What are the opening hours?

Monday 9am - 5pm Tuesday 9am - 5pm Wednesday 9am - 5pm Thursday 9am - 5pm Friday 9am - 5pm

Nutmeg Consulting, Inc.

Name: Nutmeg Consulting, Inc.
Address: 35 Philmack Drive, Ste B206, Middletown, CT, 06457, US
Telephone: +18602564822
Price range: $$

Home
United States
Middletown, CT
Nutmeg Consulting, Inc.

We offer consulting and IT management services. We specialize in security, data management, and computer and network management.

Since its founding in 2003, Nutmeg Consulting, LLC has specialized in providing high quality Information Technology (IT) and Project Management services and products targeted at small business and the non-profit sector. From the beginning, we differentiated ourselves from other companies by offering a combination of private and public sector experiences, using proven methodologies for planning and implementation. We provide the skill and knowledge every organization requires – regardless of your size. Nutmeg Consulting now offers Sophos Cloud EndPoint security as a service! As a cloud-based managed console, there is no need for server setup and can be deployed instantly. For more information about how you can start the road to better protection with Sophos Cloud, click here: http://bit.ly/M5yoqO

For a FREE 30-day Trial, register here: http://bit.ly/19SWCPt

10/28/2026

Cybersecurity Awareness Month wraps up this week. 🔐

Every organization has one — the person who forwards the suspicious email instead of clicking it. Who asks "did you actually send this?" before paying an invoice. Who reminds everyone that IT will never ask for a code.

They rarely get thanked, because the thing they prevent never happens. That is the nature of the job and it is a genuinely thankless structure.

If that is someone on your team, tell them. It takes ten seconds and it lands. 💙

And if you worked through the four weeks with us — identity, recovery, access, response — you have done more this month than most organizations do in a year:

✅ MFA on every account
✅ A tested restore, with a real number attached
✅ An account list that matches your actual staff
✅ One page describing the first thirty minutes

That is not awareness. That is four decisions, and they hold up long after October ends.

If you did not get to all four, that is completely fine. Pick one and do it in November. One finished decision beats four intentions.

Our approach to security 👉 https://hubs.ly/Q04BmR0J0

10/27/2026

Four things changed this month that affect small organizations and nonprofits. 📌

In plain language:

1️⃣ SOME MICROSOFT PRODUCTS STOPPED GETTING SECURITY UPDATES
Office 2021, Windows Server 2012, Server 2022 mainstream support, and Windows 11 version 24H2, all on October 13. Nothing broke — but new security flaws in those products will not be fixed. Windows Server 2016 is next, in January 2027.

2️⃣ AI ACCOUNTS BECAME A SECURITY TARGET
Research published in September found employee AI logins circulating across more than 80,000 corporate domains. If your staff signed up for an AI tool with a work email, that account holds whatever they pasted into it and needs the same protection as your email.

3️⃣ FEDERAL GRANT RULES MAY BE CHANGING
A major rewrite of the rules governing federal grants was proposed in May with a target effective date of October 1. It is not confirmed final. If you receive federal funds, this is worth watching closely.

4️⃣ FUNDERS STARTED ASKING ABOUT AI
Grant applications are beginning to include questions about whether AI was used and what data went into it. Organizations with a written policy answer in a paragraph. Organizations without one spend a week.

None of these require panic. All four reward a little attention now rather than a lot later.

Save this for your next team meeting. 📌

How we help organizations stay ahead of this 👉 https://hubs.ly/Q04BmNnm0

10/26/2026

Week 4 of Cybersecurity Awareness Month is response. 🚨

Here is the exercise, and it is the one most organizations skip because it feels theoretical until the day it is not.

Write down the first thirty minutes.

Not a full incident response plan. Not a binder. One page answering six questions:

1️⃣ Who decides? Name the person who has authority to take systems offline. Then name their backup, because incidents do not check calendars.

2️⃣ Who calls the provider? And do they have the number somewhere that is not the network that might be down?

3️⃣ What do staff do in the first thirty minutes? "Stop working and wait for instructions" is a legitimate answer. Not having an answer is not.

4️⃣ Who talks to clients, funders or customers? And who explicitly does not?

