<?xml version='1.0' encoding='utf-8'?>
<section article="ged" article_name="Education" number="4-148" title_number="4" title_name="Local School Administration" subtitle_number="1" subtitle_name="County Boards of Education">
  <level label="a">
    <text>Each local school system shall:</text>
    <level label="1">
      <text>Designate a local point of contact for all cybersecurity–related communications; and</text>
    </level>
    <level label="2">
      <text>Notify the State Chief Information Security Officer of:</text>
      <level label="i">
        <text>The designation; and</text>
      </level>
      <level label="ii">
        <text>Any subsequent update to the designation.</text>
      </level>
    </level>
  </level>
  <level label="b">
    <level label="1">
      <text>Beginning in 2027, each local school system shall:</text>
      <level label="i">
        <text>Comply with the State minimum cybersecurity standards established by the Department of Information Technology; and</text>
      </level>
      <level label="ii">
        <text>Conduct a cybersecurity maturity assessment every 2 years.</text>
      </level>
    </level>
    <level label="2">
      <text>On or before June 30, 2027, and each June 30 every 2 years thereafter, each local school system shall certify to the Office of Security Management within the Department of Information Technology compliance with the State minimum cybersecurity standards established by the Department of Information Technology.</text>
    </level>
  </level>
</section>
