In New York, your industry should narrow the list before your headcount does. Law firms should start with Kraft Kennedy; hedge funds and private equity firms with ECI, Abacus or Netrio; and schools and nonprofits with CTS. Small offices without a specialist need are well served by Power Consulting, Tekscape or ETech 7, Thrive suits companies with offices beyond the city, and Electric fits startups that want software-driven IT at a published price. In every proposal, ask for on-site response times, the names of your day-to-day contacts, how the provider will document SHIELD Act safeguards or Part 500 controls, and what it costs to leave, including how passwords, documentation and backups will be handed back.
What does New York’s SHIELD Act require from a small business?
Any business that owns or licenses New Yorkers’ computerized private information must keep reasonable administrative, technical and physical safeguards, such as a designated security coordinator, risk assessments, staff training, contracts that require service providers to protect the data, monitoring for attacks and secure disposal of old records. A small business, defined as one with fewer than 50 employees, under $3 million in annual revenue in each of the last three years or under $5 million in year-end assets, only needs safeguards appropriate to its size and complexity. If a breach happens, affected New Yorkers must be notified within 30 days of its discovery, and so must the Attorney General, the Department of State and the State Police.
Which firms must follow NYDFS Part 500, and what changed in November 2025?
The Department of Financial Services’ cybersecurity regulation, 23 NYCRR Part 500, covers anyone licensed, registered or chartered under New York’s Banking, Insurance or Financial Services laws, from banks and insurers to many brokers and lenders. Under its 2023 amendments, the final requirements took effect on November 1, 2025: multi-factor authentication for anyone accessing a covered company’s information systems, with narrower rules for firms that qualify for a limited exemption, and a complete, documented inventory of IT assets. An MSP that serves financial firms should be able to show exactly how its services map to these controls.
Is an MSP cheaper than hiring IT staff in New York?
It can be, depending on the quote. Federal wage data for May 2025 put the average New York metro salary at $78,800 for computer user support specialists and $122,580 for network and computer systems administrators, before payroll taxes, benefits and recruiting, and one employee can’t cover nights, vacations and every specialty. An MSP spreads those skills across many clients for a monthly fee, usually per user or per device; ask for a written quote that lists what is included, such as on-site visits, after-hours support, security tools and projects, so you can compare it with a salary on equal terms.