Five reasons to think cyber

As far back as 2022, the UK’s National Cyber Security Centre (NCSC) identified construction organisations as attractive targets for ransomware, phishing, payment diversion fraud and supply chain attacks. Construction projects involving major infrastructure assets present heightened national security and resilience concerns.

Here are five risks construction businesses should be preparing for now:

The construction industry relies on complex supply chains and IT infrastructure. Your business will be expected to demonstrate that it can operate securely and recover quickly if something goes wrong. As threats become more sophisticated and damaging both operationally and reputationally, suppliers should expect potential customers to ask about their cyber governance and security controls as part of tender submissions.

If you demonstrate good cyber practices, you are likely to find yourself in a stronger position when competing for work.

One of the key themes of the new legislation is clear oversight and understanding of your supply chain cyber risk. Those businesses operating under the scope of the new Bill will be expected to understand the risks posed by suppliers and service providers. That expectation is gaining momentum through commercial supply chains.

This means you need to consider stringent due diligence and robust governance arrangements. You should expect the same level of compliance from any contractors or suppliers you use. It’s now another measure of supplier quality and stability.

The sector has undergone significant transformation in recent years, with cloud-based collaboration platforms driving efficiency and becoming more common. BIM, digital projects and connected sites are just some of the advancements we’ve seen lately – and with increased connectivity comes new vulnerabilities.

If a contractor experiences a cyber incident, it won’t just impact their systems. It could delay projects, disrupt upstream and downstream supply chain participants and impact wider communications, including with clients and suppliers, possibly affecting contractual delivery.

Your project resilience will be heavily dependent on your cyber resilience.

Historically, cyber clauses were often generic. Infrastructure owners should now be seeking increased contractual protections that require contractors to maintain specified cyber standards, requirements to notify your counterparty promptly, cooperate with investigations, maintain or increase cyber insurance and preventative controls. You should also mirror obligations through your own subcontractor supply chain.

This can increase your commercial and legal exposure, particularly as clients increasingly expect businesses to demonstrate robust cyber resilience. This may include requirements around:

Perhaps the biggest message is that cyber security is the leadership team’s responsibility. Senior leaders need to understand the key cyber risks for the business and, in turn, ensure appropriate controls are in place. They need to be satisfied that the business can respond effectively to an incident.

Clients, insurers and commercial partners want reassurance that cyber resilience is embedded within an organisation rather than treated as an afterthought.

Practical steps would include:

Although the Cyber Security and Resilience Bill is still progressing through Parliament, its message is clear. For the construction sector, this isn’t simply about preparing for future regulation – businesses should be reviewing their cyber resilience and taking action now. It’s about protecting your projects, maintaining client confidence in your operations and strengthening your commercial resilience as the industry becomes more digital.

Keep up to date with DC+: sign up for the midweek newsletter.