Construction Cybersecurity: Threats and Controls

Construction firms move large sums of money between many short-lived parties, run projects from temporary sites on shared networks, and hold design data that clients, insurers and regulators increasingly expect them to protect. That mix makes the sector a steady target for payment diversion fraud, ransomware and supply chain intrusion, while security budgets and IT teams are usually small compared with turnover. This guide sets out the threat picture specific to contractors, consultants and their supply chains, the regulation and contract clauses that now carry security obligations (the UK golden thread, ISO 19650-5, US defence contracting rules), and the controls that matter most across the project lifecycle. It is written for IT and security leads at contractors and design practices, project directors, and the people who assess construction suppliers.

Key takeaways

Payments are the primary target. Interim valuations, retention releases and subcontractor bank detail changes give fraudsters a regular, predictable reason to send a convincing payment request.
Every project is a temporary organisation. Joint ventures, subcontractors and consultants come and go, so access is granted quickly and rarely removed on time.
Design data is an asset with security duties attached. ISO 19650-5 and the UK golden thread for higher-risk buildings both expect sensitive building information to be controlled, versioned and handed over securely.
Sites are hostile networks. Cabins, shared broadband, rugged tablets, drones, GPS and machine control kit sit outside the corporate perimeter and are often unmanaged.
Start with the basics, applied to the project model. Phishing-resistant MFA, verified payment changes, offline backups and a joiner, mover and leaver process for project partners remove most of the realistic risk.

Why construction is targeted

When the UK National Cyber Security Centre published its first sector guidance for construction in February 2022, produced with the Chartered Institute of Building (CIOB), it gave a simple reason: construction firms hold sensitive data and process high-value payments. It named spear-phishing, ransomware and supply chain attacks as the main threats and pointed to growing reliance on 3D modelling packages, GPS equipment and business management software. The guidance is aimed mainly at small and medium-sized firms and walks through each stage of a project from design to handover.

Several structural features turn those generic threats into sector-specific problems:

Thin margins and cash flow pressure: a delayed project costs liquidated damages, so a firm under ransomware extortion is under real pressure to restore quickly, and staff under deadline pressure approve payments quickly.
Fragmented supply chains: a single project may involve dozens of subcontractors and suppliers, many of them small businesses with personal email accounts and no IT support. A compromise of any one of them gives a trusted mailbox to send invoices from.
Public information about projects: planning portals, tender notices, site hoardings and trade press tell an attacker who the client, main contractor and key subcontractors are, which makes impersonation easy.
Dispersed workforce: site managers, surveyors and engineers work from cabins, vans and client premises on mobile devices, with shared logins still common for site equipment and software.
Long asset life: data created during design and construction is needed for decades of operation, so it has to be protected well beyond the project team.

The construction threat picture

The table maps the threats most often seen in the sector to the project activity they exploit and the ATT&CK technique that describes them. Use it to check that each technique has a control owner on your projects.

Threat	What it exploits on a project	ATT&CK technique	Priority control
Payment diversion and invoice fraud	Subcontractor bank detail changes, valuation and retention payments, supplier invoices sent by email	T1566 Phishing; T1534 Internal Spearphishing; T1657 Financial Theft	Out-of-band verification of every bank detail change, dual approval, DMARC enforcement
Mailbox takeover of staff or partners	Shared or reused passwords, legacy authentication, site staff on personal devices	T1566.002 Spearphishing Link; T1078 Valid Accounts	Phishing-resistant MFA, conditional access, block legacy protocols
Ransomware	Flat networks, internet-exposed remote access, file servers holding live project data	T1133 External Remote Services; T1190 Exploit Public-Facing Application; T1486 Data Encrypted for Impact	MFA on all remote access, patching of edge devices, immutable offline backups
Supply chain intrusion	Partner access to common data environments (CDEs), shared project accounts, managed IT providers	T1199 Trusted Relationship	Named accounts per person, time-bound access, supplier security requirements in contracts
Executive impersonation and deepfakes	Finance teams in regional offices acting on instructions from senior leaders	T1657 Financial Theft	Call-back to a pre-registered number, no approval on voice or video alone
Site and plant technology compromise	Internet-reachable cameras, site access systems, telematics portals, machine control base stations	T0883 Internet Accessible Device (ICS)	Asset inventory, changed default credentials, no direct internet exposure

