Keep construction files secure across job sites by treating every drawing, model, contract, schedule, photo, credential and device as part of one security system. Start with an inventory and risk ranking, assign owners, enforce least-privilege access with multifactor authentication, manage field devices and personal-device use, encrypt data, restrict remote entry points, maintain offline and cloud backups, and rehearse recovery.
The controls below are designed for offices, temporary site trailers, mobile crews, subcontractors, vendors and project handoffs. Adapt them to your contracts, technology, workforce and local legal duties.
As an Amazon Associate I earn from qualifying purchases.
1. Define what must be protected before buying controls
Security decisions are easier when the company can answer three questions: what information exists, where it is stored, and what would happen if it became unavailable, altered or exposed. A drawing repository, a superintendent’s tablet, a cloud project workspace and a remote-management portal are all parts of the same risk picture.
Recommended Free Tools
Build a project-data map
List each repository and the data it contains. Include office file servers, cloud storage, project-management applications, estimating and accounting systems, email, jobsite cameras, field forms, mobile applications, shared folders, contractor portals and personal devices that are permitted to access company information.
#1 Best Overall
- POWERFUL SECURITY KEY: The YubiKey 5C NFC is the most versatile physical passkey, protecting your digital life from phishing attacks. It ensures only you can access your accounts
- WORKS WITH 1000+ ACCOUNTS: Compatible with popular accounts like Google, Microsoft, and Apple. A single YubiKey 5C NFC secures 100+ of your favorite accounts, including email, password managers, and more
- FAST & CONVENIENT LOGIN: Plug in your YubiKey 5C NFC via USB and tap it, or tap it against your phone (NFC), to authenticate. No batteries, no internet connection, and no extra fees required
- MOST SECURE PASSKEY: Supports FIDO2/WebAuthn, FIDO U2F, Yubico OTP, OATH-TOTP/HOTP, Smart card (PIV), and OpenPGP. That means it’s versatile, working almost anywhere you need it
- PRIMARY & SPARE KEYS: Just like having a spare house key, we recommend buying two YubiKeys - one for daily use and one as a spare. That way you’ll never get locked out of your accounts
Classify information by business effect rather than by file extension. A practical set of categories is:
| Data class | Examples | Why compromise matters | Starting safeguards |
|---|---|---|---|
| Safety and operationally critical | Structural drawings, building-information models, change directives, inspection records, emergency plans | Wrong or unavailable information can create safety hazards, rework or a halted site | Named owner, least privilege, MFA, encryption, frequent backup and tested restoration |
| Commercially sensitive | Bids, contracts, payment applications, schedules, cost forecasts and negotiated rates | Disclosure can weaken negotiating position or delay payment | Role-based access, restricted sharing, audit logs and protected exports |
| Personal and regulated | Employee records, identification documents, payroll data and visitor logs | Loss can trigger privacy, employment or contractual obligations | Minimum collection, limited access, retention rules and secure disposal |
| Routine project material | Progress photos, meeting notes, submittal correspondence and general forms | Exposure may still damage trust or reveal project details | Authenticated sharing, sensible retention and device protection |
Record logical and physical assets
CISA’s ransomware guidance recommends tracking logical assets such as data and software as well as physical assets such as computers and other hardware. Your register should record the asset, its business owner, technical administrator, location, supplier, users, dependencies, backup method and recovery priority. Include equipment that is easy to overlook: network appliances in a trailer, cellular routers, USB drives, printers with stored jobs, camera recorders and temporary laptops.
Give each asset a review date. When a project closes, decide whether the asset is archived, transferred, wiped or decommissioned; do not leave old accounts and shared links active indefinitely.
Do these 3 things before closing this tab:
1Scan for outdated or missing drivers - takes under a minute2Repair Windows errors before they cause bigger problems3Fix the driver behind crashes, sound loss and screen glitchesIdentify dependencies and recovery order
Note which services depend on an identity provider, internet connection, mobile network, single administrator or external vendor. A file may be backed up yet still be unusable if the account that can decrypt it or the application that opens it is unavailable. Mark the systems that support safe work, payroll, contractual deadlines and field coordination so restoration can be sequenced deliberately.
