Operate processor contracts + security measures + pseudonymisation under MCA 30-14-2809 + 30-14-2811. Processor contracts MCA 30-14-2809 mandatory containing: (a) clear instructions for processing + nature and purpose + type of data + duration + rights and obligations; (b) processor confidentiality obligation including employees + subcontractors; (c) processor security including technical and organisational measures appropriate to nature and risk + alignment with NIST CSF + ISO 27001 baselines; (d) at controller direction delete or return all personal data at end of provision (default delete) unless retention required by law; (e) make available to controller information necessary to demonstrate compliance + cooperate with assessments and audits; (f) engage subprocessors only after providing opportunity to controller to object + flow down same obligations; (g) ROPA records of processing activities maintained. Reasonable security practices required for all controllers + processors appropriate to volume + nature of personal data + processing nature + state-of-the-art + Montana Online Personal Information Theft Prevention Act baseline. Pseudonymisation MCA 30-14-2811 permitted to enable lawful processing while reducing risk + technical and organisational measures preventing re-identification + separation of additional information. De-identified data exempted with public commitment + contractual binding of recipients + technical safeguards. Aggregated consumer information also exempted.
The graph holds this control, the 0 it maps to, and the evidence behind each claim, over MCP and REST.