Publication-2026-English-Secure-Digital-Collaboration-in-the-Construction-Industry

Secure Digital Collaboration in the Construction Industry

0.0 Colophon

This publication is issued by ConTech Lab - part of Molio, in connection with the analysis project Secure Digital Collaboration in the Construction Industry (August 2025 to January 2026).

The project, which maps the construction industry’s digital vulnerabilities and solutions that strengthen security in digital collaboration, has been carried out in collaboration between DI Construction, Implement Consulting Group, COWI, Molt Wengel, Molio, buildingSMART Denmark and ConTech Lab. Graphic design and layout by Chris Adam for Crash Creative.

ConTech Lab is the construction industry’s shared development platform, where companies collaborate to develop and experiment with new ways of using data, digitalisation and technology to create the construction of the future, a more sustainable and productive industry.

ConTech Lab shares all knowledge and learning for the benefit of the entire industry.

0.1 Table of Content

3

1.0

Reading Guide

04

2.0

Introduction

07

3.0 3.1 3.2 3.3 3.4 3.5

Part 1: The Digital Threat in the Construction Industry The Construction Industry’s Digital Setup The Risk Landscape Vulnerabilities in the Office, on Site, and in the Cloud IT Culture in the Construction Industry Vulnerabilities in the Construction Industry

08 10 12 14 16 19

4.0 4.1 4.2 4.3 4.4 4.5 4.6 4.7 4.8 4.9

Part 2: Catalogue of Solutions Risk Assessment as a First Step Governance and Allocation of Responsibilities Technical Controls Organisational Measures Organisational Maturity Level Data Classification in Construction Projects Requirements for Digital Security Standards Relevant to Digital Collaboration Available Tools

20 22 24 26 27 30 31 34 35 36

5.0 5.1 5.2

Managing Security Incidents and Preparedness in Construction Projects – What Do We Do If Things Go Wrong?

What Is a Security Incident in Construction?

A “Light” Preparedness Approach for Construction Projects

38 40 41

6.0

Which Solutions Are Missing in the Construction Industry

42

7.0

Checklists

46

8.0

Digital Solutions to Watch

48

9.0

Conclusion

52

10

Glossary

55

1.0 Reading Guide

Who can use this publication and how?

The publication can be used by all stakeholders in the construction and civil engineering industry, but for different purposes:

The publication brings together knowledge and insights from dialogue with experts, workshops with companies in the construction industry, interviews, surveys, and desk research.

• Clients and investors can use the publication to define clear, risk-based requirements for digital security in procurement, contracts, and governance.

The publication is divided into two parts:

• Consultants can use it to integrate risk assessment and information security into design, modelling, and collaboration processes.

Part 1: The Digital Threat in the Construction Industry Part 1 describes the threat landscape and the construction sector’s specific risk conditions, including the industry’s digital setup, IT culture, complex value chain, and the phase transitions of construction projects. The purpose is to provide a common language and an overview of risks that companies can use as inspiration for their own risk assessments.

Part 2: Solution Catalogue Part 2 presents relevant requirements as well as recommended actions and tools to strengthen secure digital collaboration in the construction industry.

The focus is on risk assessment, requirements in procurement and contracts, shared project practices including ICT, concrete technical and organisational measures, as well as examples of relevant tools and solutions.

At the end of the publication, a glossary with explanations and definitions is provided.

• Contractors can use it to establish secure collaboration platforms, access management, network practices on site, and shared procedures with project partners.

• Subcontractors and suppliers can use it to understand expectations and minimum requirements, as well as document their own maturity and compliance.

How to turn the publication into action As a reader, you can use the publication in three ways: • As inspiration for mapping your own risk landscape (organisation, supply chain, or a specific construction project).

• As a checklist at project start-up, fx when defining requirements in procurement, selecting platforms, managing access, and agreeing on responsibilities • As a reference for shared practices in ongoing construction projects, where security should be continuously monitored and documented.

5

Scope and Focus

What is not covered by this publication?

This publication focuses on secure digital collaboration in construction and civil engineering projects. The focus is on digital workflows, systems, and data exchanges that arise when multiple companies collaborate across the construction value chain.

To ensure a clear focus, the publication does not cover:

The publication specifically addresses: • Collaboration across clients, consultants, contractors, subcontractors, and suppliers.

• Shared data environments and project platforms (CDE, project web, cloud solutions).

• Access and permission management in projects with many stakeholders and project phases.

• Networks and digital infrastructure on construction sites.

• Operational technology (OT), such as machinery, cranes, and sensors.

•

Governance, roles, responsibilities, culture, and behaviour in digital collaboration.

The focus is therefore not only on technical IT security, but on the interaction between technology, people, and processes in cross-organisational collaboration.

Primary emphasis is placed on the early and execution phases of construction projects, where the framework for digital collaboration is established and where the most significant practical vulnerabilities arise.

Operations and maintenance are included to the extent that decisions made during the project phase affect information security and robustness later in the building’s lifecycle.

• Detailed technical configurations or product recommendations.

• Specific descriptions of vulnerabilities at individual construction sites or in named projects.

• In-depth treatment of cybersecurity in the operational phase of buildings (facility management, smart buildings, etc.), unless it is directly relevant to the digital collaboration within the construction project itself.

• Legal advice in a strict sense (the publication outlines frameworks and key considerations but does not replace specific legal or technical advice).

2.0 Introduction

Digital collaboration has become a prerequisite for efficient construction, but it has also made the industry more vulnerable. Construction and civil engineering projects involve many stakeholders, changing phases, and extensive data sharing across companies and platforms. This means that a vulnerability in one part of the value chain can have consequences elsewhere.

Cybersecurity in construction therefore requires not only a focus on individual companies, but also shared methods, clear requirements, and practices that work in everyday operations on site.

