to detailed information.
NOTE 2 The organization should ensure that tender
agreements include appropriate confidentiality and
security requirements that cover all parties, including
sub-contractors and suppliers of a bidding supplier,
associated in the preparation of a tender.
9.3.2 The requirements in 9.3.1 shall apply when
tendering or re-tendering contracts relating to the
procurement of:
a) advisory, business support, or consultancy services;
b) raw materials, ingredients, consumables,
components, digital artefacts, and any equipment,
systems or software used in manufacturing and
logistics processes;
NOTE The systems used in manufacturing and
logistics processes generally involve the use
of OT, for example the cyber elements in
cyber-physical systems. Particular care should be
taken with regards to OT and any equipment
that provides connectivity between the OT and
the organization’s enterprise ICT systems and any
remote systems, such as those used for monitoring
of plant and machinery by suppliers.
c) the organization’s ICT equipment and systems used
for the management of its operations, including
any cloud-based applications and/or storage;
d) facilities management (FM); or
e) maintenance/management.
9.3.3 Where the tender documentation contains
sensitive information relating to the use of a
manufacturing or business asset, or high-level
information about the level of protection the asset
requires, the organization’s board-level management
shall require them to be subject to appropriate security
measures. These measures shall be sufficient to:
a) limit access to this information to identified key
roles;
b) exclude this information from any published tender
documentation;
29
PAS 1085:2018
c) exclude detailed requirements for any such
physical asset security provisions from the tender
documentation to be used by general contractors;
and
d) enable general contractors to provide the correct
infrastructure (for example, conduit and cable
trays, etc.), for the installation of sensitive assets or
systems by specialist security-cleared contractors.
NOTE For example, an organization might be planning
to extend an existing manufacturing facility that
produces sensitive items or use sensitive proprietary
processes as part of the manufacturing process. In
this situation the organization might wish to protect
information about the items or processes from
contractors involved in the construction of the new
facility by limiting the detail provided for the execution
of the relevant construction tasks and applying
appropriate security measures, including but not
limited to those listed in 9.3.3.
9.3.4 The organization’s board-level management shall
require that, as part of the supplier selection process,
all tender documentation is assessed to establish how
the prospective supplier(s) intend to meet any security
requirements specified by the organization.
9.3.5 The organization’s board-level management shall
require an assessment of the security understanding,
capability, competence and experience of the potential
suppliers bidding for a contract, as well the prospective
supplier(s) need for any security training, coaching
and support.
9.4 Unsuccessful bidders
The organization’s board-level management shall
require that all relevant data and/or information
is returned or destroyed. Where appropriate, the
organization’s board-level management shall require
the unsuccessful bidder(s) to verify that defined
procedures have been completed.
30
9.5 Contractual measures
NOTE Legal advice should be sought regarding the
wording used to address the security requirements in
suppliers’ contracts.
9.5.1 The organization’s board-level management shall
manage its supply chain security risks by having in
place contractual provisions which support the security
policies, processes and procedures contained within the
SCSMP (see 7.4).
NOTE 1 The contractual terms should address the
security requirements in a holistic manner by addressing
people, process, physical and technological matters.
These terms might include measures such as providing
a document setting out the security aspects of the
contract (e.g. a ‘security aspects letter’), requiring
the contractor to work in accordance with a security
management plan supplied by the organization,
or requiring the supplier to develop a security
management plan for approval by the organization.
NOTE 2 Contractual provisions should be supported by
the organization’s ability to review the effectiveness
of the supplier’s security systems on a periodic basis.
Organizations with a greater security sensitivity should
have developed standards and self-assessment systems
which enable a supplier’s capability and practice to be
assessed on a regular basis.
9.5.2 Where appropriate, the provisions shall include
the flow down of contractual obligations from the
primary suppliers (including professional advisors
and contractors), who are in direct contract with the
organization, through any layers of sub-contracts.
NOTE It is not an acceptable security practice, at any
level in the contract hierarchy, for the contracting party
to pass, or to try to pass, all security responsibility to its
sub-contractors or suppliers.
9.5.3 The organization’s board-level management shall,
where appropriate and proportionate, require insertion
of a clause within the contractual documentation
to enable adjustments in response to changes in the
political, legislation or regulatory environment to
be implemented, where these obligations extend
throughout the lifecycle of the organization’s products
and/or systems, and any related services.
NOTE 1 The need for this contractual provision depends
on the nature of the item, system or service covered by
the contract. For example, if the contract relates to the
processing of sensitive data and/or information there
might be a need for the contract to accommodate
legislative and/or regulatory changes.
NOTE 2 The organization should be aware of the
potential cost implications of any such changes.
© The British Standards Institution 2018

9.5.4 Where compliance with specific security
standards is required (e.g. the provision of physical and
technological protection for ICT and OT equipment and
systems to a defined standard, the implementation of
appropriate security regimes, etc.), these shall be clearly
identified in the contract along with any expected
independent, third-party inspection or verification.
9.5.5 The organization’s board-level management
shall impose, through its contractual arrangements,
a general obligation on all individuals relating to
acceptable use of models, data and information
provided by the organization.
9.5.6 To handle security incidents caused by a supplier
(including professional advisors and contractors) there
shall be clear contractual provision for the reporting
of the incident to the organization, and for provision
of assistance by the supplier in the investigation and
follow up actions.
9.5.7 The contractual measures shall include provisions
that allow the organization to review security measures
and compliance with the relevant security policies,
processes and procedures at any level in the contract
chain.
NOTE Depending on the sensitivity of the asset,
products, services and/or related services, and the
potential security threats, there might be a need for
systems and personnel used by the suppliers (including
professional advisors and contractors) to satisfy specific
security requirements.
9.5.8 The organization’s board-level management
shall require monitoring and enforcement of all
security-related contractual provisions relating to
its suppliers (including professional advisors and
contractors) in order that they adopt an acceptable
security-minded approach to the fulfilment of their
contractual obligations.
NOTE A balance should be struck between formal
verification involving supplier audits and an honour/
trust-based system of verification. Those suppliers
handling sensitive information, or with access to
sensitive parts of the organization’s premises, sites
or systems, should be subject to greater scrutiny
than those involved in less sensitive roles. As part
of this balance the organization might consider it
appropriate to advise suppliers that making false claims
or statements about their security capability and/or
adherence to required security controls can be treated
as fraud.
© The British Standards Institution 2018
PAS 1085:2018
9.5.9 The organization’s board-level management shall
require that the contracts specify the secure processing
and storage of, secure access to, and ultimately secure
disposal of, all sensitive information shared with or
provided by the supplier, and that such data and
information is retained for no longer than the period
required to comply with legal or other regulatory
requirements, together with any specific warranty
requirements of the organization, whichever is longer.
NOTE Guidance on secure disposal of digital and
physical assets can be found on the NCSC 5) and CPNI 6)
websites.
9.6 End of contract
9.6.1 On completion or termination of a contract,
where some or all data and/or information is sensitive
or there is a general contractual provision for all data
and/or information to be disposed of securely, the
organization’s board-level management shall require
that all relevant data and/or information is returned,
destroyed or stored securely in accordance with
contractual requirements. Where appropriate, the
organization’s board-level management shall require
the supplier to verify that defined procedures have
been completed.
NOTE In some industrial sectors or specific situations
there might be a requirement that some data
and/or information be retained for a specified
period to comply with legal, regulatory or insurance
requirements. The data and/or information can be held
in digital or hard copy formats. In such circumstances
the data and/or information should be appropriately
stored and protected so as to prevent unauthorized
access, to maintain availability, utility, integrity and
authenticity. Where the data and/or information is
held in digital format, consideration should be given as
to how it is accessed, if required, during the required
retention period, particularly if stored in a proprietary
format; and such access requires use of specific
software.
9.6.2 The organization’s board-level management shall
require decommissioning and demobilization processes
to be put in place to maintain the security of sensitive
data and/or information.
5)
For information from NCSC on destruction and disposal, see:
www.ncsc.gov.uk/topics/destruction-and-disposal [20].
6)
For information from CPNI on secure destruction of sensitive
items, see: www.cpni.gov.uk/system/files/documents/c5/
e1/2017_01_20_CPNI_Secure_Destruction_Standard.pdf [21].
31
PAS 1085:2018

