Uptown Charlotte runs bank ledgers and power grids. Both regulators ask the same thing first. Who had access?

Usually by a lot. Birthright access granted by role can be certified once at the role level instead of person by person, and dormant entitlements can be revoked before the campaign. What's left is the access that actually needs a manager's judgment.

The statute ties the Attorney General notice to resident notification. If you notify any affected North Carolina residents, you also notify the Consumer Protection Division, with no minimum count. Confirm specifics with counsel, since federal bank rules may apply alongside.

Often, yes, if the CIP side is deployed so that its components meet CIP requirements themselves, such as running inside or alongside the electronic security perimeter. Some utilities keep a separate instance for the OT side. We work through the trade-offs with your compliance team before buying anything.

Yes, on identity and access. We fix the gaps the questionnaire exposes, such as shared admin accounts or missing MFA on production, and then help you write answers that match what your logs will show.