2. Assign ownership and rules that survive project turnover
Security fails when everyone assumes someone else is responsible. Establish a simple decision structure before a project starts.
| Responsibility | Typical owner | Decisions to document |
|---|---|---|
| Business risk owner | Executive, owner or project director | Acceptable downtime, critical data and funding for controls |
| System owner | IT lead or application administrator | Configuration, access, logging, patching and backup settings |
| Data owner | Commercial, design, safety or operations lead | Who may view, edit, share, export and retain the information |
| Site coordinator | Superintendent or site technology lead | Device issue and return, connectivity, local storage and incident escalation |
| Supplier or subcontractor contact | Contract manager | Evidence of required controls, account end dates and handoff obligations |
Put security requirements into subcontractor, consultant and vendor agreements. Specify approved repositories, account naming, MFA, breach notification, return or deletion of project data, evidence needed at handoff and the date access ends. Confirm which party supplies devices, administers the account and preserves records. Contract language should be reviewed for the jurisdictions and clients involved; it is not a substitute for technical enforcement.
Rank #2
- POWERFUL SECURITY KEY: The Security Key C NFC is the essential physical passkey for protecting your digital life from phishing attacks. It ensures only you can access your accounts.
- WORKS WITH 1000+ ACCOUNTS: Compatible with Google, Microsoft, and Apple. A single Security Key C NFC secures 100 of your favorite accounts, including email, password managers, and more.
- FAST & CONVENIENT LOGIN: Plug in your Security Key C NFC via USB-C and tap it, or tap it against your phone (NFC) to authenticate. No batteries, no internet connection, and no extra fees required.
- TRUSTED PASSKEY TECHNOLOGY: Uses the latest passkey standards (FIDO2/WebAuthn & FIDO U2F) but does not support One-Time Passwords. For complex needs, check out the YubiKey 5 Series.
- BUILT TO LAST: Made from tough, waterproof, and crush-resistant materials. Manufactured in Sweden and programmed in the USA with the highest security standards.
3. Make identity the gate to every project system
Require MFA where the consequences are highest
Require multifactor authentication for email, file storage, project-management services and remote access. CISA recommends starting with administrator accounts and people who handle sensitive information, then expanding coverage. Prefer phishing-resistant methods when the service supports them. A physical security key is one option, but it works only when the identity provider and the relevant applications support the required standard and enrollment process.
Quick wins for a faster PC:
Repair Windows errors before they cause bigger problemsFix Now →Fix the driver behind crashes, sound loss and screen glitchesFind Drivers →Do not treat MFA as enabled merely because a key or authenticator has been purchased. Verify enrollment, recovery methods, enforcement reports and a tested process for replacing a lost factor.
Use least privilege and time limits
Give an employee, subcontractor or vendor only the access required for the current role. Separate viewing, editing, approving, exporting and administration where the software allows it. Use project groups instead of individual ad-hoc permissions, and set an end date for temporary access.
| Role example | Typical access pattern | Review trigger |
|---|---|---|
| Field worker | View current drawings and submit assigned forms or photos | Role change, site transfer or project completion |
| Design consultant | Access only the discipline folders and issue packages covered by the contract | Package delivery, scope change or consultant offboarding |
| Subcontractor supervisor | Submit and view records for the subcontracted scope; no unrelated commercial folders | Scope completion, replacement of supervisor or contract termination |
| Project manager | Broader project coordination rights, with approval separated from system administration | Project closeout or reassignment |
| System administrator | Administrative control through a separate privileged account | Every privilege change and periodic access review |
Operate a joiner-mover-leaver process
- Joiner: verify the person, employer, project role and manager before creating an account. Enroll MFA and issue only approved devices or applications.
- Mover: change group membership when duties or sites change. Remove old permissions rather than stacking new ones.
- Leaver: disable identity-provider access, revoke sessions and tokens, collect company equipment, transfer ownership of files and recover MFA factors. Ask the person’s employer to confirm deletion or return of project data where the contract requires it.
