Cybersecurity Services in Minnesota
From a pork plant in Worthington to a clinic in Bemidji and a water utility north of the Twin Cities, Minnesota organizations have learned that attackers ignore size and distance. NetSys runs managed security programs for Minnesota businesses and nonprofits statewide, remotely from Brooklyn: detection and response, hardened sign-ins, email filtering, staff training and backups that survive ransomware.
The short answer
NetSys provides cybersecurity services across Minnesota: ThreatDown managed detection and response, Microsoft Defender for Business, multifactor authentication with Conditional Access, Barracuda email protection, KnowBe4 training, Rapid7 vulnerability scanning, Keeper password management, immutable backups and incident response. All of it is delivered remotely from our Brooklyn office, with security monitoring around the clock and the help desk staffed 3 a.m. to 10 p.m. Central every day. NetSys does not send engineers on site anywhere in Minnesota. We also help organizations meet the security duties in the Minnesota Consumer Data Privacy Act. Pricing is per user per month after an assessment.
Service information by The NetSys Group. Our editorial standards.
How cybersecurity is delivered to organizations across Minnesota
Distance does not change the security work, because the tools do not depend on location. A laptop in Rochester, a server closet in Mankato and a Microsoft 365 tenant used from Duluth all report to the same ThreatDown console and the same NinjaOne dashboard in Brooklyn. From there our analysts can isolate an infected device, revoke a stolen session token or block a malicious sender for the whole company. Physical work is rare and prepared ahead: a firewall for a new branch arrives preconfigured, and your staff or a local electrician connects it while an engineer confirms the tunnel is up. NetSys has no Minnesota office and no engineers in the state, so a written incident runbook replaces the assumption that someone can come over and look. Monitoring runs 24/7 from Brooklyn, and so does emergency service. Our staffed help-desk hours are 4 a.m. to 11 p.m. Eastern time (3 a.m. to 10 p.m. Central), seven days a week. The proposal states severe-incident escalation, authorized remediation and any other after-hours work.
What the July 2026 water-system attacks mean for plants and utilities
Over the weekend of July 26 and 27, 2026, attackers reached the control systems of more than 30 Minnesota community water systems. Braham's plant went briefly offline, and the city disconnected it from the internet and ran it manually afterward; the FBI says utilities in at least seven states reported incidents. Security researchers traced the intrusions to programmable controllers exposed directly to the internet, not to new malware. Manufacturers and food processors run the same kind of equipment on their lines. Our first step at any Minnesota plant is to find every device with a public address, close what does not need to be open and put the rest behind a firewall reachable only through authenticated VPN. Production networks are then separated from office networks, so a phishing email cannot travel from the front office to the packaging line.
Food, agriculture and the cost of a stopped line
Minnesota's food economy runs from Hormel in Austin and the co-ops and grain shippers of the south and west to General Mills, Land O'Lakes and CHS in the Twin Cities. When REvil ransomware hit JBS at the start of June 2021, the company's pork plant in Worthington canceled shifts and closed for the day, and JBS later said it paid the equivalent of $11 million. Smaller processors and agribusinesses face a more ordinary threat: business email compromise. A spoofed or hijacked supplier mailbox sends new bank details just before a large grain, livestock or equipment payment. We reduce that risk with DMARC on your domain, Barracuda impersonation protection, multifactor sign-in on every mailbox, alerts on new forwarding rules and a callback rule for any change to payment instructions.
Clinics outside the metro and the lessons of Change Healthcare
Regional providers, from independent clinics in central Minnesota to practices near Essentia in Duluth or CentraCare in St. Cloud, often run lean IT on the same EHR and billing connections as the large systems. The February 2024 attack on Change Healthcare, part of UnitedHealth Group, showed how a single clearinghouse outage can stop claims and cash for weeks. Under the HIPAA Security Rule a practice needs a risk analysis, access controls, audit logs and a contingency plan, and Minnesota's Health Records Act generally requires patient consent before records are released. We cover the technical side: encrypted email, role-based access, backups of anything stored locally, and a written downtime procedure that names the alternate clearinghouse, the paper forms and who calls payers if the connection goes dark.
Security duties in the Minnesota Consumer Data Privacy Act
Most commentary on Minnesota's privacy act focuses on consumer rights, but section 325M.16 also sets a security standard: controllers must establish, implement and maintain reasonable administrative, technical and physical data security practices, appropriate to the volume and nature of the data, including an inventory of the data they manage. Section 325M.18 adds written documentation of compliance policies, plus data privacy and protection assessments for targeted advertising, sales of data, sensitive data and risky profiling. The attorney general enforces the act with civil penalties of up to $7,500 per violation, and the 30-day warning period ended on January 31, 2026. We turn reasonable security into controls you can show: multifactor sign-in, encryption, logging, patch records, vendor reviews and a current data inventory.
