Architecture and engineering practices hold the most detailed picture of a building that will ever exist, yet most run on shared file servers, open project extranets and CAD workstations set up for speed rather than control. A design firm's risk is different from a contractor's: there is less site equipment and fewer payment runs, but far more intellectual property, client-sensitive drawings and files exchanged with dozens of outside parties. This guide covers the controls that are specific to design practices: securing CAD and BIM files and the scripts that run inside them, running project extranets and file sharing safely, meeting client and data protection duties, and lining up professional indemnity and cyber insurance. It is written for practice principals, IT managers and BIM or CAD managers in architecture, structural, building services and civil engineering firms. Site, plant and contractor topics are covered in the Cybersecurity for Construction Guide, which this page builds on rather than repeats.
Key takeaways
- Design files are executable surfaces. CAD templates, LISP routines and plug-ins run code on open, so a drawing from a client or partner can be a malware carrier, not just data.
- The extranet is the perimeter. Most leaks come from project links that never expire, shared logins and partner accounts left open after handover.
- Clients set the security bar. Security-sensitive projects arrive with requirements under a security-minded approach based on ISO 19650-5, and the practice must be able to show it meets them.
- Insurance needs a deliberate check. Professional indemnity responds to claims about your professional services; who pays for your own ransomware recovery or a misdirected fee is a separate question to settle with a broker.
- Small practices can cover most of the risk cheaply. Locked-down CAD loading, MFA on email and extranet, expiring share links, immutable backups and call-back on bank details remove most realistic scenarios.
What makes design firms different
A contractor's main exposure is money moving between many short-lived parties. A design practice's main exposure is information: concept options before planning, structural calculations, building services layouts, security and access arrangements, and survey data about existing buildings and their occupants. That information is shared early and widely, often before contracts are signed, and much of it outlives the project.
| Asset | Where it usually lives | Who wants it | Harm if lost or altered |
|---|---|---|---|
| CAD drawings and BIM models | File server or NAS, cloud CAD or BIM platforms, local workstation caches | Ransomware groups, competitors, foreign intelligence on sensitive projects | Programme delay, IP loss, physical security risk for the finished building |
| Calculations and design reports | Analysis software projects, document management | Fraudsters seeking credibility, litigants | Integrity disputes, professional liability claims |
| Client-sensitive drawings (security, plant rooms, access control) | Restricted project folders, client CDE | Hostile reconnaissance | Breach of client security requirements, loss of future work |
| Survey data, photographs, occupant and staff details | Survey apps, point cloud stores, shared drives | Data thieves | Data protection breach and notification duties |
| Fee invoices and bank details | Finance mailbox, accounting platform | Business email compromise gangs | Lost fees, misdirected client payments |
The design practice threat picture
| Threat | How it shows up in a practice | ATT&CK technique | Priority control |
|---|---|---|---|
| Malicious CAD content | A template, drawing or script pack downloaded from a portal or sent by a partner runs code when opened | T1204.002 Malicious File; T1080 Taint Shared Content | Restrict executable loading to trusted folders, block script file types at the mail gateway |
| Ransomware on project storage | Large, flat shares mapped on every workstation; one compromised account encrypts years of projects | T1486 Data Encrypted for Impact; T1039 Data from Network Shared Drive | Least-privilege project shares, immutable and offline backups, MFA on remote access |
| Extranet and cloud share exposure | Anyone-with-the-link shares, accounts for ex-partner staff, download of whole project sets | T1530 Data from Cloud Storage; T1078 Valid Accounts | Named accounts, expiring links, download alerts, close-out reviews |
| Partner and consultant compromise | A sub-consultant's mailbox or extranet account is used to send lures or pull files | T1199 Trusted Relationship; T1566 Phishing | Partner access by project, MFA required for external users, supplier security terms |
| Fee and payment fraud | Fake "change of bank details" for the practice or a sub-consultant | T1657 Financial Theft | Call-back to a known number, dual approval of bank detail changes |
| Departing staff and project files | Leavers copy portfolios that include client-confidential drawings | T1567 Exfiltration Over Web Service | Clear portfolio rules, offboarding checklist, endpoint DLP for sensitive projects |
Malicious CAD content is not theoretical. In 2012 ESET analysed ACAD/Medre.A, an AutoLISP worm that spread through a booby-trapped AutoCAD template posted on a public body's website in Peru, which firms working with that body were urged to download. It emailed drawings to accounts at two Chinese email providers, and ESET estimated that tens of thousands of drawings leaked. The lesson still holds: a template or drawing from a trusted source can carry code, and the CAD application will run it unless told not to.
