How should AEC firms handle iPad management across jobsites?

A superintendent leaves a tablet on the tailgate. A foreman quits and takes the field iPad home. A project engineer signs a jobsite device into a personal Apple Account, and six months later nobody can reset it. Each of these is a small event on its own. Across a fleet of tablets spread over a dozen projects, they add up to drawings, site photos and client information sitting on devices the firm cannot see or control.

This guide covers what iPad management at scale means for an architecture, engineering or construction firm, which controls matter most, and what to put in place this quarter.

Why do jobsite iPads need more control than office laptops?

Jobsite tablets are shared, carried into uncontrolled places, and handed between people far more often than office laptops, so they are lost, reassigned and left unlocked more often. They also hold the firm's most sensitive field data: current drawing sets, punch lists, inspection photos and markups.

NIST SP 800-124 Rev. 2, NIST's guidance on managing mobile devices in the enterprise, notes that portable devices are more likely to be lost or stolen than desktop systems and that tablets fall within its scope. A lost laptop in an office is rare. A lost tablet on a site with trailers, trucks and subcontractor crews is a routine event that needs a routine response.

The stakes for an AEC firm are contractual and reputational. Site photos can show security systems, utility routes and the owner's operations. Drawing sets for some facilities carry confidentiality terms in the owner contract. For firms on defense work, project files on a tablet can include controlled unclassified information (CUI), which brings federal requirements onto the device itself.

What does iPad management at scale involve?

iPad management at scale means every firm-owned tablet is enrolled in a mobile device management (MDM) service from the moment it is unboxed, configured from a standard profile, kept updated, and able to be locked or wiped remotely. The goal is that no tablet depends on one person's memory, password or personal account.

NIST SP 800-124 Rev. 2 describes enterprise mobility management as the tooling used to deploy, configure and actively manage mobile devices. Its core recommendations line up with what a field fleet needs:

• Fully secure each organization-issued device before it can reach company systems.
• Require a passcode and an automatic lock after a period of inactivity.
• Keep operating systems and apps updated.
• Restrict apps to an approved list instead of blocking known bad ones.
• Wipe a device before it is reissued to another person or retired.

The same guidance warns that organizations should not rely on remote wipe as the only control, because native remote wipe on iOS and Android requires the device to be powered on. Encryption, passcodes and app restrictions do the work while a tablet sits switched off in a truck.

How does Apple Automated Device Enrollment help a field fleet?

Automated Device Enrollment lets a firm's tablets enroll in its device management service automatically during setup, so a new or reset iPad arrives configured without IT touching it. Devices purchased with the firm's Apple Customer Number or Reseller Number appear in Apple Business automatically, and IT then assigns them to the management service, by hand or through a default assignment.

Supervision is the part that matters most for field devices. Apple's deployment guide states that a supervised device cannot be unenrolled by the user, and that the firm can prevent users from removing the management profile. That closes the common gap where a frustrated user deletes the profile and the tablet quietly drops out of management.

For jobsite fleets this means a tablet shipped directly to a trailer can be powered on by the superintendent and configured with the firm's apps, Wi-Fi and restrictions, with no imaging step back at the office.

What happens when a tablet is locked to a former employee's Apple Account?

A firm-owned iPad that a user has locked with their personal Apple Account can become unusable once that person leaves, because Activation Lock requires their credentials to reset it. Apple's Activation Lock guidance notes that user-linked Activation Lock lets users lock devices the organization owns with their personal Apple Account.

Supervised devices avoid this. Apple describes an organization-linked option where the device management service, not the user, contacts Apple to lock or unlock the device, and the service generates and stores a bypass code. Apple also cautions that a bypass code not retrieved within 15 days becomes unretrievable and that codes should be backed up before changing management services. Firms planning a move between management platforms should confirm those codes are exported first.

Which security frameworks cover field tablets?

The CIS Critical Security Controls and, for defense work, NIST SP 800-171 both include specific requirements for mobile devices. Firms with no regulatory obligation can still use the CIS Controls as a practical baseline.

• CIS Safeguard 1.1 calls for a detailed inventory of enterprise assets, which includes every tablet, its assigned user and its project.
• CIS Safeguard 4.11 (Implementation Groups 2 and 3) calls for remotely wiping enterprise data from enterprise-owned portable devices when they are lost or stolen, or when the individual leaves.
• CIS Safeguard 4.12 (Implementation Group 3) calls for separate enterprise workspaces on mobile devices where supported.
• NIST SP 800-171 Rev. 2 requirements 3.1.18 and 3.1.19 call for controlling the connection of mobile devices and encrypting CUI on mobile devices and mobile computing platforms.

For firms supporting the Department of Defense, a tablet that opens CUI drawings is in scope for those requirements regardless of where CMMC phase timing stands. Our overview of what still applies during the CMMC pause covers the broader picture.

What should a standard jobsite iPad profile include?

A standard profile should define the passcode and lock settings, the approved app list, the networks the device joins, and how project files are stored, so every tablet on every site behaves the same way. Keep it to one profile for most field users and a second for shared kiosk-style devices if needed.

• Passcode required, with automatic lock after a short idle period.
• Approved apps only, pushed from the management service: the firm's construction management platform, PDF markup tool and file sync client.
• App Store and personal account sign-in restricted on supervised devices where the workflow allows it.
• Project files opened through managed apps tied to firm accounts, so a wipe removes them cleanly.
• Operating system updates enforced within a defined window.
• Jobsite Wi-Fi and any cellular settings pushed centrally. Our guide to jobsite network security covers trailer and Starlink connections.

Field AI tools and site photos need the same discipline. The firm's AI policy for design, bids and the field should match what the tablet profile allows.

What should AEC firms do this quarter?

Start with an inventory and a reset of how tablets enter and leave service, then tighten the profile. Most of the risk comes from devices nobody is tracking and from reassignments done by hand.

• Count every tablet in the field and match it to a person and a project. Flag any that are not in device management.
• Link the firm's Apple Business account to its device management service and set purchases to enroll automatically.
• Re-enroll unmanaged tablets through Automated Device Enrollment so they become supervised.
• Check for tablets locked to personal Apple Accounts and recover them while the user is still reachable.
• Write a two-step lost tablet procedure: report within the same shift, then lock or wipe.
• Add tablet return and wipe to the offboarding checklist for field staff and project closeout.
• Confirm Activation Lock bypass codes are stored and backed up.

What should your counsel review before you standardize field tablets?

Do this review before you finalize the standard tablet profile, and again before a project starts under an owner contract or defense subcontract with data handling terms. Bring these decisions:

• Whether any project files on the tablets are controlled unclassified information. If they are, NIST SP 800-171 Rev. 2 requirements 3.1.18 and 3.1.19 apply to those devices. Bring the prime contract or subcontract, its clauses and any CUI markings on the drawings.
• Whether an owner contract limits where drawings, site photos or security details may be stored or carried. The governing rule is the confidentiality or security clause in that owner agreement. Bring the agreement and the list of apps and storage locations in the tablet profile.

How does s90 help AEC firms manage field devices?

s90 manages device enrollment, standard profiles, updates and lost device response for architecture, engineering and construction firms across Los Angeles and Orange County. If your tablets have grown project by project, we can start with an inventory and show you where the gaps are.