10 Security of a manufactured item

10.1 The organization’s board-level management shall 10.3 Where the organization’s products and/or systems,
consider the security risks across the lifecycle of its and any related services are being procured by a
products and/or systems, and any related services. third-party who incorporates them in a larger
NOTE 1 From the lifecycle organization’s perspective product and/or system, and any related services, the
the lifecycle depends on the organization’s role, i.e. organization’s board-level management shall ensure
whether it is responsible for the specification, design, that the organization works with its customer and/or
manufacture, assembly and delivery of the products end user to mitigate any security risks arising from the
and/or systems, and any related services or whether use of the goods or services it supplies.
it is only responsible for manufacture, assembly and
delivery and/or operation. 10.4 Where the organization’s products and/or systems,
and any related services are supplied, either directly
NOTE 2 Where the organization is assembling and/
or via a sales channel, to an end user, or class of end
or configuring a product or system that includes
users, the organization’s board-level management
components, sub-assemblies and digital artefacts (for
shall provide appropriate and proportionate support
example, software, data and/or information) that is
to the end user to mitigate any security risks arising
sourced from its supply chain, it should consider and
from their use of the products and/or systems, and
manage the risks arising from its suppliers.
any related services.
10.2 The organization’s board-level management shall
10.5 Where the organization is responsible for
document and inform customers and/or end users
the design of the manufactured products and/or
the security risks that might arise in respect of their
systems, and any related services, to the extent that is
products and/or systems, and any related services,
practicable, the organization’s board-level management
in the event of:
shall ensure that the design is secure-by-default.
a) the sale or transfer of ownership of a product or
system; 10.6 Where the organization is only responsible for the
b) relocation of the product or system at the end of manufacture of a product or system, or the support
a hire period or lease; of any related services, and it becomes aware of a
c) changes in delivery or termination of any related security vulnerability in the design, the organization’s
service; or board-level management shall require that the relevant
design authority is informed of the vulnerability in a
d) relocation of a product or system at the end of
timely and security-minded manner.
a hire period or lease.
NOTE Immediately prior to any of the events listed
in 10.2a) to d) occurring, the customer or end user
should be able to permanently delete any data and/or
information stored in a product, system or associated
service, that allows or might allow inferences to be
drawn about the use of the asset, its location or users.

32 © The British Standards Institution 2018


11 Data and information management
11.1 Data and information security
11.1.1 The organization’s board-level management shall
develop, record, implement and manage appropriate
and proportionate policies, processes and procedures
relating to security-minded data and information
management which are based on an understanding
of the security implications associated with the loss,
compromise, unauthorized manipulation or change of
data and/or information, as set out in Clause 4.
NOTE Principle 7 of the ICO’s Data sharing code of
practice [12] provides information on fulfilling the
requirements of the DPA in respect of personal data.
11.1.2 The policies, processes and procedures set out
in 11.1.1 shall address the security risks (identified in
accordance with the process in Clause 6) associated
with the potential impact of:
a) the loss or disclosure of intellectual property and/or
commercially sensitive data and/or information;
b) the loss or disclosure of personal data;
c) the corruption of, or loss of access or unauthorized
changes to, metadata; and
d) the corruption of, or loss of access or unauthorized
changes to, referential master data.  and/or information in an archive where it is stored
11.1.3 The policies, processes and procedures set out
in 11.1.1 shall also include:
a) the security features required for the organization’s
data and information architecture (see 11.2);
b) the security-minded approach to managing
data and information to ensure its accuracy and
authenticity and preserve its long-term utility
(see 11.3); and
c) the security-minded approach to be implemented
in relation to data and information that could
be used to cause harm to assets, services and/or
individuals in respect of:
1) data and/or information sharing (see 11.5); and
2) publication of data and/or information.
© The British Standards Institution 2018
PAS 1085:2018
11.1.3 The policies, processes and procedures set out
in 11.1.1 shall be applicable across the generic data and
information lifecycle, shown in Figure 10, and which
comprises:
a) capture – the activity associated with the creation
and initial storage of a data value or piece of
information, including its metadata;
b) maintenance – the activities that serve to deliver
the data and/or information ready for synthesis or
usage in a form and manner that is appropriate
for these purposes and include: validation and
verification; cleansing; reformatting; enrichment;
movement; integration from multiple systems; and
updating of published data and/or information;
c) synthesis – the creation of derived data and/or
information through the use of inductive logic
using other data and/or information as inputs;
NOTE For example use of expert opinion or
judgement or automatic decision making to create
the additional data and/or information.
d) usage – the application of data and/or information
to activities, functions or tasks;
e) archival – the replication or placement of data
but where no maintenance, usage or publication
occurs;
f) publication – the process of making the data
and/or information available outside the
organization; and
g) purging – the removal of every known copy of an
individual data item or piece of information from
an organization.
33
PAS 1085:2018
Figure 10 – Generic data and information lifecycle
11.1.4 The policies, processes and procedures related
to purging data and/or information shall include
measures for the identification and secure removal
of any potential unofficial copies of the data and/or
information or versions, including those that have been
shared with external parties.
11.1.5 The policies, processes and procedures set
out in 11.1.1 shall be embedded within the
non-security-related activities of the organization.
11.2 The organization’s data and
information architecture
11.2.1 The organization’s board-level management shall
ensure that any service using data and/or information
that identifies individuals or groups:
a) is designed, built and operated using the NCSC
guidance on digital service security [NR1]; and
b) is subject to regular vulnerability assessment and
penetration testing, determined by the processes
used for maintaining situational awareness.
NOTE 1 Individuals and other organizations should
be able to trust the manufacturing organization to
protect their privacy and identity if trust in any services
delivered by the manufacturing organization is to
be maintained.
34
NOTE 2 The frequency of vulnerability assessment
and penetration testing can be determined by
considering the nature of the system, its criticality to
the smooth and safe operation of the organization
and the sensitivity of the data and/or information it
contains or processes. It is prudent for the frequency
of the penetration testing to be at least annually and
more frequently if the system is subject to changes or
software upgrades.
NOTE 3 Processes used for maintaining situational
awareness include, monitoring of security alerts,
software patches, etc.
NOTE 4 Particular attention should be paid to known
technical vulnerabilities including, for example, the
OWASP top 10 web application vulnerabilities.7)
11.2.2 The organization’s board-level management
shall identify and undertake an audit of the existing
channels that are used in support of its products and/or
systems to provide data and/or information.
NOTE Examples of such channels include websites,
smartphone applications, SMS, telephone and
face-to-face.
7)
See: www.owasp.org [16].
© The British Standards Institution 2018

