IT Support for ConstructionIT support for construction firms, from head office to the site cabin.
A construction firm's IT is spread across a head office, a handful of site cabins on temporary connections and dozens of phones and tablets in the hands of people who move between jobs. Payments go out every month to subcontractors and suppliers, which makes the accounts mailbox a target. We run the IT for construction firms: site devices managed and wipeable, drawings where everyone can find the current revision, payment fraud made harder, and Cyber Essentials ready for the next tender.
Who this is for
Small and medium-sized builders, main contractors, specialist trades, M&E contractors and housebuilders, with a head office and live sites, staff who change from job to job, and estimating and accounts on systems such as Sage, COINS, Eque2 or Causeway.
Invoice redirection and the monthly payment run
Construction pays a lot of people, often, and by bank transfer. Under the Construction Industry Scheme contractors verify subcontractors with HMRC and make deductions, so the accounts team handles a steady stream of invoices, statements and bank details. That is exactly the traffic invoice redirection fraud hides in: a supplier's or subcontractor's mailbox is compromised, and a convincing email arrives saying their bank details have changed just before the payment run.
On Microsoft 365, the technical controls are multi-factor authentication on every account, Conditional Access that blocks sign-ins from unmanaged devices, Defender for Office 365 tuned for lookalike domains and impersonation of your directors and regular suppliers, and alerts on mailbox forwarding rules. The process control matters just as much: any change of bank details is confirmed by phone to a number already on file, never one in the email. We set up the first and help you write down the second.
Site cabins, site staff and shared devices
Site offices run on 4G or 5G routers, Starlink or a temporary line, and get moved when the job does. We specify and configure the connection and Wi-Fi so it is ready when the cabin arrives, with the same security as head office and no shared password written on the wall. Site managers, supervisors and operatives use phones and tablets for drawings, photos, permits and timesheets; every one is enrolled in Intune, encrypted and wipeable, so a tablet left on a job is a remote wipe rather than a data breach.
Shared site tablets are set up so each person signs in as themselves, and staff turnover is handled properly: new starters have an account and a device ready before day one, and leavers lose access the day they go, with a record of both. With labour moving between firms and jobs, that is often the difference between a former employee who can still read the tender folder and one who cannot.
Drawings, CAD and BIM
AutoCAD and Revit models and large drawing sets do not behave like office documents. We set up SharePoint and Teams, or Google shared drives, with a structure per project, permissions for subcontractors and clients who need access, and sync that will not choke on a 400 MB model on a site connection. Where the files are too big or the software needs it, we keep a file server or a dedicated design workstation patched and backed up instead, and we tell you honestly which is the better fit.
We support systems such as Sage, COINS, Eque2 and Causeway: the installs, servers, backups and secure remote access. The software itself stays with your vendor, and we work with them when a problem crosses the line.
Tender questionnaires and Cyber Essentials
PQQs and tender documents now routinely ask about cyber security. For central government and NHS contracts that handle personal information or certain ICT systems, Procurement Policy Note 014 sets out when Cyber Essentials certification is required, and other public bodies and main contractors ask for it in their own supply chain questions. We hold Cyber Essentials ourselves and take construction firms through it as a fixed project, then keep the evidence current for the next bid.
The helpdesk works Monday to Thursday 08:45 to 17:00 and Friday 08:45 to 16:00, and our RMM monitoring and patching runs 24/7 with alerts raised to the helpdesk. Sites often start earlier than that. If you need an engineer on call outside office hours, that is an optional extra, not part of the standard price; speak to the team about what would work for your sites.
Source: PPN 014: Cyber Essentials scheme (GOV.UK), Cyber Essentials (NCSC)
On Google Workspace? Same protection, Google's controls
Many builders and contractors run on Gmail and Google Drive, and we support Google Workspace as fully as Microsoft 365. We give honest advice on which fits and do not ask you to move. For the accounts team and everyone else, we enforce 2-Step Verification on every account, with security keys or passkeys for admins, set Gmail's phishing, spoofing and malware protection along with SPF, DKIM and DMARC, and alert on suspicious sign-ins and on mail being forwarded outside the business, which is how invoice redirection usually starts.
Project folders live in shared drives with external sharing controlled, so subcontractors and clients see the jobs they are on and nothing else, and third-party app access is restricted. Site phones, tablets and laptops are managed through Google endpoint management or Intune on a standalone licence, so a lost tablet can still be wiped. Gmail, Drive, Calendar and Contacts are backed up outside Google and kept for seven years in the UK, as a separate per user service, and Cyber Essentials works the same on either platform.
What is included
Helpdesk and monitoring
Unlimited support answered by an engineer, Monday to Thursday 08:45 to 17:00 and Friday 08:45 to 16:00. Every device monitored and patched 24/7 by our RMM tooling, with alerts raised to the helpdesk.