5️⃣ Where does the team gather if email is unavailable? A phone tree, a group text, anything that does not depend on the affected system.

6️⃣ Who calls legal or your insurer? Cyber policies frequently have notification requirements measured in hours.

Print it. Put it somewhere physical. A response plan stored only on the network it is meant to protect is a plan you will not have when you need it.

Thirty minutes to write. Potentially the most valuable page your organization produces this year.

Continuity and incident planning 👉 https://hubs.ly/Q04BmMZ80

10/21/2026

Week 3 of Cybersecurity Awareness Month is access. 🔑

Here is the exercise, and it finds something at nearly every organization that runs it.

Pull your list of active accounts. Compare it against your current staff roster.

Then check these five, which standard offboarding usually misses:

🔸 Shared accounts — the "info@" or "billing@" login several people use. Who still has the password? When did it last change?
🔸 Vendor and contractor access — granted for a project that ended, never revoked.
🔸 Third-party app connections — tools staff connected to your email or file storage. These often survive the person leaving.
🔸 Automations and integrations — anything set up to run on a schedule. If it was configured by someone who left, it may still be running with their permissions.
🔸 AI tool accounts — signed up for with a work email, holding whatever was pasted into them, usually outside any offboarding checklist.

Those last two are new problems, and most offboarding processes were written before either existed.

The fix is not complicated: one checklist, one owner, and a quarterly review that covers more than human user accounts.

But somebody has to decide it is worth an afternoon.

How we structure IT operations 👉 https://hubs.ly/Q04BmMxZ0

10/20/2026

The one-page AI policy. ✍️

If your organization has been circling this for months, here are the five things to write down. It fits on a single page and takes an afternoon.

1️⃣ THE APPROVED TOOLS
Name them. Two or three is fine. A short list that people follow beats a long list nobody reads.
2️⃣ THE DATA BOUNDARY
One sentence naming what may never be entered into a tool outside that list. Client records, financial data, health information, personnel files, anything covered by a funder or client agreement.
3️⃣ THE HUMAN REVIEW RULE
Name which outputs require a person to check them before they leave the organization. Anything going to a funder, a client, a board or the public belongs here.
4️⃣ THE ESCALATION PATH
What someone does when they think a mistake happened. Make this easy, and make it explicitly non-punitive — you want to hear about it early, and people do not report what gets them in trouble.
5️⃣ THE OWNER AND THE REVIEW DATE
A rule without a name attached is a suggestion. A policy without a review date is a snapshot.

That is the whole thing. Five items, one page, one afternoon.

You can add principles, definitions and appendices later if you need them. Most organizations find they never do.

Save this and bring it to your next leadership meeting. 📌

Our data governance work 👉 https://hubs.ly/Q04BmLNK0

10/19/2026

DID YOU KNOW? 📄

The strongest line in any AI policy is a single sentence.

Not the principles section. Not the page about responsible innovation. One sentence naming the data that may never be entered into an AI tool that is not on your approved list.

Something like: "Client records, financial data, health information, personnel files and anything covered by a funder or client agreement may not be entered into any AI tool outside the approved list."

That is it. That sentence does more practical work than twenty pages of framework language, for three reasons:

✅ It is memorable. Staff can hold it in their head on a Tuesday afternoon under deadline pressure, which is when the decision actually gets made.
✅ It is enforceable. There is no interpretation required.
✅ It is stable. Which AI tools are best changes constantly. Which data is sensitive does not.

If your organization has been circling an AI policy for months without producing one, start here. Write the data boundary. Name the approved tools. Name the person who decides.

One page. One afternoon. You can add the rest later, and most organizations never need to.

A policy nobody can remember is not governance. It is documentation of an intention.

How we help organizations get their data under control 👉 https://hubs.ly/Q04BmJq20

10/18/2026

"We have backups" and "we can recover" are two different sentences. 💾

Week 2 of Cybersecurity Awareness Month is recovery, and this is the gap worth closing.

A backup job completing successfully tells you a job completed. It does not tell you:

⏱️ Whether the data inside is usable
⏱️ Whether anyone currently employed knows the restore procedure
⏱️ How many hours a full restore actually takes
⏱️ Whether your most critical system is even included

The only way to know any of that is to try it.

