Architecture, engineering and construction firms have become a favorite ransomware target for a simple reason: the data is valuable — contracts, bid pricing, project drawings, financials — and the teams are busy running projects, not watching for phishing emails. Add multiple offices, jobsite trailers and subcontractors with their own access, and the attack surface grows fast. This is the checklist we run through with every new AEC client.
Identity & access
- Multi-factor authentication on every account — email, Microsoft 365, accounting software, project management platforms. This single control blocks the large majority of account takeover attempts.
- Least-privilege permissions on shared project drives — a subcontractor or new hire should only see the jobs and folders relevant to them, not the whole file server.
- A real offboarding checklist for departing employees and subs: disable accounts, revoke VPN and file access, and recover devices the same day, not "whenever someone gets to it."
Endpoints & network
- Managed endpoint detection & response (EDR), not consumer antivirus — EDR watches for the behavior of an active attack, not just known malware signatures.
- Consistent patch management across Windows, Microsoft 365 and design software, so known vulnerabilities get closed on a schedule instead of by accident.
- Secured Wi-Fi at jobsite trailers — field connectivity is often the least protected part of an AEC firm's network and an easy entry point if it's left open.
Email & domain
- Email filtering tuned for phishing and invoice fraud, the two most common ways attackers target project-based businesses handling large payments.
- SPF, DKIM and DMARC configured on your domain so attackers can't easily spoof your firm's email to send fraudulent invoices to your clients or subs.
Backup & recovery
- 3-2-1 backups of project files: three copies, on two types of media, one stored off-site or in the cloud — losing a project's drawings to a single failure isn't an acceptable risk.
- Immutable, ransomware-resistant backups that an attacker with network access can't simply delete or encrypt alongside your live data.
- An actually-tested restore process — a backup nobody has restored from is an assumption, not a plan.
People
- Security awareness training for every employee, including field and admin staff who don't think of themselves as "IT people" but receive the same phishing emails.
- A regular review of vendor and subcontractor access, so temporary project access doesn't quietly become permanent.
The quick-reference checklist
- MFA on every account
- Least-privilege file and folder permissions
- Same-day offboarding for departing staff and subs
- Managed EDR on every endpoint
- Consistent patching across OS, Microsoft 365 and design software
- Secured jobsite Wi-Fi
- Phishing-tuned email filtering
- SPF, DKIM and DMARC on your domain
- 3-2-1 backups with ransomware-resistant copies
- A tested restore process
- Ongoing security awareness training
- Regular vendor and subcontractor access reviews
Most AEC firms have a few of these in place and gaps in the rest — usually not from neglect, just because nobody owns security as a full-time job. That's the baseline we build into every managed IT engagement rather than selling it as a separate upsell.