Cybersecurity in Minnesota: what NetSys delivers
Detection and response
- ThreatDown managed detection and response with EDR agents on every workstation, laptop and server, monitored 24/7
- Microsoft Defender for Business and Rapid7 InsightIDR telemetry from identities, email and endpoints, with a person acting on alerts
Identity and email
- Entra ID Conditional Access and multifactor authentication across Microsoft 365, with legacy authentication switched off
- Privileged access and privileged identity management so admin rights are granted just in time and removed afterwards
Exposure and recovery
- Rapid7 InsightVM vulnerability scanning on a schedule, with findings fixed rather than filed
- Cisco Meraki or Fortinet firewall management, segmentation and DNS filtering on office and remote devices
Law office: layered security on Microsoft 365 with cloud-to-cloud backup
A 25-attorney firm needed client confidences protected better than a closet server could manage. Alongside a Microsoft 365 migration, NetSys layered anti-phishing and email threat protection, DNS filtering, multifactor authentication on every account and endpoint protection across attorney devices in the office and remote, and established independent cloud-to-cloud backup of the entire tenant because the recycle bin is not a backup strategy for privileged material. The firm reported 82% fewer IT support incidents per month within two quarters.
Cybersecurity work for other clients
- Insurance
Regional title insurance company
Barracuda email protection for 85 users, phishing simulations, employee security training, and MFA deployment.
Security Awareness & Phishing TrainingIT for Insurance Agencies and Brokers
Client names are withheld. These examples were chosen for the work involved, not for where the client is, so none is presented as a Minnesota client.
What cybersecurity costs in Minnesota
Cybersecurity is priced per user per month when it runs as an ongoing service, and per project for an assessment or a remediation. What moves the number: how many devices and identities are in scope, how much incident remediation and recovery is needed beyond the monitoring and authorized MDR actions in scope, which compliance standard the evidence has to satisfy, and whether the Microsoft 365 tenant is already on Business Premium or the security tooling comes from us. The free external penetration test costs nothing and runs remotely before any of that. Our managed IT pricing page explains how the fee is built.
Who this fits, and who it does not
Best fit: businesses with enough people, money movement or regulated data that a breach would hurt, and no security team of their own: professional practices, healthcare groups, importers, financial firms, nonprofits and agencies holding client credentials. Companies with an internal IT person fit as a co-managed arrangement.
Read next
Industry pages: IT for Healthcare · IT for Life Sciences & Biotech
Terms used on this page: Managed Detection and Response (MDR) · Endpoint Detection and Response (EDR) · Conditional Access
Guides: MDR versus antivirus for a small business · the Conditional Access policies to turn on first
Related pages
Read the full Cyber Security service page. See everything NetSys delivers in Minnesota.
Also in Minnesota: Managed IT Services
Cybersecurity elsewhere: Chicago · Cincinnati · Columbus · Detroit · Illinois · Indiana
Related services: Penetration Testing · Cyber Insurance Readiness · Security Assessments · Managed Detection & Response (MDR)
Cybersecurity in Minnesota: FAQs
How does cybersecurity work for Minnesota organizations?
Remotely, from Brooklyn, using security tools that reach your devices and cloud accounts wherever they are in the state. Detection and response, email filtering, sign-in policies and backups are managed through cloud consoles, and alerts are watched around the clock by people who can act on them. Severe incidents go to your dedicated engineer immediately. NetSys does not send engineers on site in Minnesota, so we document ahead of time who on your staff can unplug a device or power down a closet if an investigation needs it. Routine questions go to the help desk, open 3 a.m. to 10 p.m. Central.
How much do cybersecurity services cost for a Minnesota company?
Managed security is priced per user per month after an assessment, and we do not publish a rate. The variables are the number of endpoints and servers, how many sites and firewalls are involved, whether you run production or control systems that need their own network segment, and the evidence you must produce for an insurer, auditor or customer. Projects such as segmenting a plant network, a HIPAA risk analysis or a penetration test beyond the free external one are quoted after scoping. Terms are month to month.
Which cybersecurity requirements apply to businesses in Minnesota?
It depends on the data and the industry. Minnesota Statutes section 325E.61 requires breach notice in the most expedient time possible and, when more than 500 people must be told at once, notice to the nationwide credit bureaus within 48 hours. The Consumer Data Privacy Act adds security and inventory duties for companies above its thresholds. Clinics follow the HIPAA Security Rule and the state Health Records Act, tax preparers the FTC Safeguards Rule and IRS Publication 4557, and defense suppliers DFARS 252.204-7012 and NIST SP 800-171. This is general information, not legal advice.
Do you provide vCISO or cybersecurity consulting for Minnesota companies?
Yes. A virtual CISO gives leadership a named security owner without a full-time salary: a written security program, a risk register, quarterly reviews, answers to customer and insurer questionnaires and a plan for the next twelve months. Consulting projects include Conditional Access redesigns, Microsoft 365 hardening, network segmentation for production equipment, incident response tabletop exercises and preparation for a HIPAA or NIST SP 800-171 assessment. These can run alongside an internal IT team or another provider, with the split documented so alerts and decisions have a clear owner.
What should a Minnesota business do in the first hour of a ransomware attack?
Disconnect affected computers from the network without turning them off, so evidence stays in memory, and stop anyone from paying or emailing the attackers. Then call your IT provider's emergency line, your cyber insurer's breach hotline and your attorney. For NetSys clients, ransomware goes straight to the dedicated engineer, who contains it remotely, preserves logs and starts restores from immutable backups. In the more than 30 ransomware cases we handled over three years, every client recovered fully, and those with a disaster recovery plan were running again within 24 hours.
See what an attacker sees before they do.
The free assessment is a remote external penetration test, limited to the information available to NetSys and the external scope we agree with you. Internal reviews and ongoing security management are scoped separately.