PC Slower Than It Used to Be?
A free scan shows the junk files, broken settings and background clutter dragging Windows down - then fixes them in one click.Free scan · Windows 10 & 11Outdated Drivers Are Slowing You Down
One free scan finds every outdated or missing driver and matches the right update for your exact hardware.Free scan · exact hardware matchSpecial offer. See more information about Outbyte and uninstall instructions. Please review EULA and Privacy policy.
Use this checklist across design, construction and handover. A construction project is exposed through drawings and payment instructions, cloud collaboration, mobile devices, subcontractor accounts, remote technicians and connected building equipment. The practical objective is to keep critical information confidential and accurate, keep work operating during an incident, and recover the records and systems needed to finish safely.
This is operational guidance, not a universal legal-compliance list. A small UK contractor, a U.S. defense subcontractor and a project with connected building systems can have different contractual, privacy and technology obligations. Confirm the requirements in the particular tender, contract and jurisdiction before mobilization.
As an Amazon Associate I earn from qualifying purchases.
Set ownership before anyone connects to the project
Cybersecurity fails when everyone assumes another organization is responsible. Put a named person and a backup decision-maker on the project record before issuing accounts or sharing drawings. The role may be held by a project manager, IT lead or competent service provider, but it must be a real person with authority to stop unsafe access and escalate an incident.
Recommended: Crashes or Glitches? A Free Driver Scan Usually Finds the Culprit →Recommended: PC Feels Slow? A Free Scan Shows What's Dragging Windows Down →
Special offer. See more information about Outbyte and uninstall instructions. Please review EULA and Privacy policy.
| Action | Main contractor | Client | Joint venture | Subcontractor or supplier |
|---|---|---|---|---|
| Project cyber contact and alternate | Names the operational lead and maintains the contact tree. | Provides client security and emergency contacts. | Documents which partner has decision authority. | Provides an accountable technical and business contact. |
| Data and system inventory | Lists project files, accounts, devices, applications and site equipment. | Identifies client-owned information and systems that must be protected. | Agrees a shared register and risk owner for each item. | Reports the systems, software and remote-access tools it will use. |
| Access approval | Approves access needed for site work and reviews it regularly. | Approves access to client environments and sensitive information. | Uses the agreed approval route rather than informal partner permissions. | Requests only the access required for its contracted role. |
| Incident coordination | Coordinates the site response and informs the client and affected partners. | Sets notification expectations and receives escalations. | Defines which organization leads communications and technical decisions. | Reports suspected compromise immediately and preserves relevant records. |
| Handover security | Transfers final records, credentials and configuration evidence securely. | Accepts the information and confirms its retention requirements. | Records who owns each system after completion. | Removes its access and supplies support or maintenance documentation. |
Record the contractor, client, key subcontractors, IT provider, managed service provider and equipment vendors who must be contacted if email or the project platform is unavailable. Keep an alternate contact method outside the affected system.
#1 Best Overall
Yubico - YubiKey 5C NFC - Multi-Factor authentication (MFA) Security Key and passkey, Connect via USB-C or NFC, FIDO Certified - Protect Your Online Accounts
- POWERFUL SECURITY KEY: The YubiKey 5C NFC is the most versatile physical passkey, protecting your digital life from phishing attacks. It ensures only you can access your accounts
- WORKS WITH 1000+ ACCOUNTS: Compatible with popular accounts like Google, Microsoft, and Apple. A single YubiKey 5C NFC secures 100+ of your favorite accounts, including email, password managers, and more
- FAST & CONVENIENT LOGIN: Plug in your YubiKey 5C NFC via USB and tap it, or tap it against your phone (NFC), to authenticate. No batteries, no internet connection, and no extra fees required
- MOST SECURE PASSKEY: Supports FIDO2/WebAuthn, FIDO U2F, Yubico OTP, OATH-TOTP/HOTP, Smart card (PIV), and OpenPGP. That means it’s versatile, working almost anywhere you need it
- PRIMARY & SPARE KEYS: Just like having a spare house key, we recommend buying two YubiKeys - one for daily use and one as a spare. That way you’ll never get locked out of your accounts
Before work starts: design and mobilisation checklist
1. Define the project’s high-impact information
- Identify drawings, specifications, models, schedules, surveys, tender data, commercial terms, contact lists, credentials, payment instructions and handover records.
- Mark which information would cause the greatest harm if exposed, changed or unavailable. A drawing may be sensitive because it reveals security arrangements; a payment instruction may enable fraud even when it contains no technical data.
- Agree the approved storage locations, permitted sharing channels, change-approval process and retention period. Do not let urgent site work become a reason to forward project material to personal email or an unapproved file-sharing service.
