Most contractor owners know cybersecurity matters and still never get to it, because the work feels endless and the payoff is invisible. The fix is not a bigger project. It is a short, repeatable routine that keeps the handful of controls that matter from quietly decaying while you run jobs.
This is a ten-minute weekly check you can do yourself or hand to a controller or office manager. It will not replace a security program, but it catches the drift that causes many avoidable incidents: an ex-employee still logged in, a backup that stopped running, a payment change nobody confirmed.
The weekly routine
Set a recurring calendar block, same day each week, and work through these five items in order.
1. Review sign-in alerts and new accounts
Open your Microsoft 365 or Google admin console and look at recent sign-in warnings and any accounts created in the last week. Every new account should match a real hire, sub, or vendor you can name. Anything you cannot explain gets disabled until someone vouches for it.
2. Confirm backups finished
Check the backup dashboard or the summary email. You are looking for one thing: a successful run within the last day for every protected system. A backup that has failed for three weeks is the same as no backup. If you see failures, open a ticket the same day.
3. Look at payment changes
Ask your accounts payable lead whether any vendor banking details, remittance addresses, or payroll direct deposit accounts changed this week. For each, confirm it was verified by calling a known phone number, not one in the request email. Ten seconds of review here is worth more than almost any tool.
4. Check departures and returns
Compare the list of people who left, were laid off, or finished a seasonal contract this week against active accounts and devices. Disable access the same day. Confirm that returned laptops and phones were collected and wiped or reassigned deliberately.
5. Skim the update status
Ask whether laptops, phones, and any servers or routers are current on security updates. Your IT provider should be able to give you a one-line answer. If the answer is "I think so," that is itself a finding.
Monthly additions
Once the weekly rhythm sticks, add a short monthly layer.
- Pick one user group, such as project managers, and review what systems they can reach compared with what they actually need.
- Send a short note to staff about one real scam pattern you saw, such as a fake plan room invite.
- Ask for a list of devices that have not checked in for thirty days. Unreachable devices are often lost, stored, or forgotten, and each one is unmanaged risk.
Make it stick
Routines fail when they depend on one person's memory. A few habits help.
- Write the five items on a single page and keep it where the owner and controller both see it.
- Record the date and any issue found in a simple shared log. A log turns a vague feeling of being covered into evidence you can show an insurer or a prime contractor.
- Rotate who does the check once a quarter so it does not become one person's hidden burden.
- Treat a missed week as a signal, not a failure. Pick up the next day and keep going.
What this routine will not catch
Be honest about the limits. A weekly check will not detect an attacker who is already inside, will not stop a well-crafted phishing email from landing, and will not substitute for multi-factor authentication, email filtering, endpoint monitoring, or tested backups. Those are the underlying controls. The routine confirms they are still on and still working.
If something looks wrong during the check, do not try to investigate alone. Capture what you saw, such as a screenshot of the alert or the account name, and escalate to your IT provider immediately. Early reports are cheap. Late ones are not.
Where Ironfield Cyber fits
If you would like this routine built around your actual systems, with dashboards that make the five checks quick, Ironfield Cyber can set it up and take over the parts that do not need an owner's eyes. We are glad to start with a short security review of what you have today.