A construction security review should collect evidence from identities, project rosters, drawings, field devices, subcontractors, financial workflows, connectivity, providers, support tickets, backups, closeouts, and incidents. The review should test real project paths, not only compare settings with a generic checklist.
Preserve contracts, approvals, project records, drawings, financial evidence, safety and training records, audit logs, closeout material, and replacement ownership before removing users or systems. Coordinate changes around bids, inspections, deliveries, payroll, billing, closings, and active incidents.
Evidence to collect before changing construction and contracting IT
The review produces a dated record of project and system scope, tested evidence, affected jobs and data, field and financial consequence, owner, immediate containment, durable correction, due date, and retest. It separates office, jobsite, subcontractor, provider, and process problems.
- Current project, worker, subcontractor, design-team, owner, provider, device, application, location, and administrator inventories.
- Identity, group, project, drawing, external, privileged, financial, service-account, token, session, recovery, and remote-support exports.
- Drawing revisions, RFI and submittal logs, change approvals, daily records, support tickets, security alerts, phishing and payment events, and device status.
- Backup scope, project and accounting exports, restore evidence, outage tests, closeout archives, warranty records, and recent departures.
- Licensing and contractual requirements, insurer conditions, provider responsibilities, incident contacts, and accepted exceptions.
Confirm projects, ownership, identity, external access, and authority
Project, system, and record ownership
What to check: Sample active, canceled, closed, and warranty projects and capture business and technical owners, system of record, identifiers, administrators, integrations, retention, export, recovery, and closeout.
What to do next: Assign accountable ownership, correct identifiers and project mapping, transfer administration, document record locations, repair export and recovery, and close abandoned dependencies.
Identity, project, and external permissions
What to check: Compare worker and company rosters with active, canceled, closed, and unrelated projects. Capture inherited groups, confidential views, last use, sponsor, end date, downloads, and public links.
What to do next: Correct role and project groups, close stale links, remove unrelated and inactive projects, expire external users, transfer ownership, and retest allowed and denied paths.
Autodesk Docs is a documented product example: direct, role, company and inherited grants can overlap. Removing one grant does not necessarily remove effective access. [1]
Privileged and financial authority
What to check: List high-impact roles by person with need, approval, last use, separation of duties, callback verification, monitoring, expiration, and backup coverage. Sample representative changes and transactions.
What to do next: Remove unnecessary authority, separate daily and administrative roles, add dual approval and known-channel verification, expire emergency access, alert on changes, and retest transactions.
Test drawings, devices, field connectivity, finance, monitoring, and support
Drawing, RFI, submittal, and change control
What to check: Trace sampled decisions from current field view to source, responsible reviewer, dates, revision, superseded material, approval, cost and schedule effect, and audit history.
What to do next: Publish current records in the approved platform, close unsafe attachments and duplicate folders, correct roles and notifications, preserve history, train users, and verify field and offline views.
Field device, mobile, and connectivity control
What to check: Match workers and locations to devices and collect ownership, last seen, health, encryption, protection, apps, local administrator, remote tools, connectivity, offline status, loss, and recovery.
What to do next: Recover unassigned systems, quarantine risk, enroll and patch devices, replace unsupported equipment, remove unknown remote tools and local privilege, secure jobsite networks, and correct offline and loss procedures.
Email, phishing, and payment-change verification
What to check: Test owner, executive, vendor, subcontractor, supplier, payroll, and change-order impersonation, hidden mailbox rules, callback independence, approvals, and after-hours escalation.
What to do next: Correct email protection, remove malicious rules and forwarding, refresh trusted contacts, require independent verification, reduce authority, train affected roles, and monitor high-risk changes.
FBI guidance recommends independent verification of payment/account-number changes using a known contact route. [3]
Application integrations and service identities
What to check: Record owner, purpose, projects, permissions, data, credential, last use, logs, failure behavior, billing, support, export, and removal path. Identify employee-owned and duplicate integrations.
What to do next: Disable unknown connections after preserving evidence, reduce scope, transfer ownership to managed identities, rotate secrets, add monitoring, remove duplicates, and document continuity.
Review backup, closeout, continuity, and incident readiness
Monitoring and support evidence
What to check: Choose representative critical and warning events and capture receipt, owner, investigation, containment, resolution, project and deadline context, user communication, and permanent correction.
What to do next: Fix missing telemetry and routing, define severity and coverage, add project and location context, test a known event, and correct recurring failures that workers have normalized.
Backup, outage, and project closeout
What to check: Match critical records to protected copies and capture retention, immutability, failures, restore time, project deadlines, final ownership, external access removal, and archive recovery.
What to do next: Add missing scope, isolate backup administration, correct jobs, run clean restores, complete project exports and archives, close temporary access, and repeat outage and closeout tests.
CISA recommends protected backups and regular recovery testing, including attention to cloud responsibility. [2]
Incident response for office and field
What to check: Run account takeover, payment fraud, ransomware, lost device, exposed drawings, provider outage, or subcontractor compromise and capture decisions, timing, affected jobs, continuity, recovery, and follow-up.
What to do next: Correct authority, contacts, evidence, containment, financial verification, field procedures, communication, provider roles, recovery, and training, then repeat the exercise.
Prioritize active exposure, payment risk, and project deadlines
Present findings by affected project, location, worker or company, record, financial or schedule effect, evidence, immediate containment, durable correction, owner, due date, and retest. Give field and office leaders specific decisions rather than a generic score.
