Significant and continued growth of cyber-attacks against state and local governments makes cyber-security a critical issue for Montana. Recent events have increased the need to enhance security programs, processes, and support in this key area of business to protect citizen information. We protect against crimes on our streets; we must also work to defend Montana citizen information from cyber threats ranging from identity theft to consumer fraud to threats to our physical infrastructure.

Governor Steve Bullock signed an Executive Order to create the Montana Information Security Advisory Council (MT-ISAC) in June of 2015. The Governor appointed Council members from public and private sectors. The Council’s objectives are leverage this public-private partnership to enhance cybersecurity information sharing, outreach and risk awareness to help effectively protect information systems across the state. The first official meeting was held August 19, 2015. To request membership or more information, please use the "Contact Us" icon.
Council Members
2017 Biennium MT-ISAC Goals and Objectives
Operating Procedures
MT-ISAC SharePoint Site
Archived Meeting Agendas and Minutes

MT-ISAC Approved Documents

Agency Security Policy Template, Approved October 2015

MT-ISAC Goals and Objectives, Approved November 2017

POL-Information Security Policy, Approved September 2015

POL-Information Security Policy - Appendix A (Baseline Security Controls), Approved September 2015

POL-Information Security Policy - Appendix B (Security Roles and Responsibilities), Approved September 2015

POL-Information Security Policy - Appendix C (Blocked Sites and Rules of System Usage forms), Approved September 2015

POL-Information Security Policy - Appendix D (Cyber Security Framework crosswalk to Baseline Security Controls), Approved September 2015

28 Rescinded Security Policies, Approved October 2015

Vulnerability Management Procedure, Approved November, 2016

Workgroup List
Disposal of Media Storage- Form, Approved June, 2016
Disposal of Media Storage, Approved June, 2016
Hardening of Devices, Approved February, 2016
Large Cyber Incident Handling Steps, Approved June 2016
Small Cyber Incident Handling Steps, Approved May, 2016
Cybersecurity Tips For International Travel
Identification and Authentication, Approved April, 2017
Acceptable Use of IT Resources with Acknowledgement Forms, Approved April, 2017

Additional Resources

NIST Cybersecurity Framework

NIST SP 800-53 Rev 4, Security and Privacy Controls

NIST SP 800-37, Risk Management Framework

State of Montana Policy Management System (MOM)