Construction & Contractors
We find out whether your office network, job-site connections, estimating and accounting systems and shared project files are safe from attackers, and fix what we find. Contractors move large payments between many outside parties, run temporary networks in trailers and keep sensitive drawings on shared drives. We tighten payment controls, secure each site and write down what an owner or prime contractor will ask to see.
A contractor's business runs on payments, schedules and shared documents. Millions of dollars move to subcontractors and suppliers on a draw schedule, crews work from trailers that did not exist last month, and every project means a new circle of outside people who need files. Attackers know this. Fraudsters watch for payment cycles, and ransomware groups look for firms that cannot afford a stopped week.
Our team treats construction as a cybersecurity problem first. We test whether the office, the job sites, the accounting and estimating systems and the shared project files are safe from attackers, then fix what we find: payment-change controls that hold up when an email looks real, segmented site networks with a backup connection, controlled sharing with subcontractors, and, for defense work, the evidence a prime contractor asks for under CMMC. We work within your project calendar and leave your people able to run what we build.
Threat wire
Latest security news for decision makers
Selected automatically every 6 hours from public news sources. Headlines link to the original reporting. Is your company exposed? Book a free assessment
What we see in your industry
- Wire and vendor-bank fraud targets contractors because payments are large, frequent and often arranged by email. A taken-over subcontractor mailbox can ask for a progress payment to go to a new account, and nothing in a busy accounts payable process stops it unless a written callback rule does.
- Job sites are temporary networks. Trailer Wi-Fi, cameras, tablets, a cellular router and a visiting inspector's laptop often share one flat network that nobody monitors, and the connection must keep working when the fiber or the cell tower does not.
- Drawings, bid documents and RFIs are shared with dozens of subcontractors, architects and owners. Links that never expire and accounts that outlive the project leave project files open long after the job is done.
- Defense subcontractors that handle controlled unclassified information (CUI) face the Department of Defense's CMMC program. Level 2 maps to the 110 requirements of NIST SP 800-171 Rev. 2, and a prime contractor will ask for a score, a plan of action and evidence.
- Ransomware that reaches estimating, scheduling or ERP systems stops payroll, bids and pay applications at once. Tested, separate backups and a rehearsed restore decide how long the stop lasts.
Vendor-bank fraud comes first. The pattern is simple: a message that looks like part of a normal thread asks accounts payable to send the next progress payment to a new account. We set one written rule, no bank-detail change from an email alone, and back it with a callback to a number already on file, two people on every change, a hold on the first payment to a changed account and a weekly review of every vendor-master change. Our insight article on vendor payment fraud lays out the controls in detail, and the FBI's Internet Crime Complaint Center reports business email compromise among the costliest categories of cybercrime.
Job-site networks come second. A site trailer needs an internet connection on day one and loses it when a trench cuts the line. We design a segmented site network with separate Wi-Fi for the crew, for guests and for managed company devices, cameras and sensors on their own VLAN with no route to the office, cellular failover over LTE or 5G, and managed tablets that can be locked or wiped if one goes missing. The network is the same pattern on every site, so a new trailer is a standard kit, not a custom project.
Project files and subcontractors come third. Drawings, specifications, bid packages and RFIs move between your team and many companies you do not control. We set up named, expiring access instead of open links, separate each project's space, require multi-factor authentication for anyone who can reach financial or design files, and close each project's access at turnover. Email authentication with SPF, DKIM and DMARC at enforcement makes it harder for someone to impersonate your company to your subcontractors and owners.
CMMC readiness is its own track for defense subcontractors. The Department of Defense's Cybersecurity Maturity Model Certification program is set out in 32 CFR Part 170, and contract clauses carry its requirements to subcontractors that handle federal contract information or CUI. Level 2 follows the 110 requirements of NIST SP 800-171 Rev. 2. We scope the environment so CUI lives in a small, defensible enclave, assess against the requirements, score it, write the system security plan and a plan of action with dates, and gather evidence. Whether a given contract requires a self-assessment or a third-party assessment is set by the contract; your contracts officer and counsel confirm it.
Ransomware readiness protects the systems that keep a contractor paid. Estimating, project management, accounting and payroll are often one flat network with one set of administrator accounts. We separate them, keep backups on a separate identity with an immutable copy, restore a system to prove it works and write a short plan for the week the ERP is down: who approves payments, how crews are paid and who calls the insurer.
