The Unseen Substructure: Putting Cyber Readiness on the US Project Delivery Clock

On a US transit extension, a data center campus, or a bridge replacement, the most consequential infrastructure is no longer only concrete and steel. It is also the temporary network that moves survey data, the cloud platform that tracks pay applications, the telematics unit on a tower crane, and the vendor laptop that reaches into a building automation system. Each is part of the delivery system. Each can become an entry point.

That reality has not yet changed how many US programs are governed. Cybersecurity is still frequently assigned to an information technology department, addressed through a corporate policy, or deferred until turnover. On a megaproject, that approach leaves a gap between the project execution plan and the systems that actually run the work. A ransomware event that locks project controls, a compromised subcontractor credential, or a spoofed sensor reading can stop a Pour, trigger rework, or compromise site safety. The delivery consequence is immediate, even when the data loss is not.

Cyber risk is a construction risk

The first step is to stop treating cyber incidents as an abstract corporate exposure. On a active jobsite, the operational technology estate is broad and improvised. It includes programmable logic controllers at batch plants, networked access-control readers, environmental monitoring, fuel-management systems, laser scanning equipment, and the Wi-Fi that supports field crews. Much of it is installed temporarily, maintained by vendors, and connected to the internet through cellular gateways that were never part of a formal architecture.

Owners and contractors do not need to become intelligence agencies. They do need to recognize that a cyber event can present as a schedule event, a safety event, or a quality event. A project controls platform that is unavailable for a week is not merely an inconvenience; it can freeze progress payments, obscure cost trends, and push decision-making back to spreadsheets. A compromised vendor account with access to commissioning software can alter settings in ways that are difficult to detect before energization.

Contract language that makes expectations enforceable

A cyber baseline begins in the agreement. Security requirements that live only in an appendix or a corporate policy are difficult to enforce when a subcontractor is under schedule pressure. The project’s contract should define minimum controls, incident notification timelines, audit rights, and the obligation to participate in exercises. It should also flow down to lower-tier vendors that touch project systems.

Useful provisions include a requirement to maintain an asset inventory for connected equipment, restrictions on default credentials, patching service levels for exposed systems, and a right to review network diagrams before commissioning. The contract should clarify data ownership and return obligations, require multifactor authentication for remote access, and establish a single project contact for cyber incidents. Insurance requirements and indemnity language deserve the same scrutiny as other delivery risks, but they are not substitutes for operational controls.

Segment the temporary network like permanent infrastructure

The project network should be designed with the same intentionality as the permanent facility. That means separating information technology from operational technology, isolating vendor networks, and restricting traffic between construction management systems and control systems. Flat networks are convenient during mobilization and dangerous during delivery.

A practical baseline includes dedicated project virtual local area networks, allowlisted connections where feasible, monitored jump hosts for remote administration, and multifactor authentication for all privileged access. Cellular gateways and wireless access points should be inventoried and secured, not left with vendor defaults. Commissioning networks should be separated from production networks and decommissioned or transferred under a documented plan. None of this is exotic; it is the digital equivalent of fencing, signage, and controlled site access.

Vendor access is a supply-chain control

Most project cyber incidents do not begin with a sophisticated attack on the owner. They begin with a credential. A controls vendor, a surveying firm, a scheduling consultant, or a crane supplier may need remote access to perform legitimate work. The question is whether that access is known, approved, limited in time, and logged.

A vendor access register is a simple but powerful tool. It should identify who has access, to which systems, under what approval, and for how long. Just-in-time access, session recording, and least-privilege accounts reduce exposure. Subcontracts should require the same discipline from lower-tier firms. The goal is not to block vendors; it is to make their access visible and revocable.

Rehearse the bad day before it happens

Incident response plans that sit in a binder are not delivery controls. The project should run tabletop exercises that include construction leadership, safety, scheduling, procurement, legal, communications, and key vendors. Scenarios should be project-specific: a ransomware attack on the project controls platform during a pay cycle, a compromised account at a commissioning vendor, or a network outage that disables access control at a remote gate.

The exercise should test roles, contact trees, decision authority, and recovery time objectives. It should also test the relationship between cyber response and stop-work authority. If a control system may have been compromised, who can halt work? How is the workforce notified? What offline copies of schedules and drawings are available? These questions belong in the same readiness reviews as safety drills and schedule recovery planning.

Verify at commissioning, not after turnover

Cyber readiness should be a commissioning gate. Before systems are accepted, the project team should verify the asset inventory, network diagrams, patching status, authentication controls, backup restoration, and removal of temporary accounts. The turnover package should include the incident response plan, access records, and a clear schedule for transferring responsibility to the operations team.

When cyber verification is deferred until after occupancy, the project inherits unknown risk at the worst possible moment. When it is built into commissioning, it becomes another measurable condition of readiness, like pressure testing or energization.

US infrastructure programs in 2026 cannot separate digital resilience from physical delivery. The jobsite is now an attack surface, and the project schedule is exposed to it. Owners and contractors that place cyber readiness alongside safety and schedule reviews will not eliminate every threat, but they will reduce the chance that a preventable digital incident becomes a construction crisis.