Cyber Essentials for construction firms and trades

If you subcontract to a main contractor or bid for public work, you're increasingly likely to be asked for a certificate before you're allowed on the job.

Who's asking

• Tier 1 main contractors increasingly require Cyber Essentials, and sometimes Cyber Essentials Plus, from their supply chain before contract award.
• Pre-qualification. Build UK's Common Assessment Standard, used across much of the industry, includes questions on cyber security.
• Public sector clients. Central government and NHS contracts can require Cyber Essentials under government procurement policy.

Why construction is a target

• Big payments, many parties. Stage payments and subcontractor invoices are ideal for "change of bank details" fraud.
• Site offices and shared kit. Temporary site laptops, shared logins and tablets on site are easy to forget.
• Ransomware. Construction and engineering firms have been hit repeatedly, and a locked-up estimating or payroll system can stop a project.

What to sort first

1. Give everyone their own login, including site managers. No shared "site" account.
2. Multi-factor login on email and project systems.
3. Phone-check every bank detail change from suppliers and subcontractors, using a number you already hold.
4. Keep site devices updated and on the list of devices you manage.
5. Offline backups of accounts, drawings and payroll. See our ransomware guide.

Plant, machinery and other operational kit can usually be kept out of scope if it's separated from your office network. A certification body can advise on scope.