On or before October 1, 2026, and every 2 years thereafter, the Office of Security Management in the Department of Information Technology shall: Collect certifications of each community water system and community sewerage system provider’s compliance with standards used in the assessments conducted under § 9–2705(b)(3) of this subtitle for cybersecurity–related policies and procedures; and Submit a report to the State Chief Information Security Officer, or the Officer’s designee.