A pharmacy giant in Woonsocket, a bank tower downtown and submarine work down the bay.

Check the two tests in §6-48.1-4. Processing data on 35,000 Rhode Island customers in the prior year, not counting data used only to complete a payment, brings you in. So does processing 10,000 while getting more than a fifth of revenue from data sales. Counsel should also review the act's exemptions for your sector.

The statute counts from confirmation of the breach and from when the information needed for the notice can be determined, and law enforcement can request a delay. Identity logs decide how fast you can determine who was affected, which is why we push for centralized sign-in and privileged session records before anything happens.

The contract or the prime's flow-down tells you. Suppliers that only handle federal contract information typically need Level 1 self-assessment, while those handling controlled unclassified information usually need Level 2. We help you confirm which data you actually hold before scoping.

Yes. The trick is birthright access driven by HR job codes and store location, so most people get the right access on day one without a ticket. Exceptions go through request and approval, and managers certify them on a regular cycle.