Contractor IT Checklist: Field Devices, Email, Backup

A contracting business needs IT that works from a phone first. In practice that means one current set of plans everyone can open in the field, multi-factor authentication on every mailbox because payment fraud arrives by email, a decision about where QuickBooks lives, a backup that keeps project records for the five years California requires, and a way to lock or wipe a lost phone. The checklist below covers each item.

The Tools a Contracting Business Runs

Area	Typical products	IT question to settle
Project management	Procore, Buildertrend and similar	Who is an administrator, and is each login tied to one person?
Accounting	QuickBooks Online, QuickBooks Desktop or Enterprise	Where does the company file live, and who backs it up?
Estimating and takeoff	Bluebeam Revu, PlanSwift, STACK and others	Is it a desktop program (needs a capable PC) or a web app?
Plans and documents	PDF sets, photos, contracts, change orders	One shared location, or scattered across phones and inboxes?
Email and calendar	Microsoft 365 or Google Workspace	Is sign-in protected by more than a password?
Field hardware	Phones, tablets, a laptop in the trailer, a hotspot or cellular router	Who owns each device, and what happens when one is lost?

A note on QuickBooks Desktop

Intuit stopped selling QuickBooks Desktop Pro Plus, Premier Plus, Mac Plus, and Enhanced Payroll to new US subscribers after September 30, 2024. Existing subscribers can keep renewing and still receive updates, and QuickBooks Enterprise remains for sale. If you run Desktop, two things follow. First, the company file sits on a computer or server in your office, so backing it up is your job, not Intuit’s. Second, anyone who works in it remotely needs a secure way in, which is covered in secure remote access for small businesses.

Why Is MFA on Email the First Thing to Fix?

Because contractors send and receive large payments on the strength of an email. In business email compromise (BEC), a criminal gets into a real mailbox, or imitates one, and sends a believable message: new bank details for a supplier, a changed payoff address, a revised invoice. The FBI’s 2025 Internet Crime Report counted 24,768 BEC complaints with reported losses of about $3.05 billion, second only to investment fraud among the crime types in the report.

Multi-factor authentication (MFA) adds a second proof of identity, such as an authenticator app prompt, on top of the password. CISA’s MFA guidance explains why a stolen password alone then fails, and recommends phishing-resistant methods where you can use them. The steps:

1. Turn on MFA for every mailbox, including the owner’s and any shared accounts such as billing or estimating.
2. Use an authenticator app or passkey in preference to SMS codes.
3. Publish SPF, DKIM, and DMARC records for your domain. These are DNS settings that help other mail systems reject messages faking your address, and they also help your real mail arrive, as described in the guide to business email going to spam.
4. Add an office rule that technology cannot replace: any change to bank details, yours or a vendor’s, is confirmed by phone using a number already on file, never a number from the email asking for the change.

The business email compromise guide goes deeper on how these scams unfold.

Setting Up Phones and Tablets for the Field

Most of your people will only ever touch company systems from a phone. Plan for that.

• Decide who owns the devices. Company-owned tablets are simplest to control. Personal phones are workable if you protect the work apps and leave the rest of the phone alone. See the BYOD policy guide.
• Use device management. Mobile device management (MDM) software lets you require a screen lock, confirm the phone is encrypted, install work apps, and remove company data when someone leaves or a device disappears. The MDM guide compares the options.
• Give every person their own login. Shared crew logins make it impossible to see who changed what, or to remove one person’s access.
• Plan for damage. Rugged cases, a charging spot in each truck, and automatic photo upload to the shared location so that a broken phone does not take a week of progress photos with it.

Jobsite Connectivity: What Are the Options?

Option	Fits	Watch for
Phone hotspot	Short jobs, one or two people	Battery drain, plan data caps, stops when that person leaves the site
Dedicated cellular hotspot or router in the trailer	Longer jobs, several devices, a printer	Check carrier coverage at the site before you commit. An external antenna can help inside a metal trailer
Wired or fixed internet at the site	Long projects with a staffed office	Lead time to install, contract length

Whatever you choose, plan for no signal at all. Procore documents that its mobile app works offline only for items already viewed or downloaded while connected, and that changes made offline are sent once a connection returns. The habit to build: open or download the current drawings and documents before leaving a good connection. Check your own platform’s help pages for its offline rules.

Shared Plans: One Current Set

Working from an outdated sheet is an expensive mistake that good file habits prevent.

