What areas does Metro Point IT serve?

We serve businesses throughout Maryland, Virginia, and Washington DC, including Bethesda, Rockville, Silver Spring, Annapolis, Arlington, Alexandria, Fairfax, and the entire DMV region.

Do you offer flat-rate IT pricing?

Yes. Metro Point IT offers flat-rate monthly managed IT plans with no long-term contracts, so you always know what you're paying.

Are you HIPAA compliant?

Yes. We support HIPAA-covered entities and execute Business Associate Agreements. Our team has experience with healthcare IT compliance across Maryland, Virginia, and DC.

What is HIPAA and does it apply to my medical practice?

HIPAA applies to all healthcare providers that transmit health information electronically — virtually every modern medical practice, dental office, physical therapy clinic, and specialist. It covers EHRs, billing systems, scheduling software, email with patient information, and text messages.

What is the difference between HIPAA and HITRUST certification?

HIPAA is a federal law you must comply with. HITRUST CSF is a voluntary but increasingly expected security certification demonstrating higher security maturity, often required by hospitals, large health systems, and health insurers as a condition of partnership.

What happens if my practice has a HIPAA data breach?

Under HITECH you must notify affected patients within 60 days. If 500+ individuals are affected you must also notify HHS and prominent media. Penalties range from $100 to $50,000 per violation with annual caps up to $1.9 million.

Do you sign a Business Associate Agreement?

Yes — Metro Point IT signs a BAA with every healthcare client before any work begins. We also help practices identify all other technology vendors requiring BAAs and assist in executing those agreements.

How quickly can you get our practice HIPAA compliant?

A full HIPAA Security Risk Assessment and initial remediation typically takes 4-8 weeks depending on environment complexity. We prioritize highest-risk gaps first so your practice reaches a defensible compliance posture quickly.

Does GLBA apply to my financial advisory or CPA firm?

Yes. The FTC Safeguards Rule applies broadly to registered investment advisors, mortgage brokers, CPA firms that prepare tax returns, and others. If your business handles customer financial information as a material part of operations, the Safeguards Rule almost certainly applies.

What technical requirements does the updated Safeguards Rule require?

The 2023 rule requires a written Information Security Program, a designated qualified individual, a risk assessment, MFA for anyone accessing customer information, encryption at rest and in transit, annual penetration testing, activity monitoring and logging, a written incident response plan, and annual board reporting.

What is SOC 2 and does my firm need it?

SOC 2 demonstrates your organization maintains effective security controls over customer data. Not legally required, but increasingly demanded by enterprise and institutional clients. It gives significant competitive advantage and reduces insurance premiums.

How do you protect client financial data on our network?

Defense-in-depth: next-gen endpoint protection, MFA on all accounts, encrypted communications, network segmentation, real-time threat monitoring, and regular penetration testing. Employee security training is included because phishing remains the most common entry point.

What happens if our firm experiences a data breach?

Under the updated Safeguards Rule, notify the FTC if 500+ customers are affected. SEC-registered firms must disclose material incidents within 4 business days. Metro Point IT incident response plan defines exactly what to do, who to notify, and how to document the response.

Are law firms required to have cybersecurity measures?

Yes. ABA Model Rule 1.6(c) requires reasonable efforts to prevent unauthorized disclosure of client information. Maryland, Virginia, and DC bar associations have all issued reinforcing guidance.

How do you protect attorney-client privilege in our IT?

Encrypted email and file transfer, access controls restricting matter file access to authorized personnel only, MFA on all systems, network segmentation, comprehensive audit logging, and attorney training on behaviors that can inadvertently waive privilege.

Do you support legal practice management software?

Yes — Clio, MyCase, PracticePanther, NetDocuments, iManage, Worldox, and Relativity. We handle setup, Microsoft 365 integration, troubleshooting, data migration, and user training.

What should a law firm do after a data breach?