7

This publication has been developed as part of the analysis project Secure Digital Collaboration in the Construction Industry (August 2025 to January 2026). It outlines the construction industry’s specific risk landscape and highlights solutions that can strengthen security and robustness in digital collaboration without hindering progress and productivity.

The five key takeaways are: • The value chain is the attack surface.

Cyberattacks often exploit the weakest link.

Security must therefore be addressed across companies, suppliers, and collaboration platforms in construction projects.

• Project platforms and access management are among the most significant practical risk areas.

Unclear roles, overly broad access rights, and lack of proper access termination create unnecessary risk, especially when projects move between phases and participants.

•

Construction site networks and OT represent a growing vulnerability. A single shared network, lack of segmentation, and unpatched equipment create entry points that can, in the worst case, lead to security, financial, and operational consequences.

• Culture and behaviour are often the decisive factors. Awareness, training, and shared practices are among the most cost-effective measures and are essential to ensure compliance in practice.

• Security must be embedded from the outset and followed up continuously. Risk assessments, clear requirements in procurement and contracts, ICT agreements, and ongoing follow-up make security manageable and documentable throughout the entire project lifecycle.

The project Secure Digital Collaboration in the Construction Industry is led by DI Construction, Implement Consulting Group, COWI, Molt Wengel, Molio, buildingSMART Denmark, and ConTech Lab.

3.0 Part 1

The Digital Threat in the Construction Industry Construction companies, like all other Danish businesses, operate under constant risk pressure.

The Danish Centre for Cyber Security’s “Threat Assessment of the Cyber Threat against Denmark 2025” states that cyber threats have become a basic condition. Authorities, companies, and citizens are exposed daily to attacks from both state and non-state actors¹.

Phishing remains the most widespread type of attack².

These attacks are often not targeted at a single company but are carried out broadly using large volumes of email addresses that are traded illegally.

At the same time, “social engineering” is gaining ground as a method. Here, attackers manipulate individuals into revealing sensitive information or performing actions that compromise security, often by impersonating a trusted sender and using imitation, pressure, or persuasion³.

1 2

samsik.dk/publikationer/cybertruslen/ PWC’s Cybercrime Survey 2025

For the construction and civil engineering industry, attacks can also occur on and through operational technology (OT), such as machinery, cranes, ventilation systems, and sensors. When OT is connected to networks, new attack surfaces emerge.

In the worst case, equipment may be affected or destroyed, or safety systems may be compromised.

According to PwC’s Cybercrime Survey 2025⁴, 32% of companies report having experienced a security incident. Among affected companies, phishing is the most common incident (62%). In addition, DoS attacks (28%), supplier failures (25%), and accidental sharing of sensitive information (23%) are reported as frequent incidents.

3 4

Cybersikkerhed: social engineering - Consilium PWC’s Cybercrime Survey 2025

9

What types of security incidents are we dealing with?

Phishing attacks

62%

DoS attacks targeting your organisation

28%

Incidents caused by supplier failures

25%

Don’t know

Accidental sharing of personal data or other sensitive information

23%

Yes

Unauthorised access to or use of information, systems, or networks

20%

No

Financial fraud targeting your organisation

17%

Social engineering

16%

Malware (viruses, worms, or other code)

13%

6%

32% 63%

Has your organisation experienced a security incident within the past 12 months?

Example: Bouygues, France Bouygues, a major French construction company, was hit by a ransomware attack in 2020 that began with phishing emails. With a “flat network”, where systems were closely connected without segmentation, attackers were able to move quickly and freely once they had gained access.

The result was the shutdown of numerous construction sites for three weeks and an estimated financial loss of DKK 7.5 billion.

The example illustrates how a single click on a malicious link can have disproportionate consequences for many stakeholders across a construction project’s value chain.

3.1 The Construction Industry’s Digital Setup A significant part of the construction industry’s risk landscape is related to its long value chain: A company can be affected because an attacker finds a weak link at a partner or supplier.

“

The construction industry is characterised by many stakeholders, with companies entering into numerous partnerships and collaborating across the value chain – especially digitally.

Cybersecurity in construction must therefore be considered far more broadly than just a company’s own IT systems.

Malene Stidsen Programme Manager for Cybersecurity, Industriens Fond

Idé

Finansiering

Projektering

Bygherrer

This makes it essential to consider value chain security: • • •

Who has access to data?

Who can influence systems?

Which platforms connect the collaboration?

Construction and civil engineering projects often span several years and go through multiple phases, where both governance and project management can change in nature. This means that IT governance and security procedures can become unclear or inconsistent.

Planlægning

Projektudviklere og Investorer

Nedrivere

Arkitekter

BYGGERIETS VÆRDIKÆDE Driftsherrer

Rådgivende ingeniører

Materialeleverandører

Renovering og transformation

Entreprenører

Drift

Udførelse

Phase transitions, such as moving from planning to execution, can make it difficult to maintain responsibility for, among other things, platforms, access control, data sharing, and preparedness.

Project practices may at times conflict with the companies’ own policies regarding, for example, role allocation and security.

11

3.2 The Risk Landscape

In the National Risk Assessment 20255, the Danish Agency for Civil Protection encourages companies to develop their own risk assessments. To support the construction industry, the project partners behind the project ‘Secure Digital Collaboration’, together with input from the industry, have developed a consolidated risk overview for construction.

This can be used as inspiration for companies’ own risk evaluations, as well as for assessing risks in supply chains and collaborations.”

The construction industry’s risk landscape highlights the following key issues:

IT culture and security practices Many companies lack clear IT security policies, and employees are not trained in the secure use of systems.

5

Nationalt Risikobillede 2025 – Danmarks væsentligste risici og trusler

Interconnected systems

Lack of updates and legacy systems

Many systems, platforms, and processes are interdependent within a construction project. A disruption in one place can create a domino effect, including in payments and deliveries, if a central actor or supplier is affected.