11.2.3 The audit required in 11.2.2 shall:
a) collect information about the security measures
employed by each channel to secure access to the
organization’s data and/or information;
b) use the information collected in 11.2.3a) and a risk
assessment based on the data and/or information
being handled to establish whether the security
of individual channels is consistent with best
practice; and
c) where there is a shortfall in the security of a
channel, put in place an action plan to either:
1) raise the security standard of the channel to
an acceptable level; or
2) engineer out the current service through its
replacement with a service providing secure
connectivity between the organization’s digital
assets and the service users’ digital devices.
b) maintain the quality of the organization’s data
11.2.4 Where appropriate, technical safeguards shall
be included in the architecture to reduce the risk of
inadvertent release of sensitive data and information.
NOTE 1 Safeguards might include:
a) the use of data loss prevention tools to monitor
and enforce rules regarding email attachments and
web uploads;
b) multi-step authorization of a release, similar to
measures used in online banking to authorize new
transactions; and
c) introduction of an independent checking step
prior to the actual disclosure or release of the data
and/or information.
NOTE 2 The technical safeguards included should
be consistent with, and supported by, the policies,
processes and procedures the organization has in place
relating to people, physical, data and information and
technological security.
11.3 Managing accuracy, authenticity and
long-term utility of data and information
c) maintain the value and medium- to long-term
11.3.1 The organization’s board-level management shall
take appropriate and proportionate measures to:
a) ensure the resilience of the data and information
infrastructure and the availability of all of the
organization’s data and information;
NOTE 1 Using the internet to share data and/or
information does not provide any guarantee of its
availability when it is required, or the timeliness of
access. Performance of and access to internet-based
systems can be affected by a range of technical and
environmental factors outside of the control of the
organization, for example:
© The British Standards Institution 2018
PAS 1085:2018
1) degraded network performance due to high
usage or system failures;
2) damage to network infrastructure, whether
caused by human or natural causes, leading to
loss of connectivity;
3) malware and denial of service attacks on
network and server systems; and
4) failure of the platforms hosting the data
and/or information, due to software or
hardware faults, or human error.
NOTE 2 Where manufacturing systems are being
designed and implemented that are reliant on
remote processing of data and/or information,
for example, use of cloud-based monitoring
and or control, consideration should be given
to the impact of loss of availability or degraded
performance of the remote processing.
and information by ensuring that changing and
emergent systems and data and information
architecture are managed to:
1) ensure appropriate provenance for all data and
information; and
NOTE This should include data streaming from
IoT and other distributed technologies.
2) maintain the integrity of the data and
information repositories across the lifecycle of
individual data and information sets;
NOTE 1 It is good practice to ensure that an
unmodified version of the shared data and
information remains available in order to
preserve its provenance.
NOTE 2 Loss of integrity of data and
information or disputes about its authenticity
could have significant financial and
reputational impact on organizations. In
these circumstances, inaccurate or incomplete
records, or the inability to prove their
authenticity, could impact on the outcome of
warranty claims and any legal proceedings.
usefulness of the organization’s data and
information by:
1) maintaining the data and information;
2) monitoring and recording changes to:
i) the data and information capture,
maintenance and usage; and
ii) the manufacturing environment, including
processes, systems and sensors;
3) understanding and regularly assessing the
effect of changes in the algorithms, logic or
rules used in data synthesis.
35
PAS 1085:2018
NOTE 1 As organizations evolve, changes
occur in the systems used to capture, store
and process the organization’s data and
information. If not monitored and assessed,
the impact of these changes might lead to
data and/or information being unusable, or
to unpredictable outcomes due to changes in
the fidelity, timeliness or encoding of data. For
example, if a sensor is changed and replaced
with a more sensitive one, this could create
data artefacts when the output is compared
to the outputs from other adjacent or related
sensors, resulting in unnecessary time and
effort being expended.
NOTE 2 The use of smart systems is still at a
relatively immature stage. Where a system
includes machine learning or artificial
intelligence, the outcomes should be
monitored to ensure that:
• the desired results are being consistently
achieved;
• the level of false positive or negative results
is acceptable;
• the algorithms are not being ‘gamed’ or
influenced by those with malicious or criminal
intent; and
• appropriate consideration has been given to
digital ethics issues.
d) maintain the integrity and utility of assets when
applying patches or updated to digital systems or
sub-systems, including verifying the authenticity of
the patches/updates and adopting appropriate and
proportionate testing and verification processes
and procedures.
NOTE Some suppliers are adopting fully automated
patch/update mechanisms where the update or
patch is pushed directly into operational systems.
Organizations should consider the impact of failure
of the automated approaches and where necessary
the ability to roll back such updates to a known
good state.
11.4 Technological security
11.4.1 The organization’s board-level management shall
develop, record, implement and manage appropriate
and proportionate policies, processes and procedures
relating to technological aspects which shall include, as
a minimum:
a) measures related to the cyber security of systems
processing, storing and sharing the organization’s
data and/or information, including the level of
cyber security to be evidenced by supply chain
36
organizations’ handling, processing or storing the
organization’s data and/or information, taking into
account its nature, volume and sensitivity from
both security and privacy perspectives;
NOTE 1 A risk-based approach to the management
of all systems storing, processing and sharing data
and/or information should be taken.
NOTE 2 Depending on the nature and volume
of data and information being handled, the
organization’s board-level management might
require evidence of the supplier or service
provider’s implementation of Cyber Essentials 8)
or Cyber Essentials Plus,9) the 10 Steps to Cyber
Security,10) or that the contractors and suppliers are
appropriately BS ISO/IEC 27001 certified for all parts
of the organization that have access to its data
and/or information.
NOTE 3 Sensitive data and/or information about
the organization’s physical assets (i.e. buildings,
plant, machinery, etc.), services, and the processes
relating to security of the organization and the
items it manufactures should be regarded as
controlled data and/or information, with access
limited to those who need to know, in order to
fulfil their official duties.
NOTE 4 Consideration should be given to the
separation of sensitive data and/or information
sets to reduce the risk of unauthorized access or
disclosure, and to limit the impact in the event of a
security breach or incident.
b) the security of interconnections and interactions
between systems processing and storing the
organization’s data and/or information;
c) the security around systems controlling physical
assets within the organization, in particular its
manufacturing assets;
d) interoperability of systems;
NOTE 1 Interoperability of systems can introduce
risks associated with cascade effects leading to
the failure of multiple services. Services should
therefore be designed with the aim of reducing
the risk of common mode failure by incorporating
sufficient resilience.
NOTE 2 Common mode failure is the engineering
term that refers to events which are not statistically
independent. For example, failures in multiple
8)
For Cyber Essentials, see: www.ncsc.gov.uk/scheme/cyber-
essentials [22].
9)
For Cyber Essentials website, see: www.cyberessentials.ncsc.
gov.uk/ [23].
10)
For 10 Steps to Cyber Security, see: www.ncsc.gov.uk/
guidance/10-steps-cyber-security [24].
© The British Standards Institution 2018

