HomeServicesIT Audit ServicesNew York City

IT Audit · New York City

IT Audit Services in New York City

In New York the request for an IT audit usually comes with a date attached: an NYDFS certification due April 15, a Regulation S-P deadline that has already passed, a cyber insurance renewal, a client's security review, or a provider contract that renews in sixty days. NetSys looks at the systems directly, with read-only access and a visit to your office when the scope calls for one, and writes down what we find. The report is yours, and it is written so your current provider can act on it too.

All IT services in New York City

The short answer

NetSys provides IT audit services in New York City: an independent, point-in-time review of who controls your accounts, what is unsupported or unused, whether backups restore, how security basics stand and how well your provider keeps up, with written findings, evidence and a prioritized plan. Fieldwork can include a visit to your office in the five boroughs.

Service information by The NetSys Group. Our editorial standards.

How an IT audit runs in New York City

With your written authorization we ask for read-only administrator access, or a supervised screen share if your provider prefers, to your Microsoft 365 or Google Workspace tenant, firewall, backup console, device management tools and ticketing system. Most of the evidence comes from those consoles and exports, and that part of the fieldwork runs remotely from Brooklyn in Eastern time. New York City is also inside our on-site radius, so the scope can include a visit to your office: walking the server closet or the telecom room, checking what is actually plugged into the switch, counting the laptops against the inventory, reading the labels on the firewall and the backup appliance, and interviewing the people who use the systems rather than the people who sell them. If a provider will not share access to systems you pay for, we record that as a finding and work from what you can export. Each finding states what we saw and where, the business risk and the likely size of the fix, and the findings are grouped under the six functions of NIST CSF 2.0 so anyone can check the report against a public framework. You fact-check the draft before anything is final.

NYDFS Part 500: the certification, the risk assessment and the evidence behind them

For banks, insurers, insurance producers, mortgage companies and other entities licensed by the Department of Financial Services, 23 NYCRR 500 turns the IT audit into preparation for a signature. Section 500.17(b) requires each covered entity to submit by April 15 either a certification that it materially complied with Part 500 in the prior calendar year or an acknowledgment of noncompliance identifying the sections and a remediation timeline, signed by the highest-ranking executive and the CISO, with supporting records kept for five years. Section 500.9 requires the risk assessment to be reviewed and updated at least annually and whenever a change in the business or technology materially changes the entity's cyber risk. Section 500.17(a) requires notice to the superintendent within 72 hours of determining that a cybersecurity incident has occurred, and 500.17(c) notice of an extortion payment within 24 hours. Entities under the 500.19 thresholds (fewer than 20 employees and contractors, under $7.5 million in gross annual revenue, or under $15 million in assets) are exempt from several sections but still file a notice of exemption. An IT audit gathers the facts those filings rest on: who holds the admin roles, whether MFA is enforced everywhere, whether access was reviewed, whether the backups restore. The compliance determination stays with the firm's executive, CISO and counsel (checked on November 7, 2026).

SHIELD, Regulation S-P and the insurer's questionnaire

Three more New York pressures send firms to an audit. The SHIELD Act, General Business Law 899-bb, requires reasonable administrative, technical and physical safeguards for any New York resident's private information, including regular testing and monitoring of key controls, and 899-aa requires notice of a breach to affected residents within thirty days of discovery with notice to the Attorney General, the Department of State and the State Police. Registered investment advisers and broker-dealers, of which Manhattan holds a great many, now work under the SEC's 2024 amendments to Regulation S-P: a written incident response program, customer notice within 30 days of becoming aware that sensitive customer information was or is reasonably likely to have been accessed without authorization, and compliance dates that have both passed, December 3, 2025 for larger entities and June 3, 2026 for smaller ones. And every firm's cyber insurer asks the same questions at renewal: MFA coverage, endpoint detection, backups that are offline or immutable, patching and who holds administrative access. An IT audit answers each from evidence rather than memory, and it reads the same whether the audience is the Attorney General, the SEC's examiners or an underwriter (checked on November 7, 2026).

What the IT audit deliverable contains

The report opens with an executive summary of the findings that matter most. Each finding then states what was checked, the evidence (a screenshot, an export or a log entry), why it matters to the business and the recommended fix, ranked by risk and effort. An inventory section lists accounts and who holds administrative roles, devices and their support dates, licenses against active users, and the vendor and registrar accounts that are registered to the provider rather than to you. A backup section records what is backed up, where and how often, whether a copy is offline or immutable, and the result of any test restore you authorized. A support section summarizes ticket volume, repeat problems, time to resolution and the contract's notice period and ownership terms. The report closes with a remediation roadmap in priority order with an effort estimate for each item, grouped under NIST CSF 2.0, and an evidence file you keep. Our IT audit checklist lists what we look at, our IT risk assessment template shows how findings are rated, and a cybersecurity risk assessment is the separate scope that tests how exposed you are to attack.