Securing CAD and BIM files and workstations
CAD and BIM platforms support automation through scripts and plug-ins, and that automation runs with the user's rights. Treat the CAD environment like any other application that runs macros. In AutoCAD, the controls are documented system variables; other platforms offer their own add-in and script trust settings, so apply the same principles to every design tool you use.
| Control | Setting or practice | Why |
|---|---|---|
| Restrict executable loading (AutoCAD) | SECURELOAD = 2 so executable files load only from folders listed in TRUSTEDPATHS; lock the value through the CAD deployment | Autodesk documents 1 as the default (trusted folders only, warning for others) and 0 as legacy behaviour it does not recommend |
| Trusted folders | TRUSTEDPATHS points at a read-only network or local folder managed by the CAD manager, never at project folders or Downloads | Users cannot drop a script beside a drawing and have it load |
| Script and plug-in file types | Block or quarantine .lsp, .fas, .vlx, .dvb and .arx attachments at the mail gateway; release only through the CAD manager | These are the AutoLISP, VBA and ObjectARX formats that execute inside AutoCAD |
| Template and block library sources | Download templates from portals only to a quarantine folder, scan, and publish to the standard library after review | Medre.A spread through exactly this route |
| Plug-in inventory | Keep an approved list of add-ins per design platform, with owner and update source | Unapproved plug-ins are a supply chain risk and are rarely patched |
| Workstation privileges | No standing local admin for designers; use managed installs for software and plug-ins | Limits what a malicious file or plug-in can change. See the Engineering Workstation Security Guide |
In AutoCAD 2026-based products, Autodesk documents that when PROJECTAWARE is set to 1, SECURELOAD becomes read-only at 2, which suits practices that want enforcement without separate locking. Confirm these settings against Autodesk's current documentation for your release, since behaviour can change between versions.
Large model files change how you back up. Point clouds and federated models run to tens or hundreds of gigabytes, so daily full copies are often replaced by snapshots. Make sure at least one copy is immutable or offline and that restores of a full live project are tested, not just single files. See the Backup Security and Immutable Backup Guide.
Project extranets and file sharing
Every project needs a place to exchange drawings with clients, contractors and sub-consultants. Whether that is a common data environment (CDE) set by the client, the practice's own cloud storage, or a dedicated extranet, the same rules apply.
- One workspace per project: create a separate site, folder tree or project in the platform for each job, with access granted by project role, not to the whole practice library.
- Named accounts only: no shared "projectteam@" logins for partners. Require MFA for external users, either through the platform or by trusting the partner's own identity provider.
- Links that expire: disable or restrict anonymous links; set a default expiry (for example 14 or 30 days) and require sign-in for anything marked sensitive. See How to Audit Google Drive External Sharing and Public Links for the audit pattern.
- Sensitive folders apart: keep security, access control and critical plant drawings in a restricted area with a named list of people, view-only or watermarked where the platform supports it.
- Close out on handover: at practical completion, archive the workspace, remove external accounts and links, and record what was handed to the client and in what form.
- Review quarterly: list guest users and active external links per project and remove anything with no project owner. See How to audit guest and external users.
For sensitive assets, the UK National Protective Security Authority (NPSA) recommends an information handling strategy based on ISO 19650-5, the international standard for security-minded information management in BIM and other built environment work. NPSA guidance for clients of major infrastructure projects expects consultants to receive the client's security requirements at RIBA Stage 1 and to produce a security strategy at Stage 2, updated at Stages 3 and 4. It also points to provisions for keeping sensitive information out of planning submissions and to the IET and NCSC Code of Practice for cyber security in the built environment. If you choose a commercial platform for this work, the Secure File Sharing and Virtual Data Rooms buyer's guide lists the evaluation criteria.
