AI and security for engineering and planning firms
Project data in ten portals, drawings on every laptop and a client who asks for proof of security. Where we start in planning firms. And which recurring work can go first.
The situation
A planning firm lives on projects, and every project brings its own tools: the client's portal, the general contractor's exchange platform, the BIM model, plus email and the firm's own file storage. The data sits everywhere, and nobody in the firm has the job of keeping track of it.
In most firms IT is run by an external provider. The provider makes sure servers and laptops work. The responsibility for who can access which drawings, and for what happens when a laptop disappears, still stays with management.
At the same time, clients are changing what they ask for. Public tenders and larger clients ask in the procedure how information security is handled, and some require a certificate. Without a solid answer you lose points before fees are even discussed.
Margins in the planning business do not allow a dedicated security position. What they allow is clear responsibility, a review that first asks what can go, and answers that are ready for the next tender.
What we find in this industry
- Project data sits with clients, subconsultants and on laptopsEvery project has a different platform, every platform its own logins. In the end nobody knows where the current version of a drawing is and who can see it.
- An external firm runs IT, the responsibility stays with youThe provider keeps operations running. Whether backups can be restored, whether former staff still have open access and what happens in an emergency: nobody has given the provider that job.
- Tenders ask for evidence that nobody can provideQuestions on data protection, access control and emergency planning are answered from scratch every time, often just before the deadline. That costs points and late nights.
- Drawings and models are the capital, backup is a matter of trustYears of planning work sit on one server and a few laptops. People believe the backup runs. Whether it can be restored has rarely been tested.
- Access for former staff and subconsultants stays openInterns, freelancers, subconsultants: access is granted quickly and rarely revoked. On projects that run for several years, it adds up.
- Software and licences have grown over the yearsCAD, BIM, project platforms, cloud storage, protection software from different years. Much of it overlaps, and some of it nobody pays for consciously any more.
Where the time goes in planning firms, and what we build there
These are the workflows we ask about in the first conversation, because we find them in engineering and planning firms again and again.
Where the time goes
- Project progress only in someone's headWhoever wants to know where a project stands asks the project lead. She stops her work and answers.
- Every proposal written from scratchThere have been dozens of similar projects. None of them can be found, so it gets written again.
- The report to the client costs you FridayPull hours, costs, deadlines and open items from three systems, format, comment. For every project, every month.
- Hours reconstructed after the factAt month end nobody remembers exactly. What is missing gets estimated and not billed.
- Handover on departure costs weeksWhen someone leaves, the project history leaves too. The successor starts from zero, in front of the client.
- Minutes and open items scatteredMeeting minutes, emails, portals. Before every site meeting somebody collects what is still open.
What we build
- Proposals built on your own historyThe draft knows your earlier projects, your rates and your format. You review instead of writing.
- Project status without a reporting roundBudget, deadlines and risks for every project, current every day and readable for management.
- Client report from project dataThe monthly report is built from hours, costs and open items, in your format. The project lead comments instead of building.
- Handover when someone leavesWhen a person leaves, the project knowledge is already captured. The successor reads instead of asking.
Where we would start: Start with the proposal built from project data. You have the baseline from your last proposals, and the effect shows in the next one.
Typical trigger
A tender asks for information on information security, and nobody can prove it. Or a laptop with live projects goes missing, and it is unclear what was on it and who else has access.
The ODCUS difference
No selling of additional tools. The first step is always: what do you already have, what of it works, and what can we cut? Most mandates start by reducing cost and improving protection at the same time.
Why these services fit
Order in access, portals and backup, without stopping projects
We record where project data sits, who accesses it and what is backed up. The result is an order that works with the project business instead of against it.
Your external IT provider stays. We give the provider clear tasks and check that they are done, so you do not have to.
First count what is there, then invest
At a fixed price we assess the current state, uncover duplicate tools and prioritise by what really hits your business: data loss, open access, an outage in the final stretch of a project.
In many firms, what gets cut pays for a good part of what is missing. That is why this service comes first.
The answer for the next tender is ready
A lean ISMS answers the questions of clients and contracting authorities once, in a structured way, instead of again before every submission. Where a certificate is required, we support you through to ISO 27001 certification.
The certificate is the visible part. The practical benefit is that project leads no longer fill in questionnaires at night.
Responsibility on a mandate basis instead of a position
One to two days a month are enough in most firms to lead security: set priorities, steer the provider, report to management.
The mandate can be scaled back as soon as the order is in place. It is a cost structure that stays affordable even in a weak project year.
Who it is for
- Engineering, architecture and planning firms with 30 to 250 employees and no in-house IT role
- Firms that have to provide evidence of information security in public tenders or to large clients
- Owners who want to steer their external IT provider instead of trusting it
- Firms with many subconsultants, freelancers and project platforms
Related engagements
- Microsoft 365 hardening at a services company
- Gap assessment against the CIS Controls as the basis for a security program
- Coordinating an IT security program with external providers
Anonymised looks at real engagements. Not all of them come from this industry, but the task is the same.
FAQ
An external firm runs our IT. Is that not enough?
For operations, yes. For security, only half. The provider does what has been ordered. What has not been ordered is left undone: revoking access, testing backups, evidence for tenders. We define these tasks, hand them to the provider and check that they are done.
A client requires ISO 27001. Is that worth it for a firm our size?
If the certificate decides contracts, yes. A lean ISMS for a planning firm is much smaller than many expect, because it only covers the workflows that actually run in your firm. Often a provable state without a certificate is enough for the tender, and we clarify that first.
How do we handle drawings on laptops and private devices?
With a rule that works in day-to-day project work, and technology that enforces it: encrypted devices, central storage, access through accounts instead of through files. In most firms this can be done with what is already licensed.
Let us talk about your situation
Thirty minutes, free and without obligation. We tell you honestly whether and where we can help.