Cybersecurity decisions affect more than computers. They involve business information, employee responsibilities, outside providers, payment processes, and the ability to continue serving customers. For organizations in Nassau County, Suffolk County, and throughout New York, a useful cybersecurity risk review connects technical questions with the activities the business depends on every day.
This guide draws on official resources from the National Institute of Standards and Technology, the Federal Trade Commission, and the FBI. It includes suggested planning questions and clearly identified hypothetical examples. Risk Management International LTD (RMI) provides business risk management consulting; its published services include risk identification, insurance program review, and strategic and operational risk management.
Use a Framework to Organize the Discussion
NIST’s Cybersecurity Framework 2.0 Small Business Quick-Start Guide provides an introduction for organizations with modest or no existing cybersecurity plans. It organizes cybersecurity risk management around six functions: Govern, Identify, Protect, Detect, Respond, and Recover.
These functions provide a structure for discussing responsibilities, understanding exposures, implementing safeguards, recognizing problems, and preparing for recovery. They should be considered together rather than treated as isolated purchases or one-time projects.
A suggested first step is to identify which person coordinates each area and what information management needs to evaluate progress. Using a framework does not establish that a business meets every legal, contractual, or technical requirement.
Source: NIST — Cybersecurity Framework 2.0 Small Business Quick-Start Guide.
Start With Essential Business Activities
Before selecting new tools, document which activities depend on digital systems. Suggested questions include how employees communicate with customers, where work records are stored, which applications support billing, and who controls access to those services.
For example, a hypothetical Nassau County professional office might depend on email, scheduling software, and shared client documents. A hypothetical Suffolk County distributor might also rely on inventory applications and electronic delivery records. These examples illustrate different assessment questions rather than establish the needs of every company in those industries.
Record what is known and what still requires confirmation. A service described as essential should have an identified business owner who can explain the consequences of its unavailability.
Review Basic Safeguards With Your Technology Provider
The FTC’s small-business cybersecurity guidance recommends updating software, regularly backing up important files, protecting sensitive information, and using strong passwords. It also recommends encryption and multifactor authentication as parts of protecting business information.
A practical review can ask the technology provider to identify which safeguards are implemented, which systems are included, and how their operation is checked. Distinguish a recommendation from a completed configuration.
For instance, a proposal to enable additional account protection should remain an open action until the responsible person confirms implementation. Avoid describing the entire organization as protected based on a setting enabled for only one account.
Source: FTC — Cybersecurity for Small Business.
Examine Multifactor Authentication Coverage
CISA recommends requiring multifactor authentication for remote access to an organization’s network and for privileged or administrative access. Its business guidance also encourages moving toward phishing-resistant authentication.
For an internal assessment, ask which accounts have multifactor authentication, which methods are used, and how exceptions are approved. Include the accounts used to administer important business services.
A suggested action list can record the service, account owner, current authentication method, and unresolved questions. Qualified technical staff should evaluate suitable configurations and recovery arrangements. Multifactor authentication is a safeguard, not a guarantee that an account cannot be compromised.
Source: CISA — Require Multifactor Authentication.
Help Employees Recognize Phishing
The FBI explains that phishing messages may impersonate legitimate organizations and ask recipients to disclose information or visit a fraudulent website. Its guidance recommends examining requests carefully and avoiding suspicious links or attachments.
A practical employee reporting process can identify whom to contact when a message seems unusual. Give employees a way to ask questions without requiring them to make a technical determination themselves.
As an illustrative example, a worker receiving an unexpected request for account information could contact the established internal support person through a known channel. The example demonstrates a verification habit rather than a complete incident response procedure.
Source: FBI — Spoofing and Phishing.
Review Payment Changes Separately
The FBI’s Internet Crime Complaint Center describes business email compromise as a scam targeting businesses and individuals making transfers of funds. This makes payment instructions an important subject for a business risk review.
