Cyber Essentials for Construction and Building Contractors

Why principal contractors are asking

• Payment application and invoice fraud, where an intercepted email redirects a large payment.
• Design, BIM and drawing data shared through common data environments across many parties.
• Public sector and framework work that passes the requirement down the chain.
• Client and insurer expectations on supply chain assurance.

Scoping a construction business

• Head office and estimating team devices and email.
• Site tablets, laptops and phones used for drawings, timesheets and site records.
• Cloud services you administer: Microsoft 365 or Google Workspace, project management, accounting and any common data environment you own.
• Site connectivity, including mobile broadband routers in site cabins – default passwords must be changed.
• Personal phones used for work email, covered by a documented BYOD policy. See BYOD rules.

The controls that usually need work

1. MFA on all cloud accounts, including shared site or project mailboxes wherever technically possible.
2. Old site hardware running unsupported Windows or Android versions – the most common failure point.
3. Patching within 14 days across a distributed estate that rarely returns to the office.
4. Shared logins in site offices, which need replacing with individual accounts.
5. Leavers, given seasonal and project-based staffing.

Payment fraud: the control outside the certificate

Cyber Essentials closes the technical route into your mailbox, which is where payment diversion begins. Pair it with a firm rule that bank detail changes are verified by phone to a previously known number. Together these address the sector's most expensive loss scenario.

Cost and timescale

• Cyber Essentials £320 + VAT, priced by organisation size.
• 24 to 48 hours when prepared, two to four weeks if site devices need replacing or MFA rolling out.
• Cyber Essentials Plus £1,400 + VAT where a principal contractor requires audited evidence.

Bidding for public work? See Cyber Essentials for tenders.