A finished estimate holds nearly everything a competitor would want to know: your labor rates, your markup, your preferred subcontractors and the prices they gave you. It is also sitting in spreadsheets, email attachments and estimating software on laptops that travel. Few companies treat it with the same care as payroll data, but the damage from a leak can be just as real.
Bid data is also a target for fraud. An attacker who sees your pending bids and subcontractor relationships can craft convincing messages that reference real projects and real names.
Where Bid Data Actually Lives
Start by mapping it. In most contractors, bid information is scattered across several places.
- The estimating platform or spreadsheets used to build the number.
- Email threads with subcontractors and suppliers, including attached quotes.
- Plan room and bid-invitation portals where drawings and addenda are downloaded.
- Personal laptops, phones, and USB drives that estimators use to work from home or the jobsite trailer.
- Shared folders where old bids from years ago still sit with full pricing.
If you cannot list these locations, you cannot protect them. A thirty-minute conversation with your estimators will usually surface places IT has never seen.
Practical Controls That Do Not Slow Estimators Down
Limit access by role
Not everyone needs every bid. Put active bids in a folder that only the estimating team and executives can open. Project managers and superintendents can get access after award. Review that list quarterly, and remove people who changed roles.
Require multi-factor authentication on everything that touches bids
That includes email, your cloud storage, the estimating platform and any plan room accounts. A stolen password alone should not expose a bid.
Control how quotes arrive
Subcontractors will email quotes, and that is fine, but treat unexpected changes with suspicion. If a sub sends a revised quote with new instructions or a link to a download, confirm by calling a known number. Attackers often compromise a sub's mailbox and send changes that look real.
Manage the devices
Estimators should use company-managed laptops with disk encryption and automatic lock. If someone loses a laptop at an airport on the way to a pre-bid meeting, encryption means it is an inconvenience, not a breach.
Set retention rules
Old bids from lost projects do not need to live forever in active shares. Decide how long you keep them, then archive to restricted storage or delete when the period ends. Less stored data means less to leak.
Special Handling for Defense and Public Work
If you bid on projects that involve controlled unclassified information, some bid documents may carry marking requirements. Those files should sit in a separate, tightly controlled location from your ordinary bid data. For public projects, bid documents are usually public after opening, but your internal estimate and pricing are not.
Watch for the Warning Signs
Some patterns suggest bid data is leaking or being targeted.
- Competitors seem to know your numbers or sub relationships better than they should.
- Subcontractors report receiving messages that appear to come from your estimators but that your team did not send.
- Estimators see unexpected sign-in alerts on their email.
- Plan room invitations arrive from addresses that look nearly right but not quite.
If you see any of these, change passwords, check the mailbox for forwarding rules, and review sign-in logs.
A Simple Offboarding Rule
Estimators who leave take knowledge with them, and sometimes files. When an estimator gives notice, restrict access to active bid folders that day, review recent downloads or large file transfers, and recover the company laptop promptly. This is not about distrust. It is a normal control, applied the same way to everyone.
A Hypothetical Example
Consider a hypothetical mid-size specialty contractor whose estimator uses a personal email account to forward quotes to a home computer so they can finish a bid over the weekend. Nothing malicious happens, but the personal account has a weak password that was reused from another site. Months later, someone breaks in and finds years of pricing. No one at the company ever knew the files were there. The control that would have prevented it is plain: a managed device and secure remote access, so nobody needs to forward files at all.
Next Steps
Pick one active bid, trace every place its data lives, and check who can see it. That exercise alone usually reveals a few easy fixes. Ironfield Cyber works with contractors on exactly this kind of data mapping and access cleanup, and we can help you set up estimating folders, multi-factor authentication and managed devices without getting in the estimators' way.