Temporary Wi-Fi, connected CCTV, cloud project platforms and digital access systems are changing the risk profile of construction projects.
The security perimeter no longer stops at the head office. It now extends to the active construction site, where security increasingly depends on systems, suppliers and users outside the organisation’s direct control.
A major project can involve multiple contractors, consultants and technology providers connecting to shared platforms and sensitive project information. IoT sensors, digital engineering environments, remote access tools and biometric systems add further digital dependencies that boards need to understand.
The governance challenge is whether the organisation can demonstrate who owns the risk, which controls it requires, what evidence supports those controls, and who governs exceptions.
Third-Party Cyber Risk Is a Governance Issue
Principal contractors may remain accountable for project delivery without directly controlling the internal security practices of every organisation in their supply chain. This creates a gap between project accountability and direct control.
A contract can establish a security requirement and a questionnaire can record a supplier’s response. But neither, on its own, demonstrates that an important control is operating effectively.
For boards, the objective should therefore be proportionate, evidence-based assurance.
This direction is consistent with the broader ANZ governance environment. ASIC guidance emphasises that organisations should address cyber risk within their risk-management frameworks.
Australian Signals Directorate guidance also stresses clear cyber responsibilities and regular reporting to boards and executive committees. New Zealand’s NCSC similarly places governance, defined responsibilities and risk management at the centre of organisational cyber resilience.
That does not mean every supplier requires the same level of assessment.
A subcontractor with no access to sensitive systems presents a different risk from a provider with privileged access to project platforms or operational technology. Suppliers handling confidential engineering information may also warrant a higher level of assurance.
Moving From Assumed Compliance to Verified Assurance
For higher-risk third parties, independent assessment can help boards determine whether technical evidence supports the information suppliers provide. A secure configuration review, for example, may identify default credentials on connected systems, unnecessary exposed services or weak network segregation.
A vulnerability assessment may show where externally accessible infrastructure or third-party connections introduce exploitable weaknesses. Access reviews can also reveal governance problems, such as accounts remaining active after a contractor or consultant has finished their involvement in a project.
These findings matter because cyber risk does not remain neatly contained within organisational boundaries. A compromised supplier account or unmanaged remote connection can provide a pathway into systems that support broader project delivery.
Assurance should give decision-makers reliable evidence to govern risk. That evidence should also shape the questions boards ask of management and key suppliers.
What Should Boards Be Asking?
Instead of asking only, “Are our suppliers compliant?”, boards should challenge the organisation with more specific questions:
• Which third-party cyber risks could materially affect project delivery, regulatory obligations or the organization’s risk appetite?
• Do we have a current inventory of critical and high-risk third parties?
• Which suppliers have access to sensitive customer, financial or confidential information?
• Who is accountable for identifying, assessing and governing these risks?
• What evidence gives the board confidence that critical suppliers are meeting required security and compliance obligations?
• Which suppliers have experienced significant security incidents or control weaknesses?
• How quickly could we detect and respond to a third-party cyber incident?
• How are material control deficiencies, exceptions and residual risks escalated to the appropriate decision-makers?
• What reporting enables the board to monitor changes in third-party risk throughout the project lifecycle?
• How does management verify that remediation actions are completed and that accepted risks remain within approved tolerances?
A risk-based cyber security audit can support this process for suppliers whose access, data exposure or operational role justifies deeper assurance.
Where technical exposure is material, independent penetration testing may also be appropriate. It can assess how remote gateways, project portals or other externally accessible systems respond to realistic attack scenarios.
Assessment informs governance without replacing the board’s decision-making role.
Independent Assessment Should Lead to Clear Decisions
Cybernetic GI supports organisations by independently analysing cyber risk, assessing control evidence, identifying gaps and providing prioritised recommendations.
Boards retain responsibility for determining how the organisation should treat identified risks and which recommendations it should prioritise. They also determine what level of risk the organisation can accept and how remediation should be governed.
Cybernetic GI provides the independent evidence and specialist advice needed to support those decisions. It does not make or implement governance decisions on the organisation’s behalf; its role is to give boards a clear evidence base for informed action.
Working with a certified cyber security consultant in Australia can help organisations translate technical findings into risk implications that boards and project leaders can evaluate.
At Cybernetic GI, organisations can work directly with the lead assessor conducting the engagement.
A useful assessment should give decision-makers more than a list of vulnerabilities. It should clearly set out the assessment scope, the evidence examined and any material gaps identified. It should also explain what those gaps could mean for project delivery and which actions the organisation should consider.
Governance Requires Evidence, Not Assumptions
As digital dependencies extend across contractors, suppliers and site infrastructure, boards need proportionate assurance, clearly assigned accountability and evidence that supports informed risk decisions.
Mature governance frameworks identify which controls matter and require evidence that those controls are operating as intended.