Construction Cybersecurity in Canada: Jobsite Wi-Fi, Devices and Data

Construction cybersecurity comes down to four controls: a segmented jobsite network, managed devices with multi-factor authentication (MFA), tested offline backups, and a written incident plan. Contractors hold bid pricing, payment details, drawings and subcontractor access, and they work across trailers, tablets and temporary networks. That combination makes them a profitable target. Ransomware is the top cybercrime threat facing Canada’s critical infrastructure, and a stalled project costs money by the hour.

This guide covers what to protect, how to set up jobsite Wi-Fi, how to secure phones, tablets and laptops, which Canadian obligations apply after a breach, and the order in which a small contractor should act.

TL;DR

• Separate jobsite Wi-Fi into a staff network and a guest/IoT network, and use a corporate VPN whenever staff connect from an unmanaged network.
• Turn on MFA for email, Microsoft 365 and banking first. Business email compromise targets payments and change orders.
• Keep backups offline or immutable and test a restore. Backups decide whether ransomware is an inconvenience or a shutdown.
• Write an incident plan before you need it: who calls whom, who isolates devices, who notifies clients and regulators.
• Under PIPEDA, record every breach for 24 months and report those that create a real risk of significant harm.

Table of Contents

• Why construction companies are targeted
• What to protect first
• Jobsite Wi-Fi: how to set it up safely
• Securing phones, tablets and laptops on site
• Protecting project data, email, payments and subcontractor access
• Canadian obligations after a breach
• An incident plan for a small contractor
• Where to start: a 30-day order of work
• Perspective: security has to travel to the jobsite
• How we can help
• FAQ
• Sources

Why construction companies are targeted

A general contractor is a hub. It connects owners, architects, engineers, trades, suppliers and lenders, and each connection is a route in. Attackers do not need to defeat the contractor’s firewall if a subcontractor’s mailbox is already compromised and a convincing invoice arrives from a known address.

Three factors raise the stakes:

• Time pressure. Schedules are tight, so a locked file server or a frozen scheduling tool has a direct daily cost. Attackers know this and price ransom demands accordingly.
• High-value transactions. Progress draws, deposits and change orders move large sums on short notice. That is what makes payment-redirection fraud work.
• Informal IT. Many small and mid-sized contractors rely on a part-time helper or a vendor who set things up years ago. Patching, offboarding and access reviews slip.

The Canadian Cyber Centre notes that threat actors are adapting their tactics to increase financial rewards and target high-value data, and are using new technologies such as AI. Newer infostealer malware, for example, has been reported to rank victims by what they are worth, which means a firm with valuable project and payment data is sorted toward the top of the list. Our own overview of why Canadian businesses are being targeted by ransomware covers the broader pattern.

The threats you will actually see

For a wider catalogue, see our guide to types of business cybersecurity threats.

What to protect first

Not all data deserves equal effort. Rank it by the damage if it is stolen, altered or unavailable for a week.

1. Email and identity. The mailbox is the key to password resets, invoices and client conversations. Protect it first.
2. Financial systems. Accounting, payroll, banking portals and any system that stores payment details.
3. Bid and estimating data. Pricing, margins and subcontractor quotes. A leak here hands competitors your numbers.
4. Project documents. Drawings, BIM models, contracts, RFIs and submittals, plus the cloud platform that shares them with outside parties.
5. Personal information. Employee records, client contact details and anything covered by privacy law.
6. Operational technology and cameras. Site cameras, access control and connected equipment, which are rarely patched.

A practical start is an inventory. The Cyber Centre’s guidance tells organizations to inventory hardware and software and apply basic hygiene (MFA, updates and backups). You cannot protect a laptop nobody remembers issuing.

Jobsite Wi-Fi: how to set it up safely

Temporary site networks are where convenience tends to beat security. A trailer router with the default password, shared with every trade, puts your project laptop on the same network as a visitor’s phone.

