New York Declares Cybersecurity Services Subject to Sales Tax

The Department of Taxation and Finance (DTF) published an Advisory Option upon a request submitted by a cybersecurity company that provides various services to detect and respond to cyber attacks on mid-sized financial institutions, healthcare facilities, and other public and private institutions and entities.

The company asked for an opinion on whether the provision of network security monitoring services and professional advisory services is subject to New York state and local sales tax.

Facts of the Case and DTFs Decision

Network security monitoring services are subscription-based services that help clients detect and prevent cyber attacks on network-connected assets and alert them when such attacks occur. The service also consists of advisory services related to the attack, and the company works with clients to resolve issues and repair any deficiencies.

The recipient of the network security monitoring services does not need to download or install any software. Those services are provided by installing a control box to detect unusual activities on the client's servers.

Professional advisory services include customized services, such as creating, overseeing, and implementing formal cybersecurity policies and procedures for clients and consulting on and developing tailored cybersecurity programs.

In its decision, the DFT notes that under the New York Sales Tax Law, protective services of any kind are subject to sales tax. This includes services that prevent unauthorized access to or use of a customer’s information technology (IT) assets in New York and monitor for such unauthorized access.

According to this and data provided by the company and found on the company website, the DTF concluded that the network security monitoring services and professional advisory services fall under the scope of sales tax.

Conclusion

As the technology improves and companies increase their reliance on it, the risk of cyber attacks also increases, making companies vulnerable. Therefore, the role of cyber security companies is becoming greater in the modern business environment. With this in mind, the DFT's decision to clarify and define taxable and non-taxable services is vital for any cyber security company in New York.

Source: Department of Taxation and Finance