State Finance and Procurement (GSF) — Title 3.5. Department of Information Technology
Statutes in effect as of October 1, 2026.
Subtitle 1
Md. Code Ann., State Fin. & Proc. § 3.5-101 (2026)
Title 3.5. Department of Information Technology
Subtitle 1
§ 3.5-101LinkCopy Citation
(a)
In this title the following words have the meanings indicated.
(b)
“Cloud computing” means a service that enables on–demand self–service network access to a shared pool of configurable computer resources, including data storage, analytics, commerce, streaming, e–mail, document sharing, and document editing.
(c)
“Department” means the Department of Information Technology.
(d)
(1)
“Oversight of implementation” means management of the process to implement a new technology, system, or product into practice and use by a unit.
(2)
“Oversight of implementation” includes:
(i)
planning and preparation to implement the product or practice; and
(ii)
ongoing monitoring and support of the implementation team to ensure successful execution and that the project goals are met.
(3)
“Oversight of implementation” does not include:
(i)
responsibility for day–to–day management of any individual projects or products; or
(ii)
responsibility for implementing individual–level process requirements for a project or product.
(e)
“Secretary” means the Secretary of Information Technology.
(f)
“State minimum cybersecurity standards” means the State minimum cybersecurity standards established by the Department of Information Technology.
(g)
“Telecommunication” means the transmission of information, images, pictures, voice, or data by radio, video, or other electronic or impulse means.
(h)
“Unit of State government” means an agency or unit of the Executive Branch of State government.
Subtitle 2
Md. Code Ann., State Fin. & Proc. § 3.5-201 (2026)
Title 3.5. Department of Information Technology
Subtitle 2
§ 3.5-201LinkCopy Citation
(a)
There is a Department of Information Technology established as a principal department of State government.
(b)
Subject to the provisions of § 3.5–302 of this title, it is the intent of the General Assembly that responsibility and oversight of the information technology projects for units of State government be centralized at the Department and that priority be given to funding information technology projects that address the needs for the public health, education, safety, or financial well–being of the residents of Maryland.
Md. Code Ann., State Fin. & Proc. § 3.5-202 (2026)
Title 3.5. Department of Information Technology
Subtitle 2
§ 3.5-202LinkCopy Citation
(a)
The head of the Department is the Secretary of Information Technology, who shall be appointed by the Governor with the advice and consent of the Senate.
(b)
The Secretary shall have experience in information technology, data processing, telecommunications, and systems procurement, planning, and management.
(c)
Before taking office, the appointee shall take the oath required by Article I, § 9 of the Maryland Constitution.
(d)
The Secretary shall advise the Governor on all matters assigned to the Department and is responsible for carrying out the Governor’s policies on those matters.
(e)
The Secretary is responsible for the operation of the Department and may establish guidelines and procedures to promote the orderly and efficient administration of the Department.
(f)
The Secretary may establish, reorganize, or abolish areas of responsibility in the Department necessary to fulfill the duties assigned to the Secretary.
Md. Code Ann., State Fin. & Proc. § 3.5-203 (2026)
Title 3.5. Department of Information Technology
Subtitle 2
§ 3.5-203LinkCopy Citation
(a)
(1)
With the approval of the Governor, the Secretary shall appoint a Deputy Secretary.
(2)
The Deputy Secretary:
(i)
serves at the pleasure of the Secretary;
(ii)
is entitled to the salary provided in the State budget; and
(iii)
has the duties provided by law or delegated by the Secretary.
(b)
Each assistant secretary and professional consultant is in the executive service, management service, or is a special appointment in the State personnel management system and is appointed by and serves at the pleasure of the Secretary.
(c)
Except as provided in this section or otherwise by law, the Secretary shall appoint and remove all other staff in accordance with the provisions of the State Personnel and Pensions Article.
(d)
The appointment of or removal of staff of any unit in the Department is subject to the approval of the Secretary.
Md. Code Ann., State Fin. & Proc. § 3.5-204 (2026)
Title 3.5. Department of Information Technology
Subtitle 2
§ 3.5-204LinkCopy Citation
(a)
The Attorney General is legal adviser to the Department.
(b)
At the request of the Governor, the Attorney General shall assign to the Department the number of assistant Attorneys General authorized by law to be assigned to the Department.
(c)
(1)
The Attorney General shall designate one of the assistant Attorneys General assigned to the Department as counsel to the Department.
(2)
After the Attorney General designates the counsel to the Department, the Attorney General may not reassign the counsel without consulting the Secretary.