parts of a system caused by a single fault,
particularly random failures due to environmental
conditions or the loss/degradation of inter-system
connectivity.
e) configuration management and change control
policies, processes and procedures for the systems
that process the organization’s data and/or
information;
NOTE Effective system, software and hardware
configuration management is important for the
efficient and effective operation of business
continuity and disaster recovery plans, and for the
rapid identification and assessment of potential
security vulnerabilities.
f) the required level of software trustworthiness;
NOTE Software trustworthiness is based on
the principles of safety, reliability, availability,
resilience and security which, along with software
trustworthiness levels and implementation
framework, are described in PAS 754:2014.
g) demobilization of organizations who are leaving
the organization’s supply chain, including the
secure deletion and/or destruction of sensitive
data and information held by those organizations,
and/or removal of access to that data and
information; and
NOTE Appropriate policies, processes and
procedures are required to manage the technical
security consequences of events such as changes in
ownership of organizations, mergers, demergers
and insolvencies.
h) policies regarding the retention of different types
of data and/or information, so as to minimize the
period for which it is retained and to require secure
deletion, destruction and/or removal of access to it
once the specified period(s) have elapsed.
NOTE There might be a variety of legitimate
reasons why data has to be retained for significant
periods, for example to comply with legal or other
regulatory requirements, or for warranty and
product liability purposes. However, the aim should
be to avoid unnecessary retention, thus reducing
the overall impact in the event of a security
incident involving unauthorized access to sensitive
data and/or information.
11.4.2 The organization’s systems and its manufactured
products and/or systems, and any related services, shall
be secure by default (i.e. full functionality is available
without compromising security), addressing each of
aspects shown in Figure 11 and described as follows:
© The British Standards Institution 2018
PAS 1085:2018
NOTE 1 An application or system is secure-by-default
if it is configured so that the default configuration
settings are the most secure settings possible, for
example, the use of default usernames and password
on IT equipment makes them vulnerable to hacking
via the internet or unauthorized access within an
organization’s premises.
NOTE 2 An application that is secure-by-default should
be configured so that the default settings prevent
disclosure of user, product and/or system data and/or
information or metadata without explicit customer/user
consent. For example, by not revealing information
about the location of the user, product or system, its
pattern-of-use, etc.
a) confidentiality – controlling, and preventing of
unauthorized access, to data and/or information
which might be sensitive or breach privacy, in
isolation or in aggregate; 

NOTE The need for confidentiality applies to
all sensitive data and information, irrespective
of whether it is stored or processed in the
manufacturer’s systems or its manufactured
items. The degree of confidentiality required is
determined by the sensitivity of the data and/or
information, and the impact of its unauthorized
disclosure or use.
b) availability (including reliability) – ensuring that
the data, information, systems, and associated
processes are consistently discoverable, accessible,
usable and, where appropriate, disclosable in an
appropriate and timely fashion;
NOTE 1 Achieving the required availability
depends on the ability to maintain access to data,
information or services in instances of systems
failure and planned maintenance and upgrades.
The relevant contract or service-level agreement
might specify availability in terms of a percentage
(e.g. 99.9999% per annum) with a specified
maximum time for restoration of a normal service
(e.g. 30 minutes).
NOTE 2 The concept of data and information
being accessible includes, where appropriate,
discoverability (for example, through data or
service catalogues) and disclosure (for example, in
response to a request for information).
NOTE 3 Malware, particularly ransomware, has
become an increasingly serious problem in complex
enterprise environments. A ransomware incident
does not generally involve loss of confidentiality,
but does impact on data, information, service and
system availability through loss of access and results
in loss of possession if the incident affects the ability
to control a system or service. Recent examples of
ransomware have led to disruption of the shipping
37
PAS 1085:2018
container handling by Maersk, costing the business
an estimated $200 – 300m in lost business.11)
NOTE 4 Where wireless technologies are used for
the transport of data and/or information there are
potential availability, reliability and resilience issues
due to the ease with which radio signals can be
jammed or be subject to interferences. This should
be taken into account where services are critical to
the safe and secure operation of the organization.
c) safety – products, systems and related processes are
designed, implemented, operated and maintained
so as to prevent the creation of harmful states
which might lead to injury or loss of life, or
unintentional environmental damage, or damage
to assets;
NOTE 1 The safety of the individuals, including the
organization’s personnel, should be of paramount
concern when developing and implementing
manufacturing systems and processes and in
the design, manufacture and operation of the
organization’s products and/or systems and any
related services.
NOTE 2 The organization should also consider the
relationship between safety and security of its
products and/or systems, as security vulnerabilities
might create hazards affecting the user(s),
environment or other assets.
d) resilience – the ability of data, information,
products, systems and any related services to
transform, renew and recover in a timely way in
response to adverse events; 
 information source to assert its identity and for this
NOTE The increasing dependence on complex
interactions between different organizational
components, data and information sets, services
and systems can significantly detract from
the overall resilience of an organization. The
organization should have rehearsed the handling
of incidents and to have workable plans to enable
business continuity and disaster recovery based
on fall-back service provision, which is either
predominantly manual or less IT and data intensive.
e) possession – products, systems and any related
processes or services are designed, implemented,
operated and maintained so as to prevent
unauthorized control, manipulation or interference,
and to ensure that data and/or information are used
only in accordance with the terms of the compliance
and contractual rights and obligations;
11)
Interim report from Maersk CEO: http://investor.maersk.
com/releasedetail.cfm?ReleaseID=1037421 [25].
38
NOTE 1 Loss of possession could arise from a physical
incident of natural or human origin, that affects a
data centre or control room, preventing the system
operators from managing the system or online
service. It could also arise due to interference with
the operation of the system(s) through software bugs
or crashes, hacking (external or internal), malware or
denial of service attacks.
NOTE 2 Loss of possession, whatever the cause, is
especially critical for safety- and/or security-critical
systems.
NOTE 3 oss of possession can also cause economic
and/or reputational damage to the data owner and
data controller.
NOTE 4 Limiting the risk of inappropriate use of
shared data and/or information is described in
Clause 9.
f) authenticity – ensuring that the data and
information input to, and output from products,
systems and any related processes or services,
and that the state of the products and/or system
and any related processes, services, data and/or
information are genuine;
NOTE Authenticity issues arise if it is not possible
to establish that data and/or information is
what it portrays itself to be, for example, that
data originated from a specific device, from the
particular location where that device is sited, and
at a specific point in time. As such, authenticity is
heavily dependent on the ability of the data and/or
to be reliably captured in any associated metadata.
g) utility – ensuring that data, information and
systems remain usable and useful across the
lifecycle of the data and/or information and any
associated asset, individual or organization; and
NOTE 1 Changes to systems, including sensors and
processing, asset configuration, referential master
data, etc. should be tracked and managed through
formal change control mechanisms to reduce
the risk of divergence between the real, physical
world and that which is captured in the data
and/or information. For example, changes to a
system’s sensors might introduce metrology artefacts
such as changes in baseline readings, or increases in
granularity, which make it more complex to compare
readings taken before and after the change.
© The British Standards Institution 2018
 PAS 1085:2018

NOTE 2 Where multiple versions of a specific

data and/or information set are used within the
organization, consideration should be given to
the risks of holding multiple sets of versioned data
and/or information, including the dependencies
between the sets and those between the sets and
their associated versioned metadata.
h) integrity – maintaining the completeness, accuracy,
consistency, coherence and configuration of the
data, information, products, systems and any
related processes or services.
NOTE Examples of losses of integrity include out of
tolerance sensors, gaps in data sets, timing errors
(e.g. loss of synchronization between systems or
incorrect system clocks), or configuration issues that
prevent processing or result in incorrect attribution
of data values to sensor locations. Loss of integrity
might also occur as a result of malicious injection of
data and/or information.

Figure 11 – Security goals for the organization’s data and information

  

 

 
 
!
  

 
 
!
 
 


 
   

 
!
 


  

   

    

 



 

 
  
!

