IIJA Funding and Cyber Security Risks in Construction

  • Home
  • IIJA Funding and Cyber Security Risks in Construction
IIJA Funding and Cyber Security Risks in Construction

Surety Bond Professionals is a family owned and operated bonding agency with over 30 years of experience. With access to a broad range of surety markets, our expert agents are ready to assist with all of your construction bond needs.

The Threat of Cyber Attack

Cybersecurity experts have warned us for several years of the threat that cyber attacks pose to critical infrastructure and those who rely on it. Water supplies, electrical grids, banking, and communication systems are particularly vulnerable to disruption through cyber attacks. Sensitive personal and corporate information can be acquired through data breaches and sold, held for ransom, or used for other nefarious purposes.

The construction industry is far from immune to cyber attacks. In 2021, construction was the third most frequently targeted industry as far as ransomware is concerned, accounting for 13.2% of all ransomware attacks in North America. It’s a favored target because of a lack of awareness and inadequate cybersecurity measures. One study found 74% of businesses in the construction industry are unprepared to respond to a cyber attack, despite the abundance of sensitive data and financial information they accumulate. And as the use of artificial intelligence and degree of connectivity in construction continue to increase, so does the need for additional data security.

Cybersecurity Initiatives

The federal government is well aware of the threat of cyber attacks and is taking measures to prevent incidents, for example by making project funding of state and local projects contingent on ensuring the security of their information systems. The Infrastructure Improvement and Jobs Act (IIJA) includes a number of appropriations for cybersecurity projects, such as the development of advanced cybersecurity applications and technologies for the energy sector ($250 million), the creation of a Cyber Response and Recovery Fund to help public and private organizations in the aftermath of a cyber attack ($20 million per year through 2027), and funding for critical infrastructure security and resilience research, development, testing, and evaluation by the Department of Homeland Security’s Cybersecurity and Technology Directorate ($157.5 million).

IIJA grant applicants are required to develop a cybersecurity plan describing their approach to continuous cybersecurity vulnerability assessment and threat mitigation, implementing best practices for enhancing cybersecurity, and addressing cyber threats related to critical infrastructure. Contractors interested in bidding on or participating in projects funded by IIJA grant money need to have a compliance program in place that is aligned with the cybersecurity requirements contained in the Federal Acquisition Regulation (FAR). They also should be prepared to provide the federal government with a detailed cybersecurity plan upon request.

Impact on Bonding Capacity

Construction companies grow only to the extent that their bonding capacity supports growth. Companies bidding on IIJA-funded contracts most likely will be required to provide certain construction bonds that are mandated for government-funded construction projects. Surety bond guarantors examine every construction bond application in terms of the contractor’s financial strength and stability, experience in the construction industry, and business practices. When seeking work on an IIJA-funded project, that will most likely include looking at the cybersecurity plan required under IIJA. The surety’s underwriters will certainly consider whether a contractor’s cybersecurity is strong enough to mitigate the risk of cyber attack or the contractor’s actions in responding to and recovering from a previous attack. If the risk level is too high, the contractor might be assigned a higher than usual bond premium rate. Cybersecurity issues might even determine whether the contractor will be approved for a high enough aggregate bonding capacity to support the company’s continued growth.

Surety Bonds You Might Need

The most commonly required construction bonds for federally funded projects such as those funded by IIJA grants are bid bonds, performance bonds, and payment bonds.

  • A bid bond guarantees that if chosen as the winning bidder, the contractor will enter into the contract at the bid price and is able to obtain the necessary performance and payment bonds.
  • A performance bond protects the project owner against financial loss if the contractor defaults or fails to complete the job according to the terms of the contract.
  • A payment bond is the contractor’s guarantee to pay suppliers, subcontractors, and workers in accordance with the construction contract, indemnifying the project owner against any legal liability for the contractor’s unpaid bills.

Other surety bonds also may be required, such as maintenance bonds, site improvement bonds, or supply bonds.

Call Us Today

Our surety bond professionals will help you grow your revenue by maximizing your surety capacity. Call us today!