A civil engineering firm we work with made the decision last year to move their project collaboration platform from an aging on-premises SharePoint deployment to Microsoft 365. The business case was straightforward: better mobile access for field engineers, better collaboration with subconsultants, lower infrastructure cost, and better backup and recovery than the server in the back room closet.
Three months into planning, their water utility clients started asking questions. Where would project data be stored physically? What data residency commitments could Microsoft make? How would Sensitive Security Information (SSI, a regulated category of data related to water infrastructure) be handled? Did the firm have a Data Protection Agreement in place that met the utilities’ requirements? Could an audit of the cloud environment be accommodated if the utility or the state primacy agency requested one?
None of these questions were unreasonable. All of them had answers, once the firm worked out the architecture. But most of them were not being asked by the firm’s internal IT team during the procurement process. They came from the clients, and they slowed the migration by several months until they were addressed properly.
Cloud platforms are, on the whole, more secure than most small-to-mid firm’s on-premises environments. But “the cloud is more secure” is not the same as “any cloud deployment meets your compliance obligations.” For civil engineering firms working on water infrastructure, moving to the cloud has specific compliance considerations that require specific architectural choices.
The Problem: Cloud Procurement Skips the Compliance Layer
Most small and mid-size civil engineering firms acquire cloud services the way any business does: a manager decides the firm needs something, IT evaluates two or three products, a subscription is purchased, data is migrated, and users are onboarded. The compliance review, if it happens at all, often happens after the fact.
For routine business data, this is usually fine. For project records related to America’s Water Infrastructure Act work, where utility clients have specific expectations about data handling, it can create exposure.
Common gaps include:
- Cloud data stored in geographic regions the utility client has not approved
- Shared tenancy environments where SSI or utility-sensitive data is commingled with lower-classification data
- Cloud-to-cloud integrations that extend data into services not covered by the compliance review
- Subcontractor access to the cloud tenant without documented access controls
- Administrative access by cloud service provider staff not accounted for in data handling policies
- Backup copies in geographic regions or cloud providers not covered by the contract
The fix is not to avoid the cloud. It is to go into the cloud deliberately, with the compliance questions answered up front.
Why It Matters to You Specifically
For a firm partner or principal, the cloud and AWIA intersection creates four specific exposures:
Client Contract Obligations
Water utility client contracts increasingly include data handling, data residency, and access control requirements. A cloud environment that does not explicitly meet those requirements puts the firm in breach even if nothing has actually gone wrong.
Sensitive Security Information Handling
SSI associated with water infrastructure has defined handling requirements under federal and state regulations. Storing SSI in a cloud environment that does not support the required handling controls is a regulatory exposure, not just a contract exposure.
Competitive Position
Firms that can answer cloud security and compliance questions clearly during proposals and client conversations win work that less-prepared firms lose. Conversely, firms that stumble on client questions about cloud data handling lose credibility that is hard to recover.
Operational Resilience
A well-architected cloud environment is more resilient than most on-premises equivalents. A poorly-architected one can be less resilient, because the firm has moved critical data into an environment it does not fully understand. Understanding the architecture is not optional.
What Good Looks Like
A civil firm with a cloud environment that supports AWIA-related work well has several distinguishing features.
Tenant Choice Aligned to Sensitivity
For firms with SSI or particularly sensitive utility client data, specialized cloud tenants (Microsoft’s GCC or GCC High, AWS GovCloud, Google’s Assured Workloads) provide additional data residency, personnel, and access controls over commercial tenants. Whether the firm needs these environments depends on the sensitivity of the data and the client’s explicit requirements. Some firms run a hybrid: commercial for general business, specialized for regulated data.
Data Residency and Replication Controls
The firm knows and controls where data is stored and replicated. For utility clients who require US-only data residency, the tenant is configured to enforce this. Backup copies do not escape to regions that violate the policy.
Clear Classification Scheme
The firm classifies data (public, internal, confidential, SSI, utility-sensitive) and handles each classification appropriately. Cloud platforms support this through sensitivity labels, Data Loss Prevention (DLP) policies, and conditional access rules. Classification that is enforced by tools is more reliable than classification that depends on users remembering the policy.
Identity and Access Management
Multi-factor authentication is enforced universally. Privileged access is separated from regular access. Access to sensitive project data is role-based, with time-limited elevation for specific tasks. The NIST Cybersecurity Framework provides a defensible reference for access control design.
External Collaboration Controlled
Subconsultants and client representatives need to access specific project data, but they should not have general access to the firm’s tenant. B2B collaboration, guest access patterns, and external sharing controls are configured deliberately, not left at default settings.
Data Protection Agreements in Place
Written agreements (Business Associate Agreements, Data Protection Addenda, Cloud Terms of Service) with the cloud provider document the provider’s obligations. The agreements are shared with utility clients when requested.
Logging and Audit
Cloud activity (sign-ins, file accesses, administrative actions, external shares) is logged. Logs are retained per the firm’s records policy. Log review is routine, not just after-the-fact during incidents. The logs are available to produce for utility client audit requests.
Backup and Recovery Planning
Cloud-native backup is used for platforms like Microsoft 365 and Google Workspace, because the cloud provider’s built-in retention is not the same as a true backup. Restore procedures are tested. Recovery time objectives are documented.
Incident Response Coordination
The firm has a plan for responding to cloud-related security incidents that includes notification to affected utility clients and coordination with the cloud provider’s incident response resources.
Practical Takeaways
- Map your current cloud footprint. Every SaaS, every cloud storage service, every integration. The full list is often surprising.
- Classify the data in each cloud environment. Is any SSI stored here? Is any utility-sensitive data stored here? Is any confidential client information stored here? The classification drives the control requirements.
- Review utility client contracts for cloud and data handling requirements. If contracts specify requirements that your cloud environment does not meet, that is a priority remediation.
- Consider tenant strategy for regulated data. If the firm handles SSI or CUI (for DoD-adjacent work), a specialized cloud tenant may be the cleanest path. For firms without that exposure, commercial tenants with strong controls are usually sufficient.
- Document the architecture in writing. A brief cloud security architecture document that describes tenant choices, data classification, access controls, and data protection measures is useful for client conversations, insurance underwriting, and internal clarity.
Cloud computing is not a compliance problem. Cloud computing done without compliance thought is. Firms that approach their cloud environment with client compliance obligations in mind end up with platforms that support growth, client acquisition, and client retention. Firms that do not end up with surprise rework at the worst possible time.
If you want a conversation about assessing and structuring your cloud environment to support AWIA-related work, the HVR Cloud team works with civil engineering firms on exactly this. Get in touch and we can talk through your current state.