AEC

A field section should require approved apps on firm-managed phones and tablets, keep site photos that show security systems, access points or utility routes out of AI tools unless the client approves in writing, require notice and agreement before any AI notetaker records a meeting, and require same-day reporting of mistakes. Keep it short enough to fit on one card in the trailer.

Yes. Microsoft lists Windows Server 2016 to Windows Server 2025 as a supported in-place upgrade path, along with 2019 and 2022. Nonclustered systems can jump directly. Clustered systems using a cluster rolling upgrade can advance only one version at a time. Check hardware age and application compatibility, such as license managers, before choosing an in-place upgrade over a new server.

Microsoft's Azure File Sync documentation does not describe locking a file across offices. It describes conflict handling instead: if the same file changes at two servers before sync completes, Azure File Sync keeps both versions and renames the older copy with the server name appended. Firms with several offices editing the same live models should test that behavior with a real project before committing.

Microsoft has not published a price on its Windows Server 2016 ESU or Azure Arc pages. Azure Arc ESUs are billed monthly on a pay-as-you-go basis starting January 13, 2027, and Microsoft directs volume licensing customers to their Microsoft representative. For comparison, on-premises ESUs for Windows Server 2012 cost 100% of the full license price per year.

DFARS 252.204-7012 requires any external cloud service storing covered defense information to meet security requirements equivalent to the FedRAMP Moderate baseline. Whether a particular Microsoft 365 tenant qualifies depends on the service offering and its configuration, so confirm the authorization and scope with Microsoft documentation and your contracting officer before placing CUI there.

No. The server keeps running and serving files. What stops is Microsoft's security updates, unless the firm enrolls in Extended Security Updates. Every vulnerability discovered after that date stays open on an unpatched server, which raises the risk of ransomware and can create problems with cyber insurance questionnaires, client security reviews and, for defense work, NIST SP 800-171 flaw remediation requirements.

It can, and the firm should catch it before issue. California Public Contract Code section 3400 generally bars public works specifications from naming a brand or trade name without the words "or equal," with limited exceptions such as matching products already in use or items available from only one source. AI tools that have seen many specifications may insert product names, so review every AI-edited section for them.

Only the human-authored parts. The U.S. Copyright Office concluded in January 2025 that AI outputs are not protected based on prompts alone. Human expression that is perceptible in the output, such as a firm's own design, and creative human selection or modification of the output can still be protected. Firms should know which parts of a deliverable are their own work.

Only when it meets the clause's cloud requirement and sits inside your security boundary. DFARS 252.204-7012 requires cloud services that store, process or transmit covered defense information to meet security equivalent to the FedRAMP Moderate baseline. The tool also has to be covered by your system security plan and the NIST SP 800-171 controls that apply to the rest of the system.

Use AI tools only on firm accounts with business terms that keep uploads private and out of model training. Upload only what the task needs, such as a massing view instead of a full drawing set. Keep marked, defense and security-sensitive drawings out of public AI tools, and check the client agreement for confidentiality terms before using AI on a project.

Yes, where they affect the boundary. Requirement 3.12.4 calls for a system security plan describing the system boundary and how each requirement is met. AI tools approved for CUI belong inside it, and tools barred from CUI should be noted along with the controls that keep CUI out, such as web filtering and data loss prevention rules.

Check who publishes the plugin and whether its code is signed, what project data it sends off the workstation and to which AI provider, whether that provider trains on or retains the data, whether it uses firm-managed or personal accounts, and whether an administrator can disable it. Also check client agreements for confidentiality limits, and record the answers, the date and the version reviewed.

The stamp signals responsibility whatever tools were used. California Business and Professions Code section 5536.1 requires the person in responsible control of plans to sign and stamp them as evidence of responsibility, and section 5535.1 ties responsible control to the professional standard of care. The statutes do not mention AI, so a firm policy should treat AI output as a draft until the responsible architect reviews and accepts it.

Through the SECURELOAD and TRUSTEDPATHS system variables. Autodesk recommends setting SECURELOAD to 1 or 2 to prevent unauthorized code from executing, keeping executable files in trusted, read-only folders separate from data, confirming third-party executables are digitally signed by a reputable issuer, and not running AutoCAD with administrator privileges. Set these through your deployment instead of on each machine.