 

© The British Standards Institution 2018 39

PAS 1085:2018

11.4.3 When considering the reuse of existing 11.5 Managed sharing of data and
technology and digital assets, the organization’s information
board-level management shall seek appropriate
professional advice about the ability of the systems and 11.5.1 Prior to the sharing and/or publication of a new,
software to deliver the level of cyber security required. or modified, data and/or information set about the
organization, its assets, and its manufactured products
NOTE 1 Where an operating system or application
or systems, and any related services, the organization’s
is close to, or has passed, the end of its support life,
board-level management shall require the application
or there is a significant shortfall in the installation
of the data and information security triage process
of software patches, it is likely to have a number of
shown in Figure 12 to identify the need for a
significant security vulnerabilities that could result in a
security-minded approach to be applied.
security breach or incident.
NOTE A modified data set is one where the scope of
NOTE 2 Depending on the nature of the advice
the data has changed significantly or additional data
required and the technology or digital assets
elements (fields rather than records) are included.
involved, sources of security advice might include
the organization’s own internal security personnel,
11.5.2 In order to identify whether there are any
specialist security consultants and government security
personal data in the data set that the triage process
advisers (e.g. CPNI and NCSC).
is being applied to, the personal data test shown in
Figure 13 shall be applied.
11.4.4 Prior to the implementation of any product,
system or service based on IoT or other distributed NOTE 1 Figure 12 is based on the ICO’s guidance on
technologies, the organization’s board-level ‘Determining what is personal data’ [26] which contains
management shall: an explanation of the individual questions and a
number of examples.
a) commission the production of a detailed security
architecture for the proposed implementation; NOTE 2 The implementation of GDPR [2] could impact
the approach outlined. Some overarching guidance is
b) determine the extent to which the architecture
available in the ICO guidance document ‘Preparing for
meets the security requirements of the
the General Data Protection Regulation (GDPR) – 12
organization and its stakeholders, taking into
steps to take now’ [27].
account personnel, physical and technological
aspects; and
c) assess any security risks against the collective risk
appetite of the organization and the benefits
which it is anticipated can be gained.
NOTE The requirements set out in 11.4.4 apply to both
the organization’s systems and to its manufactured
products and/or systems, and any related services.

40 © The British Standards Institution 2018

 PAS 1085:2018

Figure 12 – Data and information security triage process

© The British Standards Institution 2018 41

PAS 1085:2018

Figure 13 – Personally identifiable information test

42 © The British Standards Institution 2018


11.6 Security, privacy impact and/or data
and information aggregation assessment
11.6.1 Where identified as being required by the
data and information security triage process, the
organization’s board-level management shall require
the preparation of a security, privacy impact and/or
data and information aggregation assessment by a
suitably qualified and experienced person.
11.6.2 Each security, privacy impact and/or data and
information aggregation assessment shall record:
a) the composition of the data and/or information
set or layer;
b) who has access to the data and/or information
being shared, disclosed or published;
c) whether the relevant asset, data, information,
product or system owners are to be consulted
before the data and/or information is shared,
disclosed or published;
NOTE This applies to the organization’s own
data and information and to any data and/or
information collected from, stored or processes
for customers or end users.
d) whether the data and/or information set includes
any sensitive data and/or information, or sensitive
personal data;
e) the justification for sharing, disclosing or publishing
the data and/or information, in particular:
1) the objective of publishing or sharing it;
2) the potential benefits and how they are
captured;
3) the risks to assets and organization if it is not
shared disclosed or published;
4) demonstration that the proposed sharing
is proportionate to the objective and the
potential benefits; and
5) whether or not the objective could be
achieved, or the benefits delivered, without
sharing, disclosing or publishing it;
f) the authority to share or publish the data and/or
information, in particular:
1) whether the organization is the data controller
and/or has the right, legal authority and power
to do so;
2) whether there are any legal obligations to
share, disclose or publish (e.g. legislation or a
court order); and
© The British Standards Institution 2018
PAS 1085:2018
3) whether it was provided in confidence to the
organization.
NOTE More detailed guidance on legal and data
protection aspects of data sharing is given in the ICO’s
Data Sharing Code of Practice [12].
11.6.3 Where there is uncertainty as to whether the
data and/or information set contains sensitive data
and/or information, or whether there are security or
privacy issues arising from data and/or information
aggregation, the data owner shall seek advice from
appropriate security advisers.
NOTE Sources of advice can include suitably qualified
and experienced persons within the organization
and/or specialist security advisers outside the
organization.
11.6.4 Each security, privacy impact and/or data and
information aggregation assessment shall, by following
the risk management process in accordance with
Clause 6:
a) identify any data protection issues;
NOTE Data protection is a complex area, with
detailed interpretation required of what
constitutes personal data. Data and information
should be carefully analysed before being made
available to ensure compliance with the relevant
legislation.
b) identify the security risks associated with sharing or
publishing the contents of a specified data and/or
information set;
c) identify and assess potential appropriate and
proportionate risk mitigation measures to manage
any unacceptable risks and any data protection
issues; and
NOTE 1 Risk mitigation measures that might be
appropriate to adopt across a wide range of data
and information sets include:
a) removing a sub-set of the data and/or
information from the published data and/or
information set where only that sub-set creates
a risk;
b) removing outliers, i.e. small number of records
that make it easier to identify assets, groups or
individuals;
c) reducing the precision of the data and/or
information where the precision of location or
timing increases the risk;
d) providing the data and/or information in
summary form to reduce the level of detail
available where the granularity increases the risk;
43
PAS 1085:2018
e) releasing statistical data and/or information
rather than underlying data and/or
information;
f) anonymization of data and/or information sets;
g) modifying key variables to prevent
re-identification;
h) publishing the data and/or information set
without the metadata, or remove the sensitive
fields, where the metadata creates a risk;
i) reducing the level of detail and/or removing
some layers of mapped data and/or
information as a user zooms in to view a
locality where the granularity increases the
risk; and
j) monitoring access by requiring user
registration/login to access specific data
and/or information sets.
NOTE 2 Where the contents of a specified data
and/or information set contains sensitive personal
data, additional controls might be required.
NOTE 3 Where a data and/or information set is
manipulated to reduce the risk of identification
or re-identification, processing should be
independently verified to ensure the effectiveness
of the approach used.
d) list any residual risks and remaining data protection
issues.
11.6.5 A data and information aggregation assessment
shall, in addition:
a) take proportionate steps to identify any data
and/or information sets that have already been
shared or published, whether intentionally or
unintentionally that, when aggregated with
the specified data, allow a third-party to draw
inferences from the disclosed material or create
unplanned associations, including those which:
1) identify a specific individual(s) or group(s);
2) reveal sensitive personal data;
3) establish a pattern-of-life for a specific
individual(s) or group(s);
4) identify a sensitive asset;
5) reveal sensitive information about an asset;
6) establish a pattern-of-use for specific asset(s) or
group(s) of assets; or
7) compromise the safety or security of an asset,
individual(s), group(s) or service; and
44
b) provides clear examples how these inferences could
be drawn.
11.6.6 Where potential harm is identified, sharing,
publication or further/additional disclosure shall
be prohibited until appropriate and proportionate
measures are implemented to remove the sensitivity or
reduce the associated risks to a level that is acceptable
to the organization.
11.6.7 Access to any part of the security, privacy
impact and/or data and information aggregation
assessments which details sensitive information shall
be managed on a strict need-to-know basis, with the
information contained within it subject to appropriate
security measures with regard to its creation, storage,
distribution and use.
11.7 Data and information sharing
agreements
NOTE The information in this clause does not constitute
legal advice. Users of this PAS should take appropriate
legal advice regarding the data and information sharing.
11.7.1 A data and information sharing agreement
(DISA) shall be put in place prior to sharing or
processing of any sensitive or potentially sensitive data
and/or information regarding manufacturing-related
systems and the manufactured products and/or systems,
and any related services.
NOTE The term process data should be interpreted as
encompassing the various aspects of data processing
covered by the UK Data Protection Act [1] and the
General Data Protection Regulation (GDPR) [2], i.e. the
creation or collection, processing, storage, retrieval and
deletion of data and/or information.
11.7.2 A DISA shall detail, as a minimum:
a) the purpose, or purposes, of the sharing;
b) the potential recipients, or types of recipient, and
the circumstances in which they have access;
c) the type of data and/or information to be shared;
d) the quality of the data and/or information to be
shared, in particular its authenticity, coverage,
accuracy, relevance and usability;
© The British Standards Institution 2018

