IT and Security Needs by Industry

Why IT needs differ by industry

Three things change what a business needs from an IT provider: the data it holds, how much downtime it can absorb, and where its people work.

• Regulated data. Patient records (PHI), controlled unclassified information (CUI) from defense contracts, taxpayer data and client funds all come with rules about how they are protected and how fast a breach must be reported.
• Uptime. A dental office that cannot open its imaging software, a plant whose production line stops, or a restaurant whose registers go down loses revenue by the hour. Ransomware was present in 48% of breaches in the 2026 Verizon Data Breach Investigations Report ¹³, so recovery planning matters more where downtime is expensive. See backup and disaster recovery.
• Seasonal and field work. Construction crews, seasonal retail staff and volunteers join and leave often and work from phones and tablets, which makes account setup and offboarding a bigger part of the job.

A general managed IT provider can serve most of these businesses. The difference is whether they already know your rules and software. The rules below are summaries, not legal advice; confirm your own obligations with counsel or your assessor.

Healthcare and dental offices

Medical and dental practices that handle electronic patient records must follow the HIPAA Security Rule, which sets administrative, physical and technical safeguards ¹. A breach of unsecured patient information must be reported to affected patients no later than 60 calendar days after discovery ².

Enforcement reaches small practices. On October 8, 2026, HHS announced a $140,000 settlement with a dental practice ³. A proposed update to the Security Rule would add requirements such as MFA and encryption ¹⁵, but it is still a proposal and the current rule remains in effect ¹⁴.

See IT for healthcare and IT for dental offices, then the HIPAA compliance checklist and HIPAA compliance services.

Accounting firms and financial services

Tax preparers and accounting firms are financial institutions under the FTC Safeguards Rule ⁴, and the IRS says that applies regardless of firm size and requires a written information security plan ⁵. The rule requires MFA for anyone accessing an information system and encryption of customer information, and a breach of unencrypted information about 500 or more consumers must be reported to the FTC within 30 days ⁴.

Banks, lenders, insurers and investment firms answer to different regulators. Firms licensed by the New York Department of Financial Services follow 23 NYCRR Part 500, which requires notice to DFS within 72 hours of determining an incident occurred ⁸. Since November 1, 2025 it has also required MFA for anyone accessing their systems; small firms that qualify for the limited exemption have a narrower MFA duty ⁸. SEC-registered firms covered by the amended Regulation S-P must notify affected individuals within 30 days ⁹.

See IT for accounting firms, IT for financial services and our guide to the written information security plan.

Defense manufacturing, architecture and engineering

Manufacturers, engineering firms and architects that work on defense contracts often handle CUI, such as drawings and specifications. DFARS 252.204-7012 requires contractors to implement NIST SP 800-171 on systems that hold it and to report cyber incidents to DoD within 72 hours of discovery ⁶.

CMMC adds assessments on top. On July 13, 2026, DoD paused CMMC in Phase 1, which means self-assessments; third-party certification is suspended with no restart date announced, and the existing NIST SP 800-171 and self-assessment obligations still apply ⁷. The schedule may change, so check the CMMC overview and NIST SP 800-171 requirements for the current status. Some firms move CUI into a separate cloud environment such as GCC High.

Outside defense work, manufacturers worry most about production downtime. Exploited vulnerabilities were the top way into breached networks in the 2026 Verizon report, at 31% of breaches ¹³, and older machines on the plant floor are often hard to patch.

See IT for manufacturing and IT for architecture and engineering firms.

Law firms, construction and real estate

These businesses move large sums by wire, which makes them prime targets for business email compromise. The FBI received reports of about $3.05 billion in business email compromise losses in 2025 ¹⁰, and business email compromise and funds transfer fraud made up 58% of incidents in Coalition's 2025 claims data ¹².

Law firms also hold confidential client files and trust account funds, so email security, MFA and a firm rule to confirm any change in payment instructions by phone are the core of the job. Construction and property firms add field crews on phones and tablets, job-site connections and frequent staff turnover.

See IT for law firms and IT for construction and real estate, plus cybersecurity for small business for the baseline controls.

Schools and nonprofits

Most private schools and nonprofits have no single federal security rule, but they hold student, family and donor data and run on tight budgets. NIST's Cybersecurity Framework 2.0 is a free, voluntary starting point written for organizations from the smallest schools and nonprofits up ¹¹.

The common IT problems are shared and volunteer accounts, donated or aging hardware, and making the most of nonprofit software discounts. See IT for schools and IT for nonprofits, and a cybersecurity risk assessment if you need to decide where to spend first.

Restaurants, hotels, retail and startups

For restaurants, hotels and shops, the main IT risk is downtime at the point of sale, followed by card payment security terms in their merchant agreements. Separating guest Wi-Fi from business systems, keeping registers patched and having a fallback when the internet drops matter more than heavy compliance work. See IT for restaurants, hotels and retail.

Startups usually begin with cloud tools and no office server. Their IT needs grow quickly once larger customers send security questionnaires or an insurer asks for controls; our page on cyber insurance requirements lists what insurers commonly check. See IT for startups.