Isolate affected systems immediately, call Metro Point IT for incident response, preserve forensic evidence, document all known facts, and consult ethics counsel about notification obligations. Maryland, Virginia, and DC have notification timelines as short as 30 days.

How do you handle after-hours IT emergencies?

Metro Point IT provides a 24/7 emergency line at (443) 741-0823. Critical issues are responded to around the clock with on-site emergency visits when remote resolution is not possible.

What is CMMC and which contractors need it?

CMMC 2.0 applies to virtually all defense contractors. Level 1 covers contractors handling Federal Contract Information. Level 2 covers those handling CUI — most contractors on sensitive defense programs. If your contracts include DFARS 252.204-7012 you likely have CUI and need Level 2.

What is the difference between CMMC self-assessment and third-party certification?

Level 1 allows annual self-attestation. Level 2 for most CUI contractors requires triennial third-party assessment by a C3PAO. Inaccurate self-attestation can trigger federal fraud investigations under the False Claims Act.

Does my nonprofit need HIPAA or other compliance frameworks?

Nonprofits providing healthcare or handling PHI are subject to HIPAA. Those accepting credit card donations need PCI-DSS consideration. State privacy laws apply if collecting personal data from Maryland, Virginia, or DC residents.

How do you help nonprofits reduce IT costs?

We qualify nonprofits for Microsoft 365 Nonprofit plans (up to 300 free licenses), Google for Nonprofits (free Workspace), and TechSoup discounts. Our flat-rate plans are structured for smaller headcounts.

What is a System Security Plan and do I need one?

An SSP describes your information system, applicable security requirements, and how they are implemented. NIST SP 800-171 requires one for any contractor handling CUI. Metro Point IT develops your SSP as part of CMMC readiness.

How common is wire fraud in real estate and how do we protect ourselves?

Over $400 million lost annually in reported cases alone. The primary attack vector is business email compromise. Most effective protections: MFA on all email, advanced email security filtering, DMARC/DKIM/SPF configuration, and out-of-band wire instruction verification procedures.

Does GLBA apply to my real estate brokerage?

GLBA applies to firms that provide or arrange financing. If your brokerage arranges mortgages, offers financing programs, or refers clients to lenders as a material part of business, GLBA likely applies.

What real estate IT systems do you support?

Salesforce, kvCORE, Follow Up Boss, Dotloop, DocuSign, Zipforms, Buildium, AppFolio, Yardi, RealPage, and MLS platform integrations. Setup, troubleshooting, Microsoft 365 integration, and user training for all platforms.

How do you support agents working across multiple locations?

Secure VPN for remote office access, Microsoft 365 cloud productivity from any device, mobile device management for company phones and tablets, and multi-site network management for brokerages with multiple office locations.

What should a brokerage do after discovering wire fraud?

Immediately contact your bank to attempt fund recall. File a report at ic3.gov. Contact your state real estate commission if client funds were involved. Call (443) 741-0823 for immediate incident response.

What is included in your flat-rate managed IT support?

Our flat-rate managed IT plans include unlimited helpdesk support (remote and on-site), 24/7 infrastructure monitoring, automated patch management, antivirus and endpoint protection, backup monitoring, vendor management, and quarterly technology reviews. There are no per-ticket charges for covered services.

How quickly do you respond to support requests in Maryland and Virginia?

Critical issues (server down, ransomware): remote response within 30 minutes. High-priority issues (multiple users affected): within 2 hours. Standard requests: within 4 business hours. On-site visits are available same or next business day throughout Maryland, Virginia, and Washington DC.

Do you require long-term contracts?

No. Our managed IT plans are month-to-month. We earn your business every month by delivering consistent, high-quality support.

What cybersecurity services does Metro Point IT provide?

We provide EDR, MFA implementation, email security, phishing filtering, security awareness training, vulnerability scanning, patch management, dark web monitoring, and incident response planning.

What is EDR and why is it better than antivirus?

Endpoint Detection and Response (EDR) uses behavioral analysis and machine learning to detect threats based on what they do — including zero-day attacks and fileless malware that traditional antivirus misses.

