Except as otherwise provided by law, this section does not apply to a requirement or violation of: Subtitle 4 of this title; Title 7, Subtitle 1 of this article; Title 8, Subtitles 1 and 3 of this article; or Title 9, Subtitle 3 of this article. A public service company: shall comply fully with the requirements of this division; and may not violate any provision of this division.

Except as provided in subsection (b) of this section, a public service company shall file with the Commission: an annual report for the preceding calendar year; and special reports, information, contracts, records, and copies as required by the Commission. Unless otherwise directed by the Commission, a public service company is not required to comply with subsection (a) of this section if the public service company is: a common carrier; or a telephone company whose rates are not regulated by the Commission under Title 4 of this article. The Commission may require a public service company that files documents under subsection (a) of this section to file the documents under oath.

A public service company shall furnish equipment, services, and facilities that are safe, adequate, just, reasonable, economical, and efficient, considering the conservation of natural resources and the quality of the environment.

A public service company shall notify the Commission of any accident involving the public service company that results in: personal injury requiring hospitalization; property damage exceeding $50,000; or loss of life. The public service company shall notify the Commission within 30 days after the day the accident occurs or within a period that the Commission prescribes. The notice: shall be in a form that the Commission prescribes; and may not be admissible in evidence, or used for any purpose against the public service company that provides the notice, in an action for damages arising out of any matter that is reported in the notice.

This section applies to a project by an investor–owned gas company, electric company, or combination gas and electric company involving the construction, reconstruction, installation, demolition, restoration, or alteration of any underground gas or electric infrastructure of the company, and any related traffic control activities. An investor–owned gas company, electric company, or combination gas and electric company shall require a contractor or subcontractor on a project described in subsection (a) of this section to pay its employees not less than the prevailing wage rate determined solely by the Commissioner of Labor and Industry in a process substantially similar to the process established under Title 17, Subtitle 2 of the State Finance and Procurement Article. In accordance with Title 3, Subtitle 5 of the Labor and Employment Article, the Maryland Department of Labor shall enforce the requirement under subsection (b) of this section for contractors and subcontractors to pay employees not less than the prevailing wage rate determined solely by the Commissioner of Labor and Industry. A contract entered into after March 1, 2024, by an investor–owned gas company, electric company, or combination gas and electric company that is for the construction, reconstruction, installation, demolition, restoration, or alteration of any underground gas or electric infrastructure, and any related traffic control activities, includes a contract that has been executed, amended, or altered after March 1, 2024.

In this section, “zero–trust” means a cybersecurity approach: focused on cybersecurity resource protection; and based on the premise that trust is never granted implicitly but must be continually evaluated. This section does not apply to a public service company that is: a common carrier; or a telephone company. A public service company shall: adopt and implement cybersecurity standards that are equal to or exceed standards adopted by the Commission; adopt a zero–trust cybersecurity approach for on–premises services and cloud–based services; establish minimum security standards for each operational technology and information technology device based on the level of security risk for each device, including security risks associated with supply chains; and on or before July 1, 2024, and on or before July 1 every other year thereafter, engage a third party to conduct an assessment of operational technology and information technology devices based on: the Cybersecurity and Infrastructure Security Agency’s Cross–Sector Cybersecurity Performance Goals; or a more stringent standard that is based on the National Institute of Standards and Technology security frameworks; and submit to the Commission certification of the public service company’s compliance with standards used in the assessments under item (i) of this item. Each public service company shall report, in accordance with the process established under paragraph (2) of this subsection, a cybersecurity incident, including an attack on a system being used by the public service company, to the State Security Operations Center in the Department of Information Technology. The State Chief Information Security Officer, in consultation with the Commission, shall establish a process for a public service company to report cybersecurity incidents under paragraph (1) of this subsection, including establishing: the criteria for determining the circumstances under which a cybersecurity incident must be reported; the manner in which a cybersecurity incident must be reported; and the time period within which a cybersecurity incident must be reported. The State Security Operations Center shall immediately notify appropriate State and local agencies of a cybersecurity incident reported under this subsection.