Turn ISO 27001 Controls Into Tender-Ready Proof
Many Australian builders and subcontractors are now seeing new questions in government and tier-one tender portals about cyber and information security. These questions often sit right beside the normal HSEQ and project delivery sections, and they can be the difference between getting shortlisted or getting cut early. If your team scrambles at the last minute to answer them, you are not alone.
ISO 27001 talks about Annex A controls, risk treatment and information assets, which can feel very abstract on a building site. Your world is site sheds, project files, design data, safety records, subcontractor details and cloud-based project tools. To turn that theory into something that actually wins work, you need a construction-specific ISO 27001 controls checklist that translates each control into clear, simple proof.
In this guide we walk through how Annex A controls map to real construction risks and processes, what tender panels actually want to see, and how templates and an evidence pack can save your team weeks of last-minute stress.
What ISO 27001 Really Means on a Building Site
ISO 27001 is about protecting information so it stays accurate, available when needed and only seen by the right people. For builders, that means things like:
- Design drawings and BIM models
- Tender pricing and bid strategies
- Contracts and progress claims
- Safety and incident records
- Client and subcontractor details
All of this lives across head office servers, laptops, site sheds, mobiles and cloud platforms. ISO 27001 asks you to understand those information assets, assess risks and apply reasonable controls.
Three terms can help keep it straight:
- Statement of Applicability (SOA): a list of all Annex A controls, which ones you apply and why.
- Annex A controls: the high-level requirements, for example access control, backup, supplier security.
- Operational documents: the tools your teams touch daily, such as SWMS, ITPs, site diaries, subcontractor agreements and induction records.
In practice, many risks on building projects are very specific:
- Ransomware on a project server locking up drawings and RFIs
- Compromised subcontractor portals used to send fake payment instructions
- Stolen site tablets with drawings and client details
- Shared USBs with design files passed around between office and site
- Email fraud targeting progress claims and bank details
ISO 27001 gives you a framework to control these, instead of crossing your fingers and hoping IT can fix things if they go wrong
Mapping Annex A to Construction Risks and Processes
A simple way to make ISO 27001 usable for builders is to group Annex A controls into practical clusters that match how you work.
1. Governance and leadership
This is about direction from the top, clear responsibilities and risk decisions. For example:
- Protecting tender pricing: senior leaders approve which staff can see full bid numbers, backed by a documented risk assessment.
- Board or leadership review of cyber risks as part of normal business meetings.
- Clear ownership for information security in the same way you have owners for safety and quality.
Evidence could be meeting minutes, a risk register and an approved information security policy.
2. Project and document control
Here we connect Annex A controls on information classification, document control and change management with:
- Revision control of drawings on site, so only current sets are in use.
- Secure transfer of design files to and from consultants.
- Managing access to shared drives or a common data environment for subcontractors.
Evidence includes your drawing and document control procedure, screenshots of your document management system set-up and sample transmittals.
3. HR and subcontractor management
These controls focus on people and suppliers:
- Induction processes that cover cyber awareness for site teams and office staff.
- Subcontractor agreements that include information security expectations.
- Leaver processes so staff and subcontractor access is removed when they finish.
Evidence can be induction forms, HR checklists, and sample contract clauses.
4. Technology and remote access
These are the more technical Annex A controls:
- Secure configuration of project management software and mobile apps.
- Multi-factor authentication for remote access to tender folders.
- Management of company mobiles, laptops and tablets used on site.
Evidence might be screenshots of security settings, an asset register and a simple BYOD or device policy.
5. Incident and continuity planning
Annex A also covers how you prepare and respond:
- A clear process if a site tablet with drawings is lost.
- Backups of project files so you can restore quickly after an outage.
- Defined steps if a supplier portal is compromised.
Evidence can include an incident response flowchart, backup procedure and sample incident logs.
When you map each Annex A control to a construction scenario and a piece of evidence, you create a practical ISO 27001 controls checklist. A simple table works well: one column for the control, one for a construction-specific example, one for the evidence item.
