Data protection: Are you up for the challenge?

Data is one of the most valuable assets for any organization. From project plans and financial records to stakeholder communications and compliance documentation, infrastructure programs generate and rely on vast amounts of data throughout their life cycle. Protecting this data has always been important—but today, the stakes are significantly higher. 

Today, the challenge has evolved. Infrastructure programs are more data-intensive, more collaborative, and more scrutinized than ever before. With increased funding flows, stricter compliance expectations, and the rise of AI-driven decision-making, data protection is no longer just an IT concern—it is a program-level responsibility.  

Recent industry reports show that cyberattacks targeting critical infrastructure and public-sector organizations are on the rise, with ransomware and data breaches causing operational disruptions and financial losses. According to IBM’s 2025 Cost of a Data Breach Report, the global average cost of a breach is $4.44 million, and nearly 30% of breaches involve data spread across multiple environments—significantly increasing complexity and risk. At the same time, organizations are managing exponentially growing volumes of project data across disconnected systems, increasing both risk and complexity.

Industries that have been traditional leaders in IT continue to increase their investments in data protection. This is a necessity.  As organizations begin to adopt AI to improve planning and decision-making, the importance of well-governed data becomes even more critical. IBM’s 2025 report also found that 63% of organizations lack formal AI governance policies, increasing their exposure to data and security risks. AI systems rely on structured, accurate, and secure data with clear lineage and governance. Without strong data protection and governance practices, the insights generated can be unreliable, introducing new risks rather than reducing them.

Traditionally, data protection has been viewed primarily as a security issue, focused on preventing breaches and unauthorized access. While security remains critical, it is no longer sufficient on its own. 

Organizations today must think in terms of data protection and governance. While making the right decisions can be complex and often confusing, a good place to start is with these three approaches:  

Ensure that privacy and security are built into your cloud infrastructure and data architecture from the outset. Use DataSecOps to embed security and data governance into your data operations. 

DataSecOps helps establish clear data ownership, bringing accountability and structure to how data is used across the organization. It introduces automation and testing to eliminate manual bottlenecks while ensuring data remains accessible in a secure, controlled manner. 

In AI-driven environments, this foundation becomes critical—trusted, well-governed data is essential for generating reliable insights and enabling confident decision-making. 

Cloud environments centralize enterprise data, making it easier to monitor, detect threats, and respond to incidents. They also enable more advanced identity and access management through intelligent, dynamic authentication. 

However, cloud providers have varied security capabilities, and responsibility is shared between the provider and the user. Establishing and enforcing consistent security and governance policies across environments remains a challenge. 

Techniques such as data classification, data masking or encryption, and the principle of least privilege must be clearly understood and applied. Organizations must take responsibility for implementing the right controls and governance frameworks rather than relying solely on cloud providers. 

This becomes even more important in AI-native systems, where the quality, security, and governance of data directly influence the accuracy, reliability, and risk of automated decisions. 

Data wants to be free. The more it is used, the higher its value. This means access to data will need to be provided across the organization and, perhaps, even outside to external partners. This is especially true in the vast, sprawling public-sector construction ecosystem.

To prevent leaks and unauthorized access-related damage, it is necessary to mask or encrypt data as it travels across systems or is stored in the cloud.

At the same time, as data becomes more widely accessed and increasingly used in advanced analytics and AI-driven processes, new risks are emerging. According to the Thales 2026 Data Threat Report, 70% of organizations rank AI as a top data security concern, especially when deployed without robust data governance and oversight.As digital transformation reshapes the construction industry, the growing volume of data will pose a particular challenge. Organizations will need to build specialized capabilities around data management and protection. Without this, digital transformation will be meaningless and in several instances, even dangerous.