Stay up-to-date on the companies, people and issues that impact businesses in Syracuse, Central New York and beyond.
VIEWPOINT: Cyber-“Ish” Tips: The Importance of Policy
Whether your organization calls it cybersecurity, information security, or information assurance, a strong security program is an important element in determining the durability and success of your business. Without the proper policies, security controls, and trained staff, how will your business survive a cyber incident? Denial-of-service attacks, malware, ransomware, cyber extorsion, and more have all been receiving […]
Become a Central New York Business Journal subscriber and get immediate access to all of our subscriber-only content and much more.
Click here to purchase a paywall bypass link for this article.
Whether your organization calls it cybersecurity, information security, or information assurance, a strong security program is an important element in determining the durability and success of your business. Without the proper policies, security controls, and trained staff, how will your business survive a cyber incident? Denial-of-service attacks, malware, ransomware, cyber extorsion, and more have all been receiving a lot of media coverage lately as small, medium, and large businesses across the globe have fallen victim to malicious actors.
Security policies are the cornerstone of protecting an organization and often required for compliance with federal laws such as HIPAA (Health Insurance Portability and Accountability Act) or industry regulations like PCI (Payment Card Industry), as well as various state laws. An organization’s policies outline what is allowed, why, and how and are approved by senior management, so they have weight and authority. Properly written policies serve two purposes. Initially, they are proactive and establish guidelines for how the business will perform and secure things during its day-to-day operations. Policies such as “Acceptable Use” tell staff what they can and cannot do and advise them of the consequences of actions that might put the organization at risk. Other policies such as “Asset Management” help track vital (and expensive) equipment to prevent loss or theft. Secondly, well-written policies can help give guidance and help steer an organization during times of trouble or crisis. Important reactive policies like “Incident Response”, “Disaster Recovery” and “Business Continuity Planning” clearly establish the roles of staff, direct them how to proceed during trouble, and establish the importance of security within the organization.
A well-written policy should be phrased simply, with guidelines and directions that do not rely upon heavy technical terms, easy to follow guidance that allow all employees to understand and follow, even during times of stress.
According to PolicyAdvice.net: “Only 20% of businesses have offered cybersecurity training to their employees, whereas only 27% have actual cyber-security policies implemented to help prevent and deal with the aftermath of an attack.” How secure is your organization, does it have the proper security related policies to survive an “event?” Here is a list of 10 IT security policies that you should already have in place:
1. Information Security Policy: This policy is intended to document an organization’s protections and give guidance to limit the access and distribution of data to only those with authorized access. It is the master policy and should include policies and procedures to inform all users and networks within the organization meet minimum IT security and data-protection requirements.
2. Acceptable Use Policy (AUP): Guidance for the acceptable use and limitations of an organization’s IT assets and data. This policy should outline what the organization expects from its users, while they are using the organization’s computing assets. How users utilize these technologies can incur costs, or increase risk to the organization, this policy ensures that users understand the risks and limitations.
3. Remote Access Policy (RAP): A policy to outline and define acceptable methods of remotely connecting to the organization’s network from any endpoint (laptop, mobile phone, tablet, home desktop etc.) not located within the enterprise. The purpose of the RAP is to reduce risk introduced from devices outside the security perimeter.
4. Communications/Email Policy: How employees communicate with the public reflects on the business providing that communication. This policy is intended to formally document how to use the various communications media, what is acceptable and unacceptable use. Communications methods should include official social media, SMS (text), chat, blogs, and email.
5. Incident Response Policy (IRP): Security incidents happen, this policy helps your organization prepare and respond to the incident in a systematic way to minimize the impact to business, the loss and destruction of data, and accomplish a return of operations to a stable state. Whether it is a data breach, malware, insider, external attacker, or some other threat, having a proper IRP can mean the difference between a minor event to a catastrophic or crippling blow.
6. Business Continuity (BCP) / Disaster Recovery Policy (DRP): Business continuity and disaster recovery in the face of crisis are two of the more important policies. Too many businesses fail to establish (and test) their plans properly and formally for what to do when catastrophe strikes. These policies describe how the organization will operate in an emergency. When bad things happen, restoration and recovery are critical to the survival of a business.
7. 3rd-Party Vendor Policy: Partner organizations that provide data, software, hardware, or other goods and services all pose various degrees of risk to your organization. Whether it is on your premises or in the cloud, any third party that might have access to your data, critical systems, or networks could be used to gain access to your assets, or vice versa. This policy documents and details the process of validate, verification, controls, and mitigations for that relationship to define and minimize risk.