Microsoft 365 or Google Workspace secured against payment fraud
On Microsoft 365, Business Premium with MFA for everyone, Conditional Access, Defender for Office 365 tuned for supplier and director impersonation, and mailbox forwarding rules monitored. On Google Workspace, 2-Step Verification enforced, Gmail phishing and spoofing protection set and alerts on suspicious sign-ins and forwarding.
Site devices managed
Phones, tablets and laptops enrolled in Intune or Google endpoint management, encrypted and wipeable, with shared site tablets set up for individual sign-in.
Site connectivity configured
4G, 5G, Starlink or fixed lines set up with secure Wi-Fi so a new cabin works on the day it arrives (connection costs are separate).
Drawings and project files
SharePoint and Teams, or Google shared drives, structured by project, external sharing controlled, CAD and BIM files handled sensibly, and any file server maintained.
Backup, tested
Microsoft 365 or Google Workspace, server and project data backed up outside the vendor, kept in the UK, restores tested every quarter with the result shown to you. Microsoft 365 and Google Workspace backup is a separate service, priced per user per month on top of support.
Joiners, leavers and tenders
Starters ready before day one, leavers closed down the same day, and Cyber Essentials evidence kept ready for PQQs and tender returns.
What is not included, and why
- Estimating, accounts and CAD licences. You buy those from the vendor or reseller; we make sure they run and are protected.
- Mobile data, Starlink and broadband contracts are separate, covered on the broadband and mobile page.
- On-call engineering outside office hours and the 24/7 Barracuda SOC are optional extras, priced separately.
What it costs
Managed IT support for construction firms is priced per user per month, with security monitoring and device management included, so it moves with your headcount. Microsoft 365 or Google Workspace backup is a separate service, also priced per user per month. Licences are extra at Microsoft's or Google's price: Microsoft 365 Business Premium is £16.90 per user per month at Microsoft's UK price. Onboarding, site connectivity, file migrations and Cyber Essentials certification are quoted as fixed projects. We quote after a short discovery call, once we know your setup.
How it starts
- 1Free IT Health CheckA short online check that benchmarks your security and business risk and tells you where you stand.
- 2Discovery callAn engineer, not a salesperson. What you have, what is broken, what it would cost to fix, in writing.
- 3OnboardingEverything moves across on a plan, with no gap in cover and nothing lost.
Questions people ask before signing
How do you stop invoice redirection fraud?
By making mailboxes hard to take over and impersonation easy to spot: MFA on every account, Conditional Access blocking unmanaged devices, impersonation protection tuned for your directors and regular suppliers, and alerts on forwarding rules. Pair it with one rule for the accounts team: bank detail changes are confirmed by phone to a number you already hold.
Can you set up IT in a new site cabin?
Yes. We configure the router, Wi-Fi and any printer before the cabin goes to site, so the site manager plugs it in and it works. The connection itself (4G, 5G, Starlink or a temporary line) is ordered and paid for separately.
Our site staff share tablets. Is that a problem?
Only if they share an account. We set shared tablets up in Intune so each person signs in as themselves, sees their own email and files, and leaves nothing behind for the next user. If a tablet is lost, it is wiped remotely.
A tender is asking for Cyber Essentials. Can you help in time?
Usually, depending on what needs fixing first, most often missing MFA, unsupported devices or admin rights on everyday accounts. We assess against the requirements, fix the gaps and then certify, as a fixed-price project. Tell us the tender deadline at the discovery call.
Can our drawings live in SharePoint or Google Drive?
Most can. Drawing sets, PDFs and most CAD files work well in SharePoint or Google shared drives with a project structure and sensible sync. Very large Revit models or software that needs a shared network drive may still be better on a server, and we say so rather than forcing everything into the cloud.
Our sites start at 7am. Is the helpdesk open then?
No. The helpdesk is open Monday to Thursday 08:45 to 17:00 and Friday 08:45 to 16:00, and monitoring and patching run 24/7 with alerts raised to the helpdesk. On-call engineering outside office hours is an optional extra, not in the standard price, so speak to the team if early starts need cover.
We use Google Workspace. Can you still look after us?
Yes. We support Google Workspace and Microsoft 365 and will not push you to switch. We enforce 2-Step Verification, set Gmail protection against spoofing and impersonation, alert on forwarding, control external sharing on project shared drives, manage site devices and back up Gmail and Drive outside Google. Cyber Essentials for tenders works the same on either platform.
How much does IT support cost for a construction firm?
Managed support is priced per user per month with security included, so it moves with your headcount. What changes the figure is the number of users and devices, any servers, the security options you choose and any specialist software. Backup is a separate per user service, Microsoft 365 or Google Workspace licences are at Microsoft's or Google's price, and projects such as onboarding are quoted as fixed pieces of work. We quote after a short discovery call, once we know your setup.