(3)
(i)
The counsel may have no other duty other than to:
(1)
give the legal aid, advice, and counsel required by the Secretary or any other official of the Department;
(2)
supervise the other assistant Attorneys General assigned to the Department; and
(3)
perform for the Department the duties that the Attorney General assigns.
(ii)
The counsel shall perform these duties subject to the control and supervision of the Attorney General.
Md. Code Ann., State Fin. & Proc. § 3.5-205 (2026)
Title 3.5. Department of Information Technology
Subtitle 2
§ 3.5-205LinkCopy Citation
(a)
The Department shall establish a technical procurement team that includes individuals with expertise in technology procurement and agile procurement.
(b)
The technical procurement team:
(1)
in collaboration with the Department of General Services, shall develop materials that encourage cost–effective and cost–efficient information technology services spending, including procurement templates, procurement contracts, and other procurement materials; and
(2)
may assist a unit of State government, including the Department of General Services, to procure information technology services, including:
(i)
drafting requests for proposals;
(ii)
reviewing bids and selecting vendors; and
(iii)
developing information technology service contracts in a manner that encourages competition and full participation by vendors.
Subtitle 2A. Office of Security Management
Md. Code Ann., State Fin. & Proc. § 3.5-2A-01 (2026)
Title 3.5. Department of Information Technology
Subtitle 2A. Office of Security Management
§ 3.5-2A-01LinkCopy Citation
(a)
In this subtitle the following words have the meanings indicated.
(b)
“Council” means the Maryland Cybersecurity Coordinating Council.
(c)
“Office” means the Office of Security Management.
Md. Code Ann., State Fin. & Proc. § 3.5-2A-02 (2026)
Title 3.5. Department of Information Technology
Subtitle 2A. Office of Security Management
§ 3.5-2A-02LinkCopy Citation
There is an Office of Security Management within the Department.
Md. Code Ann., State Fin. & Proc. § 3.5-2A-03 (2026)
Title 3.5. Department of Information Technology
Subtitle 2A. Office of Security Management
§ 3.5-2A-03LinkCopy Citation
(a)
The head of the Office is the State Chief Information Security Officer.
(b)
The State Chief Information Security Officer shall:
(1)
be appointed by the Governor with the advice and consent of the Senate;
(2)
serve at the pleasure of the Governor;
(3)
be supervised by the Secretary; and
(4)
serve as the chief information security officer of the Department.
(c)
An individual appointed as the State Chief Information Security Officer under subsection (b) of this section shall:
(1)
at a minimum, hold a bachelor’s degree;
(2)
hold appropriate information technology or cybersecurity certifications;
(3)
have experience:
(i)
identifying, implementing, or assessing security controls;
(ii)
in infrastructure, systems engineering, or cybersecurity;
(iii)
managing highly technical security, security operations centers, and incident response teams in a complex cloud environment and supporting multiple sites; and
(iv)
working with common information security management frameworks;
(4)
have extensive knowledge of information technology and cybersecurity field concepts, best practices, and procedures, with an understanding of existing enterprise capabilities and limitations to ensure the secure integration and operation of security networks and systems; and
(5)
have knowledge of current security regulations.
(d)
The State Chief Information Security Officer shall provide cybersecurity advice and recommendations to the Governor on request.
(e)
(1)
(i)
There is a Director of Local Cybersecurity, who shall be appointed by the State Chief Information Security Officer.
(ii)
The Director of Local Cybersecurity shall work in coordination with the Maryland Department of Emergency Management to provide technical assistance, coordinate resources, and improve cybersecurity preparedness for units of local government.
(2)
(i)
There is a Director of State Cybersecurity, who shall be appointed by the State Chief Information Security Officer.
(ii)
The Director of State Cybersecurity is responsible for implementation of this section with respect to units of State government.
(f)
The Department shall provide the Office with sufficient staff to perform the functions of this subtitle.
Md. Code Ann., State Fin. & Proc. § 3.5-2A-04 (2026)
Title 3.5. Department of Information Technology
Subtitle 2A. Office of Security Management
§ 3.5-2A-04LinkCopy Citation
(a)
(1)
The Office is responsible for:
(i)
the direction, coordination, and implementation of the overall cybersecurity strategy and policy for units of State government; and
(ii)
supporting and coordinating with the Maryland Department of Emergency Management Cyber Preparedness Unit during emergency response efforts.
(2)
The Office is not responsible for the information technology installation and maintenance operations normally conducted by a unit of State government, a unit of local government, a local school board, a local school system, or a local health department.
