US-MT v2.0 Sign in

US-MT (US-MT) · Module W3 · Derived Confidence: Probable

US-MT: Operational Resilience & Critical Infrastructure

← Full US-MT Dossier (14 modules) Open US-MT in Co-Pilot ↗ Request Bespoke Deeper Dive

#

Montana's operational-resilience posture rests on breach-notification statutes requiring immediate AG notification ahead of consumer notice.

Kept on Dataprotection.gi, not restated here: data and cloud switching obligations on service providers, including notice periods and charges. Open its jurisdiction pages on Dataprotection.gi →

Standing sub-brief · as of 5 July 2026127 words · last cycle 2026-07-05

Operational Resilience & Critical Infrastructure

Montana's operational-resilience posture centers on an unusually strict breach-notification regime. Under MCA 30-14-1701 through -1705 (general businesses) and MCA 33-19-321 (insurance licensees), Montana uniquely requires immediate Attorney General notification upon discovery of a computer security breach - ahead of consumer notification - together with simultaneous electronic submission of a copy to the AG's Office of Consumer Protection. This "regulator-first" sequencing is distinctive relative to the more common consumer-first or simultaneous-notice models found in most other states, and applies across both general commercial entities and insurance-licensed financial institutions operating in Montana.

Outlook

No legislative change to the breach-notification sequencing is currently signaled; the regime should be treated as a stable, distinctive baseline feature for any payments or financial-services entity operating in the state.

no periodic updates on record for this sub-brief

Sources and findings (5 unique sources · R-3/R-4)
  1. [W3-E1] T1 Derived: Confirmed in_forcehttps://mca.legmt.gov/bills/mca/title_0300/chapter_0140/part_0170/section_0040/0300-0140-0170-0040.html re-verified

    Any person or business conducting business in Montana that owns or licenses computerized data including personal information must disclose any breach of the security of the data system to affected Montana residents without unreasonable delay, subject to law-enforcement delay provisions.

  2. [W3-E2] T1 Derived: Confirmed in_forcehttps://dojmt.gov/office-of-consumer-protection/reporting-requirements-for-data-breaches/ re-verified

    Any business required to issue a breach notice must simultaneously submit an electronic copy of the notice to the Attorney General's Office of Consumer Protection, including breach date(s), elements of personal information affected, and distribution method.

  3. [W3-E3] T3 Derived: Probable in_forcehttps://pivitstrategy.com/what-to-do-after-a-cyberattack-in-montana-2026/ re-verified

    Montana uniquely requires that the Attorney General's Office of Consumer Protection be notified immediately upon discovery of a breach, before the investigation is complete and before individual consumers are notified, one of the earliest such AG reporting requirements among US states.

  4. [W3-E4] T1 Derived: Confirmed in_forcehttps://mca.legmt.gov/bills/mca/title_0330/chapter_0190/part_0030/section_0210/0330-0190-0030-0210.html re-verified

    Insurance licensees and insurance-support organizations conducting business in Montana must develop and maintain an information security policy and breach notice procedures, and must simultaneously submit an electronic copy of any required notification to the Commissioner.

  5. [W3-E5] T1 Derived: Confirmed in_forcehttps://sitsd.mt.gov/cybersecurity/ re-verified

    For cyber incidents affecting the State Network (SummitNet), local government entities must call the State IT Services Division's Network Operations Security Center within 24 hours and notify CISA, alongside DOJ data-breach-for-business reporting channels.