title: US-MT — Operational Resilience & Critical Infrastructure (W3) | World Payments Monitor canonical: https://payments.gi/jurisdictions/united-states-montana/w3/ ### W3 Operational Resilience & Critical Infrastructure Probable re-verified 2026-10-18 · changed 2026-07-05 Montana's operational-resilience posture rests on breach-notification statutes requiring immediate AG notification ahead of consumer notice. Kept on Dataprotection.gi, not restated here: data and cloud switching obligations on service providers, including notice periods and charges. [Open its jurisdiction pages on Dataprotection.gi →](https://dataprotection.gi/jurisdictions/) Standing sub-brief · as of 5 July 2026 127 words · last cycle 2026-07-05 #### Operational Resilience & Critical Infrastructure Montana's operational-resilience posture centers on an unusually strict breach-notification regime. Under MCA 30-14-1701 through -1705 (general businesses) and MCA 33-19-321 (insurance licensees), Montana uniquely requires immediate Attorney General notification upon discovery of a computer security breach - ahead of consumer notification - together with simultaneous electronic submission of a copy to the AG's Office of Consumer Protection. This "regulator-first" sequencing is distinctive relative to the more common consumer-first or simultaneous-notice models found in most other states, and applies across both general commercial entities and insurance-licensed financial institutions operating in Montana. #### Outlook No legislative change to the breach-notification sequencing is currently signaled; the regime should be treated as a stable, distinctive baseline feature for any payments or financial-services entity operating in the state. no periodic updates on record for this sub-brief ** Sources and findings (5 unique sources · R-3/R-4)** 1. [W3-E1] T1 Derived: Confirmed [in_force https://mca.legmt.gov/bills/mca/title_0300/chapter_0140/part_0170/section_0040/0300-0140-0170-0040.html](https://mca.legmt.gov/bills/mca/title_0300/chapter_0140/part_0170/section_0040/0300-0140-0170-0040.html) re-verified 2026-07-05 Any person or business conducting business in Montana that owns or licenses computerized data including personal information must disclose any breach of the security of the data system to affected Montana residents without unreasonable delay, subject to law-enforcement delay provisions. 2. [W3-E2] T1 Derived: Confirmed [in_force https://dojmt.gov/office-of-consumer-protection/reporting-requirements-for-data-breaches/](https://dojmt.gov/office-of-consumer-protection/reporting-requirements-for-data-breaches/) re-verified 2026-07-05 Any business required to issue a breach notice must simultaneously submit an electronic copy of the notice to the Attorney General's Office of Consumer Protection, including breach date(s), elements of personal information affected, and distribution method. 3. [W3-E3] T3 Derived: Probable [in_force https://pivitstrategy.com/what-to-do-after-a-cyberattack-in-montana-2026/](https://pivitstrategy.com/what-to-do-after-a-cyberattack-in-montana-2026/) re-verified 2026-07-05 Montana uniquely requires that the Attorney General's Office of Consumer Protection be notified immediately upon discovery of a breach, before the investigation is complete and before individual consumers are notified, one of the earliest such AG reporting requirements among US states. 4. [W3-E4] T1 Derived: Confirmed [in_force https://mca.legmt.gov/bills/mca/title_0330/chapter_0190/part_0030/section_0210/0330-0190-0030-0210.html](https://mca.legmt.gov/bills/mca/title_0330/chapter_0190/part_0030/section_0210/0330-0190-0030-0210.html) re-verified 2026-07-05 Insurance licensees and insurance-support organizations conducting business in Montana must develop and maintain an information security policy and breach notice procedures, and must simultaneously submit an electronic copy of any required notification to the Commissioner. 5. [W3-E5] T1 Derived: Confirmed [in_force https://sitsd.mt.gov/cybersecurity/](https://sitsd.mt.gov/cybersecurity/) re-verified 2026-07-05 For cyber incidents affecting the State Network (SummitNet), local government entities must call the State IT Services Division's Network Operations Security Center within 24 hours and notify CISA, alongside DOJ data-breach-for-business reporting channels.