Start with how people and vendors connect to the site, then list the connected equipment and the software behind it. Temporary networks, many contractors and short project lives make construction different from a plant that runs for decades. Remote access paths and unknown software are the first two things worth inspecting.
This is a checklist drawn from public guidance, not an account of a particular incident. The sources we fetched did not include a construction specific case, so none is described.
Why is a construction site different?
A plant has a stable network and a known team. A site has crews who change monthly, trade contractors who bring their own laptops, and equipment that arrives, runs and leaves. Security responsibility is spread between a general contractor, subcontractors, equipment suppliers and, later, the owner.
The ISA/IEC 62443 series is helpful here because it assigns requirements by role. It names asset owners, product suppliers, integrators and service providers, and describes shared responsibility as an essential building block of automation cybersecurity. It also lists building automation among the sectors it applies to. On a build, the integrator who commissions building systems is often the party who can change them, so that is a contract conversation.
What is in scope for a site?
NIST SP 800-82 Revision 3 is the guide to operational technology security. Its scope includes building automation, physical access control, and physical environment monitoring and measurement, next to industrial control systems. That list reads like a modern building: access control readers, ventilation and lighting controls, fire and life safety interfaces, and cameras.
CISA's industrial control systems page offers guidance by role, including a CISA and FBI fact sheet on working with third party ICS integrators. If a contractor will configure systems for you, that fact sheet is a useful starting point for what to ask and what access to grant.
What do you inspect first?
Go in this order, because each step narrows the next.
1. Remote access. Who can connect from outside the site, with which accounts, and through which tool? Shared logins to a vendor portal and always on support tunnels are the usual surprises. Remove what is not needed this month.
2. The list of connected things. Cranes with telematics, survey equipment, site cameras, temporary access control, environmental sensors and the site office network. You cannot protect a device you do not know exists. A spreadsheet is fine to start.
3. The software behind each item. Ask suppliers for a software bill of materials. CISA calls an SBOM a nested inventory, a list of ingredients that make up software components. Even a partial answer tells you who has a process and who does not.
4. Network separation. Is the guest or contractor Wi-Fi on the same network as access control or building controls? Separate them before systems are commissioned, because moving them later is harder.
5. Default and shared credentials. Commissioning tools often ship with defaults. Check that they are changed before handover, not after.
6. Update and support terms. For each system, who patches it, how fast, and until when? Put it in writing before the site closes out.
What gets forgotten at handover?
The temporary pieces. Commissioning laptops, contractor accounts and vendor remote tools often outlive the project. Make account removal and tunnel shutdown line items on the handover checklist, with a named person to sign them off.
Also hand over the inventory. The owner who inherits building systems should receive the device list, the software component lists and the support terms, not only the as built drawings.
Where does software supply chain work fit?
Any custom software on a project, such as dashboards that read sensor data or integrations between scheduling and access control, has dependencies. Safeguard can generate SBOMs for code you own and check them for known vulnerabilities and reachability. For vendor firmware you do not control, the lever is the contract and the SBOM request.
What to do
- Map every remote access path and remove the unnecessary ones.
- Build a list of connected equipment and name an owner for each.
- Request SBOMs and patch terms from each supplier.
- Keep contractor and guest networks apart from building controls.
- Change default credentials before commissioning is signed off.
- Add account and tunnel removal to the handover checklist.
- Hand the inventory to the owner with the drawings.
Quick check
Why start with remote access?
It is the main route into site systems for people you cannot see, and removing unneeded access is fast and cheap.
Do building systems count as operational technology?
NIST SP 800-82 Revision 3 includes building automation and physical access control in its OT scope.
Who is responsible for securing site systems?
Several parties. ISA/IEC 62443 splits requirements among asset owners, suppliers, integrators and service providers, so contracts should say who does what.
Sources
- NIST SP 800-82 Rev. 3, Guide to Operational Technology (OT) Security
- CISA: Industrial Control Systems
- ISA/IEC 62443 series of standards
- CISA: Software Bill of Materials
Last reviewed: 18 October 2026.
