IT for Construction Companies: Workplace, BIM and the Building Site

In 2026, the construction sector faces just as many IT challenges as a software company, but with a muddy site cabin and three project locations running at once. Main contractors, building services installers, finishing contractors and housebuilders work with BIM models measured in gigabytes, with project schedules that need to be real-time, with subcontractors who need access to your systems, and within a supply chain where a single data breach immediately affects tenants or clients. Research by Bouwend Nederland (the Dutch construction industry association) shows that roughly 1 in 3 construction companies has already been hit by hackers. This guide explains how a small or mid-sized construction business can set up its IT properly and structurally: in the office, on site and in its software.

Why IT for construction needs its own approach

What sets construction apart from typical SME IT isn't one thing, but a combination of factors. You run a project-based organisation where people come and go, with subcontractors who need temporary access to schedules and drawings, with building sites that have no fixed network connection, and with software that was often chosen years ago and is still in use.

On top of that comes the data: BIM models, drawings (Revit, AutoCAD, Navisworks), specifications, contracts, schedules, variation records and site photos. That data often lives in several places at once, with limited control over who can see what. Meanwhile, clients (housing associations, municipalities, developers) expect you to demonstrate that you work securely. Since 2024 there has been a visible rise in data breach notifications from construction companies: 57 in 2024 compared with 47 in 2023, according to the trade press.

The pain points we see in practice: fragmentation (a separate SharePoint folder for every project, a separate server in every office), site connectivity (no fibre, patchy 4G coverage), third-party access (subcontractors with their own laptops in your files), legacy software (old estimating or drawing packages that can't simply move to the cloud) and staff awareness (from the site to the boardroom, phishing and invoice fraud are easy targets).

The foundation: one digital workplace for office and site

The first step for almost every construction business is a single central workplace where everyone signs in, stores files and communicates in the same way. For most Dutch SME builders, that means Microsoft 365 (Business Standard or Business Premium) with SharePoint as central storage and Teams for working with project staff and subcontractors.

What we recommend as a starting point:

• Microsoft 365 Business Premium for everyone who handles sensitive data: it brings Intune, Defender for Business and basic DLP, which you simply need in construction.
• One SharePoint structure per project type (new build, renovation, maintenance) with fixed folders and permissions, so you don't reinvent the wheel for every project.
• Managed devices through Intune for laptops and phones, with remote wipe for when a site manager leaves one behind on site.
• Mandatory MFA on every account, including for the managing director who finds it "inconvenient".

For a broader look at your workplace options, see our guide to the digital workplace for SMEs. And if you are torn between Microsoft 365 and Google Workspace, our comparison of the two platforms will help you make the call.

BIM, CAD and drawing software: from fixed workstations to the cloud

Revit, AutoCAD, Navisworks and Solibri traditionally run on heavy workstations, with files on a local file server. That works until you start collaborating across several offices or with freelance BIM modellers. Then latency becomes the problem, and people end up sending copies back and forth anyway.

The two modern options:

1. A BIM/CAD cloud workplace (VDI). Your modellers sign in to a virtual workplace in a Dutch data centre with the GPU power that Revit or Solibri needs. Files sit next to the VDI, not on the laptop. This is a good fit if you have one or more BIM teams working together on large models.
2. A cloud file server with smart caching. You keep drawings in one central place in the cloud, while a local cache keeps things fast for the modeller. Suitable for smaller teams.

The choice depends on model size, the number of users and whether you work with external modellers. What you never want again: one drawing existing in four versions on four laptops.

Construction software and ERP: choose with integration in mind

Bouwend Nederland maintains an overview of construction software. Popular packages in the Netherlands include 4PS Construct (built on Business Central), Ibis for estimating, Bouwsoft and Exact Online Bouw. The right choice depends on your size and whether you mainly do commercial and non-residential building, housebuilding, building services or maintenance.

What we see working in practice:

• Start with your processes, not the tool. What does your quote-to-final-costing process look like? Which integrations do you need (time tracking, materials management, variations)?
• Prefer software with open APIs. That way you can later connect time tracking, scheduling and accounting without a manual export-import routine.
• Calculate the total cost. Licences, implementation, integrations, training, annual updates. Not just the monthly price per user.

If you want to build something specific that doesn't exist yet, our guide to custom software development gives you an honest framework for when it does and doesn't pay off.

Networking on site: 4G, 5G and temporary Wi-Fi

A modern building site runs on connectivity: phones, laptops, tablets for toolbox inspections, cameras, locks and sometimes moving machinery. A fixed fibre line to a site cabin is usually too expensive or too slow to install. The standard solution is:

• A 4G or 5G router in the site cabin as the main connection (Dutch providers deliver plug-and-play within 48 hours).
• Outdoor access points at strategic points for Wi-Fi across the site.
• Cameras and locks on the same network, but in a separate VLAN so they can't reach project data.

Hardware for a temporary set-up (router, three outdoor access points, a few cameras) costs around €1,500 to €2,500 and can be reused at the next location. In 2026, rugged laptops and tablets come as standard with a built-in 5G modem with 4G LTE fallback and Wi-Fi 7. For site managers, that saves a lot of hassle with separate dongles and hotspots.

Make sure your site Wi-Fi isn't an open network for anyone who walks past. A separate guest SSID for visitors, with a temporary password and its own VLAN, keeps your project data away from random devices.

