If you lead an AEC company, you already know this: the work doesn’t stay in one place.
A project might begin in the office, move to a cloud collaboration platform, get reviewed from someone’s home, show up on a tablet at a jobsite, and eventually be shared with consultants, contractors, clients, or other partners.
That’s not a breakdown in process.
That’s how AEC companies work.
Which means cybersecurity can’t be designed around the assumption that everything important stays safely inside one office network.
Follow the Information
Rather than starting with “How do we lock everything down?” there is a more useful question for leadership:
Where does our important project information actually go?
Think about the lifecycle of a typical project.
Where are files created? Who needs access to them? Where are they stored? How are revisions shared? What gets sent outside the company? What do employees need in the field? Which partners need access, and for how long?
Following that path can tell you much more about the company’s real technology risks than simply looking at what happens inside the office.
The Jobsite Is Part of Your Technology Environment
For AEC companies, the technology environment extends wherever the project goes.
That can include employee homes, jobsites, mobile devices, cloud applications, shared files, and outside organizations.
Leadership doesn’t need to understand the technical configuration behind every one of those connections.
But leaders should understand where important work is happening and who has access to it.
If a project depends on information moving between five different organizations, protecting only the systems inside your own office doesn’t address the entire workflow.
The security conversation needs to follow the project.
Security Can’t Ignore How People Work
There is another side to this.
You could make project information incredibly difficult to access in the name of security. But if employees and partners can’t efficiently get the information they need, you’ve created a different business problem.
Projects still have deadlines.
Field employees still need current information.
Consultants still need to collaborate.
Clients still expect progress.
Controls that don’t account for those realities can create unnecessary friction and, in some cases, encourage people to find easier ways to get their work done.
The goal isn’t maximum restriction. It’s appropriate protection.
Look for the Handoffs
One useful exercise is to look at where project information changes hands.
For example:
- Office employee to field employee
- Employee to consultant
- Company to contractor
- Project team to client
- One cloud platform to another
- Current employee to replacement employee
- Company-managed device to personal or outside device
Those handoffs can reveal questions worth asking.
Does everyone still need the access they have? Is there a standard way information should be shared? What happens when a consultant’s work on the project ends? Does the company know where important project information is stored?
You don’t necessarily need a new technology product to answer those questions.
You need visibility into how the work actually happens.
Build Security Around the Project
AEC companies aren’t static environments, and their security strategies shouldn’t treat them like one.
People move. Projects change. Outside partners come and go. Information needs to be available in the office one day and at a jobsite the next.
Good security should account for that movement rather than constantly fighting against it.
For principals, owners, and operations leaders, a useful starting point is to take one active project and trace its information from beginning to end.
Where does it travel? Who touches it? What systems does the project depend on? Where are the handoffs?
You may find that the biggest security questions aren’t sitting inside your office at all.
Because when the work moves, security needs to move with it.