Outdated systems without updates pose a particular risk, especially if they are connected to modern platforms.

Simple digital networks on construction sites Many construction sites have simple or flat networks where segmentation and layered protection are lacking. When “everything is connected,” an attacker can move freely between systems and data after gaining initial access.

Inadequate user and access management

OT – operational technology Machines, cranes, ventilation systems, and sensors are connected to networks, and software updates are not performed automatically.

Digitalisation of OT creates new opportunities but also new vulnerabilities. In the worst case, someone could remotely control a crane or tamper with safety systems.

Access is often granted broadly to ensure progress.

This can mean that contractors and others gain access to sensitive information they do not need, and that access rights are not removed when they are no longer relevant.

Many partners and phase transitions

Physical access to the construction site

Construction projects involve many different and changing stakeholders (contractors, subcontractors, material suppliers, etc.), who often have varying levels of cybersecurity maturity. This increases the risk of weak links and unclear allocation of responsibilities.

Construction sites have many visitors and temporary workers. This makes it difficult to maintain a full overview of who has access to what, both physically and digitally.

3.3 Vulnerabilities in the Office, on Site, and in the Cloud Digitalisation has blurred the boundary between office and construction site. The technology connects everything, and therefore cybersecurity in the two environments is closely linked.

A particularly critical vulnerability is project platforms for document, information, and data sharing. These platforms are often financed by the client but administered by consultants or contractors.

In the office, many solutions are cloud-based.

Vulnerabilities can therefore be hidden, for example when data is transferred between regions, or when network and security configurations are not maintained systematically.

In practice, access management is not always consistent: participants may gain access to more than necessary, and access rights are not always revoked when they are no longer needed.

The contractor’s digital landscape Projects and production

Finance and Support

Offer and calculation

IT and support

Webapp med skemaer

CDE projektvalg

Officepakke

Fakturaflow Continia

ERP Nav

SIGMA

File server

Sagsdrev

Excel-ark

Bluebeam

Timer, udlæg, km Expandit

Reports YellowFinn

GYB market analysis

PC

Sagsmail

Print

MSP

EAN Spoon Connect

Adobe Design

Mobile

DWG viewer

TactPlan/ MSP

Solibri

Payroll Lessor

A&K skemaer

Internet

Special apps fx Danalock

Frame DGNB

MS Teams

Software portal IT support

Kilde

HD Lab, eksempler på digitale værktøjer i byggeriet

15

Inappropriate use of digital tools also increases risk.

Excel, for example, is widely used to manage critical functions such as budgets, schedules, contracts, and resources, where more secure systems should be used instead. Old spreadsheets are shared, version control is limited, and security is often insufficient. This can create both security risks and errors in critical decision-making.

On construction sites, vulnerabilities particularly arise from the use of a single shared Wi-Fi network for drones, tablets, cameras, sensors, and private devices.

At the same time, many individuals with varying levels of connection to the site are present, from permanent business partners who are part of the construction project to material suppliers who may only visit the site once or twice. This increases the risk of unauthorized access and non-compliance with procedures.

Finally, the use of private devices (BYOD) for work tasks creates additional entry points that the company does not fully control within its IT infrastructure. If an employee’s device is hacked in a private context, an attacker may gain access to the company’s software, and vice versa.

3.4 IT Culture in the Construction Industry

The construction industry’s efforts in IT security are generally assessed as insufficient compared to other sectors.

Statistics Denmark’s survey from spring 20246 on IT usage in small businesses shows that small companies within construction typically focus most on software updates (79%), backup to alternative locations (76%), and network access control (59%). In 13 out of 15 measures, the industry ranks below other sectors (industry, trade/transport, information/communication, and business services).

Skills development is a particular weakness. Only 24% of companies in the construction industry offer voluntary training/education, and only 16% have mandatory training. 26% include information on IT security in written contracts, and 22% have conducted a risk analysis.

The Danish Industry Foundation’s Cyber Barometer 20247 also shows that while most sectors have increased the number of cybersecurity measures over time, this is less evident in construction.

The sector has both the fewest measures and the smallest increase.

The firgure shows the development in the average number of cyber security measures across industires from 2022 to 2024 8.

2022

2023

2024

93% 85% 74%

74%

72%

85%

77%

66% 52%

Construction

6

56%

57%

Manufacturing

NYT: Øget it-sikkerhed i små virksomheder - Danmarks Statistik

54%

Transport

7 8

Communication

Cyberbarometer 2024 | Cybersikkerhed Cybersikkerhed & konkurrencefordele blandt danske SMV’er 2024

Secure digital collaboration in construction: Survey

How is project data shared between partners?

Without special security measures

In the project, a survey has been conducted among companies in the construction industry on how they work with secure digital collaboration.

The results show that only about a quarter of the companies have a jointly agreed minimum level of cybersecurity on a project or construction site, and only just under half use secure encrypted systems to share data.

Typically via regular email or file sharing with some guidelines Through secure, encrypted channels or approved systems

4%

Among the most frequently mentioned vulnerabilities are the sharing of Excel sheets and links to project folders.

49%

47%

IT security measures in small businesses distributed across industries in 2024 The figure shows the results from Statistics Denmark’s survey

All

Industry

92 55 82 23 47 39 80 69 41 51 48 36 34 45 59 43 29 34

97 51 84 18 48 36 86 73 38 48 44 30 28 41 57 36 24 31

Construction

Trade and transport

Information and communication

Business services

98 75 88 41 80 68 93 85 56 74 73 66 57 75 88 73 58 64

94 59 86 28 54 54 86 75 53 60 62 48 42 59 71 57 40 44

Percentage of all small businesses At least one type of measure Strong passwords Systematic software updates Biometric methods for user identification At least two authentication mechanisms Encryption of data, files, or emails Backup in an alternative location Access control to networks VPN (virtual private network) IT security monitoring systems Storage of logs Risk analysis IT security testing Documentation on IT security At least one type of info about IT security Voluntary education and training Mandatory education and training Via written contract

91 45 79 24 38 27 76 59 31 40 28 22 23 29 46 24 16 26

90 55 79 19 41 33 75 67 38 50 48 35 33 41 56 42 27 29

3.5 Vulnerabilities in the Construction Industry

19

As described, the specific conditions in the construction industry, IT culture, and limited security efforts create a number of recurring vulnerabilities.

