For most contractors, the accounting or ERP system is the most sensitive application in the company. It holds payroll, vendor banking details, job costs, receivables, and the approval workflows that move money. Whether you run Sage, Viewpoint, or another construction accounting package, a compromise here can mean fraud, lost data or a stopped payroll.
Many of these systems have been in place for years and run on aging servers, with permissions that grew organically. This checklist helps you review the basics. Always confirm settings with your software vendor or reseller, since options vary by product and version.
Access and accounts
- Named users only. Every person has their own login. Remove shared accounts such as "accounting" or "payroll."
- Least privilege. Review roles and make sure staff can access only what their job requires. Payroll data, vendor master editing and check printing should be limited and separated.
- Separation of duties. The person who adds or edits a vendor should not be the person who approves payments to that vendor. Where staffing is small, add a review step by a second person.
- Remove stale accounts. Disable users who have left, and review accounts for consultants and former vendors.
- Strong authentication. Where the application or its hosting environment supports multi-factor authentication or single sign-on, enable it. If the application is accessed through a remote desktop or VPN, require MFA at that layer.
- Protect administrator accounts. Limit administrators to a few named people, use separate accounts for administration, and monitor their activity.
Payment and vendor controls
Accounting systems are a prime target for payment diversion.
- Restrict who can change vendor bank details and require a documented callback to a known number before any change.
- Turn on audit trails or change logs for vendor master data and review them regularly.
- Use dual approval for large payments, wires and ACH batches.
- Reconcile bank activity daily or at least every few days so anomalies are noticed quickly.
- Coordinate with your bank on features such as payee verification and positive pay.
Remote access
Many contractors access accounting software from home or the field.
- Avoid exposing servers or remote desktop directly to the internet.
- Use a VPN or secure gateway with MFA.
- Limit remote access to people who need it.
- Review logs for unusual login times or locations.
Servers, databases and updates
- Patch the operating system and the application. Software that is several versions behind may no longer receive security fixes. If your version is nearing end of support, plan an upgrade.
- Protect the database. Restrict direct database access and service account permissions.
- Network placement. Keep the server on a protected segment with limited inbound access.
- Endpoint protection. Make sure servers have current security software and monitoring.
- Consider hosted options. Vendor-hosted or cloud versions can shift infrastructure maintenance, though you remain responsible for user access and controls.
Backups and recovery
- Back up the database using methods the software vendor supports, not only file copies.
- Keep at least one copy offsite and protected from deletion.
- Test a restore regularly, including checking that reports and recent transactions are intact.
- Document recovery steps and the priority of accounting within your overall plan. Payroll deadlines do not move because of an outage.
Integrations and exports
Modern construction stacks connect accounting to project management, payroll, banking and reporting tools.
- List every integration and who owns it.
- Review API keys and service accounts and rotate them when staff change.
- Limit exports containing sensitive data and secure where they are stored.
Monitoring and review
- Review a short monthly report of administrator activity, new users and vendor changes.
- Keep a record of who reviewed it and when.
- Include the accounting system in any incident response plan, with contacts at your software vendor.
Start with five actions
- Remove shared and stale accounts.
- Enable MFA on any remote path to the system.
- Lock down vendor bank change procedures.
- Verify that backups restore correctly.
- Confirm the software version is still supported.
Support from Ironfield Cyber
Ironfield Cyber supports contractors and energy firms running Sage, Viewpoint and related platforms, including secure remote access, backup and access reviews. We work alongside your software vendor and can help you prioritize the items above.