Pipeline control rooms and hospital records, governed by the same access model.

For the identity and access parts, yes. We document every remote and vendor path into critical cyber systems and move each one behind PAM with session recording. That gives you the access-control evidence your Cybersecurity Implementation Plan describes. Network segmentation design and OT monitoring tools stay with your OT security team or their vendor, and we coordinate with them.

It means the records must be physically stored in the US. Most large clouds let you pin storage and backups to US regions, so the work is usually an inventory of every copy, including analytics extracts, archives and vendor-hosted test environments. Whether offshore staff can view records is less clear in the statute, so ask your counsel before changing support models.

It can be a gate. We have tied PHI-system access requests to proof of completed training in the learning system, so a new hire who has not finished within the 90-day window loses clinical access automatically instead of turning up in an audit.

That's common and sometimes right, because a stalled login on an operator console is a safety issue. We usually move the strong authentication to the boundary instead, at the jump host or PAM gateway, and keep local console access physical and logged.

We price it after a short discovery that counts systems, access paths and identity sources. The cost drivers are the number of sites and OT zones, how many legacy applications lack modern authentication, and how much travel the cutover takes.