CyberSafeCheck Free · No sign-up · Instant score, action plan and PDF report · Mapped to Essential Eight, ISO 27001, Privacy Act, SMB1001
Why builders and trade businesses are targeted
The most expensive attack on builders and trades is invoice fraud. A supplier's or subcontractor's email is compromised, and a progress claim arrives with "updated" bank details. It looks genuine because it comes from a real conversation.
Site work adds its own risks: phones and tablets that get lost, shared logins to project platforms, and plans and tender documents passed around by link. Ransomware on the office systems can stop quoting, invoicing and payroll in one go.
What the construction & trades check asks about
The quick check has 20 questions and the full assessment 43. Both cover the fundamentals every business needs (access and passwords, devices and updates, email and phishing, backups, governance and data protection), plus questions specific to your sector:
- Progress-payment / invoice fraud
- Mobile & site device security
- Project & IP protection
- Subcontractor & supply-chain data
- Project/cloud collaboration security
You get a score out of 100, a breakdown by area and a prioritised action plan that shows which framework each recommendation relates to.
Obligations that may apply to you
- Personal information. You collect licences, inductions, WHS records and payroll details for workers and subcontractors. Businesses with annual turnover above $3 million must protect it under the Privacy Act, and report serious breaches.
- Client and head-contractor requirements. Government and larger commercial clients increasingly ask suppliers to show basic cyber security, often referencing the Essential Eight or SMB1001.
- Ransomware payments. Businesses with turnover above $3 million must report a ransomware payment to the Australian Signals Directorate within 72 hours.
Four things to do first
- Call to confirm any change to a supplier or subcontractor's bank details before you pay
- Turn on multi-factor authentication for email, accounting and project software
- Make sure site phones and tablets have a passcode and can be wiped remotely
- Keep backups of project and accounts data that ransomware cannot reach
Start the free construction & trades check
Frequently asked questions
How do builders avoid fake invoice scams?
Never act on new bank details sent by email. Call the supplier on a number you already have to confirm, require a second person to approve changes, and protect your own email with multi-factor authentication so your account cannot be used against your clients.
Do small trade businesses really get targeted?
Yes. Most attacks are automated and opportunistic, and trade businesses often pay large invoices by bank transfer, which makes them attractive. The basic controls in this check stop the majority of them.
Is this check an audit?
No. It is a free self-assessment with an instant score and action plan. It is not a formal audit, certification or legal advice.
This page and the assessment are general information and an educational guide to your security posture. They are not a formal audit, certification or legal advice.