The list below is not exhaustive, but highlights the most central vulnerabilities identified in the project: • Widespread use of simple passwords and reuse across projects and portals, often without a password manager or multi-factor authentication.

• Sharing of links to project folders where access is not restricted on a “need-to-know” basis, and where access often persists longer than necessary (lack of access control and deprovisioning).

• Physical placement of servers and insufficient protection may constitute a vulnerability.

• Vehicle data can provide access to mobility infrastructure via cars located at construction sites.

• USB drives are used to share data and documents and can transfer malware without being detected.

• Public tenders with complete project descriptions can provide unwanted insight into critical conditions if materials are freely available on municipal websites.

• Lack of IT security training increases the risk of phishing and social engineering.

• Temporary workers and visitors on construction sites often do not know security procedures.

• Shared Wi-Fi for “everything” without segmentation, and in some cases without sufficient access control.

• Sharing of documents via insecure platforms, email, or open cloud links (e.g., Dropbox/ WeTransfer).

• Backups are not always automated, and restore processes are not systematically tested, which worsens the impact of ransomware.

• Tablets and smartphones are used for critical tasks without MDM (Mobile Device Management).

• Older systems run without updates and constitute known vulnerabilities.

4.0 Part 2

Catalogue of Solutions Digital collaboration makes construction projects more efficient, but it also means that project stakeholders must work more systematically with digital security. A leak of construction drawings, schedules, or operational data can have consequences for people, business, and reputation. Therefore, information security should be seen as an integrated part of professional project management.

Secure digital collaboration is about supporting cooperation, reducing errors, and creating confidence for all parties involved in a construction project. Good IT governance and data quality reduce risk, promote progress, and make it easier to document compliance with requirements.

Cyber security is therefore no longer an isolated IT matter, but a competitive parameter and a prerequisite for robustness in the construction of the future. It requires companies not only to manage their own security, but also security in the supply chain and in collaborative relationships. The industry needs a cultural shift where digital security becomes a natural part of tendering, collaboration, and project management—supported by shared methods and tools.

“

Digitalization makes the construction industry more efficient, but also more vulnerable.

When construction sites are as digital as they are physical, cybersecurity becomes an operational issue that must be addressed on par with occupational health and safety and quality assurance.

Fundamental strengths in productivity, trust, and robustness in our projects are strengthened when we, together with the industry, take responsibility for security in our digital collaboration Søren Cajus Head of Construction and Technology, DI Construction

The purpose of the solution catalogue is to describe common requirements, methods, and digital solutions that the industry can use as a starting point to increase security while also supporting efficient project execution.

21

4.1 Risk Assessment as a First Step A fundamental prerequisite for better digital security in construction projects is systematic risk mapping or analysis. Today, only about one in five projects and construction sites consistently carry out such mapping9.

Has a cybersecurity risk assessment been carried out in projects and on construction sites?

Yes, it is a fixed part of our project basis and site plans

17%

Only in some projects/ construction sites

37%

No, it has not been carried out

46%

Risk mapping focuses on threats, vulnerabilities, consequences, and likelihood. Based on this mapping, a risk assessment can be carried out based on likelihood × consequence, making it possible to prioritize efforts so they match the level of risk.

After the risk assessment, initiatives for risk treatment are formulated.

These may include: • Governance (roles, responsibilities, processes) • Technical controls (access control, encryption, backup) • Organizational measures (awareness, training, quality assurance) Risk mapping should be carried out early in the construction process, already before the design phase, and continuously reassessed, including when the construction site is established and active. The mapping should describe which data and information assets are involved, how critical they are, and whether the project as a whole may be subject to regulatory requirements.

“

Future construction projects, especially those involving critical infrastructure, require a risk-based approach to digital security. It is about understanding where the project’s real vulnerabilities lie and building governance, processes, and collaboration models around them. Only then can we create true resilience.

Emil Sahin Associate Technical Director i COWI

9

ConTech Lab Cyber Survey 2026

23

Idé

Finansiering

Projektering

Bygherrer

Projektudviklere og Investorer

Nedrivere

Arkitekter

BYGGERIETS VÆRDIKÆDE Driftsherrer

Rådgivende ingeniører

Materialeleverandører

Entreprenører

4.2 Governance and Allocation of Responsibilities Clarity of responsibility is a prerequisite for secure digital collaboration A large part of the construction industry’s digital collaboration today takes place in cloud-based solutions and shared project platforms. Here, a fundamental misunderstanding often arises: that security “belongs to the provider.”

In practice, responsibility for enforcing the various cybersecurity-related tasks is shared, and if this is not clearly agreed upon, gaps in security arise.

In construction projects where platforms are often paid for by the client, administered by consultants or contractors, and used by many parties, the risk of unclear responsibility is particularly high.

Lack of clarification can lead to overly broad access, failure to deactivate users, unclear incident response procedures, and ultimately an increased risk of data breaches.

Is it clear who is responsible for data security in the different phases of your projects? (e.g., design, tendering, execution) Is it clear who is responsible for data security in the different areas of your projects? (an area could, for example, be IoT)

Yes, responsibility is clearly defined in contracts and procedures Partly, but there are gray areas between parties No, responsibility is unclear or not discussed

Kilde

21% 16% 34% 41% 45% 43%

ConTech Lab Cyber Survey 2026

Responsibility for shared tasks means that security is distributed across multiple parties, and that each party is responsible for different parts of the overall security.

