Cyber insurance for construction contractors: what carriers require in 2026

Construction didn't used to think of itself as a cyber target: no card data, no medical records, half the crew's "endpoint" is a tablet in a truck. Attackers disagree, for one simple reason: construction moves large sums of money on emailed instructions, on schedules everyone can see. A progress payment redirected to a fraudster's account is worth more than most data breaches, and it only takes one convincing email to a bookkeeper.

Carriers price accordingly. Here's what a contractor should have in place before filling out a 2026 cyber application. The standard list first, then the parts that are sharper for construction.

The standard seven still apply

Everything in the core requirements list applies to a contractor like any other business: enforced MFA on email, remote access, and admin accounts; EDR on the machines that run the office; automatic, tested, offline-capable backups (your estimating data and project files are ransom targets); patching with no end-of-life systems; documented security training; and a written, tested incident response plan.

If the back office runs on Microsoft 365 plus an accounting package plus a project-management SaaS, most of that list is configuration and paperwork rather than new spending.

The contractor-specific center of gravity: payment controls

The claims data is unambiguous. Business email compromise and funds-transfer fraud drive 58% of incidents in Coalition's 2026 report, and construction's payment patterns are the textbook setup:

• Big, irregular payments (progress draws, retainage releases, material deposits) where an unusual amount doesn't look unusual.
• Long payment chains (owner to GC to subs to suppliers) where everyone emails everyone, and one compromised mailbox anywhere in the chain can inject "updated" bank details.
• Public project visibility (permits, bid results, signage) telling attackers exactly who owes whom, roughly how much, and when.

The control that neutralizes this is embarrassingly analog: a written funds-transfer verification procedure. Any change to bank details, and any unusual or urgent payment request, gets verified by phone at a number you already had (never one from the email) before money moves. No exceptions, including for the boss's own emailed instructions (attackers impersonate owners more than anyone). Train every person who can initiate a payment; keep the one-page procedure with your policies.

Some carriers ask about this procedure explicitly, and full funds-transfer-fraud coverage terms can depend on it. It's also the rare security control that costs literally nothing.

Field realities carriers will ask about

Shared logins. One "office@" login used by five people fails the access-control questions and makes incident investigation impossible. Individual accounts, MFA on each.

Personal devices on job sites. Foremen approving invoices from personal phones is normal. An application-honest answer requires at least a basic mobile/BYOD policy: screen lock, ability to remove company email from a lost phone, no sideloaded apps on devices that touch payments.

Subs and vendors in your systems. If subs submit through your project portal or a vendor remotes into your estimating server, that's third-party access; carriers ask how you vet it. A one-page vendor inventory plus security language in subcontracts covers the question at contractor scale.

The prequalification bonus

Here's the part that turns compliance into revenue: GCs and owners increasingly push cyber questionnaires down the chain during prequalification, because their carriers ask about their subs. A contractor who can hand over a written policy pack (MFA policy, payment verification procedure, IR plan, training log) clears prequal questions that stall competitors. The same documents answer the insurance application and the GC's questionnaire.

Five minutes on the free Readiness Check will show you where a contractor's application would stand today, and the Readiness Pack includes the funds-transfer verification procedure and every policy above, mapped to the questions carriers ask.