Can you help with cybersecurity compliance in Maryland or Virginia?

Yes. We help with HIPAA (healthcare), GLBA Safeguards Rule (financial services), CMMC 2.0 (federal contractors), and Virginia CDPA data protection requirements.

Can you migrate our business from Google Workspace to Microsoft 365?

Yes — Google Workspace to Microsoft 365 migration is one of our most common projects. We migrate all Gmail, Drive, Calendar, and Contacts data with zero data loss, typically over a weekend.

What Microsoft 365 plan do you recommend?

For most compliance-sensitive businesses (healthcare, legal, government contractors), we recommend Microsoft 365 Business Premium — it includes Microsoft Defender EDR, Intune device management, and Azure AD Premium P1.

Do you provide Microsoft Teams Phone setup?

Yes. Microsoft Teams Phone replaces your traditional PBX. We handle licensing, number porting, auto-attendant configuration, call routing, and voicemail setup.

How do I know if my office network needs to be redesigned?

Common signs: Wi-Fi dead spots, slow speeds despite fast internet, frequent dropped connections, no separation between guest and staff networks, or network hardware more than 5-7 years old.

What Wi-Fi equipment do you recommend?

For most offices we deploy Ubiquiti UniFi or Cisco Meraki access points with a managed PoE switch and Meraki or Fortinet firewall — exact configuration depends on site survey results.

Do you provide structured cabling installation in Maryland and Virginia?

Yes. We install Cat6 and Cat6A structured cabling, patch panels, server rack organization, and cable management for new offices and buildouts throughout Maryland, Virginia, and DC.

How often should business data be backed up?

For most businesses, daily backups at minimum — with more frequent backups (every 4 hours) for critical servers running databases, EHR systems, or financial applications.

Can you recover our data after a ransomware attack?

Yes — if you have properly isolated offsite backups in place. Our solutions use immutable cloud storage that ransomware cannot encrypt. Recovery typically takes 4-24 hours depending on data volume.

Does Microsoft 365 back up our email and files automatically?

No — Microsoft provides service availability, not data backup. You need a separate Microsoft 365 backup solution for your Exchange mailboxes, SharePoint, OneDrive, and Teams data.

What VoIP phone systems do you support in Maryland and Virginia?

We install and support Microsoft Teams Phone, RingCentral, Zoom Phone, 8x8, and other leading cloud VoIP platforms.

Can you port our existing business phone numbers to VoIP?

Yes. Number porting transfers your existing numbers to your new VoIP system — the process typically takes 2-4 weeks and we manage it entirely.

Will VoIP work with our current internet connection?

A 20-person office typically needs 1 Mbps upload per 10 concurrent calls plus QoS configuration on your router. We assess your connection during pre-deployment review.

How many security cameras does my business need?

A typical 2,000 sq ft office or retail space requires 4-8 cameras. We perform a site walkthrough and provide a camera placement recommendation before any equipment is purchased.

Can I view my security cameras remotely from my phone?

Yes. All modern IP camera systems include mobile apps for iPhone and Android with live and recorded video access. We configure two-factor authentication for secure remote access.

How long is security camera footage stored?

A typical 8-camera 4MP system stores approximately 30 days of continuous footage on a 4TB NVR. Motion-triggered recording can extend this to 60-90+ days.

What does smart office and device setup include?

Conference room displays and AV equipment, wireless printers, POS systems, MDM enrollment for company smartphones and tablets, VoIP desk phones, and network-connected IoT devices.

Can you set up a conference room with video conferencing?

Yes. We install complete conference room AV — large format displays, ceiling microphones, cameras, and integration with Microsoft Teams Rooms, Zoom Rooms, or Google Meet hardware.

