The part of ISO 19650 that sets out how to assess and manage the security risk of a project's sensitive information - the formal standard behind the general concept of security-minded BIM. It applies to projects where the information itself could be a security risk if it leaked - critical infrastructure, defense sites, high-profile buildings - requiring a documented sensitivity assessment before deciding how openly a CDE can actually be shared.