The FBI's Internet Crime Complaint Center (IC3) puts the scale of business email compromise in perspective: its September 2024 public service announcement recorded 305,033 incidents and about US$55.5 billion in exposed losses worldwide between October 2013 and December 2023, and its 2024 annual report recorded 21,442 BEC complaints with losses of about US$2.77 billion in that year alone. Those figures are not sector-specific, but construction's payment patterns fit the BEC playbook closely. See the Email Identity and BEC Guide.

Regulation, standards and contract requirements

There is no single cyber law for construction. Obligations arrive through building safety law, information management standards, data protection law and client contracts. Confirm which apply to each project at tender stage, because they change the cost of delivery.

Instrument	Who it reaches	Security expectation
UK Building Safety Act 2022 golden thread (higher-risk buildings)	Clients, principal designers, principal contractors and accountable persons for buildings at least 18 metres or 7 storeys with at least 2 residential units, or hospitals and care homes	Information kept digitally, secure from unauthorised access, with version control; access handed over at completion (Building (Higher-Risk Buildings Procedures) (England) Regulations 2023, regulation 38 covers handover)
ISO 19650-5:2020	Any organisation managing sensitive built-environment information, usually invoked by the client's information requirements	A security-minded approach to information management: assess sensitivity, apply proportionate controls across the asset lifecycle, monitor and audit compliance
UK GDPR and EU GDPR (Art. 32)	Any firm processing worker, resident or customer personal data, including site induction, biometric access and CCTV records	Security appropriate to risk; breach notification to the regulator within 72 hours where required
US CMMC and DFARS 252.204-7012	Contractors on US Department of Defense work handling Federal Contract Information or Controlled Unclassified Information, including design and construction contracts	Level 1: 15 FAR 52.204-21 requirements; Level 2: 110 NIST SP 800-171 Rev 2 requirements. Phase 1 began on 10 November 2025; Phase 2 was suspended on 13 July 2026 pending review, and DFARS 7012 obligations still apply
Public sector supply requirements (for example UK Cyber Essentials)	Suppliers to government and many large clients	Baseline technical controls certified annually

The CMMC programme status has changed several times, so check the DoD CIO page before relying on dates. See the NIST SP 800-171 and CMMC 2.0 Guide, the Cyber Essentials Guide and the UK GDPR and Data Protection Act 2018 Guide.

Securing the project lifecycle

The NCSC guidance is organised around project stages, and that is the most practical way to assign controls, because the people and systems change at each stage.

Bid and design

Classify the information: run the ISO 19650-5 sensitivity assessment at the start. Layouts of secure areas, security systems, critical plant locations and resident details need tighter controls than general drawings.
Set up the common data environment securely: single sign-on with the firm's identity provider, named accounts only, role-based folders by work package, download and external sharing logged. See the Secure File Sharing Guide.
Write security into appointments: include minimum controls (MFA, patching, backup, incident notification within an agreed number of hours) in consultant and subcontractor terms, mirroring the client's requirements.

Mobilisation and construction

Treat the site cabin as an untrusted branch: separate networks for corporate devices, guest and subcontractor devices, and site technology (cameras, access control, plant telematics). Corporate devices connect back through always-on VPN or a zero trust access client, never directly to the site LAN.
Manage every device that touches project data: enrol tablets and phones in mobile device management, enforce screen lock and encryption, and use app protection policies on personal devices. See the Mobile Device Management Security Guide.
Remove shared logins: replace site-wide accounts on estimating, scheduling and CDE tools with named accounts. Where hardware forces a shared account (a total station controller, a site printer), change the default password and record it in a vault.
Control remote access to plant and building systems: machine control, telematics and temporary building management systems are often supported by vendors over the internet. Route that support through a brokered, recorded session with approval per use. See the OT Remote Access Guide.