Separate the networks

The Cyber Centre’s Wi-Fi guidance recommends a guest network for IoT and guest devices, separated from staff and wired networks. On a jobsite that translates into:

• Staff network: company laptops and managed tablets only, with a strong passphrase and WPA3 where the hardware supports it.
• Guest network: subcontractors, inspectors, visitors and personal phones. No route to the staff network or office resources.
• IoT network: cameras, sensors, time clocks and trackers, isolated from both.

Change the router’s administrator credentials on day one, and update its firmware before it goes on site. Retire shared passphrases when a trade finishes, so the key does not outlive the contract.

Use a VPN for company resources

When staff reach company files from a trailer network, a client’s guest Wi-Fi or a hotel, the same guidance says to use a corporate VPN that creates an encrypted tunnel, and to avoid free or public VPN services that do not vet their infrastructure. A consumer VPN app from an app store is not a substitute for a company-managed connection.

Change IoT defaults

Government of Canada guidance for small and medium businesses says to change default usernames and passwords on IoT devices and consider separate networks for them. Site cameras are the usual offender: installed in an afternoon, never touched again.

A jobsite network checklist

• Router admin password changed, firmware current
• Three SSIDs: staff, guest, IoT
• No shared passphrase carried from the last project
• VPN required for company file access
• Cellular backup if the site depends on the connection for cloud-based drawings
• A named person who decommissions the network at project close

Securing phones, tablets and laptops on site

Devices on a jobsite are dropped, left in trucks and shared between crews. Treat them as likely to be lost and make sure a loss is a nuisance, not a breach.

• Enrol every device in management. Company-owned and personal devices that open company email should be enrolled so you can enforce a screen lock, push updates and wipe remotely.
• Encrypt storage. A lost encrypted laptop is a hardware problem. A lost unencrypted one may be a reportable breach.
• Require MFA on every cloud app. Drawings platforms, Microsoft 365, accounting and banking.
• Limit local data. Work from the cloud where possible so a stolen tablet holds little.
• Patch on a schedule. Operating systems and apps, including the field apps crews install themselves.
• Use endpoint protection with monitoring. Antivirus alone does not tell anyone when a laptop starts behaving strangely at 2 a.m.
• Offboard fast. When a foreman or subcontractor leaves, remove accounts and wipe company data the same day.

Shared tablets are worth a special mention. A shared login means no audit trail and no way to tell who opened a file. Give each person a named account, even if the device is common.

Protecting project data, email, payments and subcontractor access

Payments and email

Business email compromise rarely involves malware. It involves a believable message. Build process into the payment step:

• Any change to banking details is confirmed by phone, using a number already on file, never one in the email.
• Two people approve payments above a threshold you set.
• Turn on MFA and review mailbox forwarding rules, since attackers often hide a rule that copies incoming mail.
• Flag external senders in the subject line or banner.

Project platforms and subcontractors

Give outside parties access to the project folder, not the whole file server. Use named accounts with expiry dates, and review who still has access at each milestone. Require subcontractors with access to use MFA, and put that requirement in the contract. A trade partner with weak security becomes your problem the moment their account can open your drawings.

Backups that survive ransomware

The Cyber Centre advises a defence-in-depth approach built on MFA, regular patching and offline backups. Backups connected to the network can be encrypted along with everything else, so keep a copy that attackers cannot reach and test restores. Our guides explain immutable backups, the 3-2-1-1-0 backup rule and OneDrive’s restore window for teams on Microsoft 365.

Canadian obligations after a breach

Obligations depend on where you operate and what data you hold. Many private-sector construction firms fall under the federal Personal Information Protection and Electronic Documents Act (PIPEDA), while Alberta, British Columbia and Quebec have their own private-sector privacy laws, and public-sector or health-related work can add requirements. Confirm your situation with a privacy lawyer.

Under PIPEDA, the breach rules require reporting any breach of security safeguards where it is reasonable to conclude there is a real risk of significant harm. Organizations must also keep records of all breaches for 24 months, including those below the reporting threshold. Employee records and client data are personal information, so a ransomware incident that exposes them is the kind of event that needs assessment.