At renewal. Autodesk lets purchasers save a seat reduction at any time, but the current quantity stays available until the renewal date, and the reduced quantity and price take effect when the subscription renews. For eligible annual and multi-year subscriptions, a saved reduction applies whether or not the subscription auto-renews.

No. Autodesk says a named user subscription should be assigned to one authorized user identified by a unique Autodesk ID, and that the user should be one person, not a group or shared account. Shared logins also remove individual accountability for project file access.

Admins can open the usage report under Reporting in Autodesk Account. It shows assignment dates, days used, monthly average use, and last accessed date by user and product, over ranges up to 12 months, and can be exported to Excel or CSV. Offline usage is not included.

Some can. Bluebeam's AI transparency page says administrators can disable Intelligent Studio Project Search, Smart Overlay, Smart Review and the MCP connection in Org Admin Pro. It lists OCR, Visual Search, Auto Align and Stitching as features that cannot be disabled. Check the current page before each rollout, since feature lists change with new Revu releases.

AI can draft most of the narrative in an AEC proposal, such as project approach, firm history, resumes and relevant experience, when it works from the firm's own approved content. It should not set fees or pricing. A proposal lead still needs to check every section against the RFP and the source projects, because AI tools can invent project details that sound right and are wrong.

Only in an edition that meets the DFARS 252.204-7012 cloud requirement. Any cloud service that stores, processes or transmits covered defense information must meet security equivalent to the FedRAMP Moderate baseline. Check the FedRAMP Marketplace listing for the exact service and edition, and record the decision in your system security plan before allowing CUI in it.

Yes. The July 2026 suspension stopped DoD from designating Level 2 (C3PAO) assessments in solicitations during the program review, but the Cyber AB stated that C3PAO Level 2 certification assessments remain available. Whether to pursue one voluntarily is a business decision, often driven by what primes ask of their subcontractors.

For Final Level 2 (C3PAO) status, every applicable requirement must be MET, which is a score of 110. Under 32 CFR 170.21, a score of at least 88 with the remaining gaps on a qualifying POA&M earns Conditional status, and a C3PAO must close out that POA&M within 180 days or the status expires. A lower score, or a NOT MET on one of the six non-deferrable requirements, yields no Level 2 (C3PAO) status from that assessment.

Sometimes. Under 32 CFR 170.17(c)(2), a NOT MET requirement can be re-evaluated during the assessment and for 10 business days after the active assessment period, but only if new evidence shows it is met, the change does not affect other requirements already scored MET, and the C3PAO has not yet delivered the findings report.

No. On July 13, 2026, the Department of War suspended CMMC Phase 2, which would have added Level 2 (C3PAO) certification as a condition of award starting November 10, 2026. Contracting officers were told to remove C3PAO and DIBCAC requirements from active solicitations and contracts. Further guidance is expected after the CIO's program review.

Yes. DFARS 252.204-7021 requires the prime, before awarding a subcontract, to ensure the subcontractor has a current CMMC certificate or status at the level appropriate for the information flowed down. The prime must also ensure the subcontractor's affirming official completes an affirmation before award and maintains it annually. The clause does not prescribe how proof is collected.

Under 32 CFR 170.23, a subcontractor that handles only Federal Contract Information needs Level 1 (Self). One that handles CUI needs at least Level 2 (Self), or Level 2 (C3PAO) when the prime's contract requires a C3PAO or DIBCAC assessment. With CMMC Phase 2 suspended, C3PAO requirements are being removed from contracts, so most flowdowns are Level 1 or Level 2 (Self).

Only the parts a person authored. The U.S. Copyright Office's 2025 report concludes that AI output generated from prompts alone is not protected by copyright, while human-authored expression and creative selection, arrangement or modification of AI output can be. A specification edited from the firm's own master carries more human authorship. Ownership of instruments of service also depends on the client agreement, so check those terms with counsel.

