The 17-field intake form commercial general contractors send to subs to vet cybersecurity posture before granting access to owner financial data, schedules, BIM models, or HR systems. When CMMC isn’t the right framework.
Why this questionnaire exists
Most cybersecurity vendor questionnaires you’ll find on the internet were written by SaaS security platforms, Vanta, Drata, Tugboat, for tech-company buyers vetting other tech-company vendors. They ask about SOC 2 reports, SAML SSO, AWS responsibility matrices, and pen-test cadences in language that assumes the vendor is itself a software company. That language doesn’t survive contact with a regional electrical sub running QuickBooks on a back-office desktop.
Construction has a different problem. The commercial general contractor isn’t worried about a vendor breaching their CRM. They’re worried about wire fraud during change-order payments, ransomware locking up project schedules two weeks before a turnover, business email compromise (BEC) on the AP inbox at the moment a $400K invoice flows through, and a sub’s payroll provider getting popped and exposing every framer’s SSN. Construction is now one of the highest-frequency industries for BEC attacks. IC3 has flagged it for years, and insurance carriers are repricing cyber renewals around it. The threat is real and it’s specific.
This questionnaire is built for the gap CMMC doesn’t fill. CMMC applies to federal-construction primes and their subs when the project involves Federal Contract Information (FCI) or Controlled Unclassified Information (CUI). The DoD-specific framework with SPRS scoring, C3PAO certifications, and DFARS 252.204-7021 flow-down clauses. If you’re a commercial GC building a hospital, a corporate campus, a multifamily project, or a private-sector industrial facility, CMMC is irrelevant. But you still have subs touching real-money systems: project management platforms with owner financial data, accounting integrations with payment data, HR systems with employee PII, BIM coordination platforms with proprietary IP, and email systems where wire-transfer instructions live. You need a way to vet whether those subs can be trusted with that access. Without forcing a CMMC framework that doesn’t apply.
The 17 fields below are what a commercial-construction risk officer or contracts admin actually wants to know before granting a sub access to owner project data. They cover identity (who’s the security contact at this firm, not just the IT vendor), basic hygiene (MFA on email and admin accounts, password manager, EDR coverage), email-specific BEC controls (DMARC / SPF, phishing-test cadence, wire-fraud verification process), incident readiness (breach-notification SLA, IR plan testing, business continuity), and posture signals (cyber-insurance carrier and limit, SOC 2 status if any, sub-of-sub flow-down). Some subs will fill it out cleanly in 20 minutes because their MSP runs a tight ship. Others will struggle with half the questions because nobody’s ever asked them before, and that’s the signal you’re looking for.
What this is NOT: it’s not a SOC 2 audit, it’s not a CMMC self-assessment, and it’s not legal advice. It’s the practitioner’s intake. The document you put in front of every sub during prequal, before they get access to your project management platform, your accounts payable inbox, or your shared drive. Send it once at prequal. Refresh it annually. Refresh it whenever the sub changes carriers, key cloud platforms, or experiences a security incident. File the completed form alongside the COI, the W-9, the license verification, and the financial vetting. That’s your due-diligence packet when an owner asks why you trusted this sub with their data.
Who uses this
- Commercial general contractors prequalifying subs for non-federal projects with owner data exposure
- Mid-market GCs managing multifamily, hospitality, healthcare, or industrial projects where subs touch financial or HR systems
- Federal primes as a pre-CMMC baseline for subs that won’t handle FCI/CUI but still touch project schedules and AP systems
- Risk managers and contracts admins running the prequalification cycle alongside COI and financial vetting
- Construction CFOs and controllers worried about BEC and wire fraud in the AP-to-sub payment flow
What’s included. 17 cybersecurity fields covering identity, hygiene, BEC controls, incident readiness, posture
The questionnaire captures 17 fields covering identity, hygiene, email and BEC controls, incident readiness, and posture signals:
- Sub’s primary security contact (name, title, phone, email). Not the IT vendor or the MSP. The actual person at the sub who owns security decisions and would answer the phone at 2am if there’s an incident on your project. If the sub names their MSP here, push back: who’s the internal owner? A sub without an internal security contact is a sub that hasn’t thought about the problem.
- MFA enforcement on email, file-sharing, and admin accounts. Yes/No across three categories: company email (Microsoft 365 / Google Workspace), file-sharing (Dropbox, Box, OneDrive, Google Drive, project platforms), and any administrative account (servers, network, payroll, accounting). MFA on email alone is table stakes. Anything less is a credible BEC entry point.
- Password manager deployed across all employees. Yes/No + product name (1Password, Bitwarden, Dashlane, LastPass). A shared password spreadsheet or a tradition of “Welcome2024!” for every system means the first phished credential cascades through everything. Naming the product confirms it’s actually deployed, not just licensed.
