PRACTICAL CYBERSECURITY FOR CONTRACTORS
10 cybersecurity gaps contractors should review
A bid deadline. An urgent supplier payment. A crew waiting for the latest drawings. The right security measures protect more than computers: they help protect your work, your clients’ information and the trust you have earned.
Use these ten checks to start a conversation with your office, field and IT teams. For a deeper discussion, download our 2026 construction cybersecurity book using the link below.
Looking for the older 10 Ways report? This page now provides an updated starting checklist and links to our revised book. The offered download is the 86-page cybersecurity book, not the IT-provider comparison report.
1. Accounts protected only by passwords
Ask which accounts require multifactor authentication, especially email, remote access and administrator accounts. Discuss phishing-resistant methods and document any exceptions.
2. Payment changes accepted by email alone
Confirm new bank details with an authorized contact using a previously verified phone number. Require a second authorized review before changing vendor records or releasing payment.
3. Devices no one is responsible for
Know which laptops, tablets and phones can access project information. Agree who handles updates, device protection and lost-device response, including personally owned devices.
4. Updates and unsupported software left unresolved
Review missing updates and software nearing the end of support. Plan testing, deployment and replacement around business needs, with a named owner for exceptions.
5. More access than the job requires
Review administrator permissions, shared accounts and former employee or subcontractor access. Give each person the access their role needs and remove it when the need ends.
6. Project files shared too widely
Check who can open or change client files, drawings and contracts. Review guest access, public links and approved AI tools before sharing sensitive information.
7. Backups that have never been restored
Ask what is backed up, how backup copies are protected and when recovery was last tested. Record what was restored, how long it took and which problems still need attention.
8. Alerts without a response owner
A security product can generate an alert without anyone acting on it. Confirm who reviews alerts, when they are covered and who can contain a suspected incident.
9. Staff unsure how to report a concern
Give employees a simple way to report suspicious messages, unexpected sign-in prompts and mistakes. Practice the process and make prompt reporting easier than staying silent.
10. No shared plan for an interruption
Keep incident contacts and recovery priorities available when email or systems are down. Rehearse who calls the bank, IT provider, insurer and affected business leaders.
These controls work together. No checklist or product guarantees that a breach will not happen. Coordinated people, processes and technology can reduce risk, limit damage and improve recovery. Plan technical changes with the person responsible for your environment.
Get the complete construction cybersecurity book
Free PDF · 2026 revised edition · 86 pages · 16 chapters · 9 printable worksheets
Explore account protection, vendor payments, field devices, Microsoft 365, recovery and the security stack your business and clients depend on.
Get the free cybersecurity book
The next page explains the book and provides a short form. After submitting that form, you can open or save the PDF. Read our privacy policy.
Choose one next step with your team
Mark each check as in place, needs attention or not sure. Agree on the three questions that matter most, assign an owner and set a review date.
Need help setting priorities? Book a free 15-minute IT Priorities Call. Receive a brief written follow-up with up to three priorities or questions and a recommended next step. No cost, no obligation to purchase and no system access required. Technical assessments are separately scoped.
Explore construction IT support · Browse our resource library
Further guidance: CISA resources for small and medium businesses, NIST Small Business Cybersecurity Corner, and our vendor bank-change verification guide.