Cybersecurity: why construction is an attractive target

For cybercriminals, a construction company is doubly interesting. There is pressure (deadlines, penalty clauses for delays), there are large cash flows (stage payments that are easy to divert) and there is a chain of tenants, clients and subcontractors whose data also ends up with you.

What has happened in the Netherlands:

• Coen Hagedoorn Bouwgroep (2023). A ransomware attack in which criminals gained access to tenant data from affiliated housing associations (names, addresses, phone numbers). The company had to inform tens of thousands of residents and notify the Dutch Data Protection Authority (Autoriteit Persoonsgegevens).
• Hoppenbrouwers Techniek (2021). REvil ransomware via an attack on Kaseya software. Every system went down. The company chose not to pay the ransom; total costs came to around €400,000.

The 2024 Cybersecurity Monitor from Statistics Netherlands (CBS) shows that 13 per cent of construction companies with two or more employees have taken no security measures at all. That is the pond attackers fish in first.

The basic measures you want in place today:

• Mandatory MFA on every account, with extra rigour for the finance team and management (BEC fraud).
• NGAV plus EDR on every laptop and server (see our explainer on next-gen antivirus and EDR).
• Email security with anti-phishing and anti-spoofing for your invoice and quote traffic.
• Immutable backups of project data and administration, tested by restoring them.
• Awareness training for site managers, estimators and administration staff, with at least one phishing simulation per quarter.
• Patching of servers, VDIs and workstations within 30 days.

If you are looking for support with this, our guide to outsourcing IT security for SMEs gives an overview of MSP versus MSSP and which modules lend themselves to being handed over.

Connecting subcontractors and supply chain partners securely

A construction company rarely works alone. Subcontractors, regular freelancers, engineering partners and installers often need temporary access to schedules, drawings or BIM models. Don't do this with shared login accounts or loose links sent by email.

The secure way:

• Guest accounts in your own tenant (Microsoft 365 B2B) with MFA, only the permissions they need, and an end date.
• A separate team site or Teams team per project, where externals can only reach those documents.
• Conditional access that requires external devices to meet basic rules (up-to-date OS, no jailbreak).

If you supply housing associations, energy companies or healthcare institutions, your organisation falls indirectly under NIS2 through the supply chain. Sooner or later, that leads to a supplier audit. Our NIS2 guide for SMEs sets out what you will then need to be able to demonstrate.

In-house IT or outsourcing

Many SME builders have a part-time in-house IT person, or a nephew who "does a bit with it". That works until you have 40 employees, two offices and three project sites. Then IT becomes a second job.

The options:

1. An in-house IT manager with external backup. For companies with 50 or more employees: someone handles day-to-day management, while an external partner covers holidays, sickness and the heavier security work.
2. Fully outsourcing to an MSP with an affinity for construction (one that knows what 4PS, Ibis or Exact Online Bouw are and understands VDI for Revit).
3. Hybrid. An MSP for general managed IT, an MSSP for a 24/7 SOC and security, while you stay in control of projects.

On the cost side, our guide to what outsourcing IT management costs in 2026 helps you put together a realistic budget.

Frequently asked questions about IT for the construction sector

What is the best way to share BIM models between the office and the building site? Work from one central source, such as a BIM cloud workplace in a Dutch data centre or a well-configured SharePoint with check-in/check-out. Don't share copies via WeTransfer or USB stick. On site, ideally use a tablet that pulls the latest version live over 4G or 5G.

How do I give temporary subcontractors IT access without handing them a full laptop? Give them a guest account in your Microsoft 365 tenant with MFA and access only to the relevant SharePoint folder or Teams team. That works from their own browser, with a temporary password and an end date. For larger subcontractors, a short contractual agreement on minimum security (such as demonstrable MFA, up-to-date endpoint security and secure backups) is sensible.

Does my construction company fall under the Dutch Cybersecurity Act (NIS2)? Directly, only if you have 50 or more employees and operate in a sector the law explicitly names (for example drinking water, wastewater, or public space under some interpretations). Indirectly, almost always: if you supply housing associations, energy, healthcare or government bodies, the supply chain audit will come anyway. Better to meet the ten duty-of-care requirements now than later under time pressure.

Roughly what does a proper IT set-up cost for an SME construction company with 40 employees? Budget roughly €40 to €90 per user per month for a managed workplace (Microsoft 365 Business Premium, endpoint security, backup, 8x5 helpdesk), plus one-off costs for implementation and migration. Rugged devices (laptop, tablet, phone) for site staff come on top of that. Site networks (4G/5G router plus outdoor Wi-Fi) are priced per project, usually €1,500 to €2,500 in hardware plus a monthly subscription for data.

How do I prevent invoice fraud by email (BEC) in our project administration? Combine three things: DMARC/SPF/DKIM on your email domain so your email can't easily be spoofed, MFA on the mailboxes of the accounts team and management, and a hard rule that every change to bank details is verified by phone using a known number, never a number taken from the email itself. Add awareness training for the people in your accounts team.

Conclusion

Good IT for the construction sector isn't a matter of buying "a nice package". It means bringing together the office workplace, BIM and drawing software, site connectivity, supply chain collaboration and cybersecurity in one plan that fits how your business works. Get it right, and you save time on every project, reduce the risk of data breaches and can pass a supplier audit without any fuss.

TRON Group works with Dutch contractors, installers and finishing contractors on exactly that combination: a managed workplace, secure access for subcontractors, site networking and 24/7 security. Want to know where your IT stands and where the first gains lie? Get in touch via our managed IT page or call +31 85 303 5869 for a no-obligation scan.