Duty LXD-7182
Runs an essential service, in Maryland
Maryland public service company cybersecurity standards, zero-trust approach and third-party assessmentsince 5 lines
Md. Code Ann., Pub. Util. section 5-306(b) and (c) (Critical Infrastructure Cybersecurity Act of 2023) · Read the law's page
- This binds a public service company, which means an electric, gas, sewage disposal, water or telegraph company, and does not bind a common carrier or telephone company; declare operates_essential_service if your organization is one.
- Adopt and implement cybersecurity standards that equal or exceed the standards the Public Service Commission adopts (Public Utilities 5-306(c)(1)).
- Adopt a zero-trust cybersecurity approach for on-premises services and cloud-based services (5-306(c)(2)).
- Establish minimum security standards for each operational technology and information technology device based on the level of security risk of the device, including supply chain risks (5-306(c)(3)).
- On or before , and on or before July 1 every other year after that, engage a third party to assess your operational technology and information technology devices against the Cybersecurity and Infrastructure Security Agency's Cross-Sector Cybersecurity Performance Goals or a more stringent standard based on the National Institute of Standards and Technology security frameworks, and submit to the Commission certification of your compliance with the standards used (5-306(c)(4)).
Maryland public service company duty to report a cybersecurity incident to the State Security Operations Centersince 4 lines
Md. Code Ann., Pub. Util. section 5-306(d) (Critical Infrastructure Cybersecurity Act of 2023) · Read the law's page
- This binds a public service company, which means an electric, gas, sewage disposal, water or telegraph company, and does not bind a common carrier or telephone company; declare operates_essential_service if your organization is one.
- Report a cybersecurity incident, including an attack on a system you use, to the State Security Operations Center in the Department of Information Technology, through the process the State Chief Information Security Officer establishes (Public Utilities 5-306(d)).
- Make the report as soon as practicable, but not later than 24 hours after confirmation of a detected cybersecurity incident; you may make a preliminary report while you investigate whether an event is reportable (Department of Information Technology reporting requirements for public utilities).
- Redact Critical Energy/Electric Infrastructure Information from the report (Department of Information Technology reporting requirements for public utilities).