Architecture, engineering, and construction firms often assume cyberattacker’s are after banks and hospitals. They aren’t. They are after money moving quickly between parties who trust each other — which describes nearly every construction project.

This year I completed the CERT Certification in Cybersecurity Oversight from Carnegie Mellon University’s Software Engineering Institute, alongside my NACD Directorship Certification. My most important takeaway was simple.

The board’s job is not to understand the technology. It is to make sure cyber risk if governed like every other enterprise risk.

Why our industry is exposed

• Frequent, large payments to subcontractors, suppliers and joint-venture partners make AEC firms prime targets for business email compromise and wire fraud.
• Valuable client data — building plans, security layouts, infrastructure designs — is shared across dozens of outside parties.
• Lean IT functions are built to keep systems running, not to detect and respond to threats.
• Project-based work brings new partners, new systems and new access points with every job.

Five questions every board should ask management

1. What are our crown jewels, and who can reach them? If management can’t name the three things that would hurt most if lost or exposed, the risk hasn’t been assessed.
2. How do we verify a change to payment instructions? A single call-back rule can stop the most common fraud in our industry.
3. When did we last run an incident-response tabletop exercise, and was the board in the room? The first time directors think about a ransomware demand should not be during one.
4. How do we manage third-party risk? Our exposure includes every consultant, subcontractor and software vendor connected to our systems.
5. What do you cyber insurance actually cover, and what have we promised clients by contract? Coverage gaps and indemnities tend to surprise boards at the worst possible moment.

Oversight, not operations

As a CPA who has overseen reporting, controls and audits for 14 companies across continents, I see cyber as a controls question in a new setting, Directors don’t need to configure firewalls. They need a defined risk appetite, regular reporting in business terms, access to independent expertise and clear management accountability for a framework that is actually tested.

Boards that treat cyber as “an IT thing” are delegating a risk that can end a firm. Boards that govern it well turn it into something clients notice and value.

What’s the one cyber question your board has never asked? That is usually the right place to start.

ABOUT THE AUTHOR

Cindy Anderson, CPA, NACD.DC, is Founder & CEO of Thinc Strategy, an advisory firm serving owners and executives of engineering, design, construction and technology companies on growth strategy, M&A and ownership succession. She serves as an independent director of a privately held holding company and an outside director of a regional architecture firm, and holds the NACD Directorship Certification and the CERT Certificate in Cybersecurity Oversight from Carnegie Mellon University’s Software Engineering Institute. She has advised on more than $1 billion in transactions over a 30-year career.