Auditing your current New York IT provider without a fight

New York City has hundreds of managed service providers, and most firms that ask us for an audit are unhappy with one of them: the bill keeps climbing while tickets stay open, nobody can say for sure that the backups work, or the provider holds the Global Administrator account, the domain registrar login and the firewall password and the owner has none of them. The audit keeps the tone factual. We ask the provider for read-only access or a supervised screen share and explain that the report is written so they can act on it; most cooperate. If they refuse access to systems you pay for, the refusal goes in the report, because it shows who really controls the business. You do not have to switch to NetSys afterward. Many firms use the report to reset expectations with the provider they have; some use it to plan a move; and if they move to us, the findings become the handover checklist and the first ninety days of work. Either way the report, the evidence file and the inventory are yours, in your own storage, so the next audit has something to measure against.

What is included

IT Audit in New York City: what NetSys delivers

Ownership and admin access

Global admin and emergency accounts in Microsoft 365 or Google Workspace, and whose names are on them
Domain registrar, DNS and firewall logins
Vendor portals and licensing accounts: registered to your company or to the provider
Shared logins and former employees' accounts that still work

Systems, lifecycle, licensing and backup

Device and software inventory compared with what you are billed for, with warranty and replacement dates
Unsupported systems and license counts against active users
What is backed up, where and how often, and whether a copy is offline or immutable
A test restore of a file, mailbox or server where you authorize one

Security basics and support quality

MFA coverage, endpoint protection status and patch levels
Email authentication records and admin role assignments
Ticket history: volume, repeat problems and time to resolution
Contract terms: notice period, what is included, who owns the documentation

Audit deliverables

Findings that each state what we saw and where, the business risk and the likely size of the fix
An evidence file of screenshots, exports and configuration records behind every finding
A remediation roadmap in priority order, with an effort estimate for each item, grouped under NIST CSF 2.0
A walkthrough of the final report after you have fact-checked the draft

Illustrative engagement

A 60-person Midtown investment adviser with a long-time provider and an April 15 filing

This planning example shows how we could scope the work. It is not a claim about a customer in this market or a measured result. For published customer work, see our case studies.

Illustrative planning example, not a client. A registered investment adviser with 60 staff on Park Avenue has used the same IT provider for nine years. The chief compliance officer, who also signs the firm's regulatory filings, cannot get a straight answer on whether MFA covers every account, who holds the Microsoft 365 Global Administrator role, or when the backups were last restored, and the firm's insurer has sent a longer questionnaire than last year. The provider's contract renews in the spring.

A written scope naming the systems, the read-only access requested from the provider, the authorized restore test and the one-day site visit to the Park Avenue office
Console review of the Microsoft 365 tenant, Conditional Access and admin roles, the firewall, the backup platform and the ticketing history, with exports saved to an evidence file
A site visit to inventory devices against the asset list and invoices, inspect the network closet and interview the operations lead and two advisers about how support actually works
Findings with evidence, business risk and effort, grouped under the six NIST CSF 2.0 functions and cross-referenced to the questions on the insurer's form and the firm's written information security program
A remediation roadmap in priority order and a walkthrough with the CCO and the managing partner after the firm fact-checks the draft

The deliverables are the audit report, the evidence file, the inventory and the prioritized roadmap, written so the current provider, the firm's staff or NetSys could carry it out. Whether the firm has met its regulatory obligations remains its own determination with counsel.

Published case study

Complete managed IT, cybersecurity and help desk for a 20-seat organization

A 20-seat organization handed NetSys the whole of its IT: managed services, the cybersecurity stack, a help desk its people use, onboarding for every new hire and phishing training for everyone. It shows what a fully documented environment looks like, which is the standard an audit measures against, and what the handover looks like when a firm decides to move after an audit.

Read the full case study (20 seats)

New York requirements an IT audit gathers evidence for

23 NYCRR 500 requires DFS-covered entities to file an annual certification or acknowledgment by April 15, signed by the highest-ranking executive and the CISO (500.17(b)), to review the risk assessment at least annually (500.9) and to notify the superintendent within 72 hours of a cybersecurity incident (500.17(a)). The SHIELD Act (General Business Law 899-bb) requires reasonable safeguards for New Yorkers' private information, and 899-aa requires breach notice within thirty days. The SEC's 2024 Regulation S-P amendments require advisers and broker-dealers to maintain an incident response program and notify affected customers within 30 days, with compliance dates of December 3, 2025 and June 3, 2026. An IT audit produces the evidence; the compliance determination stays with your executives and counsel. Checked on November 7, 2026.

