IT support and cyber security for construction companies and trades

The call usually comes for one of these

Construction companies are among the least likely to have an IT provider, and among the most likely to be asked to prove they don't need one.

• A prime contractor sent a security questionnaire ISNetworld, Avetta, ComplyWorks or the general's own form, and the bid depends on completing it before the deadline.
• A cyber insurance renewal or a new requirement in a contract The application asks about multi-factor authentication and tested backups. Guessing at the answers is what voids a policy later.
• A payment went to the wrong account An email that looked exactly like a supplier's asked that banking details be updated, and the draw was paid before anyone questioned it.
• Nobody has looked at any of it in years The office computers, the Wi-Fi and whatever the backup is were set up a long time ago by someone who has since moved on.

Payment diversion: the loss that actually happens

Ransomware gets the headlines, but the money that leaves construction offices usually leaves quietly. Someone compromises a mailbox, often at a supplier or a subcontractor rather than at your company, and reads the thread until a progress draw is due. Then a message arrives from that genuine address saying the banking information has changed. It references the right project, the right amount and the right people, because the sender has been reading the file for weeks.

The defences are unglamorous and they work:

Multi-factor authentication on every mailbox

Stops your own accounts becoming the compromised one in someone else's version of this story, which is also how your name ends up on a fraud that hits a client.

Filtering ahead of the inbox

Catches lookalike domains and flags outside senders clearly, so a message that appears to come from inside the company is visibly marked when it doesn't.

A verification rule everyone knows

Any change to payment details is confirmed by phone, on a number you already had on file, not one in the email. Written down, told to whoever cuts the cheques, and applied to the owner's requests too. Costs nothing and prevents most of these.

Alerts on mailbox rules

The first thing an intruder does is create a rule that hides their replies in a folder nobody opens. Watching for that catches the compromise while it is still cheap.

Prequalification, without inventing answers

The security section of a prequalification asks about six things, however it's worded.

Multi-factor authentication

Enforced on email and remote access, for everyone including the owner. The most common gap and the fastest to close.

Backups with a restore you've tested

Microsoft 365 is not backed up the way most people assume, and neither is the estimating file on the office computer. "Tested" means someone restored something and can name the date. I do the test and give you the date.

Monitored antivirus on every machine

Including the laptop in the site trailer and the one the estimator takes home. Installed and watched, not installed and forgotten.

Written IT security and acceptable use policies

Real documents that match how your company actually operates, signed by staff. Reviewers can tell the difference between a policy and a template.

Security awareness training with a record

Short sessions and phishing simulations, with a completion record you can attach to the submission.

An incident response plan

One page: who is called, in what order, when a machine is encrypted or a payment goes astray. Short is fine. Missing is not.

I work through your questionnaire with you line by line, tell you where you genuinely stand, fix what's short and hand you the evidence to attach. Where you already meet the requirement, I'll say so rather than sell you something.

Office, shop and job site

Microsoft 365 and crews that change

Licensing, mailboxes, a new hire working the morning they start, and a departure locked out the same hour. Seasonal hiring shouldn't mean rebuilding accounts every spring.

Connectivity at the yard and the trailer

Starlink with cellular backup, wireless links between the office, shop and outbuildings, cameras on the yard and remote monitoring. I farm here, so I know what distance and weather do to a link and what a February wind does to a mount.

Phones and tablets that live in trucks

Enforced screen locks, remote wipe on a device left at a site, and keeping company email separate from a personal phone so a departure doesn't take the contact list with it.

Estimating and drawing files

Backed up independently and available from the trailer, so a dead office computer doesn't stop a bid going out.

Why local matters for this

Most contractors out here are supported from a city, by a provider who has never seen the yard and quotes a service window that assumes an office tower. When the wireless link to the shop drops or a machine needs someone standing in front of it, the distance stops being an abstraction.

I work across southwest Saskatchewan, on site or remote depending on the job: Swift Current, Maple Creek, Shaunavon, Gull Lake, Assiniboia, Kindersley, Moose Jaw and the country between them. One person, a short client list on purpose, and the same person every time. There's a named backup consultant if I'm ever unavailable, everything is documented, and every password lives in a vault you own rather than in my head.

More on how I work, including pricing and after-hours.