Cyber Security in Construction: Key Risks, Impacts and Insurance Cover

With construction companies relying ever more on data-driven analytics, digital project management  and cloud storage, the execution of practical works on site is reliant on a stable IT environment.

So what are the risks to a construction industry?

A construction company is likely to hold less sensitive information than, for example, a financial or educational institution but there is still an abundance of Personally Identifiable Information (PII) nonetheless.  Indeed, there is a potential for wider exposure with the construction industry's employment of non UK nationals, where they may retain copies of employees’ passports. If these passport details are compromised in a data breach there must be a prompt notification to the ICO. The submission of such a notification can present a significant administrative and legal burden.  If the breach affects non-UK nationals, then it may also require notification to the equivalent statutory body in the homeland of that individual, increasing further the reporting burden and complicating the legal framework.

Aside from PII, commercially confidential information concerning bid and tendering processes, whether ongoing or completed, could be compromised which may leave companies commercially vulnerable to exploitation or at risk of failing with tender submissions.

The growth of Modern Methods of Construction, such as offsite modular manufacturing hubs, could be disrupted and articulated equipment utilised in 3D printing of concrete forms could be disabled.

The risks do not stop when a build is complete with the Internet of Things now acting as a hub to a whole host of building services under an overall building management system. Any compromise of heating and ventilation, lifts and escalators or fire, smoke detectors and alarms could have serious consequences for the ongoing occupation of any building.

But what if the worse happens and systems are disabled and the ransom .txt file is discovered? Companies inevitably look to their own IT department or outsourced IT providers for a response.  Often, the technical skills of these providers is inadequate to deal with an ongoing and active security breach so attention will turn to Insurers to see if there is any cover to respond to the incident.

We know, from experience, that the extent of cover for cyber risks varies significantly, ranging from a small and very often limited extension under a general computer policy to a bespoke cyber policy.  Comprehensive cyber policies typically extend cover for legal support to deal with notification and regulatory issues, technical and forensic support to remedy the breach and return systems to where they were before the attack and, potentially, costs to mitigate reputational damage and media management. Such policies may also extend to Business Interruption and Increased Costs of Working as those affected look for workarounds to overcome the interruption. Such vendor costs are significant and what may be perceived to be significant levels of cover can quickly be exhausted.  It is also likely that cover for BI and ICOW arising from cyber incidents is specifically excluded under traditional project and CAR policies.

The threat and impact of cyber attacks on construction companies is one that not only have we first-hand experience of, but it is identified by the National Cyber Security Centre (NCSC) and a useful read is their published guidance, “Cyber Security for Construction Businesses” aimed at small to medium sized businesses. Practical guidance is provided to avoid any attack and close any vulnerabilities and the guidance helpfully defines the stakeholders’ duties in relation to cyber security. Reference is also made to the “Code of Practise code Cybersecurity in the Built Environment” published by the Institution of Engineering and Technology.

Clearly, no industry is immune to cyber incidents, even those that may be perceived to be a less glamourous or fruitful target.  The interruption, disruption and recovery from such an event can be a significant challenge.  For construction, the risks are real and very much tangible to the “boots on the ground” activities.