- Endpoint detection and response (EDR) or anti-virus coverage. Yes/No + product name (CrowdStrike, SentinelOne, Microsoft Defender, Sophos, etc.) + percentage of employees covered. “We have AV on most laptops” is not coverage. Sub should be able to state the product and confirm 100% endpoint coverage including BYOD if applicable.
- Patching cadence for OS, browsers, and business applications. Free-text response describing how operating systems, browsers, and major business apps are patched (managed by MSP, employee-self-managed, automatic). Construction subs running Windows 7 estate equipment or unpatched Adobe Reader installations are vulnerable to commodity ransomware.
- Backup strategy with stated RTO and RPO. Free-text response on what’s backed up (file servers, accounting data, project files, email), where backups live (on-prem, cloud, both), how often, and the recovery time objective (RTO) and recovery point objective (RPO). Subs without offline or immutable backups are one ransomware event away from missing your project deadlines.
- Email authentication and BEC controls (SPF, DKIM, DMARC). Yes/No: domain has SPF, DKIM, and DMARC configured at p=quarantine or p=reject. Construction is a top BEC-targeted industry. Attackers spoof sub domains to redirect change-order payments. Properly enforced DMARC blocks the most common attack vector. Verify externally with mxtoolbox if needed.
- Phishing-test cadence and BEC training program. Free-text response describing if and how often the sub runs simulated phishing tests (monthly, quarterly, never), what training accompanies it, and click-rate trend if known. Subs that have never run a phishing test have a click rate of 25-40% on average. That’s the population you’re handing wire-transfer instructions to.
- Wire-transfer and change-order payment verification process. Free-text response describing the sub’s process for verifying any change in payment instructions, banking info, or wire details. Industry-standard answer: callback to a known phone number from a previously verified contact, never to a number provided in the email itself. If the sub doesn’t have a process here, BEC will eventually hit them and the loss will land on your project.
- Cyber-insurance carrier, per-incident limit, and SIR. Carrier name, per-incident limit (typical range $1M-$5M for mid-size construction subs), and the self-insured retention (SIR). A sub with $250K of cyber coverage and a $25K SIR can’t absorb a $2M ransomware event. The loss flows up the contract chain. Verify against the carrier-provided cyber rider, not just stated coverage.
- Data classification and owner-data handling policy. Free-text response on whether the sub has a written data classification policy, how owner project data (drawings, schedules, BIM models, financial reports) is treated, and whether it’s segregated from the sub’s general business data. “We treat everything the same” is a yellow flag. Owner data should be locked down, not co-mingled with the sub’s marketing files.
- BYOD policy and mobile device management (MDM) coverage. Yes/No on BYOD policy + MDM platform (Intune, Jamf, Kandji, none) + percentage of mobile devices managed. Field foremen using personal phones to receive project drawings and financial documents are a real exposure. MDM enforces encryption, remote wipe, and policy compliance.
- Third-party application inventory and access reviews. Free-text response on whether the sub maintains an inventory of all SaaS apps and third-party integrations connected to their email, file-sharing, and accounting systems, and how often access is reviewed (quarterly, annually, never). Forgotten OAuth tokens to defunct apps are a common breach path.
- Breach-notification commitment and SLA to your firm. Yes/No: sub commits to notifying your firm of any cybersecurity incident affecting your project data within a defined SLA (industry standard: 72 hours from discovery). Required for any sub touching owner financial data, schedules, or HR information. Capture the commitment in writing. Verbal “of course we’d tell you” doesn’t survive a real incident.
- Incident response plan testing and business continuity plan. Free-text response describing if the sub has a written incident response (IR) plan, when it was last tested or tabletop-exercised (within 12 months is the bar), and whether a business continuity plan exists for ransomware/extended-outage scenarios. An untested IR plan is a document, not a capability.
- Sub-of-sub flow-down acknowledgment for any tier-2 vendors. Yes/No + signature: sub acknowledges they will impose equivalent cybersecurity expectations on any of their own subs or vendors that will receive your project data (e.g., a sub’s payroll provider, their bookkeeper, their BIM coordinator). The chain is only as strong as the weakest tier-2 link, and tier-2 visibility is where most primes lose track.
How to use the questionnaire
Send this questionnaire during prequalification, alongside the COI request, the W-9, and the financial vetting forms. For each new sub:
- Email the form (PDF or DOCX version) to the sub’s main point-of-contact during the prequal cycle. 10 business-day SLA for return. Give them more time than a COI because some fields require coordination with the sub’s MSP or insurance broker.
- When the response comes back, verify items 7 (SPF / DKIM / DMARC) externally with mxtoolbox, and verify item 11 (cyber-insurance) by requesting the cyber rider from the carrier rather than relying on the sub’s stated coverage.
