EPC Cyber Security

Article overview

Part 1 — The Digital Project

EPC Cyber Security: Protecting Project Data - The Digital Project - Buro Matei

Large industrial projects do not only build physical assets.

Long before a refinery, power station, mine, data centre, LNG facility or processing plant is complete, the project has already created another asset: the digital project.

It contains drawings, models, calculations, equipment data, contracts, schedules, vendor information, automation configurations, dashboards, personnel records and thousands of technical decisions.

This information moves between owners, consultants, EPC contractors, suppliers, subcontractors and specialists.

The first security question is not “Which firewall do we use?” It is “What information does this project depend on, and where does it go?”

Project data acccess

An EPC project is unusual because its digital boundary is continuously rebuilt.

Design consultants join. Package vendors receive information. Construction teams expand. OEM specialists arrive during commissioning. People move between packages. Organisations leave while accounts, downloaded files or system connections may remain.

The problem is that who needs access, to what, and for how long changes throughout the project.

Information classification

This is why information classification matters.

At Buro Matei, we distinguish between Public, Operational, Protected and Confidential information. The purpose is practical.

If everything is treated casually, sensitive information can travel too far. If everything is treated as highly confidential, normal collaboration becomes unnecessarily difficult.

Good classification helps the project apply controls that fit the information.

Confidentiality, integrity and availability

Security is also wider than secrecy.

A project depends on:

  • Confidentiality: the right people can see the information
  • Integrity: the information is correct and controlled
  • Availability: the information is accessible when needed

Integrity is especially important in EPC.

A progress dashboard can use an incorrect mapping. Construction can receive outdated information. An automation configuration can change without the project understanding what happened.

Nothing needs to be stolen for the consequence to be serious.

The result may look normal while being wrong.

Information handover

Project information also survives the project.

Drawings, asset data, vendor records, configurations and commissioning information eventually move into operations.

Poorly controlled project information can therefore become poorly controlled asset information at handover.

In Part 2, we look at the risks that hide inside normal project work.

Part 2 — The project data risks

EPC Cyber Security: Protecting Project Data

Many security problems in EPC do not begin with a hacker; they begin with legitimate project activity.

Many security problems begin with legitimate access.

A user downloads a spreadsheet. A supplier keeps information after its work finishes. A Power BI user exports underlying data. A developer copies production data into a test environment. An old account remains active.

There are four useful ways to think about what can go wrong.

1. Confidentiality and restricted information

Someone sees information they should not see.

This may involve intellectual property, commercial information, personal data, credentials, automation configurations or sensitive technical information.

Some project information is not only commercially sensitive. It can also be legally protected or controlled.

Personal data, trade secrets and certain technical information can create specific obligations about access, handling or transfer. For an EPC team, the practical lesson is simple: before sensitive information is shared across organisations or countries, the project should know whether restrictions apply.

2. Data integrity

Someone changes information, or the project can no longer trust it.

This may be more important to project execution than conventional data theft.

A transformation changes a progress value. An uncontrolled spreadsheet becomes a new source of truth. A semantic model applies incorrect business logic. An automation configuration changes without proper control.

The problem is not always obvious.

The report still opens. The number still looks believable.

But the decision is now being made from information that cannot be trusted.

3. Data availability and recovery

The project cannot reach information when it needs it.

Ransomware is one cause. An outage, failed integration or corrupted dataset can create the same operational problem.

Construction cannot retrieve the approved drawing.

Planning cannot update progress before a reporting deadline.

Commissioning cannot obtain the trusted configuration.

“Backup enabled” is not the same as “we can recover.”

4. Data and access drift

Finally, information continues travelling after control has been lost.

Downloads, screenshots, email attachments, supplier copies, exports, personal storage and test environments all create new locations where information may survive.

Access drift adds to the same problem.

A consultant changes role. A supplier finishes its package. A commissioning specialist leaves. Their access remains.

At Buro Matei, collaboration access is personal to the approved user and linked to the approved business purpose. Within Brumata, access can be organised by role, with elevated permissions separated from normal working access.

Access should follow the work.

The supply chain expands the same problem.

Verizon reported that third parties were involved in 48% of breaches across its 2026 dataset. That figure is not specific to EPC, but it matters for an industry where delivery depends heavily on consultants, vendors, subcontractors and service providers.

Cyber security in EPC is therefore also a procurement and supplier-management subject.

In Part 3, we move from these risks to the way security can become part of normal project execution.

Part 3 — Keeping project data secure

Security works best when it follows the project lifecycle.

Mobilise. Classify. Give access. Move information. Monitor. Recover. Demobilise.

Information classification

Before major data exchange begins, the project should understand what information it expects, who owns it, how sensitive it is and which organisations need access.