A simplified model for shared responsibilities in construction projects can be described as follows: Platform and cloud provider:

Consultant / Contractor:

• Operation and technical stability of the platform • Basic technical security (e.g., data centers, network, physical security) • Built-in platform security (e.g., encryption, backup capabilities, logging)

•

Client (Project owner):

Individual project participant:

• Overall requirements for information security in the project • Definition of risk level and data classification • Requirements for the use of platforms in tenders and contracts based on NIS2, CER, and ISO 19650 (see sections 4.7 and 4.8 for more information on requirements and standards)

• Proper use of systems and platforms • Protection of own login credentials • Compliance with agreed procedures for data sharing and storage • Document their own security maturity in relation to requirements from main contractors

• • •

Integrating risk assessments into design and modeling processes Daily administration of the project platform Creating, modifying, and deactivating users and access rights Ensuring the correct use of the platform throughout the project phases

If any of these roles are not clearly defined, a security “gap” will arise.

Typical pitfalls in construction projects:

How to clarify responsibilities in practice:

Experience from the project points to a number of recurring challenges:

To translate responsibility for shared tasks into practice, the division of responsibilities should:

•

• Be explicitly described in IT agreements, contracts, or project governance documents.

• Be tied to specific roles (not just organizations).

• Be followed up at project start and continuously, especially during phase transitions.

• • •

No one has clear responsibility for closing access at phase transitions or at project completion.

The platform’s security features (e.g., logging, MFA, permission groups) are not activated.

Users share links or export data outside secure platforms.

Incident response for security events is unclear: who does what—and when?

These pitfalls are rarely due to lack of willingness, but rather a lack of shared clarification.

It is recommended that each project appoint a clearly responsible person for platform administration and digital security—for example, an IT coordinator or digital project manager with the mandate to enforce shared practices.

4.3 Technical Controls

Technical controls that support secure digital collaboration include: • Software optimization Software should be maintained securely and restricted or isolated as much as possible. The process of security optimization of existing software is called “hardening” and involves removing unnecessary functions, closing vulnerabilities, and enabling relevant security settings that often exist in systems but are not always utilized.

• Network access control Another way to strengthen digital security is to provide different levels of access for different project partners depending on their affiliation— for example, as seen in hospitals and schools: a guest network, an administrative network, and a technical/OT network.

It is also crucial to strengthen user and permission management, especially on project platforms where sensitive information is shared.

10 You are already being scanned—the question is whether you detect it. (DI Digital)

• Scanning tools Vulnerability scanning can provide a quick overview of exposed systems and companies’ digital touchpoints with the internet. Online services such as Shodan and Censys continuously map visible systems. This means that if a company has open ports or exposed systems, they are already registered. This information can easily be found by both researchers, competitors, criminals, and state actors. Scanningsværktøjer10.

4.4 Organisational Measures It is important to build a security culture that can function across the value chain, project phases, and disciplines Awareness and shared habits are often the most cost-effective way to reduce cyber risk while also strengthening trust and collaboration.

Ongoing follow-up and documentation of efforts help maintain an appropriate level of security and create learning that can improve practices in future phases and projects.

27

Effective awareness training The biggest challenge in working with cybersecurity is often behavior and creating understanding, motivation, and accountability among everyone working on the project or construction site.

It involves both common sense and basic security habits (e.g., not sharing sensitive drawings via email) as well as reducing human error in a fast-paced environment with many stakeholders.

Today, nearly half of construction companies do not conduct cybersecurity training11.

No, we do not conduct any training Yes, we do it in connection with new hires Yes, employees are continuously tested and trained in cybersecurity

11

ConTech Lab Cyber Survey 2026

19% 44% 37%

Training works best when it is short, relevant, and frequent Long annual sessions have limited effect. An effective approach can be microtraining in modules of 90–120 seconds, where users are trained continuously and linked to concrete, relatable risks (e.g., phishing, sharing links, handling sensitive information).

A key element is measurement and documentation.

With the right systems, it is possible to track who has completed training, where the risks lie, and

which departments need targeted efforts. In this way, cybersecurity becomes both measurable and manageable.

There are also solutions where employees must pass short tests to gain access to systems or workplaces, and these solutions can also be used in construction projects.

Maximize the outcome of the training

A normal standard training method in most organizations

The nano learning concept Working from home

Phishing

Jan

Feb

Mar

Apr

May

Jun

Jul

Aug

(1-2 hrs. of training)

Phishing Phishing Ransomware attack

Home wi-fi

Company credit cards

AI and sensitive data

Level of awareness

Anti bribery and corruption

Privacy links

Mutifactor authentication

Dropwise nano learning ensures continues high security awareness 1-2 videos per month

15-30 min

15-30 min

15-30 min

15-30 min

Level of awareness

High risk-periods

Phishing

Sep

Oct

Nov

Des

Jan

Feb

Mar

Apr

May

Jun

Jul

Aug

Sep

Oct

Nov

Des

(24-36 min. of training) 13

“

29

We need to engage people where the risk is and integrate requirements for awareness training into tender and collaboration processes, so that all parties work from the same baseline and documentation.

Anders Balslev Partner hos Implement Consulting Group

However, attention must be paid to requirements regarding transparency and equal treatment, particularly in public procurement processes.

Documentation can be embedded in agreements (e.g., IT agreements) and in digital systems that record training and activities.

Follow-up and documentation Ongoing follow-up is important to ensure that requirements and practices are adhered to. This can be done by revisiting the risk assessment, where new vulnerabilities or initiatives may become relevant.

As part of collaboration, parties can set requirements for controls, documentation reviews, and spot checks. Documentation can also be supported by external schemes such as supplier declarations, the CE marking, or similar (see section 4.9 for further information).