Client duties: contracts, sensitive projects and personal data
- Client security requirements: read the appointment, information requirements and any security schedule at bid stage and price the controls. ISO 19650-5 sets out a proportionate, security-minded approach that includes monitoring and auditing compliance, so expect to show evidence, not just sign a clause.
- Need-to-know on sensitive projects: keep a named list of staff and sub-consultants with access to restricted information, brief them on handling rules, and avoid publishing images or details of the project in portfolios, awards entries and social media without client approval.
- Personal data: surveys of occupied buildings, photographs, staff lists and residents' details are personal data. Under UK and EU GDPR, Article 32 requires security appropriate to the risk, and where the practice processes personal data on a client's behalf, Article 28 requires a written contract setting out processor duties. Check which role you hold on each job.
- Sub-consultants: flow down the client's security terms and require MFA, named accounts and incident notification from every firm with extranet access. See the ISO/IEC 27036 Supplier Relationships Guide.
- Baseline certification: many public and private clients ask for Cyber Essentials or equivalent evidence in tenders. See the Cyber Essentials Guide.
Professional indemnity and cyber insurance
Professional indemnity (PI) insurance is part of practice for architects and engineers; the UK Architects Registration Board expects architects in business to hold adequate insurance, usually PI, under Standard 4 of the Architects Code. Cyber incidents sit awkwardly across policies, because the same event can produce a client claim, your own recovery costs and a fraud loss. Work through these questions with your broker before an incident, not after.
| Scenario | Question for the broker | Evidence insurers usually ask about |
|---|---|---|
| A client sues because confidential drawings leaked from your extranet | Does the PI policy respond, or does it exclude data and cyber events, and does the cyber policy cover third-party liability? | Access controls, MFA, sharing policy, incident response plan |
| Ransomware encrypts live projects and you miss deliverables | Which policy covers incident response, data restoration and business interruption, and what waiting period applies? | Backups, offline copies, restore tests, patching of remote access |
| A client pays a fee into a fraudster's account after a spoofed email from you | Is social engineering fraud covered, under which policy, and with what sub-limit? | Call-back procedure, email authentication, finance training |
| A design error is traced to a file altered by an intruder | How will the PI and cyber insurers deal with a claim that has both a negligence and a cyber element? | Version history, file integrity records, audit logs |
See the Cyber Insurance Guide and Identity Controls for Cyber Insurance Questionnaires Guide for how underwriters assess controls.
Where identity fits
Design practices rely heavily on freelancers, sub-consultants and client staff, so most access risk is external identity. Give every external person a named account with an end date tied to the project, and remove it at close-out. Non-human accounts matter too: CAD licence servers, render farm and plotter service accounts, scan-to-folder accounts on multifunction printers and sync tools that copy project data to the cloud often use static passwords with broad share access. Inventory them, give each the minimum folder rights, and rotate their credentials when staff with knowledge of them leave. See Construction Identity Security for project-based lifecycle patterns.
Rolling it out
- Inventory (weeks 1 to 2): list project storage locations, extranet platforms, external accounts, active share links, design applications and plug-ins, and service accounts.
- Quick wins (weeks 2 to 4): MFA for all email, extranet and remote access; call-back rule for bank detail changes; block script file types at the mail gateway; disable anonymous links by default.
- CAD lockdown pilot (weeks 4 to 8): set SECURELOAD and trusted folders for one studio, log which scripts users need, add approved ones to the trusted folder, then roll out practice-wide. Roll back by restoring the previous CAD profile for the affected group if a deadline is at risk.
- Storage restructure (months 2 to 4): move from one practice-wide share to per-project permissions, start immutable backup copies and run a full-project restore test.
- Extranet governance (months 3 to 6): per-project workspaces, link expiry defaults, quarterly guest reviews and a close-out checklist built into the project stage plan.
- Client evidence pack (ongoing): keep a short document describing these controls, with Cyber Essentials or ISO 27001 certificates, to answer tender questionnaires quickly.
