In this subtitle the following words have the meanings indicated. “Community sewerage system” has the meaning stated in § 9–501 of this title. “Community water system” has the meaning stated in § 9–401 of this title. “Cybersecurity” means processes or capabilities wherein systems, communications, and information are protected and defended against damage, unauthorized use or modification, and exploitation. “Emergency manager” has the meaning stated in § 14–101 of the Public Safety Article. “Operational technology” means programmable systems or devices that interact with the physical environment by detecting or causing a direct change through the monitoring or control of devices, processes, and events. “Operational technology” includes: Industrial control systems; Building management systems; Fire control systems; and Physical access control mechanisms. “Water and wastewater sector” means all providers, including private and public, of water supply or sewerage services. “Zero–trust” means a cybersecurity approach: Focused on cybersecurity resource protection; and Based on the premise that trust is never granted implicitly but must be continually evaluated.

The Department shall: In coordination with the Department of Information Technology and the Maryland Department of Emergency Management, coordinate cybersecurity efforts within community water systems and community sewerage systems; Include cybersecurity awareness components for all new and renewing operator and superintendent certifications under Title 12 of this article; and In consultation with the Department of Information Technology: Update regulations governing community water systems and community sewerage systems to: Include comprehensive sections regarding cybersecurity standards for water and wastewater treatment facilities; and Require community water system and community sewerage system providers to report cyber incidents consistent with Department of Information Technology guidance in accordance with § 9–2707(b) of this subtitle; Promulgate minimum cybersecurity standards for established community water systems and community sewerage systems that meet or exceed the federal Cybersecurity and Infrastructure Security Agency’s cross–sector cybersecurity performance goals; Require community water systems and community sewerage systems to plan for disruptions of service due to cyber incidents, including ransomware attacks and other events resulting in root–level compromise; Establish a list of approved cybersecurity training programs for staff responsible for maintaining or operating water and wastewater facilities; and Implement measures to protect the active certified operators list maintained on the Department’s website while ensuring legitimate access for necessary purposes.

The Department of Information Technology shall: Employ a person trained in the cybersecurity of operational technology to: Work with the State Chief Information Security Officer and the Cyber Preparedness Unit in the Maryland Department of Emergency Management to support efforts related to water systems and other critical infrastructure; and Coordinate with the Maryland Department of Emergency Management and local government information security officers to assist in protecting community water systems and community sewerage systems; Allow all members of the water and wastewater sector in the State to join the Maryland Information Sharing and Analysis Center to further strengthen cybersecurity efforts and information sharing within the sector; and In consultation with the Department, develop and promote a guidance document that: Provides standards that meet or exceed the federal Cybersecurity and Infrastructure Security Agency’s cross–sector cybersecurity performance goals; and Outlines the best practices beyond minimum standards that can serve as a point of reference for enhancing the cybersecurity posture of community water system and community sewerage system providers.

All community water system and community sewerage system providers in the State shall: Appoint a primary point of contact for cybersecurity to interact with the appropriate local emergency manager and the Department of Information Technology regarding cybersecurity–related matters; and Attend annual trainings to improve cybersecurity awareness.

This section applies to a community water system or community sewerage system in the State that serves over 3,300 customers. Each community water system and community sewerage system provider shall: Adopt and implement cybersecurity standards that are equal to or exceed the standards adopted by the Department under § 9–2702(3)(ii) of this subtitle; Commit to adopting a zero–trust cybersecurity approach and begin planning and implementing the zero–trust approach, as appropriate for each system, modeled after the federal Cybersecurity and Infrastructure Security Agency’s zero–trust maturity model, for on–premises services and cloud–based services; and On or before July 1, 2026, and every 2 years thereafter, conduct a maturity assessment of its cybersecurity program for operational technology and information technology, based on the minimum cybersecurity standards established under § 9–2702(3)(ii) of this subtitle.

On or before October 1, 2026, and every 2 years thereafter, the Office of Security Management in the Department of Information Technology shall: Collect certifications of each community water system and community sewerage system provider’s compliance with standards used in the assessments conducted under § 9–2705(b)(3) of this subtitle for cybersecurity–related policies and procedures; and Submit a report to the State Chief Information Security Officer, or the Officer’s designee.

Each community water system and community sewerage system shall report, in accordance with the process established under subsection (b) of this section, a cybersecurity incident, including an attack on an information technology system or operational technology system being used by the community water system or community sewerage system provider, to the State Security Operations Center in the Department of Information Technology. The State Chief Information Security Officer, in consultation with the Department, shall establish a process for community water system providers, community sewerage system providers, and other members of the water and wastewater sector to report cybersecurity incidents. The reporting process shall specify: The circumstances under which an incident must be reported; The manner in which an entity must report an incident; and The time period within which an entity must report an incident. The State Security Operations Center shall immediately notify the Department and the other appropriate State and local government agencies of a cybersecurity incident reported under this section. On or before January 1, 2027, and each year thereafter, the Office of Security Management in the Department of Information Technology shall publish a report that describes the number and type of incidents reported by community water systems and community sewerage systems in the preceding calendar year. The report required under this subsection may not identify the impacted community water systems or community sewerage systems.

On or before July 1, 2026, and every 2 years thereafter, the Department shall report to the General Assembly, in accordance with § 2–1257 of the State Government Article, on water system compliance and the progress made regarding the implementation of the requirements set forth in this subtitle.