A suggested administrative control is to establish an independent verification process for changes to payment details. Management should define who performs the verification, which trusted contact information is used, and how the confirmation is documented.
For a hypothetical Long Island company, an email requesting a new bank account would trigger that established process. A familiar sender name should not substitute for the required verification. This example does not imply that every unusual payment request is fraudulent.
Source: FBI Internet Crime Complaint Center — Business Email Compromise.
Include Vendors With Access to Information
The FTC’s vendor security guidance recommends evaluating providers’ security practices and limiting access to information. Where a vendor has a legitimate business need, the FTC advises granting access on a need-to-know basis and only for the time necessary to perform the task.
A practical vendor inventory can identify the service provided, the information accessed, the internal relationship owner, and how access is removed when the work ends.
For a hypothetical Port Washington business using an outside support provider, management could ask which accounts the provider uses and who approves changes. Document the response instead of assuming that outsourcing the service answers every security question.
Source: FTC — Cybersecurity for Small Business: Vendor Security.
Prepare for a Suspected Data Breach
The FTC’s breach response guide recommends promptly mobilizing an appropriate response team. Depending on the organization and incident, that team may include information security, technology, legal, operations, communications, and forensic specialists.
The guide also recommends consulting legal counsel about applicable laws. Notification obligations and technical response steps depend on the circumstances.
A suggested preparation exercise is to identify the relevant contacts before an incident occurs and determine how they can be reached if normal email is unavailable. Record who coordinates the response and who authorizes communications. Avoid improvising technical remediation that could interfere with evidence collection or specialist instructions.
Source: FTC — Data Breach Response: A Guide for Business.
Document Recovery Questions Before an Outage
As a practical planning exercise, ask the technology provider to explain how essential services would be restored. Identify which business information is included, what tests have been completed, and what assumptions support the proposed recovery arrangements.
Separate the existence of a backup from evidence that information can be restored and used. Ask for a clear explanation of limitations, responsibilities, and dependencies.
For example, a hypothetical Suffolk County company could review whether its customer records and application settings are both included in recovery planning. Do not assume that restoring one file establishes that every business application can resume operations. Technical specialists should design any testing to protect live systems and sensitive information.
Connect Cybersecurity Questions With Insurance Reviews
The FTC’s cybersecurity resources include information about cyber insurance and questions businesses can discuss with insurance professionals. Any review should consider the actual policy and the organization’s circumstances.
Suggested discussion questions include which events are addressed, what exclusions require explanation, and whether particular response providers or notification procedures are specified. Request clarification from an appropriately qualified insurance professional.
Do not assume that a policy covers every technology incident or that purchasing coverage replaces operational safeguards. Keep confirmed policy information separate from estimates, sales descriptions, and unresolved coverage questions.
Define the Role of Risk Management Consulting
RMI’s published services include risk identification and assessment, insurance and risk financing, risk transfer strategies, and strategic and operational risk management. Its service descriptions also identify insurance program reviews as part of its work.
Businesses considering consulting support can discuss how technology-related exposures fit into a broader operational and insurance review. Define the intended scope, documents required, and expected deliverables.
Specialized technical assessments, penetration testing, forensic investigations, and legal advice should be assigned to appropriately qualified providers. They should not be assumed to be included in a general consulting engagement. RMI does not sell insurance.
Company source: Risk Management International LTD — Services.
Discuss Your Long Island Business Risk Priorities
For organizations in Nassau and Suffolk counties, an organized cybersecurity risk discussion can begin with essential activities, account access, outside providers, payment procedures, and response responsibilities. Record confirmed arrangements and assign unanswered questions to the appropriate people.
To discuss broader business exposures and risk management priorities, visit the Risk Management International LTD contact page.
This article provides general educational information. Examples are hypothetical, and suggested planning steps should be adapted to actual operations. Legal obligations, technical requirements, and insurance coverage should be evaluated with appropriately qualified professionals.