Pre-Construction Security Kickoff: A Checklist for New Projects

Project kickoff meetings cover schedule, safety, logistics and communication. Security rarely makes the agenda, yet a new project is when the most new connections form at once: new owners, designers, subcontractors, suppliers, software accounts, shared folders and jobsite equipment. Decisions made in the first weeks tend to stick for the life of the job.

A short security kickoff, added to your existing process, sets expectations while everyone is still cooperative. It does not need to be elaborate.

Before the Kickoff: Review the Contract

Look for security-related terms.

• Data handling and confidentiality requirements.
• Required platforms or portals specified by the owner.
• Incident notification clauses and their timelines.
• Flow-down requirements for subcontractors, such as those related to controlled information on defense or critical infrastructure work.
• Insurance requirements, including cyber coverage.
• Rules about subcontracting, photography, drones and cameras.

Flag anything unusual for legal or IT review before you commit.

Define Who Owns What

Name a security point of contact on your side, and ask for one from the owner, designer and major subcontractors. Decide who administers the project's collaboration platform, who approves new users and who handles incidents. Ambiguity here leads to unmanaged accounts.

Set Up Collaboration Platforms Properly

For your project management and document platforms, such as Procore or Autodesk Construction Cloud:

1. Create a clear folder or permission structure before inviting people.
2. Assign roles by job function, with least privilege.
3. Require multi-factor authentication for all users where possible.
4. Limit sharing and export where appropriate.
5. Document who has administrator rights, and keep that group small.
6. Plan for removing users at closeout.

Invite people by company email addresses rather than personal accounts when you can.

Establish Communication Rules

• Decide where official communication occurs: the project platform, not text messages or personal email.
• Agree on how payment and banking changes are handled: only through a verified process with phone confirmation to known contacts.
• Share the same warning with your subcontractors and suppliers, since they are often the target of impersonation.
• Define how sensitive documents are delivered, using secure links instead of attachments when possible.

Prepare the Jobsite

Plan technology before mobilization.

• Network: a separate network for company devices, with strong Wi-Fi settings and no default passwords. Provide guest access for visitors that cannot reach company systems.
• Devices: managed, encrypted laptops and tablets with screen locks. Define rules for personal phones.
• Cameras and sensors: inventory them, change defaults and keep them off the main network.
• Physical security: lock trailers and secure devices at day's end.
• Printers and scanners: change default settings and restrict access.

Vet Subcontractors and Vendors

Ask about their basics: Do they use multi-factor authentication? Do they have a way to report incidents? How do they handle company data? You are not auditing them, but a few questions identify weak links. For work involving controlled information or critical infrastructure, expect more detailed requirements.

Brief the Team

Hold a short session with the project team covering:

1. How to spot phishing aimed at construction, such as fake bid invitations and shared-file links.
2. Why payment change requests must be verified.
3. How to report a lost device or suspicious message, and to whom.
4. Rules for photos, drones and social media.
5. Where project data belongs and where it does not.

Ten minutes in the kickoff agenda is enough to start.

Plan the Exit

Decide now how the project will end from a security standpoint: when user access is removed, how records are archived, how devices are wiped and how temporary accounts are closed. Putting it in the plan makes closeout much easier.

A One-Page Checklist

1. Contract security terms reviewed.
2. Security contacts named on all sides.
3. Platform roles and MFA configured.
4. Communication and payment verification rules agreed.
5. Jobsite network and devices prepared.
6. Subcontractor basics checked.
7. Team briefed.
8. Closeout steps planned.

Making It Standard

Add the checklist to your project startup package so it happens every time, with an owner and a date. Ironfield Cyber helps contractors build project security kickoff checklists and prepare jobsite technology, and we can review your current startup process to see where a few small additions would help.