- Cross-reference items 1 (security contact) and 16 (IR plan testing). A sub with a real internal security owner and a tested IR plan is a different risk profile than a sub with neither.
- Score the questionnaire against your risk tier: subs touching owner financial data should be expected to clear at minimum items 2, 7, 9, 11, 15. Subs touching HR or PII data should additionally clear items 4, 6, 12, 16. Material-only suppliers can be exempted entirely.
- Save the completed questionnaire in the prequalification file alongside the COI, license verification, and financial vetting. Refresh annually and on every new project that materially changes the data the sub will access.
Stop chasing cybersecurity answers from subs.
The 17 fields above take a contracts admin 25 minutes per sub when answers come back clean, and 3-4 hours per sub when fields are incomplete, vendor names are missing, or DMARC policies need to be verified externally. Multiply across 40+ subs on a commercial project and you’ve built a meaningful chunk of the prequal cycle out of cybersecurity vendor management. Contracts Connected’s Subcontractor Prequalification feature pulls this questionnaire into the prequal flow alongside COI, W-9, and financial vetting, requests responses with automated reminders, verifies DMARC and SPF externally, and flags any sub whose answers fall below your risk-tier thresholds. Before you grant project access.
For educational purposes. These templates, checklists, and trackers are operator-built starting points designed to help you move faster on the kind of work that usually drowns construction admins in email chains. They are not legal, insurance, accounting, or tax advice. Each project, jurisdiction, and contract has its own quirks. Review the document, refine the language, and consult your attorney, broker, CPA, or compliance officer before relying on it for a live project decision.
Frequently asked questions about vendor cybersecurity vetting in construction
When does this questionnaire apply versus a CMMC questionnaire?
This applies whenever the project does not involve federal Controlled Unclassified Information (CUI) or Federal Contract Information (FCI). I.e., commercial, multifamily, hospitality, healthcare, industrial, and most state/local public projects. Use the CMMC vendor questionnaire instead when the project is a DoD federal-construction project subject to DFARS 252.204-7021 flow-down. The two questionnaires can coexist: federal primes use the CMMC version for subs touching CUI and this version for subs that don’t touch CUI but still touch project data, AP systems, or HR systems.
Which subs actually need to fill this out?
Any sub that will receive access to your project management platform (Procore, Autodesk Construction Cloud, etc.), your accounts payable inbox, your shared drive, your BIM coordination environment, or your owner’s financial reporting. Material-only suppliers receiving purchase orders and delivery addresses can be exempted. The bar is “does this sub touch a system where a breach would create owner exposure or wire-transfer risk?”. If yes, they fill it out.
What if a sub fails several questions?
Failure isn’t binary. Tier the response: subs with weak posture on items 2, 7, 9 (MFA, DMARC, wire verification) are a near-term BEC risk and shouldn’t be granted AP-system access without remediation. Subs with weak posture on items 4, 6, 11 (EDR, backups, cyber insurance) are a ransomware exposure and shouldn’t handle schedules or financial data. Subs strong everywhere except SOC 2 are usually fine. Most construction subs don’t have Type II and that’s not the deciding factor. Document the gaps, require a 60-90 day remediation plan, and re-verify before final award.
How is this different from the SaaS-vendor questionnaires online?
The questionnaires written by SaaS security platforms assume the vendor is itself a software company answering questions about their hosting environment, AWS shared-responsibility, SAML SSO support, and pen-test reports. A regional electrical sub running QuickBooks doesn’t have answers to those questions because the questions don’t apply. This version replaces SaaS-specific language with construction-specific controls: BEC-targeted email authentication, wire-transfer verification, owner-data handling, BIM platform access, and tier-2 sub-of-sub flow-down. Same risk-management goal, language that the actual respondent can answer.
Why so much focus on BEC and wire fraud?
Because construction is one of the highest-frequency BEC-targeted industries in the U.S. The attack pattern is consistent: attacker compromises sub email via phishing, monitors AP correspondence, waits for a change-order or payment cycle, sends a spoofed email with updated banking instructions, and the wire goes to the attacker. FBI IC3 reports six- and seven-figure individual losses are routine in construction BEC. Items 7, 8, and 9 (DMARC, phishing tests, wire verification) are the three highest-leverage controls against this pattern, which is why they’re called out specifically rather than buried in a generic “email security” question.
How often should I refresh responses?
At minimum annually, on the questionnaire response date anniversary. Refresh additionally whenever the sub changes cyber-insurance carriers, materially changes their cloud platforms (e.g., migrates from on-prem to Microsoft 365), experiences a known security incident, or starts a new project with a meaningfully different data scope. A sub that filled this out two years ago for a small interior fit-out shouldn’t get unrefreshed access to a new $40M healthcare project’s financial systems.