General Reporting

Dashboards allows easy visibility and actions to ensure overview and outlines the progress an organization reaches. All results can be extracted via PDF, open API, integrations and CSV. files to support data workflows for optimal output. Certificate for employees are issued upon completion.

Interactive and real-life situations based on a No blame – No shame methodology

16

4.5 Organisational Maturity Level It is beneficial to understand your own maturity level in order to prioritize the next steps. For construction projects, inspiration can be drawn from Molt Wengel and buildingSMART Denmark’s maturity model (5 levels).

5 Automated and resilient

High risk

4

Low risk

Proactive and integrated security

3 Structured openBIM support

2 Ad hoc solutions

1 Unorganized and vulnerable

No formal procedures.

Unstructured data management.

No access control.

Simple access control and loose IT policies.

No anchoring in processes.

IT policies also cover data and information in construction and infrastructure.

Controlled access and data exchange.

Security integrated into contracts, CDE, and compliance processes.

ISO 19650-5 is implemented.

IT security is strategic.

AI and automation protect data and information.

4.6 Data Classification in Construction Projects

31

Not all data is equally critical – and therefore should How the classification is used in practice: not be treated the same • Included in risk assessments and ICT agreements In construction and civil engineering projects, large • Governs access and permissions on project amounts of data are shared across companies, systems, platforms and phases.

• Supports requirements in tenders and contracts A common data classification makes it possible to • Clarifies why some data requires higher security prioritize security where the consequences of a breach than others are greatest, and to create a shared understanding of access and sharing.

Example of a practical classification level for construction projects:

Critical data

Examples Access information, OT/IoT data, security and contingency plans

Requirements Very restricted access, multifactor authentication, and special security measures

Confidential data

Examples Contracts, financial data, personal data, detailed schedules

Requirements Restricted access (needto-know), clear permission management

Internal data

Open data

Examples Working documents, meeting minutes, non-critical drawings

Examples General project descriptions, non-sensitive tender material

Requirements Controlled access via a shared platform

Requirements Can be shared broadly via approved channels

How the classification is used in practice: •

Included in risk assessments and ICT agreements

•

Governs access and permissions on project platforms

•

Supports requirements in tenders and contracts

•

Clarifies why some data requires higher security than others

4.7 Requirements for Digital Security Companies must be aware of both legal requirements and obligations, and clients/developers can advantageously set these early in the process, for example in tender materials and contracts.

Below are the most central legal requirements and regulations that companies in the construction industry need to understand and navigate.

Legal requirements for security (NIS2) The NIS2 Directive sets requirements for companies regarding risk management, contingency planning, documentation, training, and reporting of cyber incidents within critical areas.

The legal responsibility lies with the owner of the construction project, which is often the client. However, the NIS2 legislation has derived consequences throughout the entire value chain.

Larger companies must ensure that their partners comply with relevant requirements. This means that

12

samsik.dk/nis2/hvad-er-nis-2/

consultants and contractors are also expected to meet the requirements. The requirements will also be reflected in client organizations, for example subcontractors, suppliers, and ultimately also smaller craft businesses.

NIS2 is risk-based: critical suppliers are subject to stricter requirements, while non-critical suppliers will typically face fewer requirements. Therefore, the applicable requirements will vary across projects and supplier roles.

The AB system Companies must also be aware of their responsibilities within the AB system, which includes standard terms for construction contracts. If a cyber incident, for example, leads to delays, additional costs, or operational disruption, rules on time extensions, delay liability, defects, limitations of liability, etc., may become relevant.

33

Requirements in tenders Cybersecurity is increasingly becoming part of tenders, where clients can set requirements for specific digital platforms, forms of collaboration, and documentation of security. This affects not only main contractors, but also subcontractors and suppliers, and makes cybersecurity a competitive parameter.

“

Cybersecurity in contracts Cybersecurity should be considered in contracts from the outset through risk assessments, clear requirements, and balanced sanctions. The contract should support collaboration and responsibility—not merely serve as a conflict tool.

“

Nicolaus Falk-Scheibel Ph.D & lawyer at Molt Wengel

2018

Cybersecurity is not only a technical issue, but also a contractual and business matter.

Many current agreements do not regulate cybersecurity, which can create problems if a cyberattack leads to delays, data manipulation, or operational disruption. In such cases, consultants, contractors, and suppliers may become financially liable, even if they are not directly covered by NIS2.

Almindelige betingelser i bygge- og anlægsvirksomhed

Kenneth Højbjerg Digital Lead at AFRY, and participant in the project’s workshops

Betænkning nr. 1570

In larger projects we bid on, we increasingly see requirements regarding which digital platforms must be used for collaboration, and that our employees have the right training. That makes good sense, because ultimately it is about ensuring that we collaborate in a way based on sound judgment.

Almindelige betingelser i bygge- og anlægsvirksomhed Betænkning nr. 1570 2018

4.8 Standards Relevant to Digital Collaboration • ISO 27001: Framework for managing information security • ISO 19650: Information security in interdisciplinary project collaboration, tailored to the construction industry • Risk analysis and Business Impact Assessment (BIA) as methods for prioritizing security in projects

35

Governance tool with ISO 19650 ISO 19650 focuses on collaboration across organizations and makes it possible to establish shared processes that can be reused and elevate the industry. The standard specifies which processes should be carried out, in what sequence, and for what purpose, and can therefore function as a practical governance tool in project work.

Information and Communication Technology (ICT) ICT covers technologies that enable construction project participants to access, edit, transfer, and store information.

ICT regulations set requirements for, among other things, ICT coordination, digital communication, project web platforms, and digital deliverables at handover. The client must ensure coordination of ICT usage among all parties throughout the construction project.

ICT agreements can be expanded with cybersecurity requirements, responsibilities/roles, procedures, governance, risk assessments, and ongoing follow-up.

