Start by identifying what the firm needs to protect: project files, calculations, client records, payroll, financial accounts, and systems used to deliver work. Name who is responsible for each system, including email, file storage, design software, employee devices, backups, and vendor accounts. A small firm can assign an internal owner and get qualified technical help for tasks beyond that person’s knowledge.
Set basic controls across the firm. Require unique passwords and multifactor authentication on email, remote access, financial systems, and cloud storage. Remove access when staff leave or change roles. Keep computers, phones, routers, and software updated. Limit administrator privileges and give employees access only to the systems and folders their work requires. Train staff to pause and verify unexpected payment requests, password prompts, attachments, and requests to share files.
Protect project information according to client contracts and firm policy. Ask vendors where information is stored, who can access it, how they handle account security, and what they will do if they have an incident. Review access for former staff, temporary workers, and subcontractors. Keep an inventory of important accounts and a secure way to reach the people who can restore them.
Back up important data in a way that limits an attacker’s ability to alter both the live files and the backups. Test restoration of a sample project, since a successful backup message does not prove the data can be recovered. Agree on who can shut down access, contact technical support, notify leadership, and consult counsel if an account is compromised or a device is lost. Give staff one clear reporting route and tell them to report mistakes quickly, without trying to hide or quietly fix them.
Ask the broker how cyber insurance conditions, exclusions, and incident response services apply to the firm. Coverage can support a response, but it does not replace access controls, tested backups, staff training, or a response plan. Revisit the plan when the firm adds a major cloud system, accepts new kinds of client data, or changes vendors.
This is general education, not cybersecurity, legal, or engineering advice; follow applicable law, contract duties, licensed PE judgment, and local codes.
