Home / Insights / Construction Site Device Management: Tablets, Phones and MDM That Work

Construction Site Device Management: Tablets, Phones and MDM That Work

Smartphones and tablets are now everyday kit on UK construction sites. Site managers check drawings on a tablet in the cabin. Supervisors take photos of snags on a phone. Shared devices sit in a charging dock overnight and get passed between shifts. That convenience is real — and so is the risk when those devices hold emails, plans, client contacts or finance apps.

Construction site device management is not about buying the toughest case and hoping for the best. It is about knowing who owns each device, what it can access, how it is enrolled and patched, and what happens when it is lost, borrowed or left behind at demobilisation. The National Cyber Security Centre (NCSC) publishes clear guidance on mobile device management (MDM), organisation-owned devices and bring-your-own-device (BYOD). This article turns that advice into practical steps for contractors and their IT partners.

Why site phones and tablets need a plan

A site device is rarely "just a tablet". It may open a common data environment, sync a work mailbox, store offline drawings, or sign into a timesheet or purchase system. Mud, dust and drops mean rugged cases and screen protectors matter — but they do not replace patching, strong sign-in or the ability to remove corporate access if the device disappears.

Common habits that create avoidable risk:

• Shared PINs or passwords written on a whiteboard or taped under the dock
• Subcontractors borrowing a company tablet "just for this afternoon"
• Devices left unlocked in an open cabin overnight
• Personal phones used for work email or drawing apps with no separation of work and personal data
• Kit that never comes back when a package of work ends

None of that needs inventing exotic threats. Lost phones, shared credentials and unmanaged apps are enough. Pair device discipline with the basics you already need for site connectivity: a secure temporary network does little good if the tablet on the end of it is a free-for-all.

Prefer organisation-owned devices for sensitive roles

Where people handle drawings, emails or client data, organisation-owned and fully managed devices give you the strongest technical controls. The NCSC's MDM guidance is clear that BYOD significantly limits what you can enforce compared with enterprise-owned kit.

For enterprise-owned smartphones and tablets, NCSC recommends an MDM that supports zero-touch enrolment where possible. That means devices can be provisioned and hardened before users reach sensitive information, without an administrator manually setting up every handset. Enrolment should support strong authentication, including multi-factor authentication (MFA), whether you use zero-touch, admin enrolment or carefully controlled self-enrolment.

Prefer MDM services that use built-in platform management and the platform's own app stores, rather than relying only on extra client-side agents. Look for automatic application updates, logging and compliance monitoring, and device attestation where the platform supports it. Those features help you see whether devices are up to date, jailbroken or violating policy — example uses the NCSC itself highlights alongside VPN enforcement and remote wipe.

Treat the MDM as a critical system. It holds keys that can unlock, decrypt or wipe devices across your fleet, so the management console needs strong admin authentication and careful access control of its own.

Shared site tablets: ownership, access and demobilisation

Shared cabin tablets are common. They can work if ownership and process are clear:

• Record every device in an IT asset register with site, project and named keeper — not "cabin tablet" with no owner
• Use individual named accounts (or short-lived project accounts) instead of one shared login everyone knows
• Require MFA for anything that reaches email, drawings or finance; where phone-based MFA is awkward on site, see our guide to MFA without phones
• Keep an approved app list through the MDM or enterprise catalogue; block sideloading where the platform allows
• Time-box access to the project; when a package ends, run the same joiners, movers and leavers discipline you use for people — our JML process guide applies to devices as well as accounts
• On demobilisation: return the device, wipe or redeploy it under MDM, and remove project access from any accounts that used it

Rugged cases and spare chargers keep work moving. They do not replace enrolment, patching or a return checklist.

Lost, stolen or left behind

Sites lose kit. Phones fall out of vans; tablets go home in the wrong bag; cabins get broken into. Encryption at rest and the ability to act remotely matter more than hoping nothing happens.

According to NCSC device guidance on erasing devices, if a device is enrolled in your organisation's MDM you can send a remote wipe command. That command securely erases the device if it is turned on and has a data connection. Built-in cloud account wipe options exist on some platforms too. Without MDM or those cloud services, you typically need physical access.

So do not assume a wipe happens the moment you click a button if the device is powered off or offline. What you can plan for is:

• Full-disk or platform encryption so data is harder to read if someone finds the device
• MDM enrolment so you can wipe when the device next connects, or remove corporate access and credentials
• A simple report-loss process for site teams (who to call, what to revoke first)
• Immediate removal of mailbox, VPN and drawing-portal access while you wait for wipe confirmation

That combination — encryption, MDM, access revocation and a clear loss process — is practical construction site device management, not a theoretical checklist.

BYOD: useful, but limited

Personal phones will still appear on site. The NCSC is explicit that a BYOD approach may significantly limit the technical controls and features you can enforce. Where you allow it, consider combining MDM with mobile application management (MAM) so work apps and data are isolated from personal use, and so you can remove corporate access and data if the device is lost or the person leaves — without necessarily wiping someone's family photos.

For roles that routinely handle drawings, client emails or payment systems, organisation-owned managed devices remain the cleaner answer. Use BYOD for lower-risk tasks only, with written terms of use, compliance monitoring where available, and the ability to cut corporate access quickly.

Cyber Essentials still expects you to secure devices that access organisational data. Device management that matches how your sites actually work sits alongside that baseline, which matters when clients ask for evidence on tenders.

Takeaway

Construction site device management is mostly ownership, enrolment and access that matches the job. Prefer organisation-owned tablets and phones for roles that touch drawings, email or client data; enrol them with MDM (zero-touch where you can); enforce MFA and an approved app list; record keepers in an asset register; and wipe or remove access when kit is lost or a project ends. Treat BYOD as a limited option, not the default for sensitive work. That follows NCSC device and MDM guidance without turning every cabin into a locked-down office.

If you want help designing MDM policies, asset registers and site device processes that fit how your projects run, KPCR's IT consultancy and managed IT services can help. Get in touch for a no-pressure chat.

External references: NCSC, Mobile device management (https://www.ncsc.gov.uk/collection/device-security-guidance/getting-ready/mobile-device-management); NCSC, Zero-touch enrolment (https://www.ncsc.gov.uk/collection/device-security-guidance/getting-ready/zero-touch-enrolment); NCSC, Erasing devices (https://www.ncsc.gov.uk/collection/device-security-guidance/managing-deployed-devices/erasing-devices); NCSC, BYOD — put technical controls in place (https://www.ncsc.gov.uk/collection/device-security-guidance/bring-your-own-device/action-5-put-technical-controls-in-place); NCSC, Provisioning and distributing devices (https://www.ncsc.gov.uk/collection/device-security-guidance/getting-ready/provisioning-and-distributing-devices).