Since ICT coordination involves a significant level of responsibility, it is a good idea to assign the task to a specific person—such as an ICT coordinator or an ICT manager.

“

The logic of the standard can be used as a governance tool throughout the entire project lifecycle—from planning to operations. ISO 19650-5 should not be seen as a technical document, but as a shared method for working in a risk-based and holistic way with information security.

Peter Bo Olsen Standardization specialist, BuildingSMART Danmark

“

The purpose of the ICT regulations is to ensure a harmonized and value-creating use of ICT in construction, renovation, operations, and maintenance activities in the public sector. Productivity in these areas can be significantly increased through expanded use of ICT. It is also an obvious tool for establishing concrete agreements and shared processes for secure digital collaboration.

Allan Schiøtz Head of Product for ICT at Molio

4.9 Available Tools There are a number of tools that companies in the construction industry can benefit from when implementing measures to increase digital security in their business and their digital collaboration.

Here is a selection of the tools.

D-mærket’s self-evaluation14 Industry Foundation’s Cyber Barometer

13

Self-assessment and benchmarking with the industry provide recommendations for improvements within cybersecurity.

The recommendations are developed based on general knowledge, expert contributions, and case interviews, among others.

13

Cyberbenchmark | Cybersikkerhed, Industriens Fond

An overview of important focus areas for IT security and responsible data use.

The process is designed for efficient documentation and success criteria for supervision processes, so that the business can document compliance with requirements in the self-evaluation and achieve a more robust and responsible approach on the other side.

14

ConTech Lab Cyber Survey 2026

37

Sikkerdigital.dk Contains awareness materials and guides from the Danish Agency for Social Security, including a flyer with 7 tips on IT security, a flyer with 3 tips on securing IoT devices (smart products), as well as the Board’s guide and checklist for digital responsibility.

Guidelines on cybersecurity A number of guidelines have been published for companies regarding their cybersecurity, including by the Danish Agency for Social Security, the Council for Digital Security, the Confederation of Danish Industry, the Agency for Digital Government, the Danish Road Directorate, and ISO.

5.0

Managing Security Incidents and Preparedness in Construction Projects: What do we do if things go wrong?

In construction and civil engineering projects, timelines are tight, dependencies are many, and collaboration is often temporary.

Is there a shared procedure for handling cyber incidents or data breaches in projects or on the construction site?

When a digital security incident occurs, the consequences can quickly spread across companies and stop work on the construction site. Nevertheless, preparedness is often unclear:

No, there is no common plan

1. Who takes the lead?

2. Who contacts the platform provider?

3. Should the work be stopped – and how does the project continue temporarily?

Yes, with clear roles and communication channels

22% 41%

Partly, but only internally within our own company

37%

39

Without common agreements, projects risk losing both time, data, and trust.

Data from the ConTech Labs Cyber Survey 2026 shows that there is rarely a shared procedure for handling cyber incidents or data breaches in projects or on construction sites.

A simple and shared preparedness approach makes it possible to respond quickly, limit damage, and resume collaboration in a controlled manner.

What is a security incident in construction?

In construction projects, security incidents can include:

•

Ransomware or disruption of central systems

•

Compromise of user accounts (phishing, stolen login credentials)

•

Incidents related to OT or the construction site’s network

•

Unauthorized access to project platforms or folders

Not all incidents are equally serious, but all should be handled systematically.

•

Disclosure or leakage of drawings, models, or contract data

A “light” preparedness plan for construction projects The preparedness plan should be simple enough to work in practice and shared by all project participants. A basic plan can consist of several different elements, and the following are examples for inspiration:

1

Clear roles and points of contact

2

• One person responsible for digital security in the project (e.g., IT coordinator).

• Contact information for platform provider and possibly IT operations.

• Clear decision-making authority in case of incidents.

3

Shared response principles in case of suspected incident • •

Stop further spread (close accounts, change access codes).

Inform relevant parties quickly and in a coordinated manner.

Temporary continuation of work • Agreement on how critical information can be accessed temporarily.

• Consideration of offline access or alternative solutions.

• Prioritization of which functions are most critical for progress.

4

Documentation and learning • Brief recording of the incident, course of events, and consequences.

• Assessment of the need to adjust procedures, access, or training.

6.0

Which solutions are missing in the construction industry?

There are not yet established common methods for secure digital collaboration when many companies work together on the same project. This makes it particularly difficult for smaller companies to navigate requirements and expectations, and may mean that they face different requirements from different clients.

“

A small company may end up having to comply with many different requirements depending on who they collaborate with. In the project, it has been pointed out several times that there is a need to develop common methods and tools that can help the industry operationalize security in practice.

Christina Juell-Sundbye Project Manager, ConTech Lab

43

45

Shared baseline for cybersecurity A shared baseline – a minimum level of security – will make collaboration on construction projects easier and more consistent.

The solution could resemble occupational health and safety requirements in the industry. They are standardized and make it easy to know what applies.

Cybersecurity should be approached in the same way—not as something “extra,” but as an integrated part of quality and operations. If the industry can agree on a level, it will be a major advantage for the construction sector’s digital collaboration.

A “lightweight” version can cover less critical construction projects. This model could, for example, include measures such as multi-factor authentication, access management, system updates, and backup of critical data, while more critical construction projects (e.g., infrastructure) require stricter requirements.

Shared competencies for the industry A shared training program with basic modules for all project participants, combined with project- or company-specific modules, can create a common starting point.

Many contractors and consultants already use similar systems for occupational health and safety on construction sites, and cybersecurity can be incorporated in the same way.

7.0

47

Checklists What can an individual company do?

• Conduct a maturity assessment.

• Establish awareness training and campaigns.

• Implement multi-factor authentication across all relevant systems.

• Strengthen access control across networks and systems.

• Ensure continuous updating of software and devices.

What can the construction project do?

The most tangible solutions include: • Multi-factor authentication.