It may be a reportable cyber incident. DFARS 252.204-7012 defines compromise to include unintentional disclosure to unauthorized persons and requires reporting to DoD at dibnet.dod.mil within 72 hours of discovery, using a medium assurance certificate. Whether a specific upload meets the threshold is a judgment for the firm and its counsel, so start the assessment as soon as it is discovered.

Firms handling Controlled Unclassified Information under DFARS 7012 must meet NIST SP 800-171, and requirement 3.1.22 requires them to control CUI posted or processed on publicly accessible systems. A public AI service is a publicly accessible system, so CUI, including technical drawings, should stay out of public AI tools. Check your contract for any approved environments.

Egnyte says Revit co-editing is supported on its Smart Cache appliance in network share mode, with a global file lock on the Revit central model, and describes that setup for users in a single physical office. Its Storage Sync component does not provide a global lock on the central model. Firms co-editing across offices should confirm their exact scenario with Egnyte.

Chaos says a graphics card needs at least 4 GB of video memory for Enscape to be officially supported and recommends 8 GB or more. For Enscape's VR features it recommends 12 GB. The full ray tracing feature set is available only on NVIDIA RTX cards, and Enscape does not use the CPU for rendering.

Common signs include pressure to change details right before a payment run, a new account at a different bank or in a name that does not exactly match the vendor, a request to keep the change quiet, and slightly altered email addresses or phone numbers. The FBI tells payers to be skeptical of unexplained urgency. Any one of these is a reason to call the vendor at a number on file before paying.

Not as proposed. DFARS 252.204-7012 remains in effect on DoD contracts today. The June 2026 proposal names DIBNet as the reporting location for DoD contracts and says its Revision 3 parameters align with values DoD plans to codify in 32 CFR part 170, but how the two clauses would work together on DoD contracts will depend on the final FAR rule and DoD's own rulemaking.

Partly. Much of the work carries over, because Revision 3 builds on the same control families and the same systems. Revision 3 also reorganizes requirements, adds families such as supply chain risk management and relies on organization-defined parameters. Firms with existing Revision 2 documentation would typically need a mapping and gap review rather than a new program.

It is a proposed Standard Form titled Controlled Unclassified Information (CUI) Requirements. Agencies would include it in solicitations and contracts to state whether CUI is involved, what information must be protected, and where incidents must be reported. The form number is a placeholder in the proposed rule, and the June 2026 version updates it to list Revision 3 organization-defined parameters.

There is no set date. The comment period on the June 2026 proposal closed July 23, 2026, and no final rule had been published as of October 17, 2026. An earlier Unified Agenda projected a final rule in December 2025, which did not happen. Requirements would apply only after a final rule is issued and the clause appears in a specific contract.

The contracting agency. Under NARA's CUI program at 32 CFR part 2002 and the proposed FAR rule, the agency identifies CUI and, under the proposal, would communicate it through the SF XXX in the contract. A firm cannot opt out of a designation, but it can ask the contracting officer to clarify what information is covered before award.

Yes. A detection script deployed through device management can list the Revit, AutoCAD and Rhino plugin folders on every machine and report back centrally. In Microsoft Intune this is a detection-only Remediations package, which requires Windows Enterprise E3 or E5, Education A3 or A5, or VDA licensing. Keep the output to plugin names, since Intune caps it at 2,048 characters.

For narrative with no confidential content, it carries less risk, but free accounts belong to the individual, so the firm cannot see, export or delete what was shared. Pricing, past bids and confidential client details should only go into an AI tool the firm has approved, on firm accounts, under terms that bar training on firm data.

A Microsoft Entra B2B guest signs in with their home organization's identity, so once their former employer disables that account, they can no longer sign in to your tenant. The guest object still sits in your directory until you remove it, which is why every guest needs an internal owner and a regular review.

Set an end date tied to the project schedule when access is granted. Microsoft recommends enforcing expiration on access packages for external users and keeping access to no longer than 365 days unless the project runs multiple years. Review remaining guests at least quarterly and disable accounts with no sign-in for 45 days, in line with CIS Safeguard 5.3.

Treat closeout as an offboarding event for the site. Remove guest and subcontractor Wi-Fi access, factory reset routers, firewalls and access points before they move to the next project, update the asset inventory, and cancel or transfer the satellite or cellular service. Cameras and other devices left with the owner should have firm credentials removed and the handover documented.