Review dormant accounts, guest users, shared mailboxes, service accounts and API tokens. Replace shared passwords with named accounts wherever possible; if a technical system requires a shared credential, store it in a controlled password manager, restrict its use and rotate it when personnel or vendors change.
4. Secure remote access and reduce internet exposure
Remote access should be an explicit path, not an accidental collection of exposed interfaces. NIST SP 800-46 Rev. 2, published in July 2016, addresses enterprise telework, remote access and BYOD for employees, contractors, business partners and vendors. Because the publication is older, compare its architecture with your current identity, cloud and network standards before implementation.
Design a controlled access path
- List every internet-facing service, including remote desktop, network-management panels, camera systems, storage appliances and vendor portals.
- Remove services that are not needed. For necessary services, document the owner, administrator, authentication method, patch responsibility and monitoring source.
- Change default passwords and disable unused accounts and protocols.
- Require MFA and restrict administrative access to approved users, devices and locations where practical.
- Place administrative sessions behind a monitored jump host or equivalent controlled gateway when the environment requires it. Do not expose management interfaces directly just because a site has a public address.
- Patch internet-facing systems promptly according to risk, monitor traffic and review exposure regularly. CISA’s Internet Exposure Reduction Guidance recommends these measures and recurring assessments.
Plan for unreliable site connectivity
Decide which work can continue offline and how it will synchronize later. Keep a controlled, current copy of safety-critical information available through an approved application or encrypted device rather than letting workers create untracked local duplicates. Document what happens when a cellular link fails: who authorizes an alternate connection, how files are exchanged temporarily, and how the temporary copies are removed afterward.
Rank #3
- POWERFUL SECURITY KEY: The YubiKey 5 NFC is the most versatile physical passkey, protecting your digital life from phishing attacks. It ensures only you can access your accounts
- WORKS WITH 1000+ ACCOUNTS: Compatible with popular accounts like Google, Microsoft, and Apple. A single YubiKey 5 NFC secures 100+ of your favorite accounts, including email, password managers, and more
- FAST & CONVENIENT LOGIN: Plug in your YubiKey 5 NFC via USB and tap it, or tap it against your phone (NFC), to authenticate. No batteries, no internet connection, and no extra fees required
- MOST SECURE PASSKEY: Supports FIDO2/WebAuthn, FIDO U2F, Yubico OTP, OATH-TOTP/HOTP, Smart card (PIV), and OpenPGP. That means it’s versatile, working almost anywhere you need it
- PRIMARY & SPARE KEYS: Just like having a spare house key, we recommend buying two YubiKeys - one for daily use and one as a spare. That way you’ll never get locked out of your accounts
5. Manage laptops, tablets, phones and personal devices
A device at a jobsite may be shared, left in a vehicle, connected to an unknown network or used by several trades. Set a minimum baseline before it receives project data.
Organization-owned device baseline
- Supported operating system with automatic security updates enabled.
- Full-disk encryption and a strong screen lock with a short inactivity timeout.
- Endpoint protection, firewall and remote-management capability appropriate to the platform.
- Standard user account for routine work; separate administrative credentials for maintenance.
- Approved applications only, with installation controlled by IT or a designated administrator.
- Asset tag, assigned user, site location and last check-in recorded in the inventory.
- Ability to revoke access, lock or wipe the device when it is lost or returned.
Make BYOD an explicit choice
Personally owned phones and tablets can bring organizational data onto hardware the company does not fully control. NIST SP 800-124 Rev. 2, published in May 2023, describes lifecycle-oriented mobile-device security for enterprise-provided and personally owned devices. NIST SP 1800-22, published in September 2023, presents an example standards-based BYOD architecture that addresses organizational data protection and privacy; it is not a mandate to adopt one product or deployment model.
Your BYOD policy should state:
- Which applications and data are allowed on a personal device.
- Whether enrollment in mobile-device management or an application-level management system is required.
- What the company can inspect, lock or wipe, and what remains private.
- Minimum operating-system, encryption, screen-lock and MFA requirements.
- How a worker reports loss, theft, suspected compromise or a change of phone.
- How company data is removed when access ends without deleting personal content unnecessarily.
- Whether offline copies, screenshots, local downloads and automatic backups are prohibited.