IT Update

Windows 10 End of Life: What Maryland & Virginia Businesses Still Running Windows 10 Must Do Now

Updated May 2026 · 6 min read · Metro Point IT Services · Metro Point IT Services

⚠️ Update — May 2026: The Windows 10 End of Life deadline has passed (October 14, 2025). If your business is still running Windows 10, you are now operating on an unsupported OS with no security patches. Immediate action is required.

Microsoft officially ended support for Windows 10 on October 14, 2025. For Maryland and Virginia businesses still running Windows 10, that deadline has now passed — meaning your systems are no longer receiving security patches, bug fixes, or technical support. Every day you continue running Windows 10, your exposure grows as new vulnerabilities are discovered with no fix coming from Microsoft.

What "End of Life" Actually Means

End of Life (EOL) means Microsoft stops releasing security updates for Windows 10. Every vulnerability discovered after October 14, 2025 will remain permanently unpatched. Attackers actively target EOL systems because the vulnerabilities are publicly known and will never be fixed. Running Windows 10 past its EOL date is the equivalent of leaving your office door unlocked indefinitely — you may be fine for a while, but the risk compounds every single day.

For healthcare practices in Maryland and Virginia, running EOL software also creates direct HIPAA compliance exposure. HHS auditors consider unpatched, unsupported operating systems a failure of the technical safeguards required under the HIPAA Security Rule. The same logic applies to financial firms under GLBA and government contractors under CMMC — none of these frameworks allow you to knowingly run unsupported software on systems handling regulated data.

Your Three Options

Option 1: Upgrade to Windows 11 (Recommended)

Windows 11 is a free upgrade for compatible hardware. The key requirement is a TPM 2.0 chip — most machines manufactured after 2018 have this. Metro Point IT conducts compatibility assessments across your entire device fleet, identifies which machines can be upgraded in place, and performs the upgrades with zero data loss and minimal downtime.

Option 2: Hardware Replacement

If your machines are 5+ years old, upgrading the hardware makes more sense than upgrading just the OS. New hardware ships with Windows 11 Pro, runs faster, and comes with 3-5 years of warranty support. We source and deploy business-grade hardware at competitive pricing for DMV-area clients.

Option 3: Extended Security Updates (Temporary)

Microsoft offers paid Extended Security Updates (ESU) for Windows 10 for up to three additional years — but this option is expensive (approximately $61 per device for Year 1, doubling each year) and only delays the inevitable. ESU is a bridge, not a solution.

The Compliance Risk Is Real

Beyond security, running EOL software creates direct audit exposure. HIPAA risk assessments must identify and remediate known vulnerabilities — running Windows 10 after EOL is a documented, known vulnerability. CMMC Level 1 and Level 2 both require systems to be maintained with current security patches. A single auditor finding unsupported OS versions on workstations handling CUI or PHI can trigger a major finding requiring immediate remediation.

What to Do Right Now

Inventory your devices: Know exactly how many machines are running Windows 10 and whether they are upgrade-eligible.
Plan before the rush: IT providers across the DMV will be overwhelmed with upgrade requests in Q3 2026. Start now to avoid delays.
Test critical software: Some older line-of-business applications do not run on Windows 11. Test compatibility before mass deployment.
Budget accordingly: Whether upgrading software or hardware, build this into your 2026 IT budget now.

Free Windows 10 Upgrade Assessment for DMV Businesses

Metro Point IT is offering free Windows 10 end-of-life assessments for Maryland and Virginia businesses. We will inventory your entire device fleet, identify upgrade-eligible machines, flag compatibility risks, and give you a clear remediation plan — at no charge.

Schedule Your Free Assessment

What 'End of Life' Actually Means for Your Business

When Microsoft declares a product end of life, it stops releasing security patches for that version. Every vulnerability discovered after that date — and new vulnerabilities are discovered constantly — will never be fixed. Your Windows 10 machines will continue working, but every unpatched vulnerability becomes a permanent entry point for attackers.

