Architecture, engineering, and construction companies rarely operate from one location.
Employees may move between an office, job site, client location, home, and vehicle during the same week.
That flexibility helps projects move forward, but it also means cybersecurity can't depend entirely on protections inside the office.
Here are five risks AEC firms should consider when employees work in the field.
1. Laptops move between locations
A company laptop may connect to:
- the office network
- a home network
- a project site
- a hotel
- a client office
- a mobile hotspot
Security controls should continue protecting that device wherever it goes.
That may include endpoint protection, device management, encryption, software updates, and secure authentication.
2. Phones can access significant company information
A mobile phone may provide access to:
- company email
- Microsoft Teams
- project files
- SharePoint
- customer information
- job-site photos
- cloud applications
That makes phones part of the company's security environment too.
What to ask:
If an employee loses a phone, can company access be removed quickly?
3. Remote networks aren't under your control
AEC employees frequently work outside the corporate network.
The answer isn't necessarily to prohibit remote work. Instead, businesses need controls that continue to work regardless of where the employee connects.
Secure authentication, managed devices, and properly configured remote access can reduce dependence on the network itself.
4. A lost device shouldn't become a data breach
Laptops and phones get lost.
The more important question is what happens next.
Organizations should know whether devices are:
- encrypted
- password protected
- centrally managed
- remotely removable from company systems
- reporting security status back to IT
A lost laptop should be an inconvenience, not automatically a major security incident.
5. Shared devices create accountability problems
A project tablet or shared workstation may be convenient.
Shared credentials are another matter.
Individual accounts make it easier to control access, investigate problems, and remove permissions when someone leaves.
Cybersecurity for mobile AEC teams
For architecture, engineering, and construction firms throughout Greater Boston and Southeastern Massachusetts, cybersecurity needs to follow employees wherever work happens.
The goal isn't to make field work harder. It's to make secure work consistent.
Take the 2-Minute Sitting Duck Assessment:
www.systemsupport.com/campaign/duck
Frequently Asked Questions
Are company laptops safe when employees work remotely?
They can be, provided security controls such as endpoint protection, updates, encryption, MFA, and device management continue working outside the office.
Should employees use personal phones for company email?
Businesses should establish clear policies for mobile access and understand how company data can be protected or removed if a personal device is lost.
Why is device encryption important?
Encryption helps protect information stored on a device if that device is lost or stolen.
