Our site offices have rough internet. Are we stuck?

Usually not. We've been putting resilient connections onto temporary sites for years. Enterprise NBN where fibre reaches. Where it doesn't, 4G or 5G failover inside a managed router. Where several sites need to meet in the middle, we link them into one managed network. The size of the link matters less than the failover. A managed router on the right service level agreement will switch over sensibly when the primary drops.

Subbies need access to our project files but they shouldn't see the whole business. How?

Share out of SharePoint per project, with access that expires on its own when the job finishes. Guest accounts are governed by identity rules, so no shared logins and no shared drives. Set it up once and it holds as projects come and go.

Our estimating laptops are out of warranty and slow. Is that a security issue?

It can be. An operating system past end of support stops getting security patches, so anything that relies on patching quietly stops working. Your Security & Tech Review tracks the age of every machine. You get a written recommendation of what to replace and when, with the reason attached.

A head contractor sent us a security questionnaire as a condition of the tender. Can you help?

Yes. We've filled in enough of these for construction and engineering firms to know which questions carry the weight. Usually MFA, EDR, patching, backup, offboarding and cyber insurance. Every answer goes out with the evidence behind it. Where the answer is "not yet", you get a plan the head contractor will accept.

IT and cybersecurity that moves with the job.

Site offices appear and disappear. Subbies need the project files and nothing else. Every estimating and project platform wants its own logins. And head contractors now push security clauses into every subcontract. It's a lot. It's also the kind of problem we like.

What compliance asks of you See if we're a fit

What's actually different

Construction IT is logistics, not product selection.

You're probably not short on technology. What you're short on is someone who sequences it against the way the work actually runs. A site stands up, runs for six months, comes down. A subbie joins for two weeks. A design partner needs the shared building model and nothing else. A laptop gets stolen off the back of a ute. None of it is exotic. All of it needs a pattern you set once and reuse.

Then there is the security questionnaire that lands in your procurement inbox a week before tender close. The questions repeat from contractor to contractor, so a prepared firm answers in a morning. Unprepared, you spend a fortnight finding the gaps, then either lose the tender or tick "yes" on something that surfaces after an incident. We get your answers written and evidenced before the questionnaire arrives.

Site offices don't need heroic infrastructure. They need a managed router, a sensible primary link with failover, and someone watching whether it stays up. Boring. Which is the point.

Live right now

The 2026 pressure points we're actively working on with clients.

The specific asks, deadlines and enforcement actions shaping 2026 conversations in your sector.

Head-contractor security clauses are now standard

Lendlease, Multiplex, CPB, John Holland and the rest now ask subcontractors to show their security before onboarding. The usual list: multi-factor authentication (MFA), endpoint detection and response (EDR), how quickly you patch, staff training and an Essential Eight self-attestation. All of that before you get onto Procore, Aconex or Autodesk Construction Cloud. This isn't regulation, it's tender eligibility. Answer it accurately, because the contract auditors do check and an over-answered questionnaire surfaces after an incident.

Modern Slavery Act reporting is reaching subcontractors

The federal government responded to the Modern Slavery Act review in December 2024. It agreed in principle to civil penalties for reporting entities that don't comply. The $100M turnover threshold stays, but the businesses that do report are pushing supplier attestations further down the chain. Subcontract to one and you can expect an attestation form in the procurement pack.

Ransomware payments must be reported inside 72 hours

Turn over more than $3M and you have to report a ransomware payment to the Australian Signals Directorate within 72 hours. The Cyber Security Act commenced that on 30 May 2025. Most mid-size builders and engineering firms sit above the threshold, so you need an incident response plan with the reporting clock built into it.

Frameworks and regulators

Industry frameworks, regulations and audit standards for construction & engineering in Australia.

WHS record retention: Your state's Work Health and Safety rules set how long you keep incident records, safe work method statements, training records and hazard registers. Most run 5 to 30 years. Lose them in a ransomware incident and it isn't a technical problem, it's a regulatory one.
Privacy Act 1988: Personal data about your employees, contractors and subcontractors is covered. Above $3M turnover you carry the full Australian Privacy Principles, including the Notifiable Data Breaches scheme. Most larger builders are over that line.
Head-contractor security clauses: Security clauses are landing in subcontractor agreements: MFA, encrypted document transfer, a completed security questionnaire. Essential Eight maturity level one, self-attested, is becoming the minimum ask from most head contractors. We write your answers up with the evidence attached, so the next tender response takes a morning.
ACSC Essential Eight: The Australian Cyber Security Centre baseline, and the one insurers and larger clients keep pointing at. Read how the Essential Eight maturity levels work. We move construction firms up them without stopping the jobs.
Project and estimating platforms: Procore, Aconex, Jobpac, Cheops, BuildSoft and Databuild each keep their own users, permissions and audit trail. We tie them back to one central login and close the accounts off properly when a project ends.

Where firms usually start

Compliance and IT starting points for construction & engineering in Australia.

Common questions

The things construction & engineering clients ask us first.

Our site offices have rough internet. Are we stuck?: Usually not. We've been putting resilient connections onto temporary sites for years. Enterprise NBN where fibre reaches. Where it doesn't, 4G or 5G failover inside a managed router. Where several sites need to meet in the middle, we link them into one managed network. The size of the link matters less than the failover. A managed router on the right service level agreement will switch over sensibly when the primary drops.

Subbies need access to our project files but they shouldn't see the whole business. How?: Share out of SharePoint per project, with access that expires on its own when the job finishes. Guest accounts are governed by identity rules, so no shared logins and no shared drives. Set it up once and it holds as projects come and go.

Our estimating laptops are out of warranty and slow. Is that a security issue?: It can be. An operating system past end of support stops getting security patches, so anything that relies on patching quietly stops working. Your Security & Tech Review tracks the age of every machine. You get a written recommendation of what to replace and when, with the reason attached.

A head contractor sent us a security questionnaire as a condition of the tender. Can you help?: Yes. We've filled in enough of these for construction and engineering firms to know which questions carry the weight. Usually MFA, EDR, patching, backup, offboarding and cyber insurance. Every answer goes out with the evidence behind it. Where the answer is "not yet", you get a plan the head contractor will accept.

The qualifier

Let's see if we're a fit.

Seven questions, one moment of your time. We'd rather tell you now than three months in.