Your IT compliance requirements depend on the data you hold and the industry you work in. Almost every Illinois business owes reasonable security and breach notice under state law, and financial firms and healthcare practices carry federal rules on top. WEBIT Services sorts clients’ obligations into those two layers first, since the state layer applies to nearly everyone.
A 30-person accounting firm, for example, answers to the Illinois breach law for every client record and to the FTC Safeguards Rule because it prepares tax returns. Both rules shape how the firm’s email, backups and remote access have to be set up.
What does Illinois require of every business that holds personal data?
Illinois requires any business holding residents’ personal information to protect it with reasonable security and to report breaches. The Illinois Personal Information Protection Act (815 ILCS 530) requires a data collector to “implement and maintain reasonable security measures” and to notify affected residents “in the most expedient time possible and without unreasonable delay.” A single breach affecting more than 500 Illinois residents also requires notice to the Illinois Attorney General. The Act covers names paired with Social Security numbers, driver’s license numbers, account numbers, medical information, biometric data and online account credentials.
Compliance rules by industry
Industry rules sit on top of the Illinois baseline. The most common ones for WEBIT’s client base:
| Industry | Main rule | What it asks of IT |
|---|---|---|
| Tax preparers, mortgage brokers, lenders, financial advisors | FTC Safeguards Rule | A written security program, risk assessment, encryption, MFA, staff training, vendor oversight and breach reporting to the FTC |
| Medical and dental practices | HIPAA Security Rule | Risk analysis, access controls, audit logs, backups and business associate agreements |
| Any business taking card payments | PCI DSS | Secure card handling, network segmentation and regular scanning |
| Every Illinois business | Personal Information Protection Act | Reasonable security and timely breach notice |
The FTC Safeguards Rule for financial firms
The FTC Safeguards Rule covers non-bank financial businesses, including “mortgage brokers,” “tax preparation firms” and “other financial advisors.” It requires a Qualified Individual to run the security program, a written risk assessment, encryption, multi-factor authentication, staff training and a written incident response plan. Since May 13, 2024, firms must notify the FTC within 30 days of discovering a breach involving at least 500 consumers. The FTC Safeguards Rule whitepaper breaks down each element.
HIPAA for medical and dental practices
The HIPAA Security Rule applies to practices that handle electronic protected health information, and the current rule remains in effect. HHS proposed a major update in January 2025, published in the Federal Register, and it is still a proposed rule. Practices that meet today’s requirements with documented risk analysis and tested backups will be closest to ready if it is finalized. Dental offices can start with the HIPAA basics whitepaper for dental offices.
Which compliance tasks belong to your IT provider?
Your IT provider should own the technical controls, and your business owns the policies, decisions and sign-off. A workable split:
- IT provider: MFA, encryption, patching, backups, endpoint protection and logging.
- IT provider: documentation of those controls for audits, insurers and regulators.
- Your business: naming a responsible person, approving policies and training staff.
- Shared: the annual risk assessment and the incident response plan.
The guide to creating an IT compliance policy covers the written side.
How WEBIT Services supports compliance
WEBIT Services aligns every managed environment to the NIST Cybersecurity Framework as a standard part of service, with Security Essentials on every device. Managed compliance programs and compliance documentation packages beyond standard NIST alignment are available as add-ons and scoped before work begins. See the industry pages for financial services and medical practices for rule-by-rule detail.
About the author
Aarin Bailey is the Chief Operating Officer of WEBIT Services, where he leads service delivery, sales, client management, internal systems and automation. He started his career on a help desk and worked across several IT companies before joining WEBIT. More from Aarin Bailey.