8. Change Management Policy (CMP): Change can be good, but unauthorized and unapproved changes can cause chaos and introduce unforeseen risks. A good CMP formalizes a process for requesting, reviewing, approving, implementing, and even reversing (if needed) IT and security-related changes within your organization.
9. Asset Management Policy: If you do not know where the devices that store your data are, how can you protect them? This policy outlines, directs, and governs how hardware and software are acquired, managed, and tracked for accountability. Understanding the lifecycle and location of an organization’s hardware and software is vital if it is to be properly protected.
10. Password Management & Standards Policy: Password policies often seem to make most users groan in agony, yet the creation, rotation, and management of passwords is a rather important issue. Password complexity and diversity are important concepts in protecting who can access what resources. This policy needs to outline the organization’s requirements so that users (who typically make their own passwords) use secure passwords. This policy should also address multi-factor authentication, an extremely strong security control to enhance usernames and passwords by utilizing an out-of-band extra factor for authentication.
Policies are not meant to be written and then sit on a shelf. The documents need to change and grow with the organization, being reviewed regularly, updated whenever there are significant changes, and tested to ensure they work. Policies should be briefed and shared with all staff as part of an organization’s security awareness and training programs so that they are part of your security apparatus. Industry best practices recommend that all policies be updated, reviewed, and tested for accuracy at least once a year.
Jeffrey Isherwood is a cybersecurity analyst at M.A. Polce Consulting Inc., a Rome–based provider of managed IT and security services to businesses and nonprofit organizations.
NONPROFIT MANAGEMENT: Outlining affiliation structures in the nonprofit sector
“Coming together is a beginning, staying together is progress, and working together is a success.” — Henry Ford One thing about the pandemic is now perfectly clear. That is, nonprofit health and human-service organizations have, for the most part, been given a reprieve from the $6 trillion-plus of federal stimulus initiatives. Just one example of this reprieve
Become a Central New York Business Journal subscriber and get immediate access to all of our subscriber-only content and much more.
Click here to purchase a paywall bypass link for this article.
“Coming together is a beginning, staying together is progress, and working together is a success.” — Henry Ford
One thing about the pandemic is now perfectly clear. That is, nonprofit health and human-service organizations have, for the most part, been given a reprieve from the $6 trillion-plus of federal stimulus initiatives. Just one example of this reprieve is the New York State budget receiving a gift of $25 billion from the American Rescue Plan. Without this additional revenue to New York State, Gov. Cuomo had been predicting significant cost reduction and reform initiatives for the $83 billion state Medicaid program and other forms of state contract funding to Social Determinant of Health (SDOH) providers. In addition, we now have wage hikes and other forms of inflation accelerating throughout the economy. This situation will place many tax-exempt organizations in a position of assessing their ability to maintain autonomy or the need to pursue an affiliation/acquisition in the next 12-36 months.
The fact pattern described above, coupled with additional economic, pandemic, and demographic challenges, will prompt the need for updating and/or revising strategic plans to evaluate the likelihood of each tax-exempt organization being able to sustain financial viability. The extraordinary pressures faced by board and management of tax-exempt organizations will continue to force many nonprofits to merge or affiliate with other organizations. In a 2012 column, I coined the term of increased affiliations as representing the “WalMarting” of the nonprofit sector.
The following lists provide the primary external and internal factors that support the inevitability of increased merger and affiliation activity. As a result of the foregoing, maintaining autonomy may not be the best alternative strategy at this point.
External factors include the following:
• “Bigger is better and more efficient” in the eyes of government
• Fewer providers = less cost
• Aggregation / transfer of financial risk = less state administrative cost
• Government views smaller providers as “higher risk”
• Networking and consortiums may create favorable contracting leverage
Internal factors impacting agency strategy are as follows:
• Maintaining sophistication in information technology, particularly telehealth and telemedicine
• Affordability of electronic-medical records and documentation
• Maintaining regulatory compliance requirements
• Increased regulatory enforcement scrutiny and audits• Pressure on administrative efficiency and cost-driving expectations from 15 percent to 10 percent or less
There have been many local examples of success in tax-exempt service organizations collaborating to achieve an effective fulfillment of their collective mission. I believe that every nonprofit organization should have the strategic objective of continuing to assess the impact and outcomes of program services, while effectively managing the cost of service delivery.
In fact, every nonprofit should be able to candidly evaluate and answer the following two questions:
• What strategies can we implement that will make our organization more cost effective with improved service outcomes?
• What are the non-core competencies of our organization that could benefit from a strategic affiliation?
I have previously developed and strongly encourage many tax-exempt board and management-team members to consider the following continuum of contractual and structural alternatives between autonomy and acquisition. In between these two ends of the affiliation spectrum, we have:
• Co-optition
• Collaboration
• Shared-service agreement