Primary sources

What an IT audit costs in New York City

An IT audit is a one-time project, quoted as a fixed scope after the scoping call; NetSys does not publish prices for it. The quote moves with the number of users, devices and locations, the servers and cloud platforms in scope, the business applications to review, any restore tests or vulnerability scans you add, and on-site time versus remote review. A single Manhattan office on Microsoft 365 with no servers is a smaller job than three sites with a server room and a trading platform. If you later move to NetSys managed IT, that is priced per user per month, and our pricing page explains what moves the rate.

How the monthly fee is built

Who this fits, and who it does not

Best fit: a New York City firm with 10 to 250 staff that needs facts before a decision: a regulatory filing, an insurance renewal, a provider contract renewal, a client's security review, a departing IT person or a sale. Regulated firms with NYDFS or SEC obligations are the most common.

Not a fit: a firm that needs a SOC 2 report, a certification or a financial-statement audit; those come from CPA firms and certification bodies, and NetSys is neither.

IT Audit in New York City: FAQs

Do you perform IT audits on site in New York City?

Yes, when the scope calls for it. Most evidence comes from read-only console access and exports and is gathered remotely, but New York City is inside our on-site radius, so the scope can include a visit to inventory devices, inspect the network closet and interview staff in any of the five boroughs. On-site time versus remote review is one of the things the quote names. Beyond about 50 miles of Brooklyn the audit runs remotely.

How much does an IT audit cost in New York City?

We quote each IT audit as a fixed scope after a short call, and we do not publish prices. Cost follows the size of the environment: users, devices, locations, cloud platforms and applications, plus any restore tests or scans you add and whether the scope includes a site visit. You see the scope, the access we need, the deliverables and the price in writing before any work begins.

Can an IT audit prepare us for the NYDFS annual certification?

It gathers the evidence the certification rests on: who holds administrative roles, whether MFA and access controls are enforced, whether the risk assessment was reviewed in the last year, whether backups restore, and how incidents would be detected and reported within the 72-hour window. The certification itself, due April 15 and signed by the highest-ranking executive and the CISO, remains the firm's determination of material compliance, made with counsel. NetSys is not a certifying body. Checked on November 7, 2026.

Does an IT audit cover the SEC's Regulation S-P requirements for an adviser?

It covers the technical facts behind them: whether an incident response program exists in writing and in practice, whether the systems that hold customer information are inventoried and monitored, whether service providers are known and overseen, and whether the firm could detect and assess an incident in time to notify customers within 30 days. The compliance dates of December 3, 2025 for larger entities and June 3, 2026 for smaller ones have both passed, so the question now is evidence. Legal sufficiency is for counsel and the SEC's examiners. Checked on November 7, 2026.

What does the IT audit report contain?

An executive summary, then each finding with what was checked, the evidence, why it matters to the business and the recommended fix, ranked by risk and effort. An inventory of accounts, admin holders, devices, licenses and support dates. A backup section with the restore result. A support section with ticket history and contract terms. A remediation roadmap in priority order with effort estimates, grouped under the six NIST CSF 2.0 functions, and an evidence file of screenshots and exports you keep.

Will our current New York IT provider have to cooperate?

Usually they do, because the best evidence sits in consoles they manage, and we ask for read-only access or a supervised screen share and keep the tone factual. The report is written so they can act on it. If a provider refuses access to systems you pay for, that refusal goes in the report as a finding, because it shows who really controls your business.

Is an IT audit the same as a cybersecurity risk assessment or a penetration test?

No. An IT audit reviews your whole environment, including ownership, licensing, lifecycle, backups and your provider's work. A cybersecurity risk assessment asks how exposed you are to attack and ranks security findings with owners. A penetration test proves what an attacker could actually reach. Many New York firms run the audit first and add the other two where the findings point.

Do we have to move our IT to NetSys after the audit?

No. The report, the evidence file and the inventory are yours, written so your current provider or your own staff can work through them. Many firms use it to reset expectations with the provider they have. If you do decide to switch, the findings become the handover checklist, and our switching IT providers page explains how a move happens without a gap.

IT audit services in New York City

Get a straight answer about the IT you pay for.

Tell us your user count, your offices, your main systems and what prompted the question: a filing, a renewal, a questionnaire or a provider you no longer trust. We will send a written scope with the access we need, the deliverables, any site visit and the price before any work begins.

Explore IT Audit Scope 845-203-3914