In this subtitle the following words have the meanings indicated. “Branch” means the Critical Infrastructure Protection Branch. “Center” means the Maryland Coordination and Analysis Center. “Critical infrastructure” means assets, systems, and networks, whether physical or virtual, considered by the U.S. Department of Homeland Security to be so vital to the United States that their incapacitation or destruction would have a debilitating effect on one or more of the following: security; national economic security; national public health; or safety. “Critical infrastructure” includes a hospital or health care facility. “Executive Director” means the Executive Director of the Maryland Coordination and Analysis Center.

There is a Critical Infrastructure Protection Branch in the Maryland Coordination and Analysis Center.

The Executive Director shall appoint a Chief Critical Infrastructure Officer for the Branch. The Chief Critical Infrastructure Officer shall: administer and operate the Branch, in accordance with this subtitle; implement the provisions of this subtitle; direct critical infrastructure security efforts across the State; coordinate with: the Director of the Governor’s Office of Homeland Security; critical infrastructure industry, local, and federal counterpart organizations; the National Guard; the Department of Information Technology; and other key stakeholders identified by the Chief Critical Infrastructure Officer; and advise the Governor and the Director of the Governor’s Office of Homeland Security on critical infrastructure security issues.

The Branch shall: identify current and potential threats to the State’s critical infrastructure; prioritize the State’s critical infrastructure assets by: in coordination with the Department of Information Technology, the Office of Security Management, and the Public Service Commission, determining the threat level to the State’s critical infrastructure, focusing on foreign actors, domestic actors, and insider threats; determining the impacts to the State’s critical infrastructure in the case of a cybersecurity or physical attack; understanding the effect that the compromise of one aspect of critical infrastructure may have on another aspect of critical infrastructure; engaging and coordinating with critical infrastructure sector leaders, military leaders, and other relevant stakeholders; identifying the State’s critical infrastructure operational technology systems; and supporting the State’s critical infrastructure priority assets by: connecting priority assets to resources for conducting integrated assessments of the State’s critical infrastructure to detect and document vulnerabilities and operational dependencies; identifying technical and grant opportunities to support remediation of identified vulnerabilities; and establishing mechanisms to support shared learning and best practices between different critical infrastructure assets. The Department of Emergency Management shall coordinate consequence management efforts and respond to cascading impacts of an attack on the State’s critical infrastructure, in accordance with this title. The Department of Information Technology, in consultation with the Center, shall: allow the owner or operator of critical infrastructure to become a member of the Maryland Information Sharing and Analysis Center; provide up–to–date cybersecurity reporting standards to an owner or operator of critical infrastructure; and direct critical infrastructure cybersecurity efforts across the units of State government.