Contracts matter too. Owners, lenders and public bodies increasingly add security and incident-notification clauses to tenders. Read them before you sign, and make sure your insurer’s cyber policy conditions (often MFA and backups) are actually met.

An incident plan for a small contractor

The Cyber Centre recommends an incident response plan covering detection, response and recovery. On one page, yours should name:

1. Who decides. One owner of the incident, with a backup.
2. First actions. Isolate affected devices from the network, preserve evidence and avoid wiping machines before you know what happened.
3. Contacts. Your IT provider, insurer, lawyer and bank, with after-hours numbers printed and stored offline.
4. Communications. Who tells clients, owners and subcontractors, and when.
5. Recovery order. Email and identity, then accounting, then project systems.
6. Regulatory assessment. Who evaluates the real-risk-of-significant-harm test and keeps the breach record.

Rehearse it once a year. A 30-minute tabletop exercise with the owner, the office manager and your IT provider exposes most gaps. If you are already in the middle of an attack, see emergency ransomware recovery.

Where to start: a 30-day order of work

A structured review helps here. Our cybersecurity audit checklist and the article on layered security to prevent data breaches give you the questions to ask.

Perspective: security has to travel to the jobsite

Most contractors we speak with have a decent office network and an improvised jobsite one. Attackers do not distinguish between the two. They go where the controls are thinnest, and a trailer router or a shared tablet is often exactly that.

Our approach is cybersecurity-first: we design the environment to prevent a breach and downtime, then manage the day-to-day IT around it. For a contractor, that means monitored endpoints, managed Microsoft 365 with MFA, backups built for recovery, and a response plan someone has actually rehearsed. Our team is Microsoft-certified, support is available 24/7, and our average response time is under 30 minutes.

We would rather a client call us about a suspicious invoice at 6 a.m. than about an encrypted server at 9. Prevention is cheaper, and it keeps crews working.

247techify Team

How we can help

If you would rather not run this yourself, 247Techify provides managed IT with a cybersecurity-first approach for Canadian businesses: 24/7 helpdesk, threat monitoring, endpoint protection, Microsoft 365 management, backup and disaster recovery, and incident response. Business managed IT plans are published at $1,099 to $2,499 CAD per month on our GTA managed IT price index, and for smaller needs, pay-per-ticket support is $79 per ticket on our pricing page.

For monitoring and response, see our cybersecurity services, including Managed Detection & Response and Penetration Testing. Toronto-area firms can start with managed IT services in Toronto.

FAQ

What is the biggest cyber risk for a small construction company?

Business email compromise and ransomware are the two most common routes to serious loss. Email compromise redirects payments, and ransomware halts project systems. MFA, payment verification and tested offline backups address both.

How do I secure Wi-Fi on a construction site?

Separate staff, guest and IoT devices onto different networks, change the router’s default credentials and keep its firmware current. Staff should use a company VPN to reach company resources over any unmanaged network.

How do I protect tablets and phones that crews share?

Enrol them in device management, encrypt storage, require MFA and give each person a named account. Enable remote wipe so a lost device does not become a data breach.

Do I have to report a cyber incident in Canada?

Under PIPEDA, you must report breaches that create a real risk of significant harm and keep records of every breach for 24 months. Provincial laws may differ, so confirm your obligations with a privacy lawyer.

Sources

• Ransomware playbook (ITSM.00.099), Canadian Centre for Cyber Security
• Ransomware Threat Outlook 2025-2027, Canadian Centre for Cyber Security
• Wi-Fi Security (ITSAP.80.002), Canadian Centre for Cyber Security
• The Internet of Things Toolkit for Small and Medium Businesses, Get Cyber Safe
• Complying with PIPEDA’s new breach reporting rules, LexisNexis Canada

Recommended

• WiFi Site Surveys in Canada: 3 Key Moments, Security, and Sign Off
• This Quarter, Prevent Data Breaches in Canada With Layered Security
• 4 Core Components for Secure Small Office Network Design in Canada
• Cut Risk: Measurable Security Awareness Topics for Canadian Firms