e) the requirements in relation to;
1) where relevant, data protection;
2) permitted and prohibited rights of use of
the data;
3) obligations to notify the data owner
and/or data controller in the event of a security
incident or compromise, or any complaints
regarding the quality of the data and/or
information;
NOTE The obligations should reference the relevant
security incident management policies, processes
and procedures (see 7.3).
f) data and/or information maintenance, including
responding to notification of requests for erasure
or correction;
g) data and information security, including the
handling of security incidents and investigations
undertaken by data protection authorities;
h) the arrangements for retention and/or purging of
shared data and/or information;
i) where applicable, i.e. when handling personal
data, the procedures dealing with data subjects’
rights, including access requests, queries and
complaints;
a) monitoring and auditing of the
implementation of the sharing agreement; and
b) sanctions for failure to comply with the
agreement and/or a security incident caused by
an individual member of staff.
11.7.3 In the event of a security incident, or if there
is evidence that data and/or information is not being
managed and handled in accordance with the DISA, the
organization’s board-level management shall have the
authority to:
a) suspend the sharing agreement until the event or
concerns have been investigated and any remedial
measures have been agreed and implemented: or
b) terminate the sharing agreement and require
purging of the shared data and/or information if
the matter cannot be satisfactorily remedied.
© The British Standards Institution 2018
PAS 1085:2018
11.7.4 The organization’s board-level management shall
require the periodic review of all DISAs, to confirm that:
a) there is still a legitimate purpose for the continued
sharing of data and/or information;
b) the recipients of the data and/or information still
need access to it, and where they do not, that
access has been withdrawn;
c) the data and information quality and maintenance
are to the agreed standards; and
d) the data security arrangements remain appropriate
and proportionate, and that any complaints have
been satisfactorily resolved.
NOTE The frequency of the periodic reviews should
be determined by the nature and sensitivity of the
data and/or information that is being shared, and the
impact on the organization in the event that the shared
data and/or shared information were compromised or
misused. The frequency might therefore vary between
different data and information sets. The organization’s
board-level management might also wish to take into
account the behaviour of the recipient parties with
whom that data and/or information has been shared.
For example, if there have been a number of security
incidents, the organization’s board-level management
might decide to increase the frequency of reviews.
45
PAS 1085:2018
12 Security-minded approach in relation to compliance
with legislation and other standards
NOTE 1 The information in this clause does not
constitute legal advice. Users of this PAS should take
appropriate legal advice where any of the legislation
or regulations in Clause 12 applies to data and/or
information under their control.
NOTE 2 The legislation listed in Clause 12 is set out in
alphabetical order and is not intended to be exhaustive.
12.1 Computer Misuse Act 1990 [7]
The organization’s board-level management shall
require the application of a security-minded approach
in the specification, design, operation and maintenance
of manufacturing-related systems and the systems
providing services to or in support of manufactured
items, so as to ensure that personnel, professional
advisors, contractors, suppliers and system users do not
inadvertently commit offences when fulfilling their
contracted duties.
NOTE Offences can arise where an individual accesses
data and/or information where they lack the requisite
privileges or authorization. The access might include
viewing, printing, moving data and/or information or
altering files or database records.
12.2 Control of Major Accident Hazards
(COMAH) Regulations 2015 [8]
The organization’s board-level management shall
require adoption of a security-minded approach in its
disclosure of information that shall be publicly available
regarding the hazardous substances it employs in its
manufacturing processes and where there might be
security concerns to discuss these with the relevant
public authorities prior to publishing the information.
NOTE The Control of Major Accident Hazards
Regulations 2015 (COMAH) [8] aims to prevent major
accidents involving dangerous substances and to
mitigate the effects on people and the environment
of those that do occur. Depending on the location of
an organization’s site(s) in the UK it might be required
to provide specific details about hazardous substances
it uses to: the Health and Safety Executive (HSE), the
Environment Agency (EA), the Natural Resources Body
for Wales (NRW), the Scottish Environment Protection
Agency, and where COMAH applies to nuclear
licensed sites the regulations are enforced by the
Office of Nuclear Regulation (ONR) and the relevant
46
environment regulator. The Regulations require that
some of the submitted information is made publicly
available and searchable.
12.3 Data Protection Act 1998 [1]
The organization’s board-level management shall
require application of a security-minded approach to
handling, storage and use of personal data.
NOTE 1 The Data Protection Act 1998 [1] regulates
the use of personal data and may apply to asset
information, whether held in electronic or paper form,
where it includes any set of information relating to
individuals. The need for identification and protection
of personal data is addressed in 11.6.
NOTE 2 The provisions of the Data Protection Act
1998 [1] will be affected by the introduction of GDPR
(Directive 95/46/EC) [2].
12.4 Environmental Information
Regulations 2004 [4]
Where a manufacturing organization shares data
and/or information with an organization that falls
within the scope of the Environmental Information
Regulations 2004 [4], it shall, on a risk-based,
security-minded basis, consider what sensitive
information might be released, as part of the public
authority’s publication scheme and on request, and
where necessary agree with the public authority
what sensitive information needs to be protected and
how the protection is to be applied, for example by
providing it in confidence or by identifying specific
exemptions that apply to it.
NOTE 1 The Environmental Information Regulations
[4] provides public access to information about the
environment held by public authorities by:
a) obliging public authorities to proactively publish
certain information about their activities in
accordance with their publication scheme, and
b) entitling members of the public to request
information from public authorities.
© The British Standards Institution 2018

