A refinery that fuels six states and a bank that spans ten, both run from the Yellowstone Valley.

Usually not. We keep the vendor access but change its shape. Each vendor reaches the control network through one brokered, recorded session that your operators approve per visit, with no standing connection between visits. Turnaround contractors get accounts that expire on the turnaround's end date.

Yes. Section 30-14-1704 has you send the Attorney General's consumer protection office an electronic copy of the notice, plus the date and method you used, at the same time customers are told. If you notified many people, one copy with the count of Montanans is enough. Confirm details with counsel.

They cover different events. The federal rule is about incidents that disrupt bank operations and goes to your primary federal regulator. Montana's statute is about personal information and goes to residents and the consumer protection office. A ransomware event can trigger both, so we build one incident runbook with both clocks in it.

Partly. Protected health information handled under HIPAA is generally carved out, but the act can still reach marketing lists, website tracking and other consumer data outside the clinical record. We start with a data inventory that separates the two before any consent or opt-out work.

Yes, if the identity platform is the source of truth instead of each clinic's local directory. We set up a single identity with location-based roles, so a specialist who covers a Wyoming clinic on Tuesday sees only that clinic's schedule and charts that day.