Handover and operation

Hand over access, not only files: the golden thread guidance expects access and control of building information to pass to the client. Transfer ownership of CDE spaces, BMS and access control administrator accounts, and revoke contractor access on the same day.
Reset every credential: commissioning engineers set passwords on controllers, cameras and network kit. Rotate them at handover and give the operator a record of every device and account. See the Building Management System Security Guide.
Archive securely: retain project records for the contractual and limitation period in a protected archive, then delete. See the Data Retention and Secure Deletion Guide.

Where identity fits

Most construction incidents start with an identity: a mailbox, a partner account or a vendor's remote access login. Three identity problems are particular to the sector.

Project partners outnumber employees: a main contractor may have more external users in its CDE and collaboration tenant than staff. Give each a named guest identity, sponsor it to a project manager, expire it at the end of the work package and review it monthly. See the Contractor Identity Lifecycle Guide and the Third-Party Access Guide.
Integration accounts and API keys: CDEs, scheduling, cost management and drone survey platforms are connected with service accounts and API keys, often set up by a project team and never reviewed. Inventory them per project, store keys in a secrets manager and revoke them at closure. See the API Key Management Guide.
Device and plant identities: cameras, gate controllers, GPS base stations and BMS controllers each carry credentials. Track them like any other non-human identity. See the Device and IoT Identity Guide.

Priority controls and decision guidance

A firm with a two-person IT team cannot run everything at once. The order below follows where losses actually occur.

Priority	Control	Small firm (under 50 staff)	Large contractor or JV
1	Payment change verification	Call back on a number from the original contract, never from the email; two people approve new payees	Supplier portal for bank details with verified change workflow; finance system enforces dual approval and a hold period on changed payees
2	Strong authentication	MFA on email and banking for everyone, authenticator app minimum	Phishing-resistant MFA (FIDO2 passkeys) for finance, admins and site managers; conditional access by device compliance
3	Email authentication	SPF, DKIM, DMARC at p=quarantine via the email provider	DMARC at p=reject on all domains including parked and JV domains; external sender tagging
4	Backup and recovery	Cloud backup of email and file stores with a separate admin account	Immutable, isolated backups of CDE, ERP and file servers; tested restore within project tolerance
5	Partner access lifecycle	Spreadsheet of external users per project reviewed monthly	Access packages with expiry and sponsor attestation in the identity governance tool
6	Site network separation	Separate SSID for guests and subcontractors	Standard site network build with VLANs for corporate, guest and site technology, managed centrally

Choosing between models: joint ventures should decide at mobilisation whose tenant hosts the project. One partner's tenant with guest access for the others keeps a single policy and audit trail; a separate JV tenant isolates risk but doubles the identity work and is harder to close. For short projects use the lead partner's tenant; for multi-year programmes with their own staff, a dedicated tenant with its own conditional access baseline is usually justified.

See the Payment Fraud Guide, the Phishing-Resistant MFA Guide and the Backup Security and Immutable Backup Guide.

Rolling it out

Weeks 1 to 4, stop the money leaking: publish a payment change procedure, brief finance and commercial teams, and add a banner to external email. Test it with a simulated bank detail change request.
Weeks 2 to 8, lock down identities: enable MFA for all users in report-only conditional access first, review sign-in logs for breakage (site kiosks, scanners, legacy apps), then enforce in rings: IT, finance, office staff, site staff.
Weeks 4 to 12, inventory projects: list every live project's CDE, external users, integrations, site devices and remote support routes. Assign an owner per project.
Months 3 to 6, backups and recovery: isolate backup administration, make copies immutable, and run a restore of one complete project dataset. Keep the previous backup scheme running until the first restore test passes.
Months 3 to 9, standard site build: design one site network and device template, pilot on a new project, then apply to all new mobilisations. Do not retrofit live sites mid-programme unless an assessment shows exposure.
Ongoing, supply chain: add security clauses at the next contract renewal and ask key subcontractors for Cyber Essentials or equivalent evidence.

