A bank in a town of 1,200 should have the same IT support as one in Denver.
Your core provider covers the core banking platform. The teller workstations, the branch network, the firewall, and the email your payment instructions arrive in are not on that list. All of it sits with one person who was hired to do something else.
The first assessment is free, and the findings are yours either way.
Vetted, tested, and in writing.
Every certified institution is assessed by a third party risk assessor and keeps the required controls in place. When your board or examiner asks how you handle vendor risk, the answer is a document rather than an assurance.
Containment, forensics, eradication, recovery, and rebuilding if needed, at no additional cost, within defined service limits.
The Big Sky Guarantee is not an insurance policy. It’s our commitment to do the response work ourselves.
Eligible payments made directly to the organization, up to $500,000 per covered incident, depending on plan.
The Big Sky Service Warranty is not an insurance policy and does not replace cyber insurance.
For certified clients on Professional, Enterprise, or co-managed plans, with required controls in place. Eligibility requirements, service limits, and exclusions apply. Full terms are provided for your review before you sign. See which plans qualify
Nobody goes looking for an IT company on a quiet week.
One of these usually happened first. If none of them did, you’re further ahead than most institutions your size.
Your last exam left a finding
Something about patch evidence, access reviews, or a risk assessment nobody had updated. It wasn’t fatal, but it’s in writing, and it’ll be looked at again next cycle.
The FFIEC retired the assessment tool you were using
If the CAT workbook is still what your board sees each quarter, you need a replacement framework and somebody to run it.
Your IT person gave notice, or nearly did
One resignation, and the passwords, the vendor relationships, and the only working knowledge of your network walk out together.
A spoofed email almost worked
A message that looked like it came from an officer, caught by someone who happened to pick up the phone. At institutions your size, this is where the trouble usually starts.
One person, or no person, and a bank attached to it.
Most Montana institutions your size run IT one of three ways: one person who also does operations and BSA, an outside provider set up for general office IT, or nobody at all, with things fixed when they break badly enough.
Nobody checks the work.
Not because your person is careless, but because there’s no one else in the building qualified to. Every configuration decision gets made alone and stays unreviewed until an examiner or an attacker finds it.
The security work landed on a generalist.
Nobody was hired to run a security program. It arrived because there was no other desk to put it on, without the tooling or the hours to do it properly.
You are the one who signs.
The attestation has your name on it. So do the board minutes. And you’re carrying a question you can’t fully answer, which is the part that actually costs you sleep, not the finding.
Your members and customers are not less exposed because the town is smaller. The people trying to get into your network don’t price their effort by population.
Want to know what your IT person is carrying alone?
The assessment is free, and the findings are yours either way, including if the answer is that you’re fine.
The team running your network is the team that would investigate it.
You’ll have 36 hours to tell your regulator what happened. Someone has to be able to tell you first.
Big Sky started in digital forensics and incident response. We’re the firm that shows up when a Montana business gets breached, often at the insurer’s request, and goes through the logs to reconstruct what happened. That order of operations changes three things for a financial institution.
Somebody can start the clock.
Regulators expect notice within 36 hours of your determination; for federally insured credit unions, NCUA’s window is 72. Neither clock starts until someone can say what happened, and that comes from forensics, not IT.
Evidence survives the first hour.
“Our IT guy wiped it and reimaged” is the sentence that gets insurance claims reduced or denied. We preserve before we remediate, because we’ve been on the other end of that call.
Your plan gets a real test.
Your examiner will ask when you last exercised it. A tabletop run off a template is different from one run by people who have stood in a server room at 2am with a deadline.
The unglamorous half. This is most of the job.
Forensics is the reason to pick us, but below is what you’ll experience 51 weeks out of the year.
Help desk your staff can call directly
A teller with a frozen workstation at 4:40 on a Friday needs someone to pick up. Our commitment is a human response within the business hour, 8 to 5, Monday to Friday, and it’s a person rather than AI.