- For a joint venture, document shared information-security governance, each partner’s risk responsibilities and the process for resolving a disagreement about access or incident handling.
2. Build an asset and service register
List every item that can hold information, authenticate a user or affect operations:
- Cloud project platforms, email tenants, document repositories and estimating or payment applications.
- Laptops, tablets, phones, printers, removable media, site servers, network equipment and shared workstations.
- Building-management, access-control, CCTV, environmental-monitoring, temporary power or other connected equipment.
- Supplier portals, remote-support tools, virtual private networks and accounts used by subcontractors.
For each item, record an owner, administrator, location, supplier, dependency, update method, backup method and recovery priority. Identify the services whose loss would stop work, compromise safety or delay recovery. The inventory should distinguish a critical operational system from a convenience application so restoration decisions are possible under pressure.
Rank #2
Yubico - Security Key C NFC - Basic Compatibility - Multi-Factor authentication (MFA) Security Key and passkey, Connect via USB-C or NFC, FIDO Certified
- POWERFUL SECURITY KEY: The Security Key C NFC is the essential physical passkey for protecting your digital life from phishing attacks. It ensures only you can access your accounts.
- WORKS WITH 1000+ ACCOUNTS: Compatible with Google, Microsoft, and Apple. A single Security Key C NFC secures 100 of your favorite accounts, including email, password managers, and more.
- FAST & CONVENIENT LOGIN: Plug in your Security Key C NFC via USB-C and tap it, or tap it against your phone (NFC) to authenticate. No batteries, no internet connection, and no extra fees required.
- TRUSTED PASSKEY TECHNOLOGY: Uses the latest passkey standards (FIDO2/WebAuthn & FIDO U2F) but does not support One-Time Passwords. For complex needs, check out the YubiKey 5 Series.
- BUILT TO LAST: Made from tough, waterproof, and crush-resistant materials. Manufactured in Sweden and programmed in the USA with the highest security standards.
3. Check the contract, client rules and jurisdiction
- Read the tender, contract, client security schedule, privacy terms and any requirements for incident notification, encryption, records or supplier assurance.
- Record which organization owns each data set and which party must approve disclosure, restoration or system changes.
- For U.S. defense work, check whether the contract or subcontract invokes DFARS Subpart 204.73, covered defense information and covered contractor information systems. In that specific context, the regulation defines “rapidly report” as within 72 hours of discovery and includes requirements related to adequate security and NIST SP 800-171 assessment and reporting.
- Do not copy the 72-hour DFARS deadline onto unrelated commercial or public-sector construction. The applicable solicitation and contract control.
4. Design access around least privilege
- Require multi-factor authentication for email, remote access, cloud project platforms and administrative accounts where the service supports it.
- Use phishing-resistant authentication, such as a FIDO2 security key, when the organization’s email and project services support it. Confirm compatibility, enrollment and recovery procedures before deployment; no key works universally with every service.
- Give each worker or supplier only the project access needed for the current role. Use separate administrative accounts where appropriate, review privileged access and remove or change it promptly when a person changes role or leaves.
- Define third-party remote access in writing: approving person, active hours, systems reachable, authentication method, session logging and emergency shut-off. Contractual security expectations should cover managed service providers and equipment vendors as well as construction subcontractors.
5. Treat connected equipment as part of the project security design
Before buying or connecting an internet-of-things or building-system device, ask:
Recommended Free Tools
Special offer. See more information about Outbyte and uninstall instructions. Please review EULA and Privacy policy.
- Who owns and administers it during construction and after handover?
- How are firmware, software and security updates delivered, and what happens when the vendor stops supporting it?
- What default or shared credentials exist, how are they changed, and how is vendor support authenticated?
- What data does it collect, where does that data go, and which network or cloud service does it use?
- Can it be isolated without creating a safety risk, and who is authorized to make that decision?
Keep administrative access and important project systems separate from broadly shared site Wi-Fi or unmanaged personal devices where practical. Have a competent technical owner design segmentation and isolation; never disconnect or reconfigure safety-critical equipment on a guess.
