Ransomeware is estimated to cost business 11.5 billion this year alone. And here the reality: construction companies are easy pickings. They don’t understand how smart these pirates are. I am hearing of more and more companies whose data was held ransom and some had to settle and still did not get all their data unlocked! This is something you need to take seriously.
So what can you do? Proactive companies are outsourcing part of their internet security and I think this is a good idea. You will still require internal IT support or 3rd party IT services for you day to day IT needs but at least you can stop the criminals hacking into your computer infrastructure through phishing emails which is usually how they obtain access.
Here are some companies to consider:
Mimecast: This is the company HCSS uses to monitor its email. It focuses on the technical aspect as well as training employees on how to spot malicious software. I think this is key. Proper training is necessary to help employees protect themselves and the company from opening malicious emails and downloading hacked files. Besides just email and web security, they also provide secure cloud storage. I checked into the cost to monitor email and it is very reasonable however the whole package may be a bit pricey but remember security is an investment.
ForcePoint: Similar to Mimecast it protects your email, web and supports cloud storage. Forcepoint also offers insider threat analysis, which is cool but probably not necessary for smaller construction companies.
Herjavec Group: More robust (and more expensive) than the others, Herjavec Group offers more expert advice as they work alongside you to set up their software security system. They also help respond to a system breach in an effort to reduce lost data in the unlikely event that your data is hacked.

All of the companies do about the same job, with small differences. Look them up for yourself and see which one works best for you. I simply put these in a list, not create a definitive list, but to simply give you some options.
I cannot stress enough how important it is to have some sort of security with the minimum protection of email attachments being scrubbed before opening. Protect your company before your data is ransomed.