Short answer: a managed security provider protects your business around the clock by monitoring your network and devices, stopping threats, keeping systems patched, backing up your data and training your staff. For New York businesses it should also help you meet the NY SHIELD Act, and for financial firms the NYDFS Cybersecurity Regulation (23 NYCRR Part 500). For most small businesses this costs roughly $30 to $90 per user per month on top of standard managed IT, depending on the level of protection and compliance work.
What is a managed security service provider (MSSP)?
A managed security service provider, or MSSP, is an outside team that takes responsibility for your cybersecurity. Instead of hiring security specialists in-house, you get a team that watches your systems, responds to alerts and keeps your defenses up to date.
Many managed IT providers (MSPs) now include security in their plans. The difference is focus: an MSP keeps your technology running, while an MSSP's job is to keep attackers out and limit damage when something gets through. Many small businesses get both from one partner. Read more in our guide to MSP vs MSSP.
Why New York small businesses are targets
Attackers go after small businesses because they often have valuable data (client records, payment details, login credentials) and fewer defenses than large companies. The most common threats we see are:
- Phishing emails that steal passwords or trick staff into sending payments
- Ransomware that locks your files until you pay
- Business email compromise, where criminals impersonate a vendor or executive
- Unpatched software with known security holes
- Weak or reused passwords without multi-factor authentication (MFA)
A single incident can mean days of downtime, lost client trust and notification duties under New York law.
What New York law expects from your business
The NY SHIELD Act (applies to almost every business)
The SHIELD Act applies to any business that holds private information about New York residents, wherever the business is located. It requires reasonable administrative, technical and physical safeguards, such as:
- Assigning someone to run your security program
- Identifying risks and assessing your safeguards
- Training employees on security
- Choosing service providers that can protect data, and requiring it in contracts
- Detecting, preventing and responding to attacks
- Securely disposing of private information
Small businesses (fewer than 50 employees, under $3 million in annual revenue, or under $5 million in assets) can scale their safeguards to their size and risk. The Attorney General enforces the law, with penalties of up to $5,000 per violation.
NYDFS 23 NYCRR Part 500 (financial services)
Banks, insurance agencies and other businesses licensed by the New York Department of Financial Services must follow the stricter Part 500 Cybersecurity Regulation. Its 2023 amendments are now fully in effect, including multi-factor authentication for all users accessing information systems. Smaller entities may qualify for limited exemptions, but they still carry core obligations.
This is general information, not legal advice. Check with your attorney about your specific obligations.
What a managed security provider should cover
Use this checklist when you evaluate a provider:
- 24/7 monitoring and response. Someone watches alerts and acts on them, not just an automated email.
- Endpoint detection and response (EDR/XDR). Modern protection on every computer and server that can spot and stop suspicious behavior. Computero works with tools such as Trend Micro XDR.
- Firewall management. A properly configured business firewall, kept updated.
- Patch management. Regular updates for operating systems and business software.
- Multi-factor authentication on email, remote access and key systems.
- Email security to filter phishing and malicious attachments.
- Backup and disaster recovery with offline or immutable copies, tested regularly. See our data backup and disaster recovery services.
- Security awareness training for every employee, including phishing simulations.
- Vulnerability scanning and risk assessments at least once a year.
- Incident response plan so everyone knows what to do if something happens.
- Reporting you can show to clients, insurers and auditors.
How much does managed security cost?
For small and mid-sized businesses, security services usually add about $30 to $90 per user per month to a standard managed IT plan. The cost depends on how many devices you have, whether you need 24/7 monitoring, and how much compliance documentation you need. See our NYC managed IT pricing guide for full plan costs. Computero quotes security as part of your managed IT plan after a free assessment, so you only pay for the protection your business actually needs.
Questions to ask before you sign
- Who watches our alerts at night and on weekends?
- What happens, step by step, if we get hit by ransomware?
- How often do you test our backups?
- Will you help us meet the SHIELD Act (and Part 500, if we're DFS-regulated)?
- What reports will we get, and how often?
- Are your technicians local if we need on-site help?
How Computero helps
Computero is a managed service provider in New York based in Forest Hills, Queens. Our certified IT professionals identify and fix network vulnerabilities, monitor your systems, manage firewalls and endpoint protection, and keep your data backed up, for small and mid-sized businesses across NYC, Nassau County and Long Island. Learn more about our managed IT security services.
Request a free IT assessment or call (718) 275-1600.
Frequently asked questions
What does a managed security service provider do?
It monitors your network and devices, detects and stops threats, manages firewalls and endpoint protection, keeps systems patched, backs up data, trains staff and responds to incidents, so you don't need an in-house security team.
Does the NY SHIELD Act apply to my small business?
Usually yes, if you hold private information about New York residents. Small businesses can scale their safeguards to their size, but they still need reasonable administrative, technical and physical protections.
Do I need multi-factor authentication in New York?
Businesses regulated by the NYDFS must use MFA for all users under 23 NYCRR Part 500. For everyone else, MFA is one of the most effective protections and is widely considered a reasonable safeguard.
How much does managed cybersecurity cost for a small business?
Typically about $30 to $90 per user per month on top of standard managed IT, depending on monitoring hours, the number of devices and compliance needs.
What is the difference between an MSP and an MSSP?
An MSP manages and supports your IT so it keeps running. An MSSP focuses on security: monitoring threats, responding to incidents and meeting compliance requirements. Many businesses get both from one provider.