Patch management you can prove
Updates installed on schedule, on every machine, with a report behind it. Examiners ask you to prove it happened on the machines you said it happened on.
Backup verification, not just configuration
Restores tested on a routine schedule, so you find out a backup is broken on a Tuesday in March instead of the morning you need it.
Continuous monitoring
Someone watching at 11pm on a Sunday or over Labor Day weekend, which is when attacks happen, not just business hours.
Branch network and endpoints
Workstations, firewalls, switches, wireless, and the remote access your loan officers use from the road.
Email security
Business email compromise arrives as a message that looks like it came from you. At institutions your size, it’s the most common way in, more than any exotic attack.
Asset and vendor documentation
What you own, what it runs, when the warranty ends, and who to call. You’ll have it in week one, whether or not you continue with us.
Same day onsite for contract clients
We drive; we’re not stationed in your branch. If you need someone at a desk every day, hire them, and we’ll back them up with co-managed IT.
Our team can support your IT staff
Plenty of our clients keep theirs and have us extend their capabilities and hours. The split is simple: they keep the users, the relationships, and the day to day decisions. We take the security half: after hours alerts, patch verification, the monitoring nobody has time to tune, and the documentation that takes a week every quarter.
They also stop being the only qualified person in the building. That’s usually what determines whether they’re still with you in three years. People don’t resign from being busy. They resign from being alone with something this size.
Documentation that exists before anyone asks for it.
Examiners don’t ask whether you have a policy. They ask you to prove people followed it. Managed clients get that documentation produced continuously rather than reconstructed the week before an exam.
Training records with current dates
Not the ones from two years ago.
Risk assessments actually redone
Redone, not redated.
Incident logs
Including the ones that turned out to be nothing.
Proof monitoring never stopped
The gap in March is what gets found.
We work against GLBA and the Safeguards Rule, the FFIEC IT Examination Handbook, and NCUA’s Information Security Examination.
The FFIEC has retired its Cybersecurity Assessment Tool, so institutions that were mapping to the CAT need a replacement framework. If that workbook is still what your board sees each quarter, it’s worth a conversation regardless of who you hire.
Published, like the rest of our pricing.
That’s a normal looking number. What matters is what isn’t hiding underneath it.
Essentials
Per device, per month, plus a per user charge. Managed IT, monitoring, and support.
Professional
Per device, per month, plus a per user charge. Adds eligibility for The Big Sky Guarantee and Service Warranty once certified.
One year term
Written to match the annual cycles your hardware warranties and cyber insurance already run on.
No hourly billing
Remote support hours are in the number, not on the invoice afterwards.
No emergency rates
A Saturday costs what a Tuesday costs. That’s the whole policy.
No annual escalator
The price you sign is the price in month twelve.
You already have somebody. Here’s exactly how leaving works.
This is the real reason institutions stay somewhere they’re unhappy: not the cost, but the fear that the transition is worse than the problem. So here’s what switching looks like.
Your core is not touched. We support your office network: your staff, servers, networking, and everything around the core.
We document before we touch anything
Licenses, credentials, warranty status, and backup configuration, plus what your current provider has and hasn’t been doing. That document is yours either way.
Monitoring deploys alongside
It runs next to your existing provider. Nothing is cut over yet, and you're never without support while it does.
Cutover
Scheduled around your calendar, not ours: during business hours or after, whichever disrupts your branches least. About two weeks, signature to fully managed.
Timed around your exam: if you’re inside weeks of an exam window, we’ll usually tell you to wait rather than introduce a vendor change in the middle of a cycle. Ask on the call, and we’ll tell you honestly which side of that line you’re on.
If your current provider stalls on handoff, and it happens, we can rebuild access independently. It takes longer, and we’ll say so upfront if that’s your situation.
You’re required to vet us. Here’s the packet.
Third party risk management means your board can’t act on a recommendation alone. You need documentation on us, reviewed annually, sitting in a file an examiner can pull.
