MIM6: Securing Data

OASC MIM6 (global) and MIM6 Plus (EU) on Securing Data

Use Cases

Standalone use cases on the scope of this MIM are of limited value. Therefore, we intend to complement/share other use cases of other MIMs, in particular MIM3 Exchanging Data. The integration of (shared) use cases will take place in fall 2025.

(see the Use Case Information for additional information)

Description

As cities become smarter and more technology-driven, they become a target for cyber attacks with significant consequences in terms of costs and loss of services. In order to deliver reliable digital services for citizens, cities have to continuously evaluate the cyber risks and to put in place security measures to prepare for cyber attacks.

The first version of MIM 6 focuses on addressing interoperability for secure data transfer. The limited scope is to get progress and later iterations can and probably will expand the scope.

Specifications

(see Notes for Specifications from an earlier version of this MIM. This list includes relevant Specifications for the current stage of development; more detailed information to be added in due course)

Standard	Description
ISO 27001:2022	Information security, cybersecurity and privacy protection — Information security management systems — Requirements
IEC 62443	Requirements and processes for implementing and maintaining electronically secure industrial automation and control systems.

MIM6 Plus (EU version): EU Directives and overarching acts are not specifications but often point to relevant specifications. The following provides a non-comprehensive list of EU regulations with direct relevance for the EU version of MIM6 - and possible guidance for the global MIM6 version.

• NIS2, or Network and Information Systems 2, is an EU-wide legislation on cybersecurity. It provides legal measures to boost the overall level of cybersecurity in the EU and is an important driver for cities working with secure data sharing.

• CRA, or the Cyber Resilience Act, sets cybersecurity standards of digital products.

• RED, or the Radio Equipment Directive, establishes a regulatory framework for ensuring "safety and health, electromagnetic compatibility, and the efficient use of the radio spectrum" when operating radio equipment. It also covers interoperability requirements.