• Contractual affiliation
• Network formation – independent provider associations
• Joint venture
• Partnership/corporation
• Merger
At the opposite end of this continuum is as an acquisition, which is generally a four-letter word for the acquired party to the transaction. Merger is, by far, the preferred terminology.
As affiliations and mergers continue to increase in the nonprofit sector, the following information should be viewed as a primer for affiliations and the most popular structures being implemented.
I. Corporate Restructuring Utilizing a Passive or Active Parent Entity
Typically, the board and management of the nonprofit-program service provider, working with appropriate legal and financial advisors, will discuss, evaluate, and determine the most appropriate approach to forming a parent-entity structure. This structure should only be established in situations where there are clearly defined benefits that will facilitate future growth of the organization’s programs and services as well as providing for appropriate legal protections between and among the parent entity and its respective affiliates.
In conducting the evaluation referred to above, it is beneficial for the following initiatives to be completed.
• To identify the benefits to be derived from a corporate restructuring by conducting a needs assessment that would summarize the strengths, weaknesses, opportunities, and threats (SWOT) that may be relevant for board and management consideration.
• To identify the advantages, disadvantages, challenges, and opportunities that may be derived by a corporate restructuring process for board and management to consider regarding preferred corporate-restructuring models.
II. Passive vs. Active-Parent Entity Structures — What’s the Difference?
• Passive-parent entity — The passive parent corporate restructuring model is by far the most common approach utilized in the nonprofit sector. The passive-parent board retains “sole member” status in all the subsidiary/affiliate entities that provide charitable services under a tax-exempt 501(c)(3) exemption. For-profit subsidiaries/affiliates of a passive parent, depending upon the structure of the taxable entity, will have the passive parent as its sole member or 100 percent shareholder.
• Active-Parent Entity — The passive-parent entity model may or may not evolve to an active-parent entity model. The decision to move to an active-parent model can be influenced by several variables that can be characterized as either advantages or disadvantages. However, the primary difference between an active or passive-parent entity model is that active-parent entities are subject to far more regulatory reporting requirements and related policies and procedures that satisfy all the governance regulatory requirements related to the subsidiary/affiliate entities that provide programs and services. In an active-parent entity model, the senior management / executive leadership team typically become employees of the active-parent entity.
It is possible, under either the passive or active-parent entity structure, to have the management / executive leadership team personnel continue to be employed by the primary program service entity or through the establishment of a separate and distinct management / administrative / shared-service organization.
III. Common Alternative Corporate Entities in a Parent Model
The following corporate entities are the most common structures established by tax-exempt organizations providing health and human services in New York state.
1) Management-Services Organization (MSO) — As described above, the MSO entity structure can be used as a transition model for purposes of evaluating future affiliate entities for the parent.
2) Existing and Newly Established Program Service Entities under a Common Parent Entity (Passive Parent) — This is the most common affiliation structure used over the past 15 years as the hospital industry has gone through its own consolidation / affiliation process. This model typically allows for the local governing board of each entity to remain intact, with the combination of board members from each entity on the parent entity’s board. This model provides the parent entity with usually five or six reserve powers that represent what is commonly referred to as “sole member” status.
3) Passive-Parent Entity Structure with Limited Decision-Making Control by the Parent Board — In this model, current, and future affiliated entities would be under the auspices of a parent entity similar to Alternative #2. However, the reserve powers in this model provide for greater autonomy to the board and management of current and future affiliated entities.
4) For-Profit Entities — If it is determined that the activity is a for-profit business activity, it could be substantial enough to jeopardize the tax-exempt status of the parent entity or its affiliates, one or more for-profit taxable corporate entities may be formed. The for-profit entities established are also considered to be subsidiaries of the parent entity.
5) Full-Merger Alternative — In this model, the programs and services of the current operating entities are determined to be most effectively provided in a single merged entity with separate lines of business established based on the different programs and services provided. In this model, board and management would ultimately determine that neither the passive nor active-parent model is in the best interest of the future growth prospects of the organization. This single-entity structure would result in full control by a single governing board and a single management team.
Please be advised that any future substantial asset transfer from one 501(c)(3) public charity to another falls under the potential need for regulatory review and approval by the New York State Attorney General’s Office and its Charities Bureau.
Remember to keep your eyes focused on the mission of your organization. Do not allow the issues of who gets what job or who gets what number of votes to dictate your ultimate decisions.
Gerald J. Archibald, CPA, is a partner in charge of the management advisory services at The Bonadio Group. Contact him at garchibald@bonadio.com