• Access control.

• Secure networks and segmentation.

• IoT/OT security.

At the same time, shared frameworks are crucial: Security must be embedded in the project’s culture, structure, and collaboration model. The project can set documentation requirements regarding maturity and security measures.

Key measures in the construction project: • Risk assessment for the project and construction site, continuously updated and clearly prioritized.

• ICT agreements that define responsibilities, roles, and governance.

• Ongoing follow-up and training, including procedures and preparedness that can be documented and updated.

8.0

Digital solutions you should keep an eye on The digital security landscape is constantly evolving, and it can be beneficial to keep an eye on digital solutions and companies that are continuously entering the market.

A selection of solutions addressing different needs is presented here.

These are examples of available solutions and should therefore not be interpreted as specific recommendations.

49

Skjoldet SagaLabs SagaLabs is a rapidly growing startup that offers realistic cybersecurity training under the mantra “Train as you fight.” In their self-developed training platform, they train everything from companies to public authorities in realistic, scenario-based attacks such as ransomware, insider leaks, and phishing.

The training is instructor-led by professionals from the cyber front line, ensuring strong handson learning, with exercises that are realistic and up to date.

SagaLabs originates from experienced professionals from the Danish Defence, with roots in cybersecurity and software development.

They combine technical insight with pedagogical strength and help organizations and authorities build strong and practically grounded cyber resilience.

SKJOLDET is a proactive line of defense that warns against fraud through a simple visual “shield” before you are deceived.

Skjoldet uses proactive artificial intelligence and algorithm-based detection that protects and warns in real time against phishing, fake competitors, fake webshops, and other scams directly on the site you are visiting, even if the threat was not previously known.

SKJOLDET can be used on the go, as it is a browser extension for all devices and browsers.

For private users, it is completely anonymous, and for organizations, it also enables visibility into whether employees are being exposed to fraud.

Criminals are constantly improving, but with SKJOLDET, users can see within seconds whether a site is fake.

What makes SKJOLDET unique is how proactively it protects users by delivering real-time alerts directly on the webpage before any information is entered.

vacy & AI mpliance made y! Privacy & AI Product 

Community 

Learn 

Compliance made is the automated easy! way of managing

endors, scaling your privacy efforts

Openli is the automated way of managing

ilding trust. customers yourLoved vendors,by scaling your privacyfor efforts

and building trust. Loved by customers for easy to use.

ok demo

being easy to use.

Book demo

Openli Openli helps screen vendors and digitally manage a company’s privacy settings.

The company also focuses on the ROPA, which stands for “record of processing activities,” a GDPR requirement consisting of a documented list of the company’s data processing activities.

Pricing

Log in

Try O

51

Cyber Security Tool​ Copenhagen Business Hub (Erhvervshus Hovedstaden, EHHS) offers small and mediumsized enterprises in the construction industry a “Cyber Check.” Through a series of initial questions, the company’s risk profile is identified in relation to its value chain.

The purpose is to provide a clear picture of where the company stands and which areas require attention. In addition, EHHS offers one-on-one consultations, where companies receive concrete guidance on how to best protect themselves against cyberattacks.

9.0

Conclusion Digitalization of the construction industry is an important tool for strengthening the sector in a more efficient and sustainable direction. It therefore remains a prerequisite in this analysis that efforts related to digitalization must be made more secure, not reduced.

This publication has described the specific challenges of the construction industry and pointed to concrete actions that can support secure digital collaboration in practice. It is not about making everything equally secure, but about working risk based and proportionally, focusing on what is most critical for the project’s progress, safety, and trust.

Secure digital collaboration should be seen in the same way as occupational health and safety, as an integrated part of the professional and project related work. By integrating security early, clarity is created regarding responsibilities, roles, and collaboration across actors, which helps reduce risk and at the same time strengthens productivity and cooperation.

The project “Secure digital collaboration in construction” has shown that there is a need for shared methods and tools in the industry.

The next step is for these initiatives to be anchored among key stakeholders and implemented more broadly. When digital security becomes a natural part of everyday practice, both trust, robustness, and quality in future construction projects are strengthened.

10.0

Ordliste

55

Information security Information security is a broad term for the set of measures implemented to protect information in terms of confidentiality, integrity (changes to data), and availability. The work includes, among other things, organizing security efforts, influencing behavior, processes for handling data, supplier management, and technical security measures.

IoT Internet of Things

BYOD Bring Your Own Device CDE Common Data Environment (fælles datamiljø) CER Critical Entities Resilience: An EU regulation that sets requirements for robustness and resilience among companies and organizations that deliver or support critical societal functions.

Cyber sercurity In this publication, cybersecurity refers to IT security for network-connected IT systems, as defined by the Danish Agency for Social Security (SAMSIK)15. Cyber security is part of the broader concept of information security.

DoS Denial of Service: An attack in which a system or digital service is overloaded, making it unavailable to legitimate users.

Hardening Security optimization of software

15

Ordforklaringer – centrale begreber i cybersikkerhed (A-Å)

IT security IT security concerns protecting information processed in IT systems (hardware and software) against unauthorized access, use, or modification16.

Legacy-systemer Outdated systems MDM Mobile Device Management: An IT solution used to manage and secure smartphones, tablets, and laptops used for work.

MFA Multi-Factor Authentication: This means verifying your identity in more than one way when logging in.

OT Operational Technology, such as cranes Ransomware A type of cyberattack where data or systems are locked or encrypted, and a ransom is demanded to restore access.

16

Hvad er informationssikkerhed? - SKI

ConTech Lab is the construction industry’s shared development platform, where companies in the sector can collaborate to develop and experiment with new ways of using data, digitalization, and technology to create the construction of the future, a more sustainable and productive industry.

ConTech Lab shares knowledge and learning, so the entire industry can benefit.

ConTechLab.dk