Decision guidance by practice size
| Practice | Focus | Typical approach |
|---|---|---|
| Studio under 20 staff | Email, backups, CAD lockdown, extranet links | Cloud storage with per-project folders, Cyber Essentials, outsourced IT with a written scope. See Choosing an IT Support Provider or MSP Securely |
| Mid-sized, 20 to 250 staff, several offices | Project storage permissions, partner access, PI and cyber alignment | Named BIM or CAD manager owning trust settings, quarterly access reviews, endpoint protection with central logging |
| Large multidisciplinary consultancy | Sensitive project handling, supplier assurance, data loss prevention | ISO/IEC 27001 certification, ISO 19650-5 aligned procedures, restricted enclaves for security-sensitive work, DLP. See the Data Loss Prevention (DLP) Guide |
Detection and measurement
Log sign-ins and file activity on storage and extranet platforms, mail gateway blocks of script attachments, CAD load warnings where the platform records them, and changes to bank details in the accounting system. Alert on bulk downloads from a project workspace, new external sharing on restricted folders, and sign-ins to the extranet from new countries.
- External access hygiene: share of external accounts with an owner and end date (target 100%).
- Link exposure: number of anonymous or non-expiring links on live projects, trending to zero.
- CAD trust coverage: share of design workstations with SECURELOAD at 2 and a managed trusted folder.
- Close-out compliance: share of completed projects with external access removed within 30 days of handover.
- Recovery readiness: time to restore a full live project in the last test.
- Payment verification: share of bank detail changes with a recorded call-back.
Framework mapping
| Area | NIST CSF 2.0 | NIST SP 800-53 Rev. 5 | Other |
|---|---|---|---|
| CAD script and plug-in control | PR.PS-05 | CM-7, SI-3 | ATT&CK T1204.002, T1080 |
| Project storage and extranet access | PR.AA-05 | AC-3, AC-21 | ISO 19650-5 security-minded information management |
| Data at rest and backups | PR.DS-01, PR.DS-11 | CP-9 | ATT&CK T1486 |
| Sub-consultants and suppliers | GV.SC-05 | SR-6 | ISO/IEC 27036 |
| Personal data in surveys and project records | PR.DS-01 | AC-21 | UK and EU GDPR Articles 28 and 32 |
Common failure patterns
- Everyone maps everything: a single practice-wide share means one phished account can read or encrypt every project the firm has ever done.
- Trusted folders that are not trusted: TRUSTEDPATHS set to a writable project folder or the whole network drive, which defeats the control.
- Extranets that never close: partner and freelancer accounts and anonymous links stay live years after handover.
- Portfolio leaks: leavers or award entries publish images of security-sensitive projects without client approval.
- Assuming PI covers cyber: the practice discovers after an incident that its own recovery costs or a fee fraud sit outside its PI policy.
- Restores never tested at scale: backups exist, but nobody has restored a full federated model set, and the first attempt is during a ransomware incident.
Practitioner checklist
- Set SECURELOAD to 2 (or the equivalent add-in trust setting on other platforms) with a managed, read-only trusted folder.
- Block script and plug-in file types at the mail gateway and route them through the CAD manager.
- Move to per-project storage permissions and remove practice-wide write access.
- Require MFA for all staff and every external extranet user.
- Disable anonymous links by default and set expiry on all external shares.
- Build an access close-out step into the project stage plan at handover.
- Keep an immutable or offline backup copy and test a full-project restore twice a year.
- Agree with your broker in writing which policy responds to leak claims, ransomware recovery and fee fraud.
- Flow down client security requirements to every sub-consultant with access.
Standards and references
- ISO: ISO 19650-5:2020, Security-minded approach to information management
- NPSA: Major infrastructure projects, security considerations for clients
- Autodesk: SECURELOAD (System Variable)
- Architects Registration Board: Professional indemnity insurance
- FBI IC3: Business Email Compromise public service announcement (PSA240911)
- Help Net Security: AutoCAD worm steals blueprints (ESET analysis of ACAD/Medre.A)
Related NHI Mgmt Group resources: Cybersecurity for Construction Guide · Construction Identity Security · Engineering Workstation Security Guide · Invoice Redirection and Supplier Bank Detail Fraud Guide