Rank #3
Yubico - YubiKey 5 NFC - Multi-Factor authentication (MFA) Security Key and passkey, Connect via USB-A or NFC, FIDO Certified - Protect Your Online Accounts
- POWERFUL SECURITY KEY: The YubiKey 5 NFC is the most versatile physical passkey, protecting your digital life from phishing attacks. It ensures only you can access your accounts
- WORKS WITH 1000+ ACCOUNTS: Compatible with popular accounts like Google, Microsoft, and Apple. A single YubiKey 5 NFC secures 100+ of your favorite accounts, including email, password managers, and more
- FAST & CONVENIENT LOGIN: Plug in your YubiKey 5 NFC via USB and tap it, or tap it against your phone (NFC), to authenticate. No batteries, no internet connection, and no extra fees required
- MOST SECURE PASSKEY: Supports FIDO2/WebAuthn, FIDO U2F, Yubico OTP, OATH-TOTP/HOTP, Smart card (PIV), and OpenPGP. That means it’s versatile, working almost anywhere you need it
- PRIMARY & SPARE KEYS: Just like having a spare house key, we recommend buying two YubiKeys - one for daily use and one as a spare. That way you’ll never get locked out of your accounts
6. Prepare backup and recovery arrangements
- Choose the records needed to keep the project safe and operational: current approved drawings, schedules, contact trees, access configurations, supplier details and key handover information.
- Set a backup schedule, protect backup credentials separately and keep at least one recovery copy isolated or offline where appropriate.
- Confirm that the backup provider or managed service provider follows the project’s access and protection requirements.
- Test restoration before mobilization and after major system changes. Record who can authorize restoration and the order for bringing back communications, files and operational systems.
During construction: daily controls for the site and office
Protect devices used in the field
- Require a lock screen and strong authentication on phones and tablets used for site photographs, drawings, messages or sign-in approvals.
- Keep operating systems, applications, endpoint protection and project equipment maintained under a defined update process. Record equipment that cannot be updated, name its risk owner and apply compensating controls.
- Maintain a clear process for reporting a lost or stolen phone, tablet, laptop, token or removable drive. The response should include account revocation or remote wipe where available.
- Do not use an unmanaged personal device for sensitive project work unless the organization has explicitly approved and secured that arrangement.
Make phishing and payment fraud harder
- Train workers to pause on unexpected links, attachments, password-reset prompts, supplier invoices and urgent requests for credentials.
- Verify a bank-detail change, new payment instruction or unusual high-value transfer through a second, previously known channel. Do not use the telephone number or reply address supplied in the suspicious message.
- Report suspicious messages, exposed credentials and unexpected login prompts through one simple route. Tell workers not to delete evidence or conduct technical investigation beyond their role.
- Use role-based permissions for shared folders and review who can download, change or externally share sensitive files.
Control subcontractor and vendor access
- Onboard each external user against a named company and person, with a defined task, start date, end date and approving manager.
- Use individual accounts rather than shared passwords. Require MFA and prohibit credentials from being passed between technicians.
- Limit remote support to the devices and servers within the supplier’s role. Activate access only when needed, log the session where the technology allows it and disable it when the work is complete.
- Review the access list at project meetings and immediately after demobilization, role changes or termination.
Keep the site’s network and equipment changes deliberate
- Maintain a simple network and equipment diagram showing internet connections, wireless networks, remote-access paths and connected building systems.
- Require approval before adding a router, modem, camera, controller, cloud connector or remote-management agent.
- Separate guest or broadly shared connectivity from administrative systems and operational equipment where the design permits.
- Log material configuration changes, the person who approved them and the rollback method.
Incident response: what the site should do when something looks wrong
- Report and record. Capture the time, person reporting, affected account or device, visible symptoms and any actions already taken. Preserve suspicious messages, screenshots and relevant logs.
- Escalate to the incident lead. The lead decides whether the event involves phishing, ransomware, lost equipment, unauthorized access, payment fraud or connected operational equipment.
- Contain safely. Follow the approved response plan. Technical staff may isolate an account, device, server or network segment; where several systems are affected, network-level isolation may be necessary. Coordinate any isolation involving safety-critical or operational equipment with the competent technical and site leads.
- Protect recovery evidence. Do not wipe, rebuild or negotiate from an infected device unless the response lead authorizes it. Preserve the information needed to determine entry, scope and impact.
- Notify the right parties. Contact the client, contractor leadership, IT provider, insurer, legal adviser, regulator or law-enforcement body according to the contract and incident plan. Use the alternate contact method if email or the project platform is unavailable.
- Restore in priority order. Use clean, protected backups and the documented restoration sequence. Confirm that credentials and remote access have been secured before reconnecting systems.
- Review before resuming. Establish how access was obtained, whether a supplier contributed, which controls failed and what must change before normal work restarts.
Handover and closeout checklist
Transfer trustworthy records
- Deliver the final approved drawings, models, schedules, asset lists, test certificates, maintenance information, credentials and configuration records through an approved channel.
- Identify the authoritative copy, its owner, retention period and permitted future users. Do not leave competing uncontrolled copies in personal drives or temporary transfer folders.
- Provide the client with recovery instructions, backup location, restoration contacts and dependencies for connected systems.
