A general contractor sends a prequalification packet with a security section in it. Sometimes it is the owner’s risk team instead, or your client’s insurer working its way down the supply chain. The document is much the same whatever the cover letter calls it, and the window to return it is short.
Most of it you can answer at the desk. Do you require multifactor authentication. Is there endpoint protection on the workstations. Those you know.
Then it asks you to prove it
- How long do you retain security logs.
- When did you last review who has access to project data.
- When did you last restore from backup, and did the restore succeed.
- Who is the named contact if there is an incident on our project.
These stall firms for a mechanical reason. Every one of those four is a fact about what somebody is obliged to do under your IT agreement, and most agreements say nothing about any of them.
Where those answers live
Log retention is a setting on each platform, and unless somebody chose a number and wrote it down it is whatever the product shipped with. A vendor product manager picked that default. They have never seen your projects.
Nobody schedules an access review that no agreement asks for, so the honest answer is usually that nobody has looked. Restore tests are the same shape. An untested backup is a rumor.
Whose hours the evidence comes out of
Producing it is work. Somebody exports the logs, assembles the access list, digs out the restore record, and writes it up in the format your client asked for. If your agreement is silent on whose hours that is, it arrives as a change request in the week you have least room for one. Raise it at renewal.
What to have standing
These fit on one page.
- A retention period in days, per platform, written into the agreement. Ask for the number.
- A named owner for evidence requests, with a response time. A role, with a person behind it.
- An access review cadence, and the date of the last one. The date is the part clients check.
- The date of the last restore test, and what was restored. “We test backups” and “we restored a project folder and opened the files” are different claims.
What this looks like on a construction prequal
On a prequal the security section sits alongside the bonding and insurance pages. It is scored, and an incomplete answer can cost you the prequal without anybody telling you that is what happened.
Subcontractor access is worth preparing for. Consultants and trades hold credentials to project data, and the questionnaire asks how that access ends when the engagement does. Expect something on the model and drawing set as well, because a client asking about data classification wants to hear that project files are handled differently from the rest of the network.
A carrier asks a different set of questions
Your insurer wants the controls as an underwriter frames them, and a wrong answer there carries different consequences from a wrong answer to a client. Those questions, and what a truthful yes requires for each, are on our cyber insurance readiness page.
Start before one arrives
Open your current IT agreement and look for two things. A retention period expressed in days, and somebody named as accountable when a client asks for proof. If neither appears, put it on the renewal list.
Renascence runs a fixed fee assessment called JOUST for firms that want the gaps found before a client finds them. It is $1,000, and the fee credits toward the account if you partner with us inside twelve months.