Does the Oregon Consumer Privacy Act apply to a small business?

More often than owners expect. The statute reaches companies processing personal data for a defined number of Oregon consumers, or a smaller number where selling data is involved, so a regional retailer or a subscription app can be in scope without being large. The Oregon Department of Justice enforces it, and the operational burden — locating and deleting data on request — falls on whoever administers your systems.

Do Portland MSPs cover Vancouver and Clark County the same way?

Usually yes for remote support, less consistently for onsite work and almost never identically for paperwork. Crossing the Columbia changes breach-notification law, payroll handling and sometimes a provider's licensing or insurance position. If part of your headcount sits in Washington, ask each bidder to confirm onsite coverage, response clock and which state's notification process it would run in an incident.

How many MSPs are there in the Portland metro?

We count 68 providers with an office inside the Portland-Vancouver-Hillsboro CBSA offering recurring managed services below 500 seats. Against roughly 8,900 establishments in the 20-to-499-employee band that is 7.6 per thousand. It is enough for a competitive process, but the bench skews toward firms shaped by technology-sector clients, so a manufacturer should probe industrial experience specifically.

Why is co-managed IT so common in Oregon?

Cost and scarcity together. A network and computer systems administrator here has a BLS median near $102,950, so a company at 120 seats can usually afford one strong internal person but not a team, and that person cannot cover nights or specialist work. Co-managed contracts fill the gap. When you request bids, ask explicitly for both a full-outsource and a co-managed option so the comparison is honest.

MarketPortland, OR

Providers in range0 of 68 counted

Typical environment8,900 firms, 20–499 staff

Turnaround2 business days

Managed IT & helpdesk bids in Portland, OR — three quotes on one sheet.

Normalized to

cost per endpoint per month

Two regulatory currents run through this metro, and neither is the one buyers expect. The first is contractual: the Silicon Forest — Intel's Hillsboro campus, the hardware and design-automation firms clustered around it, plus Nike, Columbia and a deep bench of consumer-brand software vendors — has made SOC 2 the document procurement asks for, so a provider's real value is often audit evidence rather than helpdesk speed. The second is statutory. The Oregon Consumer Privacy Act has been enforceable since July 2024 and reaches companies well below the size threshold most people assume, which converts data inventory and deletion workflows from a legal exercise into an IT one. A third, quieter factor is the river. Plenty of metro companies run a site in Vancouver, and Washington is a different state for payroll, breach notification and sometimes for a provider's own insurance, so a claim to cover the whole metro deserves a follow-up question. Roughly 68 MSPs serve about 8,900 establishments in the buying band, 7.6 per thousand. With a $102,950 median administrator salary, co-managed models are popular here for sound reasons.

Providers counted in the Portland metro68

On our roster for managed it & helpdesk0

Businesses at 20 to 499 staff8,900

Providers per thousand of those firms7.6

Counted2026-07-29

Provider counts are the MSPs we can currently invite in this metro, not every MSP that exists here. The second number is always smaller than the first, and we would rather show you both than round one up.

Bid tabulation — sample, Portland, OR formatPrepared 2 days after request

Bid tabulation — sample, Portland, OR format. Line items down the side, one column per bidder. Scroll horizontally to compare all bidders.
Line item	Bidder ANorthlake Technology Group	Bidder BHarbor Point IT	Bidder CVantage Managed Services
Monthly price	$6,400	$7,100	$5,250Low bid
Endpoints covered	68 of 68	68 of 68	52 of 68Servers excluded
Cost per endpoint	$94	$104	$101
After-hours support	24/7 included	24/7 included	Billed at $185/hr
Backup & recovery	Included	Included	Quoted separately
Security tooling	EDR + 24/7 SOC	EDR + SOC + compliance	EDR only
Onboarding fee	$0	$2,500	$4,800
Term	36 months	24 months	36 months

Illustrative figures. Your tabulation is built from bids by providers that serve your area, your headcount, and your compliance profile.

Bidder C is $1,150 a month cheaper on the headline and leaves 16 servers uncovered. Normalized per endpoint it is more expensive than Bidder A, backup is quoted on top, and every after-hours incident bills at $185 an hour against a 36-month term. This is the line the tabulation exists to surface.

Why the bids differ

What each pricing model leaves out.