Remove construction-era access
- Reconcile every contractor, subcontractor, supplier and temporary worker account against the final responsibility matrix.
- Disable accounts, remote-support sessions, VPN access, shared links, test credentials and temporary wireless networks that are no longer required.
- Change shared or vendor-held credentials where the client’s operating model requires it, and confirm who will administer the system after handover.
Prove the receiving team can recover
- Run a handover restoration or access exercise for critical files and connected systems, with the client’s authorized team present.
- Confirm that monitoring, update responsibility, vulnerability handling and supplier escalation have an owner after the construction team leaves.
- Archive incident records, access reviews, approved exceptions and unresolved risks with a named owner and target date.
Evidence to retain for project reviews
A checklist is useful only if a project can show what happened. Retain:
- The ownership matrix, contact tree and current asset register.
- Access approvals, privileged-access reviews, joiner/mover/leaver records and supplier remote-session records.
- Training or briefing records for phishing, lost devices and incident reporting.
- Update exceptions, risk acceptances, network or equipment change approvals and backup-restoration test results.
- Incident timelines, notifications, containment decisions, recovery approvals and post-incident actions.
- Handover acceptance, account-revocation evidence and confirmation of post-construction ownership.
How to apply the checklist proportionately
Use the project’s data sensitivity, access model, recovery needs, connected equipment and contract obligations to set the depth of each control. A small fit-out with no client network connection may need a compact account, device and backup process. A hospital, transport, industrial or defense project with connected systems and multiple suppliers needs formal segmentation, stronger authentication, detailed logging, tested recovery and contract-specific reporting. The NCSC construction guidance places cybersecurity across design, construction and handover; CISA’s ransomware, cybersecurity-goals and connected-device guidance provides broadly applicable practices for small and medium-sized organizations, but those voluntary practices are not a construction law.
Rank #4
Yubico - Security Key NFC - Basic Compatibility - Multi-Factor Authentication (MFA) Key, Connect via USB-A or NFC, FIDO Certified
- POWERFUL SECURITY KEY: The Security Key NFC is the essential physical passkey for protecting your digital life from phishing attacks. It ensures only you can access your accounts.
- WORKS WITH 1000+ ACCOUNTS: Compatible with Google, Microsoft, and Apple. A single Security Key NFC secures 100 of your favorite accounts, including email, password managers, and more.
- FAST & CONVENIENT LOGIN: Plug in your Security Key NFC via USB-A and tap it, or tap it against your phone (NFC) to authenticate. No batteries, no internet connection, and no extra fees required.
- TRUSTED PASSKEY TECHNOLOGY: Uses the latest passkey standards (FIDO2/WebAuthn & FIDO U2F) but does not support One-Time Passwords. For complex needs, check out the YubiKey 5 Series.
- BUILT TO LAST: Made from tough, waterproof, and crush-resistant materials. Manufactured in Sweden and programmed in the USA with the highest security standards.
Use this checklist at mobilization, at major design or supplier changes, after an incident and at handover. The responsible people—not a document left in a folder—are what make the controls work.
Special offer. See more information about Outbyte and uninstall instructions. Please review EULA and Privacy policy.
Quick Recap
Bestseller No. 2
Bestseller No. 4
Best Value
Thetis FIDO2 Security Key (USB-A, 2-Pack) - Hardware MFA & Passkey Access for Business, School ERP & Employee Accounts | Compatible with Windows, Google Workspace, Apple ID, Coinbase, Salesforce
- FIDO2 & Passkey Ready: Business-ready and FIDO2 L1 certified. This key is supported by major management suites and is ideal for both individual and enterprise deployment. Works seamlessly with Gmail, Facebook, GitHub, Dropbox, Coinbase, and more.
- Universal Connectivity (USB-A ): Features a built-in USB-A connector—simply unfold the key and plug it into your compatible PC or laptop for seamless authentication on the go.
- Dedicated Manager App: Use the Thetis Manager App for the initial hardware PIN setup. Setting the PIN on the device first ensures a smooth registration process. Once the PIN is configured, you can begin registering the key across your favorite FIDO2-compatible online services.
- Ultra-Durable & Portable: Featuring a rotating metal cover, this key is water, crush, and tamper-resistant. It fits easily on a keychain and requires no batteries or network connectivity.
- Check FIDO2 compatibility before purchase - Known limitations: ID Austria is not supported (requires FIDO2 Level 2). Windows Hello login only works with Windows Enterprise editions that support Entra ID, and NFC is NOT supported.
Product prices and availability are accurate as of the date/time indicated and are subject to change. Any price and availability information displayed on Amazon at the time of purchase will apply.