Here is the exercise, and it takes about twenty minutes:

1️⃣ Pick one file that matters. Not a test file — something real.
2️⃣ Restore it.
3️⃣ Write down how long it took and who had to be involved.

That number is your actual recovery capability. The number in your contract is a target.

We have watched organizations discover during this exercise that their backup had been silently failing for eleven weeks, that the only person who knew the procedure left in the spring, or that the system they assumed was covered had never been added.

Every one of those is far better discovered on a Tuesday in October than during an actual incident.

Continuity and disaster recovery planning 👉 https://hubs.ly/Q04BmB4h0

10/16/2026

QUICK QUIZ 🎣 — three of these are scams. Which one is legitimate?

1️⃣ A text from a number claiming to be IT, asking you to read back your multi-factor code.
2️⃣ An email from "the CEO," sent at 4:45 on a Friday, asking you to buy gift cards and send the codes.
3️⃣ Your IT provider emailing to say they will never ask for your password or a multi-factor code.
4️⃣ A vendor emailing updated banking details "for this invoice only."

The answer is #3. 🎯

The other three are among the most common attacks hitting small organizations right now — and #1 is catching the most people. No legitimate IT team will ever ask you to read them a code. Not once. Not in an emergency.

Number 4 is the expensive one. Invoice redirection fraud has a simple defense: call the vendor on a number you already have on file, never the number in the email, and confirm the change verbally before anything moves.

Forward this to whoever handles your invoices. That single habit prevents most of these.

How we build security awareness into an environment 👉 https://hubs.ly/Q04BmB8d0

10/08/2026

MYTH vs REALITY ☁️

MYTH: "It is in the cloud, so it is backed up."

REALITY: Cloud platforms protect their infrastructure. They do not protect your data from your own team.

If someone deletes a folder in Microsoft 365 or Google Workspace and nobody notices for 45 days, that folder is frequently just gone. Retention windows are shorter than people assume, and the cloud was never a backup strategy — it is a hosting location.

What actually protects you:

🔹 A separate, third-party backup of your cloud data
🔹 A retention policy somebody has actually read
🔹 A restore test performed recently, not theoretically

And a newer one worth adding to the list: if your team is using AI tools connected to your cloud storage, those connections can move, copy or overwrite files with a user's full permissions. Your backup is now protecting you from automation errors too, not just human ones.

Quick gut check — do you know how far back your cloud data could be recovered right now?

Most people do not. That is exactly the point.

How we approach cloud environments 👉 https://hubs.ly/Q04y_MZD0

10/07/2026

Week 1 of Cybersecurity Awareness Month is identity. 🔑

Here is the ten-minute version — no IT background required.

✅ Turn on MFA for your email if it is not already on. This single control blocks the overwhelming majority of account takeovers.
✅ Check whether anyone has an exception. Most organizations granted one to a senior person years ago and never revisited it. That account is now the softest target you own.
✅ Look at your active account list. Compare it against people who actually work here. Remove what does not match.
✅ Say one sentence out loud to your team: IT will never ask you for your password or a multi-factor code. Not in an emergency. Not ever. That sentence prevents a specific and very common attack.
✅ Check your AI tools too. If staff signed up for an AI assistant with a work email, that account holds whatever they have pasted into it — and it needs the same identity controls as your email.

That last one is new this year, and it is the one most organizations have not thought about yet.

Ten minutes. No budget. No project plan.

How we build identity and endpoint security into an environment 👉 https://hubs.ly/Q04y_M0f0

Address

35 Philmack Drive, Ste B206
Middletown, CT
06457

Opening Hours

Monday	9am - 5pm
Tuesday	9am - 5pm
Wednesday	9am - 5pm
Thursday	9am - 5pm
Friday	9am - 5pm

Telephone

+18602564822

Website

https://www.nutmegit.com/

Alerts

Be the first to know and let us send you an email when Nutmeg Consulting, Inc. posts news and promotions. Your email address will not be used for any other purpose, and you can unsubscribe at any time.