Home / Insights / Construction Supply Chain Cyber Security: Getting Subcontractors Onto a Sensible Baseline

Construction Supply Chain Cyber Security: Getting Subcontractors Onto a Sensible Baseline

Main contractors rarely work alone. Designers, specialist trades, temporary labour, plant hire and software vendors all touch project information, site systems or client data. That is why construction supply chain cyber security is not a side topic for the IT team: a weak link in a subcontractor’s email, laptop or cloud folder can open the door to ransomware, invoice fraud or a leak of drawings and personal data.

The National Cyber Security Centre (NCSC) has published supply chain security guidance built around twelve principles. Its construction-sector joint venture guidance points firms to those same principles. This article turns that official advice into practical steps for contractors and their IT partners.

Why the supply chain is an IT risk on site

Attackers do not always go after the largest company first. They look for an easier account that already has access: a subcontractor’s mailbox with payment instructions, a shared drawing portal login, a remote support session into a site cabin router, or a temporary guest account that was never removed.

NCSC guidance is clear that you should know what assets need protecting when you engage a supplier, do due diligence on their security, and analyse the risk they introduce. It also stresses knowing the full extent of the chain, including sub-contractors — not only the firms you invoice directly.

The NCSC notes that, according to the 2025 Security Breaches Survey, very few UK businesses set minimum security standards for their suppliers. In construction, where dozens of firms may join and leave a single project, that gap is easy to leave open.

Set minimum requirements that are fair and achievable

NCSC principle five is to set and communicate minimum security requirements that are justified, proportionate and achievable. A one-size-fits-all demand on every labour-only subcontractor is neither fair nor workable. Different contracts need different bars.

A practical pattern that matches NCSC’s own examples:

• Baseline for anyone who handles your email, files or systems: ask for Cyber Essentials (or a clear plan to achieve its five technical controls). The NCSC recommends Cyber Essentials as a baseline that reduces exposure to common internet threats, and government suppliers are already expected to show how they will meet those controls.
• Higher assurance where risk is higher: for firms that connect into your network, run a shared common data environment, or process personal data at scale, consider Cyber Essentials Plus, stronger monitoring and a written incident process, or ISO 27001 where the contract warrants it.
• Light touch for ad hoc access: NCSC explicitly says it can be disproportionate to apply the full minimum to suppliers who only need occasional access to limited data or premises. Document those exceptions and still control the access you grant.

Write the requirements into the contract, and require that your suppliers pass the same expectations down to their own sub-contractors. That “flow-down” step is one of the NCSC’s repeated themes, and it is where many construction projects fall short.

Control access like you mean it

Even a certified supplier can create risk if you hand them broad, permanent access. When a supplier’s systems connect to yours, the NCSC says access for their people and their systems should be limited, controlled and monitored, reviewed periodically, and removed when it is no longer needed. Least privilege applies on a project just as it does in an office.

Practical habits that fit construction:

• Give subcontractors project-scoped accounts and groups, not blanket company-wide access.
• Prefer time-limited guest or project membership that ends with the package of work.
• Turn on multi-factor authentication for every account that can reach drawings, emails or finance systems, including external partners.
• Run a joiners, movers and leavers check at package completion, not only when someone leaves your payroll. Our guide to joiners, movers and leavers covers the routine.
• Keep a simple register of who has access to which project systems, so you are not guessing after a change of site manager.

If you use a common data environment for drawings and models, treat it as a security boundary as well as a collaboration tool. The NCSC points organisations to CPNI guidance on common data environments for digital built assets; the same care for accounts, permissions and audit logs that supports the golden thread helps here too.

Put security into procurement, not just the IT policy

NCSC principle six is to build security into normal contracting: ask for evidence during competition, renew and reassess risk at sensible intervals, and set out how information and assets are returned or deleted when a contract ends.

For a mid-sized contractor that can mean:

• A short security questionnaire for new suppliers who will touch IT or data (aligned with NCSC’s supplier assurance questions where useful).
• Named contacts for incident reporting, with timescales that work for UK GDPR notification duties.
• Clarity on whether sub-contracting is allowed, and when your approval is required.
• A checklist at demobilisation: accounts disabled, devices returned, shared folders closed, and data deleted or handed back as agreed.

You also have responsibilities as a supplier yourself. Pass customer requirements down, report upward when asked, and challenge clients who demand security without explaining what they need protecting.

Raise awareness and plan for incidents

Small specialist firms may not have a security team. NCSC guidance expects you to explain risks in language suppliers understand, encourage key staff to know their responsibilities, and be ready to support incidents that could affect your business or the wider chain. Contracts should say how and when incidents are reported, and what support each side will give.

A short briefing for site and package managers — phishing, invoice redirects, shared passwords, and who to call — often does more good than a long policy nobody opens. Pair that with the basics you already use for site connectivity: secure routers, patched devices and clear ownership of the temporary network.

Takeaway

Construction supply chain cyber security is mostly about clear, proportionate rules and access that matches the job. Know which suppliers can reach what, set a Cyber Essentials-style baseline where it is justified, flow requirements down the chain, limit and time-box access, and put incident reporting into the contract. That follows NCSC’s published principles without needing a specialist programme for every trade package.

If you want help turning this into questionnaires, access processes and managed controls that fit how your projects run, KPCR’s IT consultancy and managed IT services can help. Get in touch for a no-pressure chat.

External references: NCSC, Supply chain security guidance (https://www.ncsc.gov.uk/collection/supply-chain-security); NCSC, How to assess and gain confidence in your supply chain cyber security (https://www.ncsc.gov.uk/collection/assess-supply-chain-cyber-security); NCSC, Supplier assurance questions (https://www.ncsc.gov.uk/guidance/supplier-assurance-questions); NCSC, Joint Ventures in the Construction Sector (https://www.ncsc.gov.uk/files/Joint-ventures-in-the-Construction-Sector-guidance.pdf); NCSC, Establish control — minimum security requirements (https://www.ncsc.gov.uk/collection/supply-chain-security/principles-supply-chain-security/ii-establish-control).