For construction and contracting businesses
Cyber insurance for construction contractors
The short answer
Contractors answer the standard cyber insurance questions plus sharper ones about payment verification, because large progress payments moving through long chains of general contractors, subs and suppliers are the ideal conditions for wire fraud. Carriers also ask about project data and about the access your field staff and vendors hold.
What's different about construction and contracting businesses
The money is the target, not the data. A contractor's email holds pay applications, lien waivers and banking details for a dozen counterparties, and the payments are large, scheduled and expected. An attacker doesn't need to encrypt anything to profit. They just need one convincing message about changed bank details at the right moment in a draw cycle.
There's also a scheduling problem that makes contractors easier to fool. Payment instructions genuinely do change: a sub switches banks, a factoring company gets involved, an owner's title company takes over disbursement. Because legitimate changes happen, a fraudulent one doesn't look absurd, and the person approving it is usually working from a truck between two sites.
Your attack surface includes other people's offices. Work flows through general contractors, subcontractors, suppliers and sometimes an owner's representative, most of them small businesses with their own email hygiene. Compromise anywhere in that chain produces a message that looks entirely legitimate to you.
Project data is quietly valuable too. Bid pricing, drawings, schedules and change-order history sit in email and shared folders, and losing access to them mid-project stops work as effectively as losing a crew. Contractors tend to discover their backup situation is worse than assumed at exactly the wrong moment, which is why the restore-test question is worth taking seriously before an underwriter asks it.
Field operations complicate the controls. Project management platforms accessed from trucks and trailers, shared tablets, personal phones with company email, and staff who come and go with the project calendar. Carriers ask about remote access and offboarding for exactly these reasons.
What already applies to you, before any insurer asks
These aren't insurance requirements. They're obligations that exist whether you buy a policy or not, and the paperwork they call for is most of what an application wants to see.
Contract flow-downs
Owners and general contractors increasingly push security and insurance requirements into subcontracts, so your obligations may come from a contract rather than a statute. Read the cyber clause before you sign it, because it can require controls your current setup doesn't have.
State breach-notification laws
You hold employee records, and on residential work sometimes homeowner details, which brings notification duties if they're exposed. Payroll data is the usual trigger, because it contains the identifiers that make notice mandatory.
Owner and prime-contractor security requirements
Public work and larger private projects increasingly attach security language to the contract: minimum insurance limits naming cyber, sometimes specific controls, occasionally a notification window measured in hours. If you work for anyone in a regulated industry, expect their obligations to flow downhill to you.
General information, not legal advice. Whether a rule applies to your business turns on facts we don't know about it, so confirm with your own advisor.
The questions carriers weight hardest here
Every application covers the same ten control areas. All of them are written out here. These are the ones an underwriter reads twice for construction and contracting businesses.
Before changing bank details or sending an unusual payment, do you verify by phone using a known number?
Why it's weighted here: Progress payments and changed banking details are the loss carriers see most often in this trade.
If the answer is no: Institute the call-back rule today and tell every person who can move money. It's free and it prevents the most frequent claim type outright.
Your written evidence: Funds-Transfer & Payment Verification Procedure, The verification steps
What protections sit in front of your business email?
Why it's weighted here: The fraud arrives by email from a real counterparty's compromised mailbox, so filtering and anti-spoofing matter.
If the answer is no: Move email to Microsoft 365 or Google Workspace if self-hosted; enable their anti-phishing protections and SPF/DKIM/DMARC.
Your written evidence: Email Security Policy §3 Technical protections (enabled and verified)
Is MFA required for remote access (VPN, remote desktop) and administrator accounts?
Why it's weighted here: Field access to project systems from anywhere is normal, and unprotected remote access is a hard stop for underwriters.
If the answer is no: Inventory every remote entry point (VPN, RDP, remote-support tools) and privileged account; enforce MFA on each or shut it off.
Your written evidence: Remote Work Policy §2 Approved remote access methods + Access Control & Account Management Policy §4 Administrative access
Do you review the security of vendors who access your systems or data?
Why it's weighted here: Subs and suppliers touch your project data, and their compromise becomes your incident.
If the answer is no: Start with the inventory: every vendor with system or data access, what they touch, and whether they have MFA. Ten vendors, one page, one hour.
Your written evidence: Vendor & Third-Party Risk Policy §3 Before we sign: proportionate diligence
Evidence to have ready
- Your written call-back procedure for any change to payment or banking details, with the dollar threshold that triggers a second approver
- Evidence the rule is known: a signed acknowledgment from whoever processes payments
- A list of project systems reachable from outside the office, and how each one is protected
- Access removal records for staff who rolled off a project
The written half of that list is what the Readiness Pack is: Funds-Transfer & Payment Verification Procedure, Email Security Policy, Remote Work Policy, Vendor & Third-Party Risk Policy, each personalized to your business and mapped to the question it answers.
Common questions
We don't hold customer credit cards. Why would we need cyber insurance?+
Because the loss that actually hits contractors is money leaving your account, not card data leaving your servers. Funds-transfer fraud and business email compromise drive a large share of small-business cyber claims, and a single diverted progress payment can exceed a year of premium.
Our GC is asking for proof of cyber coverage. What do they want?+
Usually a certificate showing limits that satisfy the subcontract, sometimes with specific requirements for funds-transfer or social-engineering coverage. Read the clause, because those two are often sublimited or excluded by default and have to be asked for.
Do we have to worry about our subcontractors' security?+
You have to worry about its consequences for you. The fraudulent invoice that costs you money usually arrives from a real subcontractor's genuinely compromised mailbox, so it passes every instinct you have about whether a sender is legitimate. You cannot fix their email, which is exactly why the call-back rule exists: you verify the bank details by phone regardless of how convincing the message looks.
What's the single best thing to fix this month?+
The payment call-back rule, written down and acknowledged by whoever cuts checks. It's free, it takes one meeting, it targets the exact loss your trade suffers, and it's a question on the application.
Going deeper on this trade? Read the full guide.
Sources
See where your practice stands, free
Sixteen questions, five minutes, a score across the ten control areas underwriters probe, and your three biggest gaps with the fix for each. No email needed for the score.