A Cygnus Business Services brand[ Service area · Southern Maine ]
Cybersecurity for southern Maine small businesses
From Kittery and York up through Biddeford, Saco, and Portland. Southern Maine mixes defense suppliers, healthcare, and seasonal businesses, and each brings its own security questions.
[ State law ]
What Maine asks of you
// 01
Breach notice (10 M.R.S. §§1346–1350-B)
Maine sets a hard deadline: notify affected residents no more than 30 days after you become aware of a breach. Notify the Maine Attorney General or your state regulator, and the consumer reporting agencies when more than 1,000 people are affected.
// 02
Defense contract rules
Portsmouth Naval Shipyard sits in Kittery, and many nearby businesses do work connected to it. Contracts that involve Controlled Unclassified Information carry NIST SP 800-171 and CMMC requirements.
// 03
Card payments
Restaurants, inns, and shops along the coast take cards, which means PCI DSS. The common gaps are guest Wi-Fi on the same network as the register and shared logins that never change between seasons.
This is a plain-English summary. Your attorney has the final word on how a law applies to your business.
[ Who we work with ]
Southern Maine businesses we see most
// 01
Shipyard suppliers
Machine shops, engineering firms, and trades contractors in York County. We assess where you stand against NIST SP 800-171 and help you close the gaps before an assessment. See compliance.
// 02
Seasonal businesses
Seasonal staff need accounts in spring and need them removed in fall. We set up a simple process so former staff do not keep access to email, booking systems, or the register.
// 03
Healthcare and professional offices
Clinics, dental offices, accountants, and law firms in the Portland area need documented risk analysis and staff who can spot a fake invoice. See awareness training.
// 04
Businesses with staff on both sides of the river
Many Kittery and York businesses have people and customers in New Hampshire. One program can cover both states. See New Hampshire.
[ FAQ ]
Southern Maine questions
We supply Portsmouth Naval Shipyard. Where do we start with CMMC?
First, find out which CMMC level your contracts call for and whether you handle Controlled Unclassified Information. If you do, the target is the 110 requirements in NIST SP 800-171, and Level 2 usually means an assessment by an authorized third party. We start with a gap assessment and a plan you can work through.
How fast do we have to notify people after a breach in Maine?
No more than 30 days after you become aware of it, unless law enforcement asks you to wait. You also notify the Maine Attorney General or your state regulator, and the consumer reporting agencies if more than 1,000 people are affected.
Which parts of Maine do you cover?
Southern Maine, mostly York and Cumberland counties: Kittery, Eliot, York, Wells, Sanford, Biddeford, Saco, and the Portland area.
[ Next step ]
Find out where you stand
Start with a free consultation. Onboarding is free for plan clients.