If the company cannot enforce the policy or explain its privacy boundary, provide an organization-managed device instead of quietly relying on personal equipment.
Handle a lost or stolen device quickly
- Call the designated security or IT contact immediately; do not wait for the next shift.
- Revoke sessions, tokens and certificates associated with the device and user.
- Lock or wipe the device through the management system when authorized.
- Reset credentials if there is any chance that they were exposed, beginning with privileged accounts.
- Record what data and applications were reachable, then assess contractual or legal notification duties.
- Issue a replacement only after required updates, encryption, management enrollment and MFA are complete.
6. Encrypt devices, files and removable media
Encryption reduces the impact of loss, but it does not replace access control or backups. CISA advises encrypting computers, mobile devices, hard drives, removable media and files. Confirm that encryption is actually enabled, that recovery keys are escrowed under controlled access, and that the organization can recover data when a device fails.
Use removable media deliberately
Ban unknown USB drives and define which encrypted media may be used. Record who issued a drive, what project it serves, where it is stored and when it is returned. Scan media before use, avoid carrying unneeded project folders, and securely erase or destroy media at end of life.
If an external drive is part of the backup plan, keep it physically secured and disconnect it when it is not actively backing up. CISA warns that ransomware can reach an attached drive; a drive that is always connected is not an offline backup. Consider a properly vetted cloud backup as an alternative or complement, with separate administrative credentials and tested restore procedures.
Rank #4
- POWERFUL SECURITY KEY: The Security Key NFC is the essential physical passkey for protecting your digital life from phishing attacks. It ensures only you can access your accounts.
- WORKS WITH 1000+ ACCOUNTS: Compatible with Google, Microsoft, and Apple. A single Security Key NFC secures 100 of your favorite accounts, including email, password managers, and more.
- FAST & CONVENIENT LOGIN: Plug in your Security Key NFC via USB-A and tap it, or tap it against your phone (NFC) to authenticate. No batteries, no internet connection, and no extra fees required.
- TRUSTED PASSKEY TECHNOLOGY: Uses the latest passkey standards (FIDO2/WebAuthn & FIDO U2F) but does not support One-Time Passwords. For complex needs, check out the YubiKey 5 Series.
- BUILT TO LAST: Made from tough, waterproof, and crush-resistant materials. Manufactured in Sweden and programmed in the USA with the highest security standards.
7. Configure collaboration and file sharing for the way projects actually work
Most exposure occurs through ordinary sharing choices rather than exotic attacks. Set the project workspace so that internal sharing is the default, external guests are identifiable, and public or anonymous links are disabled unless a documented exception is approved.
Use controlled sharing patterns
- Create separate areas for internal working files, issued documents, vendor exchange and client handoff.
- Grant guests access to a named folder or package, not the entire project workspace.
- Set expiration dates on guest accounts and links.
- Require sign-in for downloads and maintain audit logs for sensitive packages.
- Use version history and approval status so field crews can distinguish current drawings from superseded copies.
- Disable automatic synchronization to unmanaged devices where the platform allows it.
- Review forwarding, download, print and screenshot controls for especially sensitive records.
Photos can contain more than expected: faces, vehicle plates, whiteboards, access badges, screen contents and neighboring properties. Define who may upload, where images are stored, retention periods and whether images may be posted to personal accounts or sent through consumer messaging services.
8. Make backups recoverable, not merely successful
A backup job that reports success is not proof that the company can reopen a project after ransomware, account lockout, cloud outage, fire or site loss. CISA’s #StopRansomware Guide, September 2023 edition, emphasizes asset management, least privilege, secure offline backups and incident preparation.
Set recovery objectives by system
| System or record | Recovery question | Practical validation |
|---|---|---|
| Current drawings and models | How much recent work can the site afford to lose? | Restore a representative project and open files in the required software |
| Schedules and field forms | What must be available for the next shift? | Run a timed restore to an alternate account or workspace |
| Contracts and payment records | Which versions prove obligations and approvals? | Restore version history, permissions and metadata, not only the latest export |
| Identity and configuration data | Can administrators recover access if the primary service is unavailable? | Exercise break-glass accounts and document every dependency |
Use separate recovery copies
Keep frequent backups in a secure, properly vetted cloud service, on protected external media, or both. Separate backup administration from ordinary project administration. Protect backup credentials with MFA, limit who can delete or alter copies, and retain at least one copy that ransomware cannot reach through the production network. Disconnect external media when inactive.
