# State Finance and Procurement (GSF)

## Title 13. Source Selection -- State Procurement Contracts

### Subtitle 1. Methods of Source Selection

#### Section 13-115

(a) The Department of Information Technology shall require basic security, data collection, and privacy requirements to be included in a contract under which a third-party contractor will:

  (1) have access to and use State information technology equipment, systems, or services;

  (2) collect, store, or process personal information as defined in Sec. 10-1301 of the State Government Article; or

  (3) connect to State information technology equipment, systems, or services.

(b) The security requirements developed under subsection (a) of this section shall be consistent with a widely recognized security standard, including National Institute of Standards and Technology SP 800-171, ISO27001, or Cybersecurity Maturity Model Certification.

(c) The privacy requirements developed under subsection (a) of this section shall be consistent with widely recognized privacy standards, including National Institute of Standards and Technology (NIST) SP privacy framework v1, NIST 800 SP 800-53 v5, and NIST 800-207 SP zero trust architecture, as they may be updated from time to time.

---

Md. Code Ann., State Fin. & Proc. (as displayed at mgaleg.maryland.gov, October 16, 2026)