Priority 1: Active compromise, payment exposure, or field interruption
Act immediately on confirmed compromise, exposed project or payroll information, uncontrolled privileged access, fraudulent payment changes, active malicious sessions, failed critical backup, or outages threatening safety communication, payroll, inspection, delivery, or billing.
Priority 2: Material project-control failure
Urgently correct missing MFA, broad project access, stale subcontractors, outdated drawings, unmanaged field devices, unknown integrations, untested recovery, or broken closeout ownership.
Priority 3: Governance and support weakness
Address incomplete inventories, stale procedures, recurring field workarounds, inconsistent training, poor alert context, and lower-impact drift after active project and financial risk is controlled.
Priority 4: Planned improvement
Sequence automation, reporting, device upgrades, connectivity, and workflow changes after the firm can support, protect, recover, and close the current environment.
Test the complete access path, not just the user list
Autodesk Docs is one documented example; use the equivalent supported controls in the contractor’s actual project system. The test records below are hypothetical.
On a narrow screen, scroll horizontally to read every table column.
| Access path | Audit question | Evidence to keep |
|---|---|---|
| Direct user plus company membership | Does removing the direct entry leave company-based access? | Effective permission result before/after and an excluded-user test. |
| Parent folder and inherited subfolder | Was the grant removed at the source, or is the child still inheriting it? | The parent assignment and the child’s effective access result. |
| Cloud access plus offline drawing copy | Does the former user/device still hold a previously downloaded copy? | Account/device handling and the approved record/copy decision; do not claim remote permission removal recalled every copy. |
Frequently Asked Questions
How should contractors review ownership of project systems and records?
Choose a sample of active, canceled, closed and warranty projects. For each, identify the business owner, technical administrator, authoritative record, integrations and usable recovery/export path. Ask a current backup owner to retrieve a representative record without the former project manager. A project number appearing in several applications is not proof that those records are mapped correctly.
How can contractors audit project and subcontractor permissions?
Compare the approved project/company roster with effective access, including direct users, roles, company assignments, inherited folders and public links. In Autodesk Docs, removing one permission type can leave another grant intact, and project administrators have broad folder authority. Test both an allowed user and an excluded person before declaring the access correct.
Supporting sources: [1]
What financial and administrative permissions should construction firms review?
Review who can change vendor details, prepare and approve commitments, alter payroll, release payments and administer the applications. Check the separation between preparation, verification and approval against a representative transaction. Independently verify changed payment instructions using a trusted contact route. Confirm that emergency privileges expire and that current backups can keep legitimate work moving.
Supporting sources: [3]
How should a construction IT review test current drawings and change records?
Ask a field user to open a sampled current drawing and trace its revision, source and related approval or change record. Compare the office, mobile and offline views, including superseded material. A fresh cloud upload does not prove a cached or printed set is current. Record the mismatch and retest the real distribution path after correcting it.
What should construction firms verify about field devices and jobsite connectivity?
Match workers and locations to live device records, then test one normal and one interrupted-connectivity workflow. Check encryption recovery, patch/protection state, remote tools, shared use and lost-device response. Verify that needed offline content was available before the connection failed and that later synchronization is understood. Do not promise offline access for a product or feature that has not been tested.
What should contractors test to reduce business email and payment fraud?
Rehearse a vendor bank-detail or payroll change using a fictional request. The verifier should obtain the established contact independently, complete the required approval and record the decision before any live change. Also check reporting and mailbox-rule investigation. Correct sender authentication helps, but a legitimate compromised mailbox can still deliver a fraudulent instruction.
Supporting sources: [3]
Why should construction firms audit project and accounting integrations?
An unattended connector can continue reading project data or moving accounting records after a person leaves. Record its supported owner, permissions, credential lifecycle, inputs, outputs and failure handling. Reconcile a representative run and test the manual continuity path. Resolve unknown or duplicated connections after preserving evidence; do not delete the only working handoff before a replacement is proven.
How can contractors tell whether IT alerts and support are effective?
Trace a representative event through source evidence, ticket assignment, responder action, field communication and resolution. Include the affected project and next deadline. A closed ticket should show what restored the work and what prevented recurrence, not just that the user stopped calling. Test after-hours escalation where the agreed service requires it.
What evidence proves construction project continuity and closeout?
Recover a representative project package and prove that approved staff can use it without the departed administrator or live project workspace. Include needed history, exports and warranty records, with measured recovery time and data age. Separately verify external-access closeout. An archive and an access-removal checklist are different controls, and both need evidence.
Supporting sources: [2]
How often should construction firms test office and jobsite incident response?
Use a risk-based schedule and repeat targeted tests after major system changes, project transitions, incidents or failed exercises. An annual office/field tabletop is a practical internal starting point, not a universal statutory interval. Rehearse a realistic lost-device, payment-fraud or project-platform outage scenario and close the specific authority, contact and continuity gaps found.
Related ALLMSP Resources
Sources
- Autodesk Docs: Manage Folder Permissions. Folder access can come from member/role/company assignments and inheritance, with project administrators retaining broad access; product-specific example. ↩
- CISA: #StopRansomware Guide. Maintain protected offline/encrypted backups, regularly test recovery, and understand cloud responsibility; no universal 14–30 day retention rule. ↩
- FBI: Business Email Compromise. Independently verify payment and account-number changes via known contact routes instead of replying to the changed message. ↩