This is also the point to identify personal data, controlled technical information, client restrictions and approved systems.

The project does not need to turn mobilisation into a legal exercise.

It needs enough clarity to avoid discovering important restrictions after information has already spread.

Access control

EPC Cyber Security: Protecting Project Data

Access should follow a person’s role and approved purpose.

The better question is not:

“Can this person have access?”

It is:

“What does this person need to do, and what information does that work require?”

The same principle applies to automation.

Within Brumata, we separate human users from system identities used for integrations and automated processes. An integration should not depend on somebody’s normal personal account.

This improves control and makes automated activity easier to trace.

Data movement and integration

Modern EPC information rarely stays in one system.

A typical path may be:

  • Source system
  • Controlled connection
  • Raw data
  • Transformation
  • Curated data
  • Semantic model
  • Power BI or application
  • Export or further sharing

Every step changes the security picture.

A protected source system provides limited protection if the integration copies the same information into an uncontrolled destination.

Environment separation

EPC Cyber Security: Protecting Project Data

Development, test and production environments should be separated.

At Buro Matei, Brumata uses separated environments so that changes can be developed and tested before they affect live project work.

The principle is simple:

  • Build
  • Test
  • Validate
  • Release

Analytics and reporting security

Power BI deserves special attention.

Power BI is not only a visualisation layer. It is also a publishing layer.

Imagine engineering information is available to one group. Cost data is restricted to another. Staffing data sits elsewhere. Procurement status is managed in another system.

Individually, each source may have reasonable access.

A management dashboard can combine all four.

The resulting view may reveal much more about the project than any individual source.

Data integration therefore changes security risk.

Controlling who can open a report is also not necessarily the same as controlling who can access the semantic model, inspect underlying data or export information.

Traceability and audit

Projects should have a reasonable chance of understanding important changes.

  • Who changed the access?
  • Which identity ran the integration?
  • When did the transformation change?
  • Which version reached production?

Traceability supports cyber security, but also project assurance and problem solving.

Incident response and recovery

The project should know who responds when something fails, which systems matter most and how information can be restored.

This becomes especially important where legal or client reporting deadlines apply.

For example, GDPR can require notification of certain personal-data breaches within 72 hours. The project therefore cannot wait several days before deciding internally who needs to investigate an incident.

Digital demobilisation

When people and organisations leave, access should end with the work.

Unnecessary identities and integrations should be reviewed. Required information should be retained. Unnecessary copies should be removed. Final data and configurations should be handed over deliberately.

Project demobilisation should include digital demobilisation.

Part 4 — Controlled freedom to deliver projects

B

Cyber security is often described by what did not happen.

  • No breach
  • No ransomware
  • No data leak

Those outcomes matter, but they are not the full business case.

The stronger result is a project that can use its information with less uncertainty.

The goal is not maximum restriction. The goal is controlled freedom to work.

Project performance

  • If teams work from incorrect or outdated information, rework can follow.
  • If management does not trust the data, decisions become slower or weaker.
  • If access is poorly controlled, commercial information, intellectual property or client data can be exposed.
  • If systems cannot be restored, productive work can stop.
  • If digital close-out is weak, operations may inherit unmanaged accounts, copies, connections and configurations instead of a controlled digital asset.

Good security therefore supports normal EPC performance.

Information governance

  • Clear roles make onboarding and role changes less improvised.
  • Classification allows normal information to move without treating everything as highly confidential.
  • Controlled integrations improve confidence in dashboards and management reporting.
  • Traceability makes technical problems and disputes easier to reconstruct.
  • Recovery planning reduces the amount of productive time that can be lost after a digital failure.
  • And disciplined handover improves the quality of the information that becomes part of the operating asset.

Cyber security lifecycle

NIST’s Cybersecurity Framework expresses the wider principle through Govern, Identify, Protect, Detect, Respond and Recover.

For EPC teams, the important point is that protection alone is not enough. The project must also understand what matters, see important changes, react and recover.

Buro Matei and Brumata

At Buro Matei, we approach information security as a combination of governance, people, information, contracts and technology.

Brumata supports this with controls such as role-based access, separate human and system identities, environment separation, controlled data movement and audit capabilities.

These controls support the project. They do not replace the responsibilities of owners, EPC contractors, consultants, suppliers and users.

A project that knows where its critical information is, who controls it and whether it can be trusted is easier to manage.

The real question is not “Are we cyber secure?”

It is “Do we understand what information our project depends on, who can reach it, where it can move, what happens if it is lost or changed, and how we recover?”

When a project can answer those questions well, cyber security becomes part of good EPC execution.

References

Search

Want to know more?

Contact Us