Test restoration on a schedule
- Select a real project folder or system, including a large model and associated metadata.
- Restore it to an isolated location without overwriting production data.
- Check file integrity, version history, permissions, links and application compatibility.
- Measure how long the restore takes and record missing prerequisites such as licenses or encryption keys.
- Correct the failure, update the recovery runbook and repeat with a different system.
Document who can authorize a restore, which projects come first and how stakeholders are informed. If a cloud provider or account is unavailable, the plan should identify an alternate route rather than assuming normal sign-in will work.
9. Onboard and offboard each jobsite consistently
Site-start checklist
- Confirm the project data owner, site coordinator and escalation contacts.
- Load the asset register with devices, connectivity equipment, applications and repositories.
- Create role-based groups and end-dated guest access for contractors and consultants.
- Verify MFA enrollment before issuing access.
- Patch, encrypt and enroll every device before it receives project files.
- Test remote access, offline workflows, backup jobs and an emergency contact method.
- Brief workers on phishing, lost-device reporting, approved file exchange and prohibited personal storage.
Role-change and closeout checklist
- Remove people from old project groups when they transfer or finish work.
- Recover company devices, removable media, keys and badges.
- Revoke guest accounts, tokens, links and vendor access.
- Archive the agreed record set, preserve required versions and delete temporary copies.
- Confirm subcontractor and consultant return or deletion obligations.
- Review logs for unusual downloads or sharing before final access removal.
- Record lessons from incidents, failed restores and connectivity workarounds.
10. Prepare an incident response plan for a live site
When a device displays a ransom note or a mailbox is taken over, workers need instructions that work under pressure. CISA’s ransomware guidance recommends preparation, least privilege, asset management and offline backups; turn those principles into named actions.
Best Value
- FIDO2 & Passkey Ready: Business-ready and FIDO2 L1 certified. This key is supported by major management suites and is ideal for both individual and enterprise deployment. Works seamlessly with Gmail, Facebook, GitHub, Dropbox, Coinbase, and more.
- Universal Connectivity (USB-A ): Features a built-in USB-A connector—simply unfold the key and plug it into your compatible PC or laptop for seamless authentication on the go.
- Dedicated Manager App: Use the Thetis Manager App for the initial hardware PIN setup. Setting the PIN on the device first ensures a smooth registration process. Once the PIN is configured, you can begin registering the key across your favorite FIDO2-compatible online services.
- Ultra-Durable & Portable: Featuring a rotating metal cover, this key is water, crush, and tamper-resistant. It fits easily on a keychain and requires no batteries or network connectivity.
- Check FIDO2 compatibility before purchase - Known limitations: ID Austria is not supported (requires FIDO2 Level 2). Windows Hello login only works with Windows Enterprise editions that support Entra ID, and NFC is NOT supported.
Define the first-hour actions
- Report: Tell workers exactly whom to call and provide a second contact method if email is unavailable.
- Contain: Identify who may disconnect a device, disable an account, block a token or isolate a network segment. Do not destroy evidence.
- Assess: Record affected users, devices, repositories, time of discovery and any suspicious messages or links.
- Coordinate: Assign one incident lead to work with IT, management, insurers, legal advisers, clients and service providers as appropriate.
- Recover: Rebuild or restore from known-good copies, beginning with systems required for safety and critical operations.
- Learn: Preserve a timeline, identify the entry path, close the gap and update training and controls.
Decide in advance who determines notification obligations. Requirements vary by jurisdiction, contract, data type and affected parties; obtain qualified legal advice rather than applying one universal rule.
Rehearse without disrupting production
Run a tabletop exercise using a realistic scenario such as a stolen superintendent tablet, a compromised subcontractor account or ransomware on a shared file service. Test phone trees, authority to isolate systems, backup access, alternate communication, client notification and the order of restoration. Record decisions and assign owners for every gap.
