Construction IT: how to keep jobsites connected and secure

Construction firms keep jobsites connected and secure by treating every site as a temporary branch office: a standard network kit, managed devices, named logins instead of shared ones, and a hard rule that payment changes are verified by phone. The office network usually gets attention. The trailer, the tablets in the field, and the accounts handed to subcontractors usually do not, and that is where most of the risk sits. The fixes are mostly process and configuration, and they repeat cleanly from one project to the next.

Why jobsites are harder than the office

An office network is built once and maintained for years. A jobsite network is stood up in weeks, runs for the life of a project, and is torn down when the certificate of occupancy arrives. That cycle creates a few predictable problems:

• Connectivity is improvised. A consumer router, a cellular hotspot, and a password written on the trailer wall are common starting points.
• Devices move. Tablets, laptops, and phones travel between sites, trucks, and homes, often without encryption or remote-wipe capability.
• People rotate. Superintendents, project engineers, seasonal staff, and subcontractors all need access for a defined period, then should lose it.
• Data is heavy. Drawing sets, models, and photo logs are large files that people will copy to USB drives or personal cloud accounts if the official path is slow.

Each of these is manageable. The trouble is that on most projects nobody owns them, so they default to whatever was fastest on mobilization day.

A standard network kit for every site

The single most useful change is a repeatable site kit. Every trailer gets the same firewall model, the same access points, the same configuration template, and both a primary and a backup internet circuit (often wired or fixed wireless plus cellular failover). Because the configuration is identical, it can be monitored centrally and changed remotely, and it comes back from the site in a known state.

A good kit separates traffic into at least three networks: one for company devices, one for guests and subcontractors, and one for equipment such as cameras, access control, and printers. Guests never share a network with the laptop that approves pay applications. Our network and Wi-Fi work for jobsites follows this pattern, with the template stored so the next site goes up the same way.

Field devices and the shared trailer login

Shared logins are a common pattern in construction environments. One account on the trailer PC, one password for the plan-room tablet, one mailbox that the whole field team reads. They feel efficient. In practice, nobody can tell who did what, and the password never changes because changing it means telling everyone.

The better pattern:

• Every person gets a named account, including temporary staff. Licensing for short-term accounts is cheaper than the cleanup after an incident.
• Every device is enrolled in mobile device management, encrypted, and set to lock automatically. A tablet left in a truck can be wiped remotely.
• Multi-factor authentication is required everywhere. CISA’s fact sheet on phishing-resistant MFA is direct about it: “any form of MFA is better than no MFA,” and “phishing-resistant MFA is the gold standard.” For project managers and anyone who approves payments, use the phishing-resistant kind.
• Shared kiosks, where they are unavoidable, run in a locked-down mode with no email and no saved credentials.

For crews that work from trucks, home offices, and multiple sites in a week, the same controls apply to the full remote workforce setup, including secure access to project files without a broad VPN.

Payment-change fraud on draws and subcontractor invoices

Construction runs on large, scheduled payments: owner draws, subcontractor progress payments, supplier invoices, and retainage releases. That makes it an attractive target for business email compromise (BEC). The FBI’s 2025 Internet Crime Report puts reported BEC losses at about $3.05 billion in 2025, up from about $2.77 billion in 2024, and the report tracks BEC involving real estate transactions as its own category.

The pattern is consistent. An attacker gains access to a mailbox (yours, a subcontractor’s, or a supplier’s), reads the thread, waits for a payment to come due, and sends a polite note that the bank details have changed. The email comes from a real account or a lookalike domain, references the correct project and amount, and arrives at the moment someone expects it.

Technology helps, but the control that stops this is procedural:

• Any change to banking details is verified by calling a number already on file, never a number in the email.
• Payments above a set threshold need two approvers.
• Mailbox forwarding rules and new inbox rules are monitored, because attackers often hide replies this way.
• Accounts payable and project managers get short, specific training on what these requests look like.

Offboarding seasonal staff and subcontractors

Access granted for a project should end with the project. In most environments we review, the accounts that cause trouble are the ones nobody remembered: the subcontractor who still has the plan-room share, the seasonal engineer whose mailbox still forwards to a personal address, the former superintendent whose tablet was never returned.

Tie every account to a person, a project, and an end date. When the end date arrives, disable the account, recover or wipe the device, and remove the person from shared folders and external collaboration links. Run a quarterly review of every active account against the current staff and subcontractor list. This is dull work, and it is also one of the cheapest controls available.

Backups for project data and the trailer itself

Project records outlive the project. Drawings, RFIs, submittals, daily logs, and photo documentation may be needed years later in a dispute or warranty claim. Backups should cover the cloud document platform, email, and anything stored on site devices.

The CISA #StopRansomware Guide recommends that organizations “maintain offline, encrypted backups of critical data” and “regularly test the availability and integrity of backups in a disaster recovery scenario.” For jobsites, that also means the site kit configuration is backed up, so a damaged or stolen firewall can be replaced and restored the same day. Our backup and disaster recovery service is built around tested restores, not just completed backup jobs.

How Intelligent Group can help

Intelligent Group supports construction firms with standardized site network kits, managed field devices, named-account access for staff and subcontractors, payment-change verification procedures, and tested backups for project data. Our 24/7 US-based senior engineers handle mobilization and demobilization as a repeatable process, so each new site starts from a known configuration and closes out with access removed. If you want a review of how your current sites are set up, contact us.

Frequently asked questions

Is cellular internet good enough for a construction trailer?

Often it works well as a primary or backup link, depending on coverage at the site. The more important point is having two paths, so the site keeps working when one fails. A managed firewall can switch between them automatically and alert someone when it does.

Should subcontractors get accounts on our systems?

Give subcontractors the narrowest access that lets them do the work, usually a guest network and external sharing on specific project folders. If they need a company account, it should be named, protected with MFA, and set to expire on a defined date. Shared subcontractor logins should be retired.

What is the fastest way to reduce payment-change fraud?

Adopt a written rule that any change to payment instructions is confirmed by phone using a number already on file, and require two approvers above a set dollar amount. Communicate the rule to your subcontractors and suppliers too, so they expect the call. Both steps cost little and address the most common pattern.

How often should jobsite access be reviewed?

At minimum, at every project closeout and quarterly across all active projects. Compare active accounts and shared links against the current staff and subcontractor roster, and remove anything that no longer has an owner.