Construction / Trades Compliance

Regulations That Apply

Regulation	What It Covers
Wire Fraud (BEC)	Invoice and payment fraud via business email compromise
OSHA Recordkeeping	Digital safety records — Form 300/301 retention
Davis-Bacon / Prevailing Wage	Federal contracts — payroll certification data
Customer Contractual	Subcontracting to regulated industries pulls in their compliance rules
State Breach Laws	Employee and customer PII

What You Need In Place

• Email security (SPF, DKIM, DMARC)
• Wire transfer verification policies
• Payroll system access controls
• Job-site device management
• Backup of project documentation and BIM files
• Subcontractor data handling agreements
• Phishing awareness training

Common Threats In This Sector

Construction firms move large dollar amounts on predictable schedules, which makes them ideal BEC targets. The combination of distributed jobsites, mobile workforces, and frequent vendor and subcontractor interactions creates many attack surfaces.

• Wire fraud on project payments — particularly draw requests and final payments
• Phishing for subcontractor portals, bid platforms, and vendor accounts payable
• Ransomware against project management systems (Procore, Buildertrend, CoConstruct)
• Industrial Internet of Things (IIoT) compromise on connected equipment and sensors
• Insider risk with bidding and estimating access
• Vendor portal compromise reaching back into the prime contractor’s systems

Documentation You’ll Be Asked For

General liability, builder’s risk, and surety bond underwriters now ask cybersecurity questions during renewal. Prime contractors flow security clauses down to subs. Federal projects bring CMMC scope. Each adds a documentation expectation.

• CMMC artifacts (SSP, POA&M, SPRS) if the firm is in the federal supply chain
• Written wire-fraud prevention procedures requiring multi-channel verification
• Subcontractor security assessments where the prime requires flow-down
• OSHA-required recordkeeping with appropriate data-security around medical information
• Vendor management documentation for major SaaS platforms
• Incident response plan covering project-impacting cyber events
• IoT and OT asset inventory for connected jobsite equipment

Where Most Small Contractors Fall Short

The Surety and Fidelity Association, ABC, and AGC have all flagged the same recurring gaps in member surveys. The wire-fraud exposure is consistently the most expensive single risk.

• Single-channel wire instruction confirmation — just email, no call-back verification
• No MFA on project management, estimating, or accounting systems
• Subcontractor security never reviewed before granting portal access
• Mobile devices on jobsite without management or wipe capability
• IoT equipment installed with default credentials
• No incident response plan covering business-email-compromise wire-fraud scenarios