Start with your compliance exposure. Dental and medical practices should talk to TDI Networks first; manufacturers and other defense suppliers facing CMMC should ask finalists such as EMPIST or Fulton May, which list manufacturing among their industries, how they handle NIST SP 800-171 controls; and municipalities and fire districts have specialists in ExcalTech and adNET. Then weigh location and scale: EMPIST and Framework IT are in the city, Fulton May, Dyopath and Ntiva in the western suburbs, Netrix Global and ExcalTech in the northwest, Hodgson in the northern suburbs and adNET in the Fox Valley. Ask every finalist for its response-time commitments in writing, a copy of any SOC 2 report it mentions, and how it helps clients document BIPA consent for biometric time clocks and door readers.
What does Illinois’ biometric privacy law require from employers?
Under the Biometric Information Privacy Act, a business that collects fingerprints, face scans or other biometric identifiers, including through time clocks and door readers, must first tell the person in writing what is being collected, why and for how long, and obtain a written release. It must also publish a retention policy and destroy the data once the purpose is fulfilled or within three years of the person’s last interaction, whichever comes first. People can sue for $1,000 per negligent violation or $5,000 per intentional or reckless one; an August 2024 amendment counts repeated collection of the same biometric from the same person by the same method as a single violation and allows electronic signatures for consent.
How quickly must an Illinois business report a data breach?
Illinois’ Personal Information Protection Act requires notice to affected residents in the most expedient time possible and without unreasonable delay, rather than within a fixed number of days. If a single breach requires notice to more than 500 Illinois residents, the business must also notify the Attorney General, no later than when it notifies the residents. Your MSP’s logging and incident-response plan largely determine how quickly you can work out who was affected.
What do Chicago manufacturers need to know about CMMC?
The Defense Department’s Cybersecurity Maturity Model Certification program rule took effect on December 16, 2024, and the rule that began writing CMMC requirements into defense contracts took effect on November 10, 2025, starting a phased rollout. Suppliers that handle controlled unclassified information generally need Level 2, whose requirements match the 110 security requirements of NIST SP 800-171. Ask any MSP you are considering which of those controls it will implement and document for you, and whether its own tools and data centers meet the same standard.
