Choosing a Common Data Environment (CDE) is a high-stakes decision. Get security wrong and sensitive data is exposed. Miss standards compliance and projects face contractual and legal risk. Fail on usability and adoption drops.
IT directors should compare common data environments against measurable requirements, tested on their own project workflows. Feature lists and vendor demonstrations give only part of the picture.
The challenge is widespread. Research from UCL’s Bartlett School of Sustainable Construction found that the most common failure in CDE adoption is teams reverting to multiple parallel information sources, defeating the purpose of a single source of truth (Jaskula et al., Construction Innovation, 2024). The causes are consistent: poor user engagement, fragmented workflows, inadequate change management, and overly complex implementation strategies.
Here are 7 criteria IT directors and Information Management leaders should prioritise when evaluating an enterprise CDE aligned to ISO 19650.
| Criterion | Ask the vendor to show | How Asite's CDE addresses it |
| 1. ISO 19650 verification | Independent accreditation, with evidence | BSI ISO 19650 Framework Kitemark |
| 2. Security | Certifications, penetration testing frequency, data residency, supply chain access governance | See Asite's published security certifications |
| 3. Role-based access | Container-level permissions, and revoking a user's access | Configurable permission templates aligned with ISO 19650 delivery structures |
| 4. Workflows and approval states | A document moving through each workflow state, and a rejected submission | ISO 19650 approval states and workflow controls built into the platform |
| 5. Naming conventions | An upload with an incorrect file name and how that is handled | Naming conventions enforced at the point of upload |
| 6. Audit trail | An exported audit history for a sample project | Immutable, timestamped audit trails at field, document, and workflow action level, with full export |
| 7. Structured metadata | Metadata and relationships exported at project close | Structured metadata capture and configurable information relationships |
ISO 19650 alignment is easy to claim, but difficult to enforce consistently without a purpose-built CDE. The ISO 19650 Framework Kitemark reduces the burden of selecting a CDE by giving teams independent assurance that the platform and processes already align with recognised information management best practice.
Ask every vendor to demonstrate its information states, naming validation, approval workflow, audit history and handover exports. A statement that a product is ISO 19650 compliant does not replace that evidence.
Asite is one of two UK SaaS providers that are accredited with the BSI ISO 19650 Framework Kitemark. Asite renewed the accreditation in 2026.
A CDE contains sensitive contracts, infrastructure models, asset data, and financial records. Security cannot be treated as an add-on.
According to Construction News, construction remains one of the most targeted sectors for ransomware attacks, yet many organisations still lack formalised CDE security baselines in procurement requirements.
ISO 27001 certification should be considered the baseline. Beyond that, evaluate penetration testing frequency, data residency controls, and whether access governance extends across the supply chain, not just internal users. See Asite’s Security certifications.
Ask each vendor to show single sign-on, multi-factor authentication, audit logging, encryption, data residency, and backup arrangements. Request the evidence for each.
ISO 19650-2 defines a delivery structure such as, lead appointed parties, task teams, and employers’ information requirements. A CDE’s permission model should reflect that complexity. Permissions should operate at the information-container level, enabling suppliers and partners to access only the data relevant to them.
Asite’s configurable permission templates align with ISO 19650 delivery structures to ensure only the right people have access to the right information. In a demonstration, ask the vendor to revoke a user's access and to add a new supplier part-way through a project.
ISO 19650 defines information states such as work in progress, shared, published, and archived. These are governance checkpoints, not labels.
A CDE should enforce approval workflows so documents cannot move between states without the required sign-offs. This creates a consistent and auditable approval chain across projects and portfolios, even under the pressure of fast-paced builds. Ask the vendor to move a document through each state and to reject a submission.
Asite embeds ISO 19650 approval states and workflow controls directly into the platform architecture.
ISO 19650 naming conventions structure information using project, originator, type, role, classification, and revision data, making information easier to search and manage across large programmes.
Look for a CDE that enforces ISO-defined naming at upload. ISO 19650-aligned platforms like Asite help teams maintain consistent classification across programmes and supply chains by mandating naming conventions at the point of upload. Ask the vendor to show what happens when someone uploads a file with an incorrect name.
Every upload, review, approval, and revision should create an immutable audit record. ISO 19650 requires audit trails to be complete and tamper-evident. This becomes critical during disputes, audits, and regulatory reviews, where organisations need to demonstrate exactly what was approved, by whom, and when.
Asite generates immutable, timestamped audit trails at field, document, and workflow action level, with full export capability for legal and regulatory purposes. Ask the vendor to export the audit history for a sample project.
Metadata makes information searchable, governable, and reusable across the asset lifecycle. Without structured metadata, handover and asset management become manual and fragmented.
A strong CDE should support configurable classification structures and relationships between documents, approvals, BIM objects, and issues.
Asite's structured metadata capture and configurable information relationships help organisations maintain searchable, governed, and connected project data at scale, from early design through to asset handover. Ask the vendor to export metadata and relationships for a sample project.
How should a CDE connect to your other systems?
Ask which integrations are native, partner-built, custom-developed, or dependent on manual exports. Asite publishes an API guide and offers connectors for Acumatica, Sage 300 CRE and Sage Intacct through its integrations ecosystem.
What happens to project data when the project closes?
Ask each vendor to export a sample project with documents, metadata, relationships, revision history and audit records. Confirm what stays readable after the subscription ends.
The platforms that hold up across enterprise programmes aren’t always the ones with the most features. They’re the ones still being used, consistently, by the right people.
These criteria won’t make the decision for you, but they will help you surface the questions that separate a platform built for enterprise information management from one that has been positioned that way.
To learn how Asite helps organisations standardise information management and comply with ISO 19650, get in touch with the team.