An audit is only worth the action that follows it. A report listing your risks does not stop a single fraudulent payment. What protects the business is a clear plan to close the gaps, worked through in the right order over a sensible period.
We have already covered where the cyber risk sits for a Sydney building firm: payment fraud through the progress-claim chain, devices spread across sites, and a constantly changing cast of subcontractors. This post is the next step. If an audit has just shown you where you stand, here is a practical 90-day plan to fix it, built around the way the trade actually runs.
You will not need to stop work to do any of this. Most of it is tightening things you already have.
The First 30 Days: Protect the Payments
In construction, the money is the target, so the first month goes straight at the payment chain.
Start with multi-factor authentication on every mailbox. MFA means a second step at login, usually a prompt on a phone, so a leaked password is not enough to get in. Most invoice-fraud attacks begin with an attacker quietly reading a mailbox, learning the language and timing of a real deal, then sending a convincing request to change bank details. MFA makes that initial break-in far harder. Our guide to business email compromise explains exactly how this attack runs.
Alongside the technical control, set one simple rule and hold the office to it: any change to bank details, on a supplier invoice or a progress claim, is confirmed by a phone call to a known number, never by replying to the email. That single habit catches most of what slips past the filters. It costs nothing and it is the highest-value thing you can do this month.
Then take a quick inventory of who can authorise or release payments, and confirm those accounts in particular have MFA and strong, unique passwords. The accounts that move money are the ones an attacker wants most.
Days 30 to 60: Secure the Site and the Devices
Construction happens everywhere but the office, so the second month is about the devices that travel and the networks they connect to.
Project managers work from utes and site sheds, foremen use phones and tablets, and a lost or stolen device on a busy site is a way into your systems. The basics need to travel with the device: a screen lock and encryption so a lost phone is not a breach, and the ability to remotely wipe a device that goes missing. Site Wi-Fi and public networks are not always safe to log in from, which is another reason MFA on every account matters when staff are on the move.
This is also the right time to sort backups. The flaw to avoid is the backup that runs but has never been restored. Set up a proper 3-2-1 backup: three copies, two types of storage, one copy offsite and protected so ransomware cannot reach it. Then test a restore. Downtime is expensive in this trade, with crews standing idle and penalty clauses ticking, so recovery speed is a commercial issue, not just an IT one.
Confirm patching is being actively managed across machines too, because most ransomware gets in through a known flaw that already had a fix available.
Days 60 to 90: Tidy Up Access and Keep It Closed
The final month addresses the gap that quietly catches construction firms: access that is granted and never removed.
New subbies onboard, projects wrap up, crews move on, and each change is a small security event that is easy to miss. The common result is a subcontractor or a departed staff member who still has a login to a shared drive months later. Work through who has access to what, remove anything that is no longer needed, and build a simple rule that access is granted by role and removed promptly when someone leaves or a project ends.
Then decide who owns security going forward. Controls drift the moment nobody is watching. MFA gets switched off for one account, a new login appears, a backup quietly fails. The firms that stay secure are the ones where someone checks, month after month, that the controls held.
Everything in this plan lines up with Essential Eight, the baseline published by the Australian Cyber Security Centre. You do not need to learn the framework. You need the controls behind it working on site and in the office.
Where to Start
If you have not had an audit yet, that is the natural first move, because most of these gaps stay invisible until someone looks. An IT Audit gives you a documented picture of your firm’s setup and a clear order of priorities for $990, with no ongoing commitment. You will know what to fix first and what can wait.
We are a Sydney-based team in Bella Vista, and we work with construction and trades businesses across the metro area. We understand how this trade runs, on site and on the move, and we close these gaps without getting in the way of the work. Talk to our team when you are ready.
