Law / United States / 
Maryland
Maryland public service company cybersecurity standards, zero-trust approach and third-party assessment
In force since .
A sector security regimes rule binding private bodies.
- Obligation class
- Security, Governance
As of .
What it requires
- This binds a public service company, which means an electric, gas, sewage disposal, water or telegraph company, and does not bind a common carrier or telephone company; declare operates_essential_service if your organization is one.
- Adopt and implement cybersecurity standards that equal or exceed the standards the Public Service Commission adopts (Public Utilities 5-306(c)(1)).
- Adopt a zero-trust cybersecurity approach for on-premises services and cloud-based services (5-306(c)(2)).
- Establish minimum security standards for each operational technology and information technology device based on the level of security risk of the device, including supply chain risks (5-306(c)(3)).
- On or before , and on or before July 1 every other year after that, engage a third party to assess your operational technology and information technology devices against the Cybersecurity and Infrastructure Security Agency's Cross-Sector Cybersecurity Performance Goals or a more stringent standard based on the National Institute of Standards and Technology security frameworks, and submit to the Commission certification of your compliance with the standards used (5-306(c)(4)).
These lines are LexLint's reading of the law's text, as of .
What this law does
A public service company must adopt and implement cybersecurity standards that are equal to or exceed standards adopted by the Commission. A public service company must adopt a zero-trust cybersecurity approach for on-premises services and cloud-based services. A public service company must establish minimum security standards for each operational technology and information technology device based on the level of security risk for each device, including supply chain risks.
On or before , and every other July 1 after that, a public service company must engage a third party to assess its operational technology and information technology devices and submit to the Commission certification of its compliance with the standards used in the assessments. Section 5-306 does not apply to a public service company that is a common carrier or a telephone company.
A public service company means a common carrier company, electric company, gas company, sewage disposal company, telegraph company, telephone company, water company, or any combination of public service companies. The Act that added section 5-306, Chapter 499 of the Acts of 2023 (House Bill 969), has an effective date of .
When LexLint raises it
When your app profile says your app runs an essential service.