11. Apply construction-sector guidance without treating it as universal law
The UK National Cyber Security Centre’s construction-industry guidance frames risks across design, construction and handover and includes business measures such as backing up data. It is useful sector context, but its precise version and applicability should be checked before relying on it. Construction companies must also follow the laws, privacy requirements, client specifications and contractual security clauses that apply in each jurisdiction where they operate.
What’s actually slowing this PC down?
Pick the symptom - the matching free tool is one click away.
For a multinational project, document which entity controls the data, where it is stored, who may transfer it across borders and which incident-notification timelines apply. A client’s security schedule may be stricter than the company’s normal baseline; capture those obligations in the project plan rather than leaving them in a bid attachment.
12. A practical 30-day rollout
Days 1–7: discover and contain
- Inventory repositories, devices, users, vendors and internet-facing services.
- Disable dormant accounts, change default passwords and enforce MFA for administrators.
- Identify the three data sets whose loss would most disrupt safety, revenue or delivery.
- Verify that at least one backup copy is protected from ordinary network access.
Days 8–15: establish control
- Assign data and system owners.
- Create role-based project groups and an offboarding workflow.
- Patch and encrypt managed devices; decide whether BYOD can meet documented requirements.
- Remove unnecessary public links and direct exposure of management interfaces.
Days 16–23: prove recovery
- Restore representative drawings, schedules and contracts to an isolated location.
- Test lost-device lock and wipe, MFA recovery and a break-glass administrator account.
- Document restoration order, dependencies and decision-makers.
Days 24–30: train and rehearse
- Brief office staff, field crews, subcontractors and vendors on approved workflows.
- Run an incident tabletop exercise.
- Review logs, guest access, backup results and unresolved exceptions with management.
- Set recurring dates for access reviews, exposure scans, patch checks and restore tests.
Common failure modes to eliminate
- One shared account for a whole crew: You cannot tell who acted, and one departure requires changing access for everyone. Use named accounts and role groups.
- Permanent guest links: A link copied months ago may still expose a live folder. Require sign-in and expiration.
- BYOD by convenience: If personal devices are not enrolled, encrypted or removable remotely, keep sensitive data in controlled applications or issue managed hardware.
- An always-connected backup drive: Ransomware can reach it. Disconnect inactive media and test a separate recovery copy.
- Remote access left enabled after a project: Inventory internet-facing services and remove or restrict those no longer needed.
- Backup success without restore testing: Validate files, permissions, keys, metadata and application compatibility in an isolated restore.
- Security limited to the office: Include trailers, vehicles, temporary networks, cameras, mobile crews, subcontractors and handoff repositories in the same control model.
Frequently Asked Questions
Can subcontractors use their own phones to access project files?
Only under a documented BYOD policy that defines permitted data, enrollment, authentication, privacy boundaries, lost-device reporting and removal of company data. If those controls cannot be enforced, provide a managed device or restrict access to a controlled application.
How often should access be reviewed on an active project?
Review access whenever someone joins, changes role, transfers site or leaves, and set recurring reviews for guest and privileged accounts. The interval should reflect project turnover and contractual risk rather than a universal calendar.
Is an external backup drive enough for recovery?
No. It must be protected, disconnected when inactive, supplemented as appropriate by a vetted cloud or other separate copy, and tested through an actual restore that includes permissions, metadata and required applications.
Crashes, No Sound, or Screen Glitches?
Random freezes, missing sound and display glitches usually trace back to one bad driver. Find and replace yours safely.Free scan · under a minutePC Slower Than It Used to Be?
A free scan shows the junk files, broken settings and background clutter dragging Windows down - then fixes them in one click.Free scan · Windows 10 & 11What should a worker do after losing a jobsite tablet?
Report it immediately through the designated incident channel so sessions and tokens can be revoked, the device can be locked or wiped, exposed credentials can be reset and notification duties assessed.
Quick Recap
Product prices and availability are accurate as of the date/time indicated and are subject to change. Any price and availability information displayed on Amazon at the time of purchase will apply.