• Keep the current set in one place: your project management platform’s drawings tool, or a SharePoint or Google Drive folder per job.
• Make the current folder read-only for most people. One person publishes revisions.
• Move replaced sheets to a “superseded” folder. Do not rename them in place.
• Use the same folder layout for every job so anyone can find the permit, the contract, and the latest set.

If you use Microsoft 365, the SharePoint guide covers libraries and permissions.

What Records Do You Have to Keep, and for How Long?

California Business and Professions Code section 7111 requires a licensed contractor to keep contracts, documents, records, receipts, and disbursements for not less than five years after completion of the project they relate to, and to make them available to the Contractors State License Board registrar on written request. Your attorney, insurer, or tax advisor may recommend longer periods for other reasons. This is IT guidance, not legal advice.

For IT, that means:

• Text threads and personal photo rolls are not a records system. Move change orders, approvals, and photos into the job folder or platform.
• A cloud drive is not a backup by itself. Deletions and ransomware damage sync too. Keep a separate backup with enough history to go back weeks. The business data backup guide explains how.
• If you cancel a project platform, export your project data first and store it with the job records.

The Risks That Matter Most

• Payment fraud by email, described above.
• Lost or stolen devices holding plans, customer addresses, gate codes, and email.
• Former employees or subcontractors who still have access. Remove access the same day someone leaves.
• Ransomware on the office computer that holds QuickBooks and the bid files. The ransomware guide covers prevention and recovery.

Checklist You Can Copy

1. MFA is on for every email account, QuickBooks, and your project platform.
2. SPF, DKIM, and DMARC are published for your domain.
3. A written rule exists for confirming any bank detail change by phone using a known number.
4. Every person has their own login. No shared crew accounts.
5. Every phone and tablet with company data has a screen lock and can be wiped remotely.
6. The current plan set lives in one place, and one person publishes revisions.
7. Crews download drawings before heading to sites with poor signal.
8. The QuickBooks company file and job folders are backed up off site, with history.
9. One file has been restored as a test in the last six months.
10. Records are kept at least five years after each project is completed.
11. A departure checklist removes access to email, the platform, QuickBooks, and shared files.
12. Each long job has a connectivity plan, confirmed against carrier coverage at the site.

Questions to Ask Any IT Provider

• How will you protect our email against invoice fraud, and what will our staff need to do differently?
• How do you manage phones we do not own without reaching into personal photos and messages?
• Where will the QuickBooks file live, how is it backed up, and how long would a restore take?
• Will you work with our project management platform’s support when a problem sits between their system and our devices?
• What is your process when someone leaves, and how quickly does it happen?
• Is the scope and price agreed in writing before work starts?

When You Do Not Need Much

An owner-operator with a phone, a laptop, and QuickBooks Online does not need device management or a server. MFA, a password manager, a backup of the laptop, and the bank-change rule cover most of the risk. Structure becomes worth its cost once you have office staff, several crews, or subcontractors logging in to your systems.

Common Questions

Do field crews need company email accounts?

Not always. Anyone who logs in to your project platform, receives plans, or communicates with customers on your behalf should have an individual account you control, so you can remove access when they leave. Crew members who never log in to anything can stay off the list, which keeps license costs down.

Is a personal phone acceptable for work?

Yes, with limits. Require a screen lock, keep work data inside managed apps, and get written agreement that you may remove company data from the phone when employment ends. Device management tools can do this without touching personal photos or messages.

Is QuickBooks Desktop going away?

Intuit stopped selling most Desktop subscriptions to new US customers after September 30, 2024. Existing subscribers can renew and continue to receive updates, and QuickBooks Enterprise is still sold. If you stay on Desktop, make sure the company file is backed up off site and that remote use goes through a secure connection.

What should we do if we paid a fake invoice?

Contact your bank immediately and ask for a recall of the payment, then file a report with the FBI at ic3.gov. Speed matters. After that, change the password on any mailbox involved, check it for forwarding rules you did not create, and review the steps in what to do after a data breach.

How Coastal Growth Co. Can Help

We can set up MFA and email protection, put phones and tablets under management, organize shared plans, and build a tested backup for QuickBooks and job records. Work is on site or remote, as a one-time project or ongoing support, with scope and price agreed first. The contractors and trades page summarizes the service, and the contact page is the place to start.