Rollback: conditional access policies should be enforced per group so a failing ring can be returned to report-only without affecting others. Keep a documented break-glass account excluded from MFA enforcement, monitored for any sign-in.

Detection and measurement

Log: mailbox rule creation and forwarding to external addresses, sign-ins from new countries for finance users, CDE bulk downloads and external shares, changes to supplier bank details in the finance system, and remote access sessions to site and building systems.
Alert on: new inbox rules that move or delete messages containing "invoice" or "payment", OAuth consent grants to unknown apps, and payment runs that include a payee changed in the last 30 days.

Metrics that show the programme is working:

Percentage of bank detail changes verified out of band before payment (target 100 per cent).
Percentage of users, including site staff, covered by MFA, and the share using phishing-resistant methods.
External project accounts past their end date and still active (target zero).
Days from project practical completion to revocation of all contractor access.
Time to restore a full project dataset in the last test.
Click and report rates in phishing simulations themed on invoices and valuations.

Framework mapping

Construction control	NIST CSF 2.0	NIST SP 800-53 Rev 5	CIS Controls v8.1	ISO/IEC 27001:2022 Annex A
Supplier security requirements in appointments	GV.SC-05	SR-3, SR-6	Control 15	5.19, 5.20
Partner access expiry at project closure	GV.SC-10, PR.AA-01	PS-7, AC-20	Control 6	5.18
MFA for staff and partners	PR.AA-03	IA-2	Control 6	8.5
Site network separation and remote access	PR.AA-03	AC-17, SC-7	Controls 12, 13	6.7, 8.20, 8.22
Design data protection in the CDE	PR.DS-01	AC-3	Control 3	5.12, 5.14
Backups of project data	PR.DS-11	CP-9	Control 11	8.13
Incident response with partners	RS.MA-01	IR-4	Control 17	5.24, 5.26

Common failure patterns

Trusting the channel: finance staff act on an instruction because it came from a known mailbox or a familiar face on a call. Arup, the design and engineering firm, lost HK$200 million across 15 transfers in 2024 after an employee joined a video call in which every other participant was a deepfake; see the Arup deepfake fraud.
Access that outlives the project: subcontractor accounts in the CDE and collaboration tenant stay active for years after their package finished, giving anyone who later compromises that subcontractor a route back in.
Vendor default credentials on site kit: cameras, gate systems and BMS controllers installed with factory passwords and left reachable from the internet for remote support.
Backups on the same domain: project file servers backed up to storage administered with the same domain accounts, so ransomware operators delete or encrypt the backups first.
Security clauses only on the first tier: the main contract carries ISO 19650-5 or CMMC obligations, but they are not flowed down to the design consultants and specialist subcontractors who actually hold the sensitive drawings.

Lessons from incidents

The Arup case is useful for construction precisely because no system was breached: the attacker exploited a decision process. The controls that would have stopped it are procedural (a call-back to a pre-registered number, a second approver for new beneficiaries, a hold on unusual transfers) and cost little. Firms that have spent heavily on endpoint tooling but still allow a single person to release a large payment on the strength of an email or call have the order of investment wrong. See the Executive Deepfake and CEO Fraud Guide and the Business Email Compromise Response Playbook.

Practitioner checklist

Publish and test a payment change procedure with out-of-band verification and dual approval.
Enforce MFA for every user, with phishing-resistant methods for finance, administrators and site managers.
Set DMARC to p=reject on every domain the firm and its JVs own.
Run an ISO 19650-5 sensitivity assessment at project start and set CDE permissions from it.
Give every external user a named, sponsored, expiring account; review monthly and revoke at package completion.
Build a standard site network with separate segments for corporate, guest and site technology.
Inventory and rotate all device and integration credentials at handover; transfer administrator access to the client.
Keep immutable, isolated backups of project data and test a full restore at least annually.
Flow security clauses down to consultants and subcontractors, including incident notification.
Agree with JV partners, before mobilisation, whose incident response plan applies and who notifies the client.

Cybersecurity for Construction Guide: Threats, Regulation and Priority Controls