Software supply chain risk becomes a safety risk on a construction site when software controls or monitors something physical: a crane, a hoist, a gate, a sensor that triggers an alarm. The same question applies as elsewhere, what is inside and who maintains it, but the cost of a wrong answer is higher.
Is this a documented problem or a hypothetical one?
We looked for a construction specific standard or incident record we could verify and did not find one to cite, so this article does not describe incidents or name a construction standard. What we can anchor to is general guidance for operational technology (OT). NIST SP 800-82 Rev. 3 defines OT broadly as programmable systems and devices that interact with the physical environment or manage devices that do. Its examples include industrial control systems, building automation systems, transportation systems, physical access control systems and physical environment monitoring systems. A modern site can include several of those.
NIST says securing OT must address its unique performance, reliability and safety requirements. That is the right frame for a site: security measures cannot be allowed to make equipment behave unpredictably.
Where does software hide on a site?
- Machine control units and telematics modules in cranes, excavators and lifts.
- Site access control, cameras and alarm systems.
- Temporary power, environmental and structural monitoring sensors.
- Tablets and laptops used by crews to configure machines or read drawings.
- Contractor and subcontractor remote support tools.
- Cloud platforms that collect machine data and send commands back.
Each includes open source and third party components that neither the contractor nor the site owner selected. A vulnerable library in a telematics module is the same kind of problem as in a web server, with a different response plan.
What changes when people could be hurt?
Three habits shift.
Separate safety functions from connectivity. Equipment that protects people, such as limit and emergency functions, should not depend on a network connection or a cloud service being available and correct. Confirm with the manufacturer how that separation is done, and ask in writing.
Patch with the manufacturer, not around them. Updating firmware on machinery without the maker's guidance can alter behavior. Ask for advisories, supported update paths and a contact who answers.
Assume many parties. A site has owners, general contractors, specialist subcontractors and rental firms. Decide who is responsible for security updates on each device, in the contract, before work starts.
How do I start without a big program?
Treat it like any inventory problem. List what is connected, who supplies it, and how it is updated. Ask each supplier two questions: do you provide a software bill of materials, and how do I report or hear about a vulnerability? Then put the answers in one sheet. Gaps in that sheet are your priority list.
What to do
- List every connected machine and system on a project, with supplier and software version.
- Ask each supplier for an SBOM and a vulnerability contact, and record the reply.
- Identify which functions protect people and confirm how they are isolated from remote connectivity.
- Assign responsibility for updates and remote access in subcontracts.
- Remove or disable remote support paths that are not in use, and log those that are.
- Keep a plain language incident plan that tells crews what to do if a machine behaves unexpectedly, which starts with stopping work safely.
- Review OT guidance such as NIST SP 800-82 for ideas, noting that it is not construction specific.
Quick check
Is there a construction industry standard for this?
We did not find one we could verify for this article. General OT guidance such as NIST SP 800-82 is the best anchor we can cite. Check with your industry body and insurer for current requirements.
Who is responsible when a subcontractor's machine is vulnerable?
That is a contract question. Decide it before work begins and write it into the agreement.
Sources
- NIST SP 800-82 Rev. 3, Guide to Operational Technology (OT) Security
- CISA, Software Bill of Materials (SBOM)
Last reviewed: 18 October 2026.
