Security sensitive assessments – confidentiality

Confidentiality

BREEAM ensures confidentiality for all assessments. Our terms and conditions cover maintaining assessment data and keeping it confidential.

What we share

We only share details of scoring and evidence with relevant BREEAM staff and approved parties to enable services such as quality assurance and certification.

By default, upon registering, the assessor agrees to the assessment details being published on our GreenBookLive and BREEAM Projects upon certification. This includes publishing the asset’s:

  • Name and address.
  • Assessor company.
  • Rating and score.
  • Type.
  • Validity.

Opting out

If you do not wish the details of the assessment to be shared publicly you can request that it is not publicly listed. You can do this by contacting the BREEAM registration team via webform, or email to [email protected].

Security sensitive assets

There is no single definition of what makes an asset ‘security sensitive’.

As a guide, assessments may be considered security sensitive if the asset has some or all these attributes:

  • Sensitive information about the asset (e.g. design and construction schematics, operational details, systems information) may pose a significant physical or cybersecurity threat if shared.
  • The nature of potential threats is beyond the scope of what the security criteria in BREEAM is designed to address.
  • The design, construction or operation of the asset involves personnel with a form of organisational or government sponsored security clearance.

Determining secure assessment status

In many cases, projects requiring an NDA or confidentiality agreement are covered by our standard terms and conditions, and we reserve the right to reject requests for secure assessments.

It is the assessor’s responsibility to determine whether an asset could be security sensitive, based on the client’s requirements and this KBCN.

If you are unsure, please contact us with full details, including the requirements of the client and which of the above requirements are met by the asset.

Assessing and auditing secure assessments

In most cases secure assessments can be completed using our online tools for scoring and referencing.

Assessment details can be:

  • Anonymised, or
  • Opted out of public listing.
    By default, all projects (including secure projects) are publicly listed unless opted out.

We have a dedicated secure inbox ([email protected]) where we can accept secure assessment evidence, or links to access evidence via file transfer protocol.

This inbox is used for any situation where secure data needs to be shared with BRE. This includes:

  • Admin and technical queries.
  • Assessment and evidence submission.

Where secure data is not shared, please use our usual channels to discuss the process and confirm submission methods.

For more information on the secure assessment process, see KBCN0525.