Cyber Essentials for Construction & Engineering
Public sector and Ministry of Defence construction frameworks increasingly write a recognised cyber security standard into their supplier terms, and construction firms bidding into these frameworks can lose out on tender opportunities without it, regardless of how strong their actual building work is. The sector has also moved a lot of design and site management online, with tender documents, building information modelling files and site sensors all creating new ways in for an attacker, alongside the everyday risk of a finance team being tricked into redirecting a subcontractor payment. Construction firms are frequently smaller, project-based businesses without dedicated IT teams, which can make basic gaps like unpatched laptops or shared logins more common than in sectors with more established IT governance.
Why it matters for construction & engineering
Public sector and Ministry of Defence construction frameworks increasingly write a recognised cyber security standard into their supplier terms, and construction firms bidding into these frameworks can lose out on tender opportunities without it, regardless of how strong their actual building work is. The sector has also moved a lot of design and site management online, with tender documents, building information modelling files and site sensors all creating new ways in for an attacker, alongside the everyday risk of a finance team being tricked into redirecting a subcontractor payment. Construction firms are frequently smaller, project-based businesses without dedicated IT teams, which can make basic gaps like unpatched laptops or shared logins more common than in sectors with more established IT governance.
This covers main contractors and subcontractors of any size working on public infrastructure or defence-related construction projects, and engineering firms whose contracts specify a recognised security requirement.
Common threats faced
- Tender document theft
- Site OT/IoT exposure
- Supply-chain phishing
- Subcontractor payment fraud
Steps to get certified
A guided, hands-on path from scoping to certificate, no jargon, no guesswork.
Scoping
We agree the boundary of your assessment: a device, a network, or your whole organisation.
Self-Assessment
Complete a guided questionnaire against the five technical controls, with our support throughout.
Review
We check your submission and flag anything that needs addressing before it goes for formal assessment.
Certification
Your certificate is issued, backed by IASME/NCSC accreditation, valid for 12 months.
Services we recommend for construction & engineering
Construction & Engineering questions
No, certification applies to the specific organisation that holds it, so a main contractor's certificate doesn't extend to cover a subcontractor's own IT systems. If your contract or the main contractor asks for evidence of security, you'll need your own certification even if you're one part of a larger project.
Generally no, it focuses on your organisation's own IT, such as laptops, servers, email and cloud accounts, rather than the operational technology or IoT devices installed as part of a project for a client. Those systems typically fall under separate security considerations that should be agreed directly with the client.
It doesn't prevent certification, but shared devices do need to be properly configured, kept updated and protected with individual logins rather than one shared password, since that's exactly the kind of gap the assessment looks for. It's worth reviewing how shared equipment is managed before you start.
Standard Cyber Essentials can often be completed within days once you've gathered the information needed to answer the assessment, since it's a self assessment questionnaire reviewed by an assessor rather than an extended technical test. If the tender specifically asks for the higher, independently tested level, allow more time, since that involves an actual technical check of your systems.
Latest from the blog
Browse related sectors
Get certified in as little as 5 days
Tell us a little about your organisation and we'll send an itemised quote, no obligation, no sales call required to get pricing.