Which cybersecurity services are subject to sales tax in New York?

Network security monitoring and professional advisory services to prevent or monitor unauthorized IT access are subject to New York sales tax.

Does sales tax apply to customized cybersecurity advisory services?

Yes, professional advisory services such as creating and implementing formal cybersecurity policies fall under the scope of taxable services.

Are software installations required for network security monitoring services?

No, these services are provided using a control box installed on the client’s servers without needing additional software downloads.

What protective services are taxable under New York Sales Tax Law?

Any services aimed at preventing unauthorized IT access or monitoring network activities are considered protective services and are taxable.

How does the DTF determine the taxability of cybersecurity services?

The DTF reviews service descriptions, their purpose, and their method of delivery to determine tax applicability under the law.

Why is the taxability of cybersecurity services important for businesses?

Clarifying taxable services helps cybersecurity companies and their clients understand compliance obligations and avoid legal disputes.

New York Declares Cybersecurity Services Subject to Sales Tax

The Department of Taxation and Finance (DTF) published an Advisory Option upon a request submitted by a cybersecurity company that provides various services to detect and respond to cyber attacks on mid-sized financial institutions, healthcare facilities, and other public and private institutions and entities.

The company asked for an opinion on whether the provision of network security monitoring services and professional advisory services is subject to New York state and local sales tax.

Facts of the Case and DTFs Decision

Network security monitoring services are subscription-based services that help clients detect and prevent cyber attacks on network-connected assets and alert them when such attacks occur. The service also consists of advisory services related to the attack, and the company works with clients to resolve issues and repair any deficiencies.

The recipient of the network security monitoring services does not need to download or install any software. Those services are provided by installing a control box to detect unusual activities on the client's servers.

Professional advisory services include customized services, such as creating, overseeing, and implementing formal cybersecurity policies and procedures for clients and consulting on and developing tailored cybersecurity programs.

In its decision, the DFT notes that under the New York Sales Tax Law, protective services of any kind are subject to sales tax. This includes services that prevent unauthorized access to or use of a customer’s information technology (IT) assets in New York and monitor for such unauthorized access.

According to this and data provided by the company and found on the company website, the DTF concluded that the network security monitoring services and professional advisory services fall under the scope of sales tax.

Conclusion

As the technology improves and companies increase their reliance on it, the risk of cyber attacks also increases, making companies vulnerable. Therefore, the role of cyber security companies is becoming greater in the modern business environment. With this in mind, the DFT's decision to clarify and define taxable and non-taxable services is vital for any cyber security company in New York.

Source: Department of Taxation and Finance