Architecture and engineering firms

Most small-business IT advice assumes office documents and a stable team. Architecture and engineering firms work on files measured in hundreds of megabytes or more, with project teams that change every few months, outside consultants who need access to some folders but not others, and staff who spend half their week on site.

The result is a set of problems that generic setups handle badly: sync clients choking on large models, shared links scattered across years of projects, laptops on site Wi-Fi with no protection, and an archive of past projects that is both valuable and rarely backed up properly.

Cloud sync works well for documents and struggles with large, frequently saved models and linked references. Depending on your software and team size, the right answer may be a local file server or NAS with cloud backup, a cloud file service tuned for large files, or a hybrid with active projects local and closed projects in the cloud.

What matters is that the design is deliberate: tested against your actual file sizes, with clear rules on where live project data lives and no copies drifting on personal desktops.

Firms share drawings and specifications with clients, consultants, contractors and authorities. In SharePoint and OneDrive, Microsoft lets administrators set external sharing at the organization level and tighten it per site, from 'Anyone' links through 'New and existing guests' and 'Existing guests' to 'Only people in your organization'. A site per project with sharing set to guests only, and links that expire, is a sensible default.

Microsoft Purview sensitivity labels can mark and protect confidential material, such as security-sensitive drawings for critical facilities, so protection travels with the file.

• Turn off anonymous 'Anyone' links by default
• Set expiry on guest access and review guests when a project closes
• Use one site or team per project so access is easy to remove
• Label documents that carry client confidentiality obligations

Laptops and tablets on construction sites connect to whatever network is available and are more likely to be lost or stolen. Microsoft Intune can enforce encryption, screen locks and updates, and allow a lost device to be wiped remotely. Treat site Wi-Fi and contractor networks as untrusted: firm resources should be reached through properly secured cloud services or a VPN, never by exposing a file server to the internet.

Ransomware groups target file servers because that is where the irreplaceable work sits. The Canadian Centre for Cyber Security's baseline controls for small and medium organizations include backing up and encrypting data, and its ransomware guidance stresses offline copies that a network-based attacker cannot reach.

1. 01

   Keep an immutable or offline copy

   At least one backup that cannot be changed or deleted from the network.

2. 02

   Cover the archive

   Closed projects are often excluded to save space; they are also what you need for claims and future work.

3. 03

   Test restores of large files

   Time a full project restore, not just one document.

4. 04

   Protect the backup admin

   Separate credentials with MFA, not a domain admin account.

When a new hire or contract designer starts Monday, a standard device build, licence assignment and project-access template gets them productive on day one, and an equally standard offboarding removes access the day they leave. Write it down once; use it every time. Fees are quoted per engagement, and managed plans are available.