Law / United States / 
Maryland
Maryland units of State government and local governments, duty to report a cybersecurity incident
Md. Code Ann., State Fin. & Proc. sections 3.5-405(b), 3.5-406(d)
In force since .
A vulnerability and incident reporting rule binding government bodies.
- Obligation class
- Reporting
As of .
What it requires
- This duty binds each unit of State government and each local government other than a municipal government (including a county government, local school system and local health department); it does not bind a private business.
- Report a cybersecurity incident to the State Chief Information Security Officer, using the criteria, manner and time period that Officer sets (State Finance and Procurement 3.5-405(b)).
- If you are a local government other than a municipality, report a cybersecurity incident, including an attack on a State system you use, to your local emergency manager and the State Security Operations Center in the Department of Information Technology, using the criteria, manner and time period the State Chief Information Security Officer sets (3.5-406(d)).
These lines are LexLint's reading of the law's text, as of .
What this law does
Each unit of State government must report a cybersecurity incident to the State Chief Information Security Officer. The State Chief Information Security Officer determines the criteria for when an incident must be reported, the manner in which to report, and the time period within which a report must be made.
Each local government must report a cybersecurity incident, including an attack on a State system it uses, to the appropriate local emergency manager and the State Security Operations Center in the Department. Section 3.5-406 does not apply to municipal governments. Senate Bill 812 of 2022 has an effective date of .