Practical ISO 27001 Controls Checklist for Builders
Not every builder needs the same level of detail on day one. A realistic ISO 27001 controls checklist for construction can be staged.
For smaller builders, must-have controls often include:
- Basic information security policy
- Access control for pricing and contract folders
- Simple asset register for laptops, mobiles and tablets
- Backup and restore process for project data
- Incident reporting procedure
Mid-tier contractors can then build on this with:
- Formal supplier and subcontractor information security requirements
- More detailed risk assessments for major projects
- Centralised document and drawing control linked to the ISO 9001 system
- Regular internal audits that cover information security and HSEQ together
Key evidence types usually fall into three buckets:
- Policies, such as information security, BYOD, remote work and acceptable use
- Registers, such as asset, access, training and incident registers
- Operational records, such as induction forms, toolbox talk records, design review minutes and incident reports
Most Australian builders already have ISO 9001, ISO 45001 or ISO 14001 systems in place. The smart move is to align ISO 27001 with what you already have. For example, you can:
- Add information security to existing risk registers
- Extend current induction and toolbox talk templates with cyber topics
- Piggyback on document control procedures used for quality and HSEQ
This way, you reuse evidence instead of creating new documents from scratch.
Tender-Ready Evidence Pack Templates and Examples
A tender-ready ISO 27001 evidence pack is a structured folder of documents that answer common information security questions before they are even asked. It speaks the language of Annex A but shows it in a way construction clients understand.
A simple pack might include:
- Information security policy tailored for head office and sites, covering how staff handle drawings, pricing, client data and devices
- Secure drawing and document control procedure that shows how your common data environment or document management system controls access and revisions
- Access control matrix listing user roles for project management software and site apps, showing who can view, edit or approve sensitive information
- Cyber incident response flowchart that shows steps for project teams and IT if there is a suspected breach, lost device or ransomware attempt
To make life easier for procurement panels, label documents clearly and cross-reference them. For example, in the footer or cover page you might note which Annex A controls and ISO 27001 clauses each document supports. You can also keep an index sheet that maps tender questions to items in your evidence pack, cutting down on clarification questions and delays.
Seasonal Cyber Risks for Construction in Mid-Year Tenders
Around mid-year, many Australian builders push hard to get tenders out the door. Deadlines are tight, key staff take leave and more work is done remotely. This creates easy openings for simple but damaging cyber incidents.
Common seasonal risks include:
- Rushed approvals for new subcontractor access to systems, with little checking of who really needs what
- Quick uploads of confidential tender files to shared links without proper access controls
- Phishing emails dressed up as urgent RFIs, contract variations or bank detail updates
You do not need a full rebuild of your systems to reduce these risks before peak periods. Simple, time-bound actions tied to Annex A controls can help, such as:
- Short cyber awareness toolbox talks focused on RFIs, payment fraud and safe file sharing
- Enabling multi-factor authentication on core systems handling tenders and pricing
- Quick reviews of access lists for tender folders and project portals, removing old or unused accounts
By linking these small actions to your ISO 27001 controls checklist, you show clients that seasonal risk is being managed in a structured way, not on the fly.
Turn Your Controls Checklist Into a Win-More-Tenders Asset
A construction-specific ISO 27001 controls checklist and evidence pack does more than tick compliance boxes. It shows clients that your information security is as disciplined as your safety and quality, which means fewer surprises for them during delivery. It also reduces friction inside your own business, because staff know where to find answers and documents when a tender portal starts asking detailed cyber questions.
When information security is treated as an extension of your existing HSEQ culture, not a separate IT project, it becomes part of how you plan work, run sites and close projects. One integrated system that covers quality, safety, environment and information security is easier for your teams to follow and easier for clients to trust.
Protect Your Information With A Clear, Actionable Plan
If you are ready to strengthen your information security, our detailed ISO 27001 controls checklist will help you identify gaps and prioritise improvements with confidence. At Edara Systems Australia, we work alongside your team so you can align with ISO 27001 requirements in a practical, cost-effective way. Speak with our specialists to map out your next steps or request tailored support via our contact page.
