Ask each supplier for a bill of materials covering software and firmware, a named contact for vulnerability notices, and a stated update process, and record the answers in a fleet register. Start with machines that connect to a network or carry a telematics unit, since those are the ones an outsider could reach.
Why does a construction firm need this?
A site can run owned machines, rented machines, subcontractor equipment and a mix of ages, all with embedded controllers and some with connectivity. Each contains software written by someone else. If a flaw is published in a component used by one of them, you want to know quickly whether you have it.
NIST's guide to operational technology security describes OT as programmable systems and devices that interact with the physical environment, and frames security as balancing performance, reliability and safety. NIST SP 800-161 adds that organizations worry about acquired products that could hide malicious features, be counterfeit or be weak through poor development practices, and that these risks come from limited visibility into how technology is built. A bill of materials is how you regain some of that visibility.
We are not citing any specific construction equipment incident. We did not find a confirmed primary source for one.
What goes in a fleet register?
One row per machine, kept in a spreadsheet to start.
| Field | Why it matters |
|---|---|
| Owner or renter, and contract end date | Tells you who can update it and for how long |
| Make, model, serial | Needed to match vendor advisories |
| Controller and telematics unit models | These often run separate software |
| Software and firmware versions | The base fact for any flaw lookup |
| Network connections | Cellular, Wi Fi, Bluetooth, wired, or none |
| Who can connect remotely | Vendor, dealer, rental company, you |
| Supplier vulnerability contact | Where to ask when news breaks |
| Bill of materials received (date) | Blank means you still need to ask |
Fill in what you can see, and mark the rest unknown. An honest gap is useful. It tells you what to ask next.
What should the contract say?
Whether buying, renting or subcontracting, add five requests. Legal should word them.
- A machine readable bill of materials for software, and an equivalent for hardware and firmware where available. CISA describes an SBOM as a nested inventory of software components, and CycloneDX describes a hardware bill of materials for IoT, ICS and other embedded devices that includes associated firmware.
- Statements about whether known flaws affect the product. CISA describes VEX as an attestation about whether a product is affected by known vulnerabilities.
- A named vulnerability contact and a notification timeline.
- A documented update process, including who performs it and how a failed update is reversed.
- A list of remote access paths the supplier or dealer uses, with a way for you to switch them off.
If you sell or operate in the EU, note the Cyber Resilience Act applies to products with digital elements. The Commission says manufacturers must handle vulnerabilities across the lifecycle, report actively exploited vulnerabilities from 11 September 2026, and meet main obligations from 11 December 2027. Which of your machines count is a question for the manufacturer and your lawyer.
What about rented machines?
You will not control updates, but you can still ask. Before accepting a delivery, request the same contact and remote access answers from the rental company, and record the software versions on the day of delivery. If a flaw is announced during the rental, you then know whom to call.
What are the limits?
Asking does not guarantee an answer, and a list does not prove a machine is safe. Treat the register as a way to see where you are blind, then reduce that blindness machine by machine. Physical site safety rules stay in force regardless of any software finding.
Where your own office teams build software, such as site apps or integration scripts, a tool like Safeguard can generate an SBOM for that code and match it to known vulnerabilities. It does not produce bills of materials for machines you do not own the software for.
What to do
- Create the fleet register for your 10 most connected machines.
- Fill in versions and connections from what you can read on the machine and its documentation.
- Send the five requests to those suppliers.
- Add the requests to your next rental and purchase terms.
- Set a calendar check for the CRA dates if you sell in the EU.
- When a vendor notice arrives, find the affected rows within a day and record your decision.
- Review the register every quarter and when machines join or leave a site.
Quick check
Do we need an IT team to start?
No. A spreadsheet and a standard set of questions to suppliers is enough to begin. Bring IT in for network connected machines.
What if a supplier refuses to share a list?
Record the refusal in the register, ask for a VEX style statement on specific flaws instead, and weigh it in the next purchase decision.
Sources
- NIST SP 800-82 Rev. 3: Guide to Operational Technology (OT) Security, fetched 18 October 2026
- NIST SP 800-161 Rev. 1, fetched 18 October 2026
- CISA: Software Bill of Materials, fetched 18 October 2026
- CycloneDX: HBOM capability, fetched 18 October 2026
- European Commission: Cyber Resilience Act, fetched 18 October 2026
Last reviewed: 18 October 2026.