The Regulations cover any recorded information
held
by the public authority that falls within the definition
of “environmental information” and can
also apply
to environmental information that another person or
organization holds on behalf of the public authority. It
typically covers information about land development,
pollution levels, energy production, and waste
management, and includes financial information
where it relates to the costs of redeveloping land
and constructing a new built asset, e.g. a new
manufacturing facility.
NOTE 2 There is a risk that sensitive information
disclosed to a public authority might be released to
a competitor or a potentially hostile third-party. A
manufacturing organization that wishes to protect
sensitive information such as intellectual property,
commercially sensitive information, etc. should be
aware that there are a number of specific exemptions
regarding disclosure of information as part of a
publication scheme or in response to an environmental
information request.
12.5 Freedom of Information Act 2000 [5]
and Freedom of Information (Scotland)
Act 2002 [6]
Where a manufacturing organization shares data
and/or information with an organization that is covered
by the Freedom of Information legislation it shall,
on a risk-based, security-minded basis, consider what
sensitive information might be released as part of the
public authority’s publication scheme and on request,
and where necessary agree with the public authority
what sensitive information needs to be protected and
how the protection shall be applied, for example by
providing it in confidence or by identifying specific
exemptions that apply to it.
NOTE 1 The Freedom of Information Acts [5 and 6]
provide public access to information held by public
authorities, by:
a) obliging public authorities to proactively publish
certain information about their activities in
accordance with their publication scheme, and 
 a) all data and information that it collects, stores,
b) entitling members of the public to request
information from public authorities. 
 procure, operate or maintain its manufacturing
Together, the Freedom of Information Act 2000 [5] and
the Freedom of Information (Scotland) Act 2002 [6]
cover any recorded information that is held by a public
authority in England, Wales and Northern Ireland, and
by UK-wide public authorities based in Scotland.
© The British Standards Institution 2018
PAS 1085:2018
NOTE 2 There is a risk that sensitive information
disclosed to a public authority might be released to
a competitor or a potentially hostile third-party. A
manufacturing organization that wishes to protect
sensitive information such as intellectual property,
commercially sensitive information, etc. should be
aware that there are a number of specific exemptions
regarding disclosure of information as part of a
publication scheme or in response to a freedom of
information request. Areas covered by exemptions that
the public authority might apply include:
a) health and safety;
b) environmental Information;
c) personal information;
d) information provided in confidence;
e) legal professional privilege; and
f) commercial interests.
This is a complex legal area and appropriate advice
should be sought with a manufacturing organization
before sharing it with the public authority.
12.6 General Data Protection Regulation
(GDPR) (Directive 95/46/EC) [2]
Organizations shall apply a security-minded approach
to the handling, processing, storage and use of
personal data and special categories of personal data
(i.e. sensitive personal data) that are shared, published
or processed as part of its business or manufacturing
operations.
NOTE The government has confirmed that the
UK’s decision to leave the EU does not affect the
commencement of the GDPR, which applies in the UK
from 25 May 2018.
12.7 Government Security Classifications
Where applicable, the organization’s board-level
management shall require application of and
compliance with the Government Security
Classifications [NR2] policy with regards to:
processes, generates or shares in order to own,
assets, including information received from, or
exchanged with, external parties both within and
outside its supply chain; and
b) any inventory of sensitive manufactured items
or systems and their sensitive raw materials,
components, sub-systems, drawings, schematics,
bills of materials, or supply chain details.
47
PAS 1085:2018
NOTE 1 Compliance with this policy might require
specific security measures to be imposed regarding
the access to, storage and processing of data and
information, particularly where there are significant
volumes of official and/or sensitive data or where some
of the data and/or information requires specific controls
and security measures.
NOTE 2 Government Security Classifications apply to
all data and information that the government collects,
stores, processes, generates or shares to deliver services
and conduct business, including information received
from, or exchanged with, external partners.
NOTE 3 Where central government information is not
processed or stored, it is considered to be good security
practice to apply BS 10010 to all data and information
that the organization collects, stores, processes,
generates or shares to design and manufacture items or
systems, deliver services and conduct business.
12.8 Official Secrets Act 1989 [9]
Where official data and/or information is held in paper
or electronic form or sensitive manufactured items,
systems and any related services are delivered, the
organization’s board-level management shall require
application of protective measures in accordance
with the UK Government guidance on physical and
information security 12).
NOTE The Official Secrets Act [9] applies to the
protection of official information and to sensitive
manufactured items, systems and any related
services. Where the data and/or information is, or the
manufactured items, systems and any related services
are covered by the Official Secrets Act [9], additional
protective measures might be required in accordance
with the Government’s guidance on physical and
information security.
12.9 Re-use of Public Sector Information
Regulations 2005 [10]
The organization’s board-level management shall
require application of a security-minded approach
when responding to requests for information from
public sector bodies as such information might be made
available for re-use, and the extent to which the data
is exempt from re-use should be ascertained prior to
disclosing it.
12)
See www.gov.uk/government/publications/government-
security-classifications [29].
48
NOTE Organizations should carefully consider the
security implications of making data available that
might be re-used. Whilst individual items might
not pose a threat, aggregation of data, including
correlation of data supplied to different public
bodies, could reveal sensitive commercial or technical
information and manufacturing capabilities. Where
security considerations might be applicable, the
organization should not identify the extent to which
information the information is or might be available
for re-use and determine what, if any, measures can
be legitimately used to reduce the risk of disclosing
sensitive information.
12.10 Sensitive information in planning
applications
Where a planning application relating to the design
or extension of manufacturing facilities contains
sensitive information, the organization’s board-level
management shall apply a security-minded approach
to the handling of the application using the principles
set out in PAS 1192-5 and the government’s published
guidance on sensitive information in planning
applications.13) The manufacturing organization shall
work with their construction professional advisers
and the planning authority to limit the information
available on the open planning register, with sensitive
information being subject to special handling
arrangements.
NOTE Manufacturing organizations should be aware
that a planning application could contain sensitive
information such as:
a) data and/or information relating to a sensitive
manufacturing process which reveals intellectual
property related to the process;
b) data and/or information relating to the capacity of
the manufacturing plant or its systems; and
c) descriptions of rooms or room layouts which
might assist a malicious party in conducting
hostile reconnaissance, for example to identify the
location of sensitive assets.
The organization should be aware that if such
information is available on an open planning register it
might be accessed by organizations seeking competitive
intelligence or potentially hostile parties seeking
sensitive information regarding the manufacturing
organization, its facilities and manufacturing assets.
13)
Further information can be found at: http://
planningguidance.planningportal.gov.uk/blog/guidance/
crown-development/sensitive-information-in-planning-
applications/ [28].
© The British Standards Institution 2018

Bibliography
Standards publications
For dated references, only the edition cited applies. For
undated references, the latest edition of the referenced
document (including any amendments) applies.
BS 10010:2017, Information classification, marking and
handling – Specification
BS ISO/IEC 27001, Information technology – Security
techniques – Information security management systems
– Requirements
PAS 183:2017, Smart cities – Guide to establishing
a decision-making framework for sharing data and
information services
PAS 754:2014, Software Trustworthiness – Governance
and management – Specification
PAS 1192-5:2015, Specification for security-minded
building information modelling, digital built
environments and smart asset management
Other publications and websites
[1] GREAT BRITAIN. Data Protection Act 1998. London:
The Stationery Office.
[2] REGULATION (EU) 2016/679 OF THE EUROPEAN
PARLIAMENT AND OF THE COUNCIL on the protection
of natural persons with regard to the processing of
personal data and on the free movement of such
data, and repealing Directive 95/46/EC (General Data
Protection Regulation). Available from: http://eur-lex.
europa.eu/legal-content/EN/TXT/HTML/?uri=CELEX:3201
6R0679&from=EN [viewed April 2018].
[3] GREAT BRITAIN. Trade Union and Labour Relations
(Consolidation) Act 1992. London: The Stationery Office.
[4] GREAT BRITAIN. Environmental Information
Regulations 2004. London: The Stationery Office.
[5] GREAT BRITAIN. Freedom of Information Act 2000.
London: The Stationery Office.
© The British Standards Institution 2018
PAS 1085:2018
[6] GREAT BRITAIN. Freedom of Information (Scotland)
Act 2002. Edinburgh: The Stationery Office.
[7] GREAT BRITAIN. Computer Misuse Act 1990. London:
The Stationery Office.
[8] GREAT BRITAIN. Control of Major Accident Hazards
Regulations 2015. London: The Stationery Office.
[9] GREAT BRITAIN. Official Secrets Act 1989. London:
The Stationery Office.
[10] GREAT BRITAIN. Re-use of Public Sector Information
Regulations 2005. London: The Stationery Office.
[11] DIRECTIVE (EU) 2016/1148 OF THE EUROPEAN
PARLIAMENT AND OF THE COUNCIL concerning
measures for a high common level of security of
network and information systems across the Union.
(NIS Directive) Available from: http://eur-lex.europa.eu/
legal-content/EN/TXT/PDF/?uri=CELEX:32016L1148&fro
m=EN [April 2018].
[12] INFORMATION COMMISSIONER’S OFFICE. Data
sharing code of practice. ICO: Cheshire, 2011. Available
from: https://ico.org.uk/media/for-organisations/
documents/1068/data_sharing_code_of_practice.pdf
[viewed April 2018].
[13] CHARTERED INSTITUTE OF INTERNAL AUDITORS.
Risk appetite and internal audit. London. Available
from: https://www.iia.org.uk/resources/risk-
management/risk-appetite/ [viewed April 2018].
[14] ENGINEERING COUNCIL. Available from: www.
engc.org.uk/security [viewed April 2018 2018].
[15] INDUSTRIAL CONTROL SYSTEMS. ICS CP/PE
(Cyber-to-Physical or Process Effects) case study paper
– German Steel Mill Cyber Attack. December 2014.
Available from: https://ics.sans.org/media/ICS-CPPE-case-
Study-2-German-Steelworks_Facility.pdf
[viewed April 2018].
[16] OPEN WEB APPLICATION SECURITY PROJECT
(OWASP). Available from: www.owasp.org
[viewed April 2018].
49
PAS 1085:2018

[17] US SENATE REPORT. Available from: www.
commerce.senate.gov/public/_cache/files/24d3c229-4f2f-
405d-b8db-a3a67f183883/23E30AA955B5C00FE57CFD
709621592C.2014-0325-target-kill-chain-analysis.pdf
[viewed April 2018].
[28] Sensitive information in planning applications.
Available from: http://planningguidance.
planningportal.gov.uk/blog/guidance/crown-
development/sensitive-information-in-planning-
applications/ [viewed April 2018].

