Managed IT and cybersecurity for New York firms, with a written monthly report
Stedholm runs IT and security for firms of 20 to 250 people in New York and the Tri-State area. Each month you get a short written report on the state of your devices, accounts, backups and alerts. For each finding it shows the evidence behind it and where that evidence stops. When an insurer, a client or a regulator asks about a control, you have a written answer to start from. The one below shows how it is laid out.
Every managed laptop and server on patching, with the exceptions listed.
In placeMFA on every account, and the accounts still missing it.
AttentionBasisthe tenant’s own MFA policy, read together with its per-account exceptions.
Limitreading a policy does not prove that every sign-in was challenged, and it says nothing about systems outside the tenant.
A test restore completed, with how long it took.
In placeBasisa restore the engineer carried out and timed. A backup job reporting success does not count.
Limita tested restore covers what was selected for backup. It says nothing about data that was never selected.
Every alert handled, and which ones needed your decision.
In placeThe renewal questionnaire answered as far as this report reaches, with the remaining questions listed.
PendingThis shows the structure, not a finished report. Two rows here carry their basis and their limit; in your report every row does. The report is our own work. It is not an audit opinion or a certification.
What we do
The team behind Stedholm brings together more than 30 years of experience across technology, drawn from different corners of the industry. The work covers four areas, and all four appear in the same monthly report.
- 6 areas
Managed IT
Help desk, patching, laptops and servers, user accounts, vendor calls and documentation. Fully managed, or co-managed alongside your own IT staff.
- 4 lines
Cybersecurity
Detection and response across endpoints, identity and email, vulnerability scanning and staff training, with containment steps agreed in writing ahead of time.
- 3 areas
Cloud & network
Microsoft 365 held to a written baseline, the firewalls and Wi-Fi your staff reach it through, and a separate backup copy we restore from on a schedule to prove it works.
- 10 controls
Compliance & vCISO
The controls that NYDFS Part 500, HIPAA, the FTC Safeguards Rule and your insurer ask for, tracked in one register, with a named person responsible for the program.
One flat monthly fee per person, quoted in writing after the assessment.
The fee depends on device count, log sources, compliance scope and on-site time. Work outside the agreed scope is estimated and approved by you before it starts, so no hourly charge arrives unannounced. The assessment is fixed-price and quoted before we begin. Either side can end the agreement on written notice.
The same team handles IT support and security
Most firms this size buy IT support from one company and security from another. When a problem crosses both areas, such as a patch that breaks a security policy, it can turn into a question of who owns the fix. At Stedholm the same engineer handles your help desk, patching, network, detection tooling and backups. Each of those has a runbook and a line in the monthly report, and there is one person to call about any of them.
How an engagement starts
Tell us what you run
Send a message or book a call. We reply with whether this is work we do and what it would involve.
The assessment
Fixed-price, quoted before we start. With your written authorization we review your configuration and give you a findings register ranked by risk.
Review the scope before you sign
One document lists what is included, what is not, the flat monthly fee and the exit terms. Work starts when you sign it.
Recent articles
Start with an assessment
Tell us what you run and who you answer to. We review your environment under written authorization and give you a findings register, a proposed scope and a priced plan. You keep all three, whether or not you hire us.