Per userA user with a laptop, a desk phone and a shared floor PC is one billable user and three things to patch. Per-user pricing moves that risk onto the provider, which is fine until they discover it and re-scope at renewal.
Per deviceServers, hypervisors and network gear are usually priced on a separate line at three to six times the workstation rate, and the headline device count in the proposal often excludes them entirely.
Flat rateFlat rate is per-user pricing with a fixed headcount band baked in. Cross the band — a seasonal hiring run, an acquisition — and the invoice re-tiers mid-term.
Co-managedThe split of duties, which is where all the money is. A co-managed bid that does not name which tickets your internal admin still owns is not a price, it is an intention.

Ask for

What a managed it bid must answer.

Which endpoints are in scope, and are servers counted at the workstation rate?
Is after-hours support included, or billed at an hourly rate against a multi-year term?
Who owns the RMM, EDR and documentation tenancy if we leave?
What is the onboarding fee, and what does it actually cover?

Compliance

What actually drives IT spend in Portland.

AICPA SOC 2 (Trust Services Criteria)

Portland's software companies sell tooling and services into semiconductor, athletic-brand and logistics buyers whose vendor-risk teams treat a SOC 2 Type II report as a gate on the purchase order, and Intel's Hillsboro supply chain applies similar diligence to far smaller firms than most industries would. That makes an Oregon MSP a subservice organisation inside its clients' audits, so its access reviews, change records and offboarding evidence become part of somebody else's report whether or not it planned for that.

Source

Oregon Consumer Privacy Act (ORS 646A.570-646A.589)

Oregon's comprehensive privacy statute has been enforceable since July 2024 and is administered by the Department of Justice, and its thresholds reach consumer-facing companies far smaller than the California-style laws people benchmark against. Deletion and access requests turn into technical work — data inventory, retention limits, downstream processor agreements — which lands on whoever runs the systems, so a Portland MSP's ability to locate personal data across a client's estate is now a compliance capability rather than a nicety.

Source

Process

What happens after you send the request.

You describe the environment onceHeadcount, endpoints, servers, what already lives in the cloud, and any compliance obligation. Two minutes.
We invite three or four providersMSPs that work your area, your company size, and your regulatory profile. Never more than four, so nobody is cold-calling you.
We normalize what comes backPer-user, per-device, and flat-rate bids all converted to a common cost per endpoint, with every carve-out and exclusion flagged.
You get the tabulationOne sheet, with contacts. Take the discovery calls you want, ignore the rest. Nothing is owed either way.

Questions

What buyers in Portland ask us.

Does the Oregon Consumer Privacy Act apply to a small business?: More often than owners expect. The statute reaches companies processing personal data for a defined number of Oregon consumers, or a smaller number where selling data is involved, so a regional retailer or a subscription app can be in scope without being large. The Oregon Department of Justice enforces it, and the operational burden — locating and deleting data on request — falls on whoever administers your systems.
Do Portland MSPs cover Vancouver and Clark County the same way?: Usually yes for remote support, less consistently for onsite work and almost never identically for paperwork. Crossing the Columbia changes breach-notification law, payroll handling and sometimes a provider's licensing or insurance position. If part of your headcount sits in Washington, ask each bidder to confirm onsite coverage, response clock and which state's notification process it would run in an incident.
How many MSPs are there in the Portland metro?: We count 68 providers with an office inside the Portland-Vancouver-Hillsboro CBSA offering recurring managed services below 500 seats. Against roughly 8,900 establishments in the 20-to-499-employee band that is 7.6 per thousand. It is enough for a competitive process, but the bench skews toward firms shaped by technology-sector clients, so a manufacturer should probe industrial experience specifically.
Why is co-managed IT so common in Oregon?: Cost and scarcity together. A network and computer systems administrator here has a BLS median near $102,950, so a company at 120 seats can usually afford one strong internal person but not a team, and that person cannot cover nights or specialist work. Co-managed contracts fill the gap. When you request bids, ask explicitly for both a full-outsource and a co-managed option so the comparison is honest.

Request — form CQ-1

Get three managed it bids for Portland.

Describe the environment once. If fewer than three providers cover your area and headcount, we tell you that instead of padding the sheet.

Request bids

Sources — figures pulled 2026-07-28