[18] GREAT BRITAIN. DEF STAN 05-138. Cyber security [29] Government security classifications. Available from:
for defence suppliers. Available from: www.gov.uk/ www.gov.uk/government/publications/government-
government/publications/cyber-security-for-defence- security-classifications [viewed April 2018].
suppliers-def-stan-05-138 [viewed April 2018].

[19] NATIONAL CYBER SECURITY CENTRE (NCSC). Further reading

Implementing the cloud security principles. Available
BS 7858, Security screening of individuals employed in a
from: www.ncsc.gov.uk/guidance/implementing-cloud-
security environment – Code of practice
security-principles [viewed April 2018].

BS ISO 55001:2014, Asset management – Management

[20] NATIONAL CYBER SECURITY CENTRE (NCSC).
systems – Requirements
Destruction and disposal. Available from: www.ncsc.
gov.uk/topics/destruction-and-disposal [viewed April
BS ISO 55002, Asset management – Management
2018].
systems – Guidelines for the application of ISO 55001
[21] CENTRE FOR THE PROTECTION OF NATIONAL
BS EN ISO/IEC 27001:2017, Information technology –
INFRASTRUCTURE (CPNI). Secure destruction. Available
Security techniques – Information security management
from: www.cpni.gov.uk/secure-destruction [viewed
systems – Requirements 
April 2018].
BS ISO/IEC 29100, Information technology – Security
[22] NATIONAL CYBER SECURITY CENTRE (NCSC). Cyber
techniques – Privacy framework
essentials. Available from: www.ncsc.gov.uk/scheme/
cyber-essentials [viewed April 2018].
BS ISO/IEC 38500:2015, Information technology –
Governance of IT for the organization 
[23] NATIONAL CYBER SECURITY CENTRE (NCSC).
Cyber essentials homepage. Available from: www.
BS ISO/IEC 38505-1:2017, Information technology –
cyberessentials.ncsc.gov.uk/ [viewed April 2018].
Governance of IT – Governance of data – Application of
ISO/IEC 38500 to the governance of data
[24] NATIONAL CYBER SECURITY CENTRE (NCSC). 10
steps to cyber security. Available from: www.ncsc.gov.
PAS 555, Cyber security risk – Governance and
uk/guidance/10-steps-cyber-security [viewed April 2018].
management – Specification
[25] MAERSK. Interim report Q2 2017. Available
IEC 62443 series, Industrial communication networks –
from: http://investor.maersk.com/releasedetail.
Network and system security
cfm?ReleaseID=1037421 [viewed April 2018].
ELLIOT, M., MACKEY, E., O’HARA, K. AND TUDOR,
[26] INFORMATION COMMISSIONER’S OFFICE.
C. The Anonymisation Decision-Making Framework.
Determining what is personal data. ICO. Available
Manchester: UKAN Publications, 2016.
from: https://ico.org.uk/media/for-organizations/
documents/1554/determining-what-is-personal-data.pdf
FLORIDI, L. Information – A Very Short Introduction.
[viewed April 2018].
2010. Oxford: Oxford University Press.

[27] INFORMATION COMMISSIONER’S OFFICE. Preparing

for the General Data Protection Regulation (GDPR) – 12
steps to take now. ICO. Available from: https://ico.org.
uk/media/1624219/preparing-for-the-gdpr-12-steps.pdf
[viewed April 2018].

50 © The British Standards Institution 2018


British Standards Institution (BSI)
BSI is the national body responsible for preparing British Standards and other
standards-related publications, information and services.
BSI is incorporated by Royal Charter. British Standards and other
standardization products are published by BSI Standards Limited.
About us
We bring together business, industry, government,
consumers, innovators and others to shape their combined
experience and expertise into standards -based solutions.
The knowledge embodied in our standards has been
carefully assembled in a dependable format and refined
through our open consultation process. Organizations of
all sizes and across all sectors choose standards to help
them achieve their goals.
Information on standards
We can provide you with the knowledge that your
organization needs to succeed. Find out more about
British Standards by visiting our website at bsigroup.com/
standards or contacting our Customer Services team or
Knowledge Centre.
Buying standards
You can buy and download PDF versions of BSI
publications, including British and adopted European and
international standards, through our website at bsigroup.
com/shop, where hard copies can also be purchased.
If you need international and foreign standards from other
Standards Development Organizations, hard copies can be
ordered from our Customer Services team.
Subscriptions
Our range of subscription services are designed to make
using standards easier for you. For further information
on our subscription products go to bsigroup.com/
subscriptions.
With British Standards Online (BSOL) you’ll have instant
access to over 55,000 British and adopted European and
international standards from your desktop. It’s available
24/7 and is refreshed daily so you’ll always be up to date.
You can keep in touch with standards developments and
receive substantial discounts on the purchase price of
standards, both in single copy and subscription format,
by becoming a BSI Subscribing Member.
PLUS is an updating service exclusive to BSI Subscribing
Members. You will automatically receive the latest hard
copy of your standards when they’re revised or replaced.
To find out more about becoming a BSI Subscribing
Member and the benefits of membership, please visit
bsigroup.com/shop.
© The British Standards Institution 2018
PAS 1085:2018
With a Multi-User Network Licence (MUNL) you are able to
host standards publications on your intranet. Licences can
cover as few or as many users as you wish. With updates
supplied as soon as they’re available, you can be sure your
documentation is current. For further information, email
bsmusales@bsigroup.com.
Revisions
Our British Standards and other publications are updated
by amendment or revision.
We continually improve the quality of our products and
services to benefit your business. If you find an inaccuracy or
ambiguity within a British Standard or other BSI publication
please inform the Knowledge Centre.
Copyright
All the data, software and documentation set out in
all British Standards and other BSI publications are the
property of and copyrighted by BSI, or some person or
entity that owns copyright in the information used (such
as the international standardization bodies) and has
formally licensed such information to BSI for commercial
publication and use. Except as permitted under the
Copyright, Designs and Patents Act 1988 no extract may
be reproduced, stored in a retrieval system or transmitted
in any form or by any means – electronic, photocopying,
recording or otherwise – without prior written permission
from BSI. Details and advice can be obtained from the
Copyright & Licensing Department.
Useful Contacts:
Customer Services
Tel: +44 845 086 9001
Email (orders): orders@bsigroup.com
Email (enquiries): cservices@bsigroup.com
Subscriptions
Tel: +44 845 086 9001
Email: subscriptions@bsigroup.com
Knowledge Centre
Tel: +44 20 8996 7004
Email: knowledgecentre@bsigroup.com
Copyright & Licensing
Tel: +44 20 8996 7070
Email: copyright@bsigroup.com
51
BSI, 389 Chiswick High Road
London W4 4AL
United Kingdom
www.bsigroup.com