A Cygnus Business Services brand[ Service areas ]
Where we work
Red Sector works with small and mid-sized businesses in New Hampshire, southern Maine, and northern Massachusetts. Most ongoing work is remote. Physical assessments and some incident work happen on site.
[ By state ]
Each state asks something different
State law shapes what you have to write down, who you notify after a breach, and how fast. These pages cover the parts that come up most for small businesses.
- NH
New Hampshire
Breach notice under RSA 359-C, the NH Data Privacy Act, and CMMC for Seacoast defense suppliers.
- ME
Southern Maine
Maine’s 30-day breach notice rule, shipyard suppliers in Kittery, and seasonal businesses on the coast.
- MA
Northern Massachusetts
201 CMR 17.00 and the written information security program (WISP) for the Merrimack Valley and North Shore.
[ Border businesses ]
Many businesses here answer to more than one state
A Salem, NH company with staff who live in Methuen. A Kittery machine shop whose customers are in Portsmouth. A Newburyport office with a bookkeeper in Seabrook. Data protection laws generally follow the person the data is about, not where your office is.
The most common surprise: a New Hampshire business with even one Massachusetts employee holds that person’s Social Security number for payroll, which brings in Massachusetts’ WISP rule. We sort out which rules apply during a free consultation, then build one security program that covers all of them.
[ Next step ]
Not sure which rules apply to you?
Tell us where your people and customers are. We will tell you what applies and what to do first.