<?xml version='1.0' encoding='utf-8'?>
<section article="gen" article_name="Environment" number="9-2702" title_number="9" title_name="Water, Ice, and Sanitary Facilities" subtitle_number="27" subtitle_name="Water Bottle Filling Stations">
  <text>The Department shall:</text>
  <level label="1">
    <text>In coordination with the Department of Information Technology and the Maryland Department of Emergency Management, coordinate cybersecurity efforts within community water systems and community sewerage systems;</text>
  </level>
  <level label="2">
    <text>Include cybersecurity awareness components for all new and renewing operator and superintendent certifications under Title 12 of this article; and</text>
  </level>
  <level label="3">
    <text>In consultation with the Department of Information Technology:</text>
    <level label="i">
      <text>Update regulations governing community water systems and community sewerage systems to:</text>
      <level label="1">
        <text>Include comprehensive sections regarding cybersecurity standards for water and wastewater treatment facilities; and</text>
      </level>
      <level label="2">
        <text>Require community water system and community sewerage system providers to report cyber incidents consistent with Department of Information Technology guidance in accordance with § 9–2707(b) of this subtitle;</text>
      </level>
    </level>
    <level label="ii">
      <text>Promulgate minimum cybersecurity standards for established community water systems and community sewerage systems that meet or exceed the federal Cybersecurity and Infrastructure Security Agency’s cross–sector cybersecurity performance goals;</text>
    </level>
    <level label="iii">
      <text>Require community water systems and community sewerage systems to plan for disruptions of service due to cyber incidents, including ransomware attacks and other events resulting in root–level compromise;</text>
    </level>
    <level label="iv">
      <text>Establish a list of approved cybersecurity training programs for staff responsible for maintaining or operating water and wastewater facilities; and</text>
    </level>
    <level label="v">
      <text>Implement measures to protect the active certified operators list maintained on the Department’s website while ensuring legitimate access for necessary purposes.</text>
    </level>
  </level>
</section>
