§ 14–1404
Statutes in effect as of October 1, 2026.
Md. Code Ann., Pub. Safety § 14-1404 (2026)
Title 14. Emergency Management
Subtitle 14
§ 14–1404LinkCopy Citation
(a)
The Branch shall:
(1)
identify current and potential threats to the State’s critical infrastructure;
(2)
prioritize the State’s critical infrastructure assets by:
(i)
in coordination with the Department of Information Technology, the Office of Security Management, and the Public Service Commission, determining the threat level to the State’s critical infrastructure, focusing on foreign actors, domestic actors, and insider threats;
(ii)
determining the impacts to the State’s critical infrastructure in the case of a cybersecurity or physical attack;
(iii)
understanding the effect that the compromise of one aspect of critical infrastructure may have on another aspect of critical infrastructure;
(iv)
engaging and coordinating with critical infrastructure sector leaders, military leaders, and other relevant stakeholders;
(v)
identifying the State’s critical infrastructure operational technology systems; and
(vi)
supporting the State’s critical infrastructure priority assets by:
(1)
connecting priority assets to resources for conducting integrated assessments of the State’s critical infrastructure to detect and document vulnerabilities and operational dependencies;
(2)
identifying technical and grant opportunities to support remediation of identified vulnerabilities; and
(3)
establishing mechanisms to support shared learning and best practices between different critical infrastructure assets.
(b)
The Department of Emergency Management shall coordinate consequence management efforts and respond to cascading impacts of an attack on the State’s critical infrastructure, in accordance with this title.
(c)
The Department of Information Technology, in consultation with the Center, shall:
(1)
allow the owner or operator of critical infrastructure to become a member of the Maryland Information Sharing and Analysis Center;
(2)
provide up–to–date cybersecurity reporting standards to an owner or operator of critical infrastructure; and
(3)
direct critical infrastructure cybersecurity efforts across the units of State government.