Law / United States / 
Maryland
Maryland public service company duty to report a cybersecurity incident to the State Security Operations Center
Md. Code Ann., Pub. Util. section 5-306(d) (Critical Infrastructure Cybersecurity Act of 2023)
In force since .
A vulnerability and incident reporting rule binding private bodies.
- Obligation class
- Reporting
As of .
What it requires
- This binds a public service company, which means an electric, gas, sewage disposal, water or telegraph company, and does not bind a common carrier or telephone company; declare operates_essential_service if your organization is one.
- Report a cybersecurity incident, including an attack on a system you use, to the State Security Operations Center in the Department of Information Technology, through the process the State Chief Information Security Officer establishes (Public Utilities 5-306(d)).
- Make the report as soon as practicable, but not later than 24 hours after confirmation of a detected cybersecurity incident; you may make a preliminary report while you investigate whether an event is reportable (Department of Information Technology reporting requirements for public utilities).
- Redact Critical Energy/Electric Infrastructure Information from the report (Department of Information Technology reporting requirements for public utilities).
These lines are LexLint's reading of the law's text, as of .
What this law does
Each public service company must report a cybersecurity incident, including an attack on a system it uses, to the State Security Operations Center in the Department of Information Technology. The State Chief Information Security Officer, in consultation with the Commission, establishes the process, including the criteria, the manner and the time period for reporting.
The Department of Information Technology's reporting requirements for public utilities state that reports to the Maryland Security Operations Center must be made as soon as practicable, but not later than twenty four (24) hours after confirmation of a detected cybersecurity incident. An organization that is unsure whether an event is a reportable cybersecurity incident and is investigating may make a preliminary report while it determines whether one occurred.
When LexLint raises it
When your app profile says your app runs an essential service.