IT Compliance Services on Long Island and Which Rules Apply to You
Start with the data you hold
Compliance starts with one question. What data do you keep, and whose is it?
Patient records, client tax files, card numbers and defense drawings each come with their own rules. Most Long Island businesses fall under at least one of them. Plenty fall under two or three.
The good news is that the IT work overlaps a lot. Encryption, multi-factor login, tested backups and access logs show up in almost every rule. Put those in place once and you cover most of the ground.
The New York SHIELD Act applies to almost everyone
If you store private information about New York residents, the SHIELD Act applies to you. That includes names paired with Social Security numbers, driver's license numbers, account numbers or biometric data. It also covers a username paired with a password.
The law requires "reasonable safeguards." That means administrative, technical and physical controls. Small businesses get some room here. Their safeguards only have to fit their size and complexity.
In practice, that comes down to the basics:
- Multi-factor authentication on email and remote access
- Encrypted laptops and phones
- A written plan for who does what after a breach
- Security training for staff at least once a year
HIPAA for medical and dental offices
Medical practices, dental offices and anyone who handles patient records for them fall under HIPAA. That includes billing services and IT providers. Every vendor that touches patient data needs a signed Business Associate Agreement.
Hicksville is a good example of how rules mix. Healthcare offices and insurance agencies share office parks there. Each one answers to a different regulator. We cover both kinds of clients with IT support in Hicksville.
For the full list of HIPAA controls, see our guide to healthcare IT and HIPAA.
The FTC Safeguards Rule for accountants and tax preparers
The FTC Safeguards Rule covers more businesses than most people expect. Tax preparers, CPA firms, mortgage brokers and car dealers all count as financial institutions under it.
The 2023 update added real technical requirements:
- One named person in charge of the security program
- A written risk assessment
- Multi-factor authentication for anyone who accesses customer data
- Encryption of customer data, both stored and in transit
- A written incident response plan
Firms with records on fewer than 5,000 customers are exempt from a few of these. The written risk assessment and the incident response plan are two of them. Multi-factor authentication and encryption still apply.
NYDFS rules for insurance agencies and lenders
Insurance agencies, mortgage bankers and other businesses licensed by the New York Department of Financial Services follow a stricter rule. It is called 23 NYCRR Part 500.
Part 500 requires a cybersecurity program, a written policy and regular risk assessments. Recent amendments extended multi-factor authentication to all remote access and tightened control of admin accounts. Smaller licensees can qualify for a limited exemption. It still keeps multi-factor authentication on the list.
Many insurance and financial firms on the Route 110 corridor in Melville fall under Part 500. Some fall under the FTC rule as well.
PCI DSS if you take card payments
Any business that accepts credit cards has to follow PCI DSS. That covers restaurants, shops, hotels and service companies that take cards over the phone.
For most small merchants, the work is simpler than it sounds. Use a payment processor that keeps card numbers off your own systems. Keep card terminals on a separate network from office computers and guest Wi-Fi. Then complete the right self-assessment questionnaire each year.
Around the airport in Ronkonkoma, hotels and shops often run card terminals and guest Wi-Fi side by side. Checking that those two networks are separate is the first thing to look at.
CMMC for defense suppliers
Manufacturers that supply the Department of Defense now need CMMC certification to win contracts. The requirement started appearing in defense contracts in late 2025.
Level 1 covers basic safeguarding and allows a yearly self-assessment. Level 2 applies to companies that handle Controlled Unclassified Information. It follows the 110 controls in NIST SP 800-171, and many contracts will require an outside assessment.
The industrial park in Hauppauge holds one of the largest groups of manufacturers on Long Island. A good number of them sit somewhere in a defense supply chain. If that is your business, start a gap assessment against NIST SP 800-171 now. Waiting for a contract deadline leaves little time to fix gaps. Our IT services in Hauppauge page covers what we do for companies in the park.
Cyber insurance asks the same questions
Even with no regulator involved, your insurance carrier asks the same questions. Cyber insurance applications now ask about multi-factor authentication, endpoint detection and offline backups. A "no" can mean a denied policy or a much higher premium.
That makes the insurance application a useful checklist. Can you answer yes to every technical question on it? Then you are most of the way there on the rules above.
The controls that cover most of the rules
Here is the short list we start with for almost every client:
- Multi-factor authentication on email, remote access and admin accounts
- Encryption on every laptop and phone
- Endpoint detection and response on every device
- Backups that are encrypted, kept offsite and test-restored every quarter
- Access reviews, so former employees lose access the day they leave
- Logs that someone actually reviews
- A written incident response plan
- Security training for staff once a year
Most of this comes standard with managed IT services. The difference with compliance is paperwork. Auditors and insurers want proof that each control exists and gets checked.
How a compliance assessment works
A compliance assessment maps your data to the rules that apply, then checks your systems against them. You get a written list of gaps, ranked by risk, with a cost for each fix.
We run these as part of our IT consulting work. For a small office it usually takes a week or two. If you are comparing providers, our guide on how to choose an IT company on Long Island covers the questions worth asking.
To get started, request a free IT assessment or give us a call. Tell us what kind of data you handle, and we will tell you which rules apply.
Common questions
Does the SHIELD Act apply to small businesses on Long Island?
Yes. It applies to any business that holds private information about New York residents. Small businesses can scale their safeguards to their size, but they still need reasonable protections such as multi-factor authentication, encryption and a breach response plan.
Is my accounting firm covered by the FTC Safeguards Rule?
Most likely. The FTC treats tax preparers and CPA firms as financial institutions under the rule. Firms with records on fewer than 5,000 customers are exempt from a few requirements, but multi-factor authentication and encryption still apply.
How long does an IT compliance assessment take?
For a small office, usually one to two weeks. Larger or multi-site businesses take longer, mostly because of the documentation involved.
