Construction companies should protect themselves with layers: multi-factor authentication on every account, centrally managed and encrypted devices, email filtering against phishing and invoice fraud, tested backups, 24/7 monitoring and regular staff training. They should also get Cyber Essentials, which is required for some government contracts and increasingly requested in construction tenders. Getting the basics right consistently removes most of the risk.
Why are construction companies targeted?
The NCSC says construction businesses of all sizes are targeted because of the sensitive data they hold and the high-value payments they handle. That data includes tender submissions, contracts, financial records, drawings, health and safety documents, staff data and supplier bank details. Mobile working, temporary sites and subcontractor access add further gaps. Across all UK businesses, 43% reported a breach or attack in the last 12 months, and phishing was by far the most common (38%) (Cyber Security Breaches Survey 2026).
What does a cyber attack actually cost a construction business?
The ransom is rarely the biggest cost. Inaccessible drawings, lost project records, payroll and invoicing stopped, customer data stolen, payment fraud, contract disputes and reputational damage can hit several live projects at once. A few hours of downtime can cost far more than recovering the systems.
Is Cyber Essentials a tender requirement?
Increasingly, yes. Under PPN 014 (which replaced PPN 09/23 in February 2025), suppliers to central government must hold Cyber Essentials where a contract involves citizens' personal data, government staff data or OFFICIAL information. Local authorities, housing associations, healthcare bodies, utilities and large principal contractors now ask about cyber security in pre-qualification questionnaires (PQQs) and supplier assessments too.
Cyber Essentials covers five controls: firewalls, secure configuration, user access control, malware protection and software updates. Beyond tenders, it helps with cyber insurance: the NCSC reports certified organisations are 92% less likely to make a claim. Uptake is growing, with 61,430 certificates issued in the year to June 2026, but only 5% of UK businesses hold it (Cyber Security Breaches Survey 2026). Holding it still helps a firm stand out.
The layers of protection every construction company needs
Identity protection
Use multi-factor authentication (a second check when people sign in), strong password policies, conditional access and identity monitoring. Only 47% of UK businesses use two-factor authentication (Cyber Security Breaches Survey 2026), so this is the single biggest quick win.
Device security
Every laptop, desktop and phone should be encrypted, updated, centrally managed, running endpoint protection and monitored.
Email security
Email filtering should block phishing, business email compromise (criminals posing as a colleague or supplier by email), malicious attachments and links, and impersonation. Finance teams should confirm any change to bank details by phone.
Data protection
Store project information securely, with access controls, automatic backup, tested recovery and protection against accidental deletion.
Monitoring and response
Continuous monitoring, ideally a 24/7 security operations centre, spots unusual activity and stops it before it becomes an incident.
People
Regular awareness training helps staff recognise suspicious emails, fraud attempts, password risks, social engineering and unsafe file sharing.
What does good look like?
A well-protected construction company can answer "yes" to all of these:
- Are all business devices centrally managed?
- Is multi-factor authentication enabled for every user?
- Are backups tested?
- Can lost laptops be remotely secured?
- Are updates applied automatically?
- Do staff get security training at least yearly?
- Is there a documented incident response plan?
- Have security controls been reviewed in the last 12 months?
- Are you working towards or maintaining Cyber Essentials?
Cyber security isn't a one-off project. Threats change, staff come and go, and projects start and finish, so it needs regular review.
How Indigo does this. We hold Cyber Essentials Plus and ISO 27001:2022 ourselves. Every client gets protection against viruses and ransomware (endpoint detection and response), email filtering, Microsoft 365 security settings and backup as standard, and our Platinum package adds a 24/7 security operations centre watching for threats. We take construction clients through Cyber Essentials certification, usually starting with multi-factor authentication, device management and access reviews. Those fundamentals remove most of the risk before any advanced tools are needed.
Sources: DSIT, Cyber Security Breaches Survey 2025/2026, 30 April 2026 · Cabinet Office, PPN 09/23: Updates to the Cyber Essentials Scheme · NCSC, Cyber Security for Construction Businesses (2022) · Infosecurity Magazine, Cyber Essentials Has Record Year, 17 September 2026. · Cabinet Office, PPN 014: Cyber Essentials scheme, from 24 February 2025 (https://assets.publishing.service.gov.uk/media/67af78c8a75f02dffca29bd8/PPN_014_Cyber_essentials_scheme.pdf)
Chapter 3 of 8 · All chapters
Get a free technology assessment
One of our consultants will review your IT, security, connectivity and phones, then give you practical recommendations. No obligation.