Why Design Firms Are a Specific Target
Architecture and engineering firms hold something attackers find useful: large, complex files that are difficult to recreate and that clients need immediately. A project model is not a database of customer records. It is the deliverable itself, and stopping access to it stops the project. The concentration is the problem. A firm with twenty active projects has twenty active models, all on the same network, all potentially encrypted in a single ransomware event. The recovery timeline is not measured in hours of IT work. It is measured in weeks of rebuilding, re coordinating with consultants, and managing client relationships through a crisis that is visible to everyone on the project. The financial exposure runs in two directions. First party costs are the firm's own: forensic investigation, legal counsel, notification if client data was accessed, business interruption while systems are down, and ransom payment and negotiation where lawful and approved. Third party costs are claims from clients whose projects were delayed, whose data was accessed, or who allege the firm failed to protect their information. Both are real, and they are covered by different policies that were not designed to work together.
- Design work product is concentrated in large files that are difficult to recreate
- A single ransomware event can stop every active project simultaneously
- First party costs include forensics, legal, notification, interruption, and ransom
- Third party costs include client delay claims and data protection liability
The Gap Between Professional Liability and Cyber
Professional liability covers third party damages arising from negligent acts, errors, or omissions in professional services. Cyber insurance covers first party costs and third party liability from network security and privacy events. Those two descriptions sound like they cover everything. They do not, and the gap is predictable. Professional liability forms typically exclude cyber events, or address them only through a small sublimit. Cyber forms typically exclude professional services claims, on the theory that professional liability covers those. So a client who sues because a ransomware event delayed their project and caused them to miss a construction start date has a claim that looks professional, because it arises from the firm's failure to deliver services, and also looks cyber, because the cause was a network security event. Each carrier may look to the other. The way to find the gap is to take one realistic scenario, a seven day ransomware event that delays three active projects, and trace it through both policies: what each covers, what each excludes, and where the two exclusions overlap. Most firms find at least one category of loss that neither policy clearly reaches. That is the gap worth addressing before the event rather than discovering during it.
- Professional liability excludes cyber events or addresses them with a small sublimit
- Cyber forms typically exclude professional services claims
- A project delay caused by ransomware can fall between both exclusions
- Trace one realistic scenario through both policies to find the gap
Client Contract Requirements and the Insurance Application
Two documents increasingly require specific cyber controls from design firms: client agreements and cyber insurance applications. The overlap between them is where firms create problems for themselves. Client agreements, particularly from institutional owners, government agencies, and large developers, now routinely require multifactor authentication, encryption of project data, specific backup practices, access controls on project platforms, and incident notification within defined windows. These are contractual obligations, and agreeing to controls you do not have is a breach independent of any incident. Cyber insurance applications ask the same questions. If you agree to controls in a client contract that you do not actually have, and you answer the insurance application inaccurately about the same controls, you may jeopardize coverage. Keeping one current and accurate list of your actual controls, used for both contract review and applications, resolves both risks at once. The practical discipline is to review client contract cyber requirements before signing, the same way you review insurance requirements. A control you cannot meet is a negotiation point before signature and a breach after it.
- Client agreements increasingly require specific controls including multifactor authentication and backup practices
- Agreeing to controls you do not have is a breach independent of any incident
- Cyber applications ask the same questions, and inaccurate answers can jeopardize coverage
- Maintain one current list of actual controls, used for both contract review and applications
Controls That Matter Most in a Design Environment
Generic cyber hygiene applies, but a few controls matter disproportionately for design practice. Backup architecture is first and most important. Model and drawing backups need to be isolated from the production network, tested by actual restoration rather than by assuming the job completed, versioned far enough back to recover a clean copy of a corrupted model, and fast enough to restore large files in a usable timeframe. A firm that has never test restored a full project model does not know whether it can. Multifactor authentication on email and on remote access is second, and it is now effectively a condition of obtaining cyber coverage on reasonable terms. Email is also where funds transfer fraud starts, which brings in the third control: a written payment verification procedure requiring out of band confirmation of any change to payment instructions, enforced without exception regardless of who appears to be asking. Fourth, access control on model coordination platforms. Projects accumulate external participants, and permissions rarely get removed when people leave projects or firms. A periodic access review on active projects is unglamorous and effective. Fifth, an incident response plan that names who to call, in what order, with the cyber carrier's hotline in it. Most cyber policies require prompt notice and provide access to a panel of forensic and legal resources, and using the carrier's panel from the first hour generally produces a better and better covered outcome than engaging your own vendors and seeking approval afterward.
- Isolate and version model backups, and verify them by actual test restoration of a full project
- Multifactor authentication on email and remote access is effectively a coverage condition
- Enforce out of band verification for any change to payment instructions, without exception
- Review external access on active project platforms, and keep the carrier hotline in your incident plan
Frequently Asked Questions
Related Resources
This article is for general information and is not a substitute for policy language or professional advice.