Construction software has moved into the field. Superintendents review drawings on tablets, foremen log time on phones, and inspectors submit forms from the site. These mobile apps connect directly to the same systems of record that your office uses, so a lost phone or a compromised login in the field can expose project data and financial information.
Securing field access is not about restricting crews. It is about making sure that the convenience of mobile does not become the easiest way into your systems.
What Is at Stake
Depending on the app and the user's permissions, a mobile session might reach:
- Drawings, specifications and models.
- Contracts, change orders and budgets.
- Daily logs, photos and safety records.
- Employee time and personal information.
- Contacts for owners, subcontractors and suppliers.
If the account is over-permissioned, the exposure is larger than the worker's actual job requires.
Start With Accounts and Roles
One person, one account
Shared logins on a jobsite tablet make it impossible to know who did what, and they linger after people leave. Give each person their own account, with quick sign-in methods that are secure but not painful.
Right-size permissions
Review role templates for field users. A foreman typically does not need access to project budgets or other jobs. Remove access to modules and projects people do not use.
Require multi-factor authentication
Enforce it for all users where the platform supports it, and choose methods that work in the field, such as authenticator apps that function without cell service or passkeys.
Secure the Devices
Apps are only as safe as the devices they run on.
- Screen lock. Require a PIN, fingerprint or face unlock with a short timeout.
- Encryption. Modern phones and tablets encrypt by default when a passcode is set. Verify it.
- Operating system updates. Keep devices on supported versions, and retire ones that no longer receive updates.
- Device management. Enroll company-owned devices, and consider managing apps on personal phones through a mobile application management approach that separates work data from personal data.
- Remote lock and wipe. Make sure you can remove company data from a lost device, and tell staff to report losses immediately.
- App sources. Install only from official app stores, and block unknown sources.
Handle Personal Phones Carefully
Many crews use personal phones, and a rule requiring company phones for everyone may not be realistic. A middle path is a bring-your-own-device policy that:
- Requires a passcode and current operating system.
- Allows the company to manage only the work app and remove its data, not touch personal content.
- Spells out what the company can and cannot see.
- Explains what happens when someone leaves.
Clear, honest communication builds trust and compliance.
Control Offline Data
Field apps often store data locally so crews can work without signal. That is useful and a risk. Check how the app protects offline data, whether it is encrypted and what happens when a device is lost. Where possible, limit what is cached to the projects the user actually needs.
Watch How Data Leaves the App
Photos, drawings and reports can be shared through messaging apps and personal email. Provide an approved sharing method, and set expectations about what may be sent outside the platform. Use settings in the app, where available, to limit exports and downloads.
Monitor and Review
- Review active users and last sign-in dates regularly, and deactivate dormant accounts.
- Check sign-in logs for unusual locations or repeated failures.
- Review connected third-party apps and integrations.
- Audit access to sensitive projects, such as those involving defense or utility customers.
Make Offboarding Immediate
When a foreman leaves or a seasonal crew rotates out, disable their accounts that day, recover devices and remove company data from personal phones. Include mobile apps in the offboarding checklist, since they are easy to forget.
Train in Plain Language
A ten-minute toolbox talk goes far: lock your phone, do not share your login, report a lost device right away and be suspicious of unexpected sign-in prompts. Pair it with a one-page guide.
Where to Start
If you are not sure what your field users can access today, a review of roles, devices and sign-in settings is a good first step. Ironfield Cyber helps contractors and energy firms secure mobile access to platforms like Procore, Sage and Viewpoint while keeping crews productive.