By default, yes. Midjourney's terms state that user content is publicly viewable and remixable by default, and users grant Midjourney a perpetual, irrevocable license to content they input. Stealth mode is limited to Pro and Mega plans, is described as a best-efforts commitment, and does not hide images made in public Discord channels.

Nacha defines False Pretenses as inducing a payment by misrepresenting a person's identity, their association with or authority to act on behalf of another person, or the ownership of the account to be credited. Business email compromise, vendor impersonation and payroll impersonation fit the definition. Scams involving fake or poor-quality goods or services do not.

It applies to non-consumer Originators of ACH entries, which can include businesses that send ACH payments through their bank. The rule reached all non-consumer Originators on June 22, 2026. It requires risk-based processes to identify payments suspected of being unauthorized or made under false pretenses, reviewed at least annually. Your bank's ACH agreement governs how it applies to your firm.

They can be. California and federal law protect business information that has value because it is not generally known, but only if the owner takes reasonable steps to keep it secret. Whether a firm's rates qualify is a question for counsel. Letting staff paste rate tables into any AI tool makes reasonable secrecy efforts harder to show.

Yes. CIS Safeguard 6.3 calls for MFA on all externally exposed applications, which includes the Microsoft 365 sites guests use. Microsoft Entra cross-tenant access settings let a firm accept MFA a partner already completed in its own tenant, which avoids double prompts. By default those partner claims are not trusted, so guests are prompted under the firm's own policy.

Autodesk lists 64-bit Microsoft Windows 11 as the operating system for Revit 2027. Within Windows 11, the version matters for security: Microsoft ended servicing for Windows 11 Home and Pro version 24H2 in October 2026, while version 25H2 is serviced until October 2027. Plan new workstations on a currently serviced release.

Autodesk says that if you expect an experience similar to file-based worksharing on a local network, cloud sync services such as OneDrive and SharePoint will not provide it. SharePoint works well for documents and archives. For live central models shared across offices, firms usually look at a global file system, a local cache with locking, or Autodesk's own cloud worksharing.

The main risks are data exposure and accuracy. A generic tool on a personal account may keep or train on what staff paste in, and the firm cannot see, export or delete it. The tool can also mix up projects or invent facts. Using one approved tool on firm accounts, limited to a clean proposal library, addresses both.

No. SSI is unclassified information that TSA or DOT has determined would be detrimental to transportation security if publicly disclosed. It is controlled under 49 CFR part 1520 rather than the national security classification system, and records containing it must carry the SSI marking and limited distribution statement. Access is limited to covered persons with a need to know.

Yes. Starlink documents a bypass mode that turns off its built-in Wi-Fi so a third-party router or firewall can handle the network. On a jobsite, that lets the firm run its own firewall with a standard configuration, separate staff, guest and device networks, and keep logs, instead of relying on the consumer router's defaults.

Starlink supplies the internet link. How secure the site is depends on the network behind it. Treat the connection like any untrusted network: put a firm-managed firewall behind it, separate staff, guest and device networks, change default credentials, keep firmware current, and have staff reach firm systems through identity-based access instead of an open tunnel to the office.

Automatic expiration is the most reliable way to make sure access ends when a project does. SharePoint guest expiration and Microsoft Entra access packages can both end a subconsultant's access after a set period unless a project manager extends it. For firms handling CUI on defense work, NIST SP 800-171 also requires limiting access to authorized users and protecting CUI during and after personnel actions.

Usually a guest account. Microsoft Entra B2B guests sign in with their own company's identity, so their employer manages the password and their access ends when they leave that company. A licensed firm account fits long-term contract staff who work on firm devices for months. Shared or generic logins should be avoided, because no one can tell who used them.

Vendor email compromise is a form of business email compromise in which a criminal takes over or imitates a real supplier's email account, then sends that supplier's customers fake invoices or bank change requests. Because the message comes from a familiar address and often replies inside a real thread, a callback to a phone number already on file is the most reliable check.