Ask two questions of anyone you’re considering: who actually holds the certifications, and what happens contractually when they fail.
Ours is already assembled, and it’s useful for comparing us against anyone else you’re evaluating.
What our certifications actually mean for you.
Grouped by what they let us do for an institution, not by acronym. Forensics and ethical hacking at the core, so we secure your systems the way attackers probe them.
Forensics and incident handling certifications are built around reconstructing what happened on a machine and whether anything left your network. That’s the difference between handing over a timeline and saying “we think.”
We test your environment the way an attacker would, on a schedule you control, rather than waiting for the uninvited version of the same exercise.
The monitoring, hardening and response work that happens between exams, which is the part nobody sees and the reason most weeks are quiet.
The foundation underneath all of it. Anyone on our team can tell you why the branch printer stopped and how to make it not happen again.
Where we’re not the right fit
If you want the cheapest number on the page, we aren’t it. Here’s what the price pays for.
What if a control you configured fails?
Our answer is in writing. Once you’re certified, we do the response work under The Big Sky Guarantee, and The Big Sky Service Warranty makes eligible payments of up to $500,000 per covered incident, depending on your plan. Eligibility requirements, service limits, and exclusions apply, and full terms are provided for your review before you sign.
Who fills out our cyber insurance questionnaire?
We complete it with your insurer, because the controls on that form are the controls we run, and the answers should come from whoever can actually evidence them.
Why both are in the number
We started as the forensics firm that gets called when something fails, so we don’t get to treat that outcome as hypothetical. Standing behind it costs money, and it’s in the price. Somebody will quote you less without those two answers. For some institutions that’s the right trade. Make it on purpose.
Serving Montana institutions statewide
Three offices, one team, and someone who can drive to your branch.
Great Falls — Headquarters
600 Central Ave, Suite 311, Great Falls, MT 59401
Helena
317 Cruse Ave, Suite 202, Helena, MT 59601
Billings
404 N 31st St, Suite 414, Billings, MT 59101
Frequently asked questions
What presidents, CEOs, and operations officers ask before the first conversation.
Do you replace our core provider?
No. That relationship stays exactly as it is. We handle what the core doesn’t, which is more than most institutions realize until someone maps it.
Our board only meets quarterly. How does approval usually work?
Your board sees an information security report on a schedule, and your examiner will ask what was in it and whether anyone acted on it. At most institutions your size, that packet gets assembled by one person the week before the meeting, out of screenshots and memory. We produce it on the board’s schedule instead.
What happens if we’re hit at 11pm on a Sunday?
Call 406-924-3731, and someone in Montana answers. If it needs hands on a machine, someone drives: contract clients get same day onsite. Certified clients get the response under The Big Sky Guarantee, within defined service limits; otherwise incident response is $165 an hour, with no after hours surcharge.
How fast do you respond to ordinary tickets?
Our commitment is a human response within the business hour, 8 to 5, Monday to Friday, and there’s no hourly component to it, so you’re never deciding whether a question is worth a ticket. Ask any provider you’re evaluating for their measured median, not their target.
Do we have to use your security tools?
Yes, for the security stack, and you get full access to it too. We stand behind our work, and we can only do that on tooling we’ve vetted, configured, and can see into. A monitoring platform we didn’t deploy is one we can’t tune, can’t verify is reporting, and can’t hand an examiner evidence from. When something in the stack stops earning its place, we replace it, and that’s our cost rather than a change order to you.
Can we start with just the security half?
Yes. Many institutions bring us in co-managed and expand later. Nothing restarts if you do, because we already know the environment.
Are we locked in?
One year, matched to your hardware warranty and insurance cycles. No escalator, no three year terms.
Tell us what your last exam flagged.
Twenty minutes. We’ll ask what your last exam flagged, what sits with one person, and what happens operationally if that person takes a month off. You’ll get a straight answer, including if the answer is that you’re fine.