A Cygnus Business Services brand[ Service area · New Hampshire ]
Cybersecurity for New Hampshire small businesses
From Manchester, Nashua, and Concord to the Seacoast, here is what New Hampshire law and New Hampshire customers expect from your security, and where Red Sector helps.
[ State law ]
What New Hampshire asks of you
// 01
Breach notice (RSA 359-C:19–21)
If someone gets into residents’ personal information, you notify the affected people as soon as possible and notify the New Hampshire Attorney General. Businesses overseen by a state regulator, such as banks and insurers, notify that regulator. If more than 1,000 people are affected, you also notify the consumer reporting agencies.
// 02
NH Data Privacy Act (RSA 507-H)
In effect since January 1, 2025. It covers larger data handlers: 35,000 or more NH consumers a year, or 10,000 if you sell personal data. If it applies, you need a clear privacy notice, a way for people to see, correct, or delete their data, and written assessments for higher-risk uses.
// 03
Contracts and insurance
For most small businesses here, the real pressure is not a statute. It is the cyber insurance renewal asking about multi-factor authentication and backups, or a larger client’s vendor security questionnaire. We help you answer both honestly and close the gaps they turn up.
This is a plain-English summary. Your attorney has the final word on how a law applies to your business.
[ Who we work with ]
New Hampshire businesses we see most
// 01
Seacoast defense suppliers
Machine shops, engineering firms, and contractors tied to Portsmouth Naval Shipyard and Pease. Defense contracts now carry CMMC requirements. We run the gap assessment against NIST SP 800-171 and build the plan. See compliance.
// 02
Southern-tier companies with Massachusetts staff
Businesses in Salem, Nashua, Hudson, and Seabrook often employ Massachusetts residents. That brings in Massachusetts’ WISP rule. See northern Massachusetts.
// 03
Healthcare and dental offices
HIPAA expects a documented risk analysis, not just antivirus. A risk assessment gives you that document and a ranked list of fixes.
// 04
Tax preparers and accountants
The FTC Safeguards Rule and IRS guidance expect a written information security plan. We write it with you and set up the controls it describes.
[ FAQ ]
New Hampshire questions
Does the NH Data Privacy Act apply to my business?
Probably not if you are a typical small office. It applies to businesses that handle personal data of at least 35,000 New Hampshire consumers a year (not counting data used only to complete a payment), or at least 10,000 if more than a quarter of revenue comes from selling personal data. Online retailers and businesses with large marketing lists should check.
What counts as a breach under New Hampshire law?
Unauthorized access to computerized data that includes a resident’s name together with a Social Security number, a driver’s license or other government ID number, or a financial account or card number with the code needed to use it. Encrypted data is generally exempt unless the key was taken too.
Do you come on site in New Hampshire?
Yes, for physical security assessments and when a project needs it. Most ongoing work, like vulnerability scanning and alert review, is done remotely.
[ Next step ]
Find out where you stand
Start with a free consultation. Onboarding is free for plan clients.