Awareness training is built for the field. Superintendents and project managers sign in on phones between inspections, and accounting staff handle payment requests under deadline. Short, specific sessions and phishing simulations teach the one rule that matters most for each group.
Related work on our track record: a commercial construction firm that stopped a fake subcontractor bank-change request with callback verification (illustrative), a general contractor's segmented job-site network with cellular failover (illustrative), and a defense contractor's CMMC Level 2 readiness (illustrative).
CMMC Level 2 and Your SPRS Score, Explained for Small Defense Subcontractors
If you handle controlled unclassified information for a defense prime, two things decide whether you keep the work: your score in the Supplier Performance Risk System (SPRS) and your CMMC status. Here is what the rules say, in order, with the primary sources.
Work like yours
An engineering firm cleans up 1,480 guest accounts in Entra ID with access reviews, a sponsor for every guest and a block-then-delete lifecycle
Guest accounts fell from 1,480 to 612, every remaining guest has a named sponsor who has confirmed the need within the last quarter, and no…
Read the case
A CUI contractor maps its cloud provider's customer responsibility matrix into its system security plan before the assessment
The mock assessment found 4 issues across the 30 sampled requirements, all of them fixed, against the 17 weaknesses the same sample would…
Read the case
A construction firm builds immutable backups after a near-miss, with object lock, a separate admin identity and a restore test of estimating and ERP data
The first restore test took 9 hours to get the ERP usable and about 20 to bring back everything on the list, against a guess of 'a couple…
Read the caseHow we help
Cybersecurity
We find out whether everything you run is safe from attackers, then we fix it.
Learn moreManaged IT Services
We run your IT day to day so it stays secure: help desk, devices, Microsoft 365, Exchange, Active Directory, backups, networks and monitoring.
Learn moreSecurity Awareness Training
Train your people to stop the phish, the fake voice and the wire request before money moves.
Learn moreEmail Security, Archiving & Continuity
Filter threats out of mail, keep every message in an immutable archive you can search, and keep email working when the mail platform goes down.
Learn moreClayton Secure
One view of your entire cybersecurity program, in near real time.
Learn moreDisaster Recovery Planning
Know how long you can be down, and prove you can come back before the day you must.
Learn moreVoice, Fax & SMS
One platform for business voice, fax and text messaging, connected to your ERP, your Microsoft Teams and the software we build for you.
Learn moreCloud Management
Cloud cost review and management, without compromising on quality or security.
Learn moreFrequently asked questions
Direct answers to the questions we hear most. Something else on your mind?
Send us a messageHow do fake bank-change requests target contractors?
A message that looks like part of a real thread asks accounts payable to send the next progress payment to a new account. It works because payments are large, frequent and arranged by email. The fix is a written rule: no bank-detail change from an email alone. Confirm every change by calling a number already on file, require two people to approve it, and hold the first payment to a changed account.
Can a job-site trailer be made secure without a network engineer on site?
Yes, if the design is a standard kit rather than a custom build. Each trailer gets separate Wi-Fi for the crew, guests and company-managed devices, cameras and sensors on their own network with no route to the office, and a cellular backup connection for when the fiber is cut. Because every site uses the same pattern, a new trailer is a ship-and-plug-in job.
How should we share drawings and bid documents with subcontractors?
Use named accounts and links that expire, not open links that last forever. Give each project its own space, require multi-factor authentication for anyone who can reach financial or design files, and close the project's access at turnover. That way files are not left open after the job ends.
Does a defense subcontractor need CMMC?
It depends on what your contracts say. If you handle federal contract information or controlled unclassified information (CUI) on a Department of Defense contract, requirements are passed down from the prime contractor. Level 2 follows the 110 requirements of NIST SP 800-171 Rev. 2. Whether you need a self-assessment or a third-party assessment is set by the contract, so check with your contracting officer and counsel.
What happens to payroll and pay applications if ransomware hits our accounting or ERP system?
Without a plan, everything stops at once: payroll, bids and pay applications. Separate backups on their own identity, an immutable copy and a restore you have actually tested decide how long the stop lasts. We also write a short plan for that week: who approves payments, how crews are paid and who calls the insurer.