Call the subcontractor at a phone number already in your vendor file or subcontract, never one included in the request, and confirm the change with someone you know. The FBI recommends verifying payment changes in person or via a known telephone number. Have a second person approve the change, and flag the first payment to the new account.

A C3PAO is a CMMC Third-Party Assessment Organization: a company authorized by the Cyber AB to conduct CMMC Level 2 certification assessments. Its assessors evaluate a contractor against the 110 requirements in NIST SP 800-171 Rev 2 and submit the results through eMASS to SPRS, where they set the contractor's Level 2 (C3PAO) status.

Global file locking means a file opened for editing in one office is locked for users in every other office, so two people cannot overwrite each other's changes. Some platforms, such as Panzura CloudFS, also offer byte-range locking, which locks only the part of a file in use for applications that support it, including Revit and AutoCAD.

Revit Cloud Worksharing is Autodesk's option for hosting a workshared Revit model in the cloud on Autodesk Docs instead of on a file server. Autodesk's documentation says users must subscribe to Autodesk Docs or be invited to an Autodesk Docs project. Because it replaces the file-based central model, it is worth comparing alongside Egnyte and Panzura.

Revit reads .addin manifest files at startup from two folders: an all-users folder under C:\ProgramData\Autodesk\Revit\Addins and a per-user folder under the user's AppData\Roaming\Autodesk\Revit\Addins, each with a subfolder for the Revit version year. Each manifest names the file it loads and the vendor, so listing these folders gives a quick add-in inventory.

Only AI services that meet FedRAMP Moderate or a verified equivalent and sit inside the environment your system security plan covers. DFARS 252.204-7012 applies that bar to any cloud service that stores, processes or transmits covered defense information, and a December 2023 DoD memo defines equivalency as 100 percent of the Moderate baseline validated by a FedRAMP-recognized assessor.

Only covered persons with a need to know. Under 49 CFR part 1520, employees and contractors working for a covered person are covered persons, and a contractor has a need to know when access is necessary to perform the contract. Public AI tools and their vendors are not covered persons, and an unauthorized release must be reported promptly to TSA or the relevant DOT or DHS component.

The project manager who requested the access is usually the right owner. The owner confirms the person still needs access during each review and tells IT when the subconsultant rolls off, so removal follows the project schedule.

Use a sanitization method that makes the data unrecoverable, such as a verified cryptographic or vendor-supported erase of the drive, or physical destruction by a recycler that issues a certificate listing each serial number. NIST SP 800-88 Rev. 2 is the federal reference for media sanitization. Keep the certificates with your asset records.

ZTNA takes more upfront work than a VPN: every application has to be inventoried, published and given an access policy, and older systems need extra testing. It depends on strong identity and managed devices, so gaps in multifactor authentication or device management have to be closed first. It is also an ongoing service that someone has to administer, review and keep current.

For most remote user access, yes. ZTNA can cover file servers, license servers and business applications once each is published through a connector. Some firms keep a site-to-site link between offices, or a limited path for IT administration or a legacy system that does not work through a connector. Find those cases during the inventory, before you set a shutdown date.

No. ZTNA controls who can reach a file server and from which devices, but the data still has to cross the user's internet connection. If central models live on an office server, remote users will still feel their size. Test with real project files in the pilot, and consider where project data is stored as part of the same plan.

NIST SP 800-171 Rev. 2 does not name a remote access technology. Requirements 3.1.12 through 3.1.14 call for monitoring and controlling remote sessions, protecting them with cryptography and routing them through managed access control points. A firm can document how its ZTNA broker, policies and logs address each one in its system security plan for an assessor to review.

Yes. A platform that brokers and controls access to CUI provides security functions to the assessment scope, which makes it a Security Protection Asset under 32 CFR 170.19. The DoD Level 2 scoping guide says these assets are assessed against the requirements relevant to the capabilities they provide, such as access control, authentication and audit logging. Zero trust can shrink endpoint scope, while the security stack itself stays in scope.

A VPN connects a remote user to the network, often with broad access once connected. Zero trust network access connects a verified user on a checked device to specific applications only, based on role and device health, and logs each connection. NIST SP 800-207 describes zero trust as granting no implicit trust based solely on network location.