Oneida County surpasses CDC’s substantial COVID transmission level but won’t issue mandates yet
UTICA, N.Y. — Oneida County says it will not be issuing any communitywide mandates, including on masks, at this time even as it is now

SUNY Oswego project to renovate Hewitt Hall into broadcasting and graphic-design facility
OSWEGO, N.Y. — SUNY Oswego has launched a $65 million project to renovate Hewitt Hall into a hub for its School of Communication, Media and

Cayuga Lake National Bank opens new Lansing branch
LANSING, N.Y. — The Lansing branch of Cayuga Lake National Bank (CLNB) in Tompkins County formally opened on July 26. Located at 3077 N Triphammer

Syracuse names Read acting head coach of women’s basketball program
SYRACUSE, N.Y. — Vonn Read, who has been serving as associate head coach of the Syracuse University women’s basketball team, will serve as acting head

Lockheed Martin CFO retires, firm appoints acting CFO
BETHESDA, Maryland — Lockheed Martin (NYSE: LMT) says CFO Kenneth Possenriede has decided to retire immediately due to personal reasons. “Over the past 14 months,

Frontier Airlines to provide year-round, nonstop service from Syracuse to Miami
SYRACUSE, N.Y. — Frontier Airlines plans to launch year-round, nonstop service from Syracuse Hancock International Airport to Miami International Airport beginning Nov. 1. Frontier will

NYAG report says Cuomo sexually harassed women; he responds in video message
“This is a sad day for New York because independent investigators have concluded that Governor Cuomo sexually harassed multiple women and, in doing so, broke

Madison County won’t issue mask mandate for fully vaccinated at this time
WAMPSVILLE, N.Y. — Madison County officials say they’re not mandating that fully vaccinated residents wear masks, as the county’s transmission level is currently categorized as
Stay up-to-date on the companies, people and issues that impact businesses in Syracuse, Central New York and beyond.