This isn't theoretical. After Windows XP reached end of life in 2014, exploit kits specifically targeting XP vulnerabilities proliferated on criminal marketplaces. Businesses still running XP years later faced significantly elevated breach rates. The same pattern will repeat with Windows 10 — attackers will hold zero-day exploits discovered before October 2025 and use them en masse against the large installed base that remains after the deadline.

Cyber Insurance Implications

Many cyber insurance policies explicitly exclude coverage for breaches involving end-of-life software. If you're running Windows 10 past October 2025 without an Extended Security Update agreement, your insurer may deny a claim arising from that system. Review your policy language now.

The Windows 11 Hardware Requirement Problem

The primary reason many Maryland and Virginia businesses are nervous about the Windows 10 deadline is Windows 11's strict hardware requirements. Unlike previous Windows upgrades, Windows 11 requires a TPM 2.0 chip and a processor from Intel's 8th generation (2017) or later — or AMD's Ryzen 2000 series or later. Many business-class workstations purchased before 2018 simply cannot run Windows 11, regardless of their RAM, storage, or processing capability.

This means the Windows 10 end of life isn't just a software update — for many businesses, it's a hardware refresh cycle. The good news is that business-class workstations and laptops are more affordable and capable than ever, and a proactive refresh program can spread the cost over time rather than requiring emergency replacements after the deadline.

Your Four Options After October 14, 2025

Option 1 — Upgrade to Windows 11 (if hardware qualifies): Free upgrade via Windows Update for eligible machines. The cleanest and least expensive option. Run the PC Health Check tool on each machine to verify compatibility
Option 2 — Replace hardware and deploy Windows 11: For machines that don't meet Windows 11 requirements, replacement is the most secure long-term option. Business-class Lenovo ThinkPad/ThinkCentre, Dell Latitude/OptiPlex, and HP EliteBook/EliteDesk lines start from $600-900 with Windows 11 Pro
Option 3 — Extended Security Updates (ESU) for Windows 10: Microsoft offers paid Extended Security Updates for Windows 10 through October 2028. In the first year, ESU costs $61 per device. Price doubles each year ($122 in year 2, $244 in year 3). This is a bridge, not a solution — use it to buy time for a proper hardware refresh
Option 4 — Do nothing (strongly not recommended): Running end-of-life Windows 10 without ESU in a business environment exposes you to unpatched vulnerabilities, potential cyber insurance exclusions, and possible compliance violations for regulated industries

What Maryland and Virginia Businesses Should Do Right Now

Inventory your Windows 10 devices: Use the Microsoft PC Health Check app or ask your IT provider to generate a report of all Windows 10 machines and their Windows 11 upgrade eligibility
Categorize each machine: Windows 11 upgradeable vs. requires hardware replacement. Flag any machines running critical applications that may not be Windows 11 compatible
Create a replacement timeline: Spread hardware replacements over the next 12 months based on priority. Highest-priority: machines handling sensitive data (patient records, financial data, client files)
Test application compatibility: Before upgrading, verify that your EHR, practice management, accounting, or line-of-business applications support Windows 11
Plan the migration: User profile migration, data transfer, and application reinstallation take time — plan for 2-4 hours per machine minimum
Update your backup strategy: Before migrating any machine, verify you have a current backup

Need Help Planning Your Windows Upgrade?

Metro Point IT provides Windows 10 to Windows 11 migration planning and execution for Maryland and Virginia businesses. We inventory your devices, identify compatibility issues, recommend replacements, handle migrations, and ensure continuity of business applications throughout the process. Call (443) 741-0823 for a free assessment.

Services

Managed IT Support for DMV Businesses

Cloud

Why Maryland Businesses Are Moving to Microsoft 365

Services

Cybersecurity Services for DMV Businesses

Written by

Metro Point IT Editorial Team

CompTIA A+ & Network+ Certified | Microsoft 365 Solutions Expert | DMV IT Specialists

The Metro Point IT team consists of certified IT professionals with hands-on experience supporting businesses across Maryland, Virginia, and Washington DC. Our technicians hold CompTIA, Microsoft, and compliance-specific certifications.