(b)
The Office shall:
(1)
establish standards to categorize all information collected or maintained by or on behalf of each unit of State government;
(2)
establish standards to categorize all information systems maintained by or on behalf of each unit of State government;
(3)
develop guidelines governing the types of information and information systems to be included in each category;
(4)
establish security requirements for information and information systems in each category;
(5)
assess the categorization of information and information systems and the associated implementation of the security requirements established under item (4) of this subsection;
(6)
if the State Chief Information Security Officer determines that there are security vulnerabilities or deficiencies in any information systems, determine and direct or take actions necessary to correct or remediate the vulnerabilities or deficiencies, which may include requiring the information system to be disconnected;
(7)
if the State Chief Information Security Officer determines that there is a cybersecurity threat caused by, affecting, or potentially affecting an entity connected to the network established under § 3.5–404 of this title that introduces or may introduce a serious risk to entities connected to the network or to the State, take or direct actions required to mitigate the threat;
(8)
manage security awareness training for all appropriate employees of units of State government;
(9)
assist in the development of data management, data governance, and data specification standards to promote standardization and reduce risk;
(10)
assist in the development of a digital identity standard and specification applicable to all parties communicating, interacting, or conducting business with or on behalf of a unit of State government;
(11)
develop and maintain information technology security policy, standards, and guidance documents, consistent with best practices developed by the National Institute of Standards and Technology;
(12)
to the extent practicable, seek, identify, and inform relevant stakeholders of any available financial assistance provided by the federal government or non–State entities to support the work of the Office;
(13)
provide technical assistance to localities in mitigating and recovering from cybersecurity incidents;
(14)
annually review and, if necessary, update the State minimum cybersecurity standards;
(15)
provide technical services, advice, and guidance to units of local government to improve cybersecurity preparedness, prevention, response, and recovery practices; and
(16)
support local governments in developing a vulnerability assessment and cyber assessment, including providing local governments with the resources and information on best practices to complete the assessments.
(c)
The Office, in coordination with the Maryland Department of Emergency Management, shall:
(1)
assist local political subdivisions, including counties, school systems, school boards, and local health departments, in implementing best practices and guidance developed by the Department; and
(2)
connect local entities to appropriate resources for any other purpose related to cybersecurity preparedness and response.
(d)
The Office, in coordination with the Maryland Department of Emergency Management, may:
(1)
conduct regional exercises, as necessary, in coordination with the National Guard, local emergency managers, and other State and local entities; and
(2)
establish regional assistance groups to deliver or coordinate support services to local political subdivisions, agencies, or regions.
(e)
(1)
On or before December 31 each year, the Office shall report to the Governor and, in accordance with § 2–1257 of the State Government Article, the Senate Budget and Taxation Committee, the Senate Committee on Education, Energy, and the Environment, the House Appropriations Committee, the House Health and Government Operations Committee, and the Joint Committee on Cybersecurity, Information Technology, and Biotechnology on the activities of the Office and the state of cybersecurity preparedness in Maryland, including:
(i)
the activities and accomplishments of the Office during the previous 12 months at the State and local levels; and
(ii)
a compilation and analysis of the data from the information contained in the reports received by the Office under § 3.5–405 of this title, including:
(1)
a summary of the issues identified by the cybersecurity preparedness assessments conducted that year;
(2)
the status of vulnerability assessments of all units of State government and a timeline for completion and cost to remediate any vulnerabilities exposed;
(3)
recent audit findings of all units of State government and options to improve findings in future audits, including recommendations for staff, budget, and timing;
(4)
efforts to secure financial support for cyber risk mitigation from federal or other non–State resources;
(5)
key performance indicators on the cybersecurity strategies in the Department’s information technology master plan, including time, budget, and staff required for implementation; and
(6)
any additional recommendations for improving State and local cybersecurity preparedness.
(2)
A report submitted under this subsection may not contain information that reveals cybersecurity vulnerabilities and risks in the State.
(f)
(1)
Except as provided in paragraph (2) of this subsection, on or before the third Wednesday in January each year, the Office shall report to the Governor and, in accordance with § 2–1257 of the State Government Article, the Senate Budget and Taxation Committee, the Senate Committee on Education, Energy, and the Environment, the House Appropriations Committee, the House Health and Government Operations Committee, and the Joint Committee on Cybersecurity, Information Technology, and Biotechnology on:
(i)
the State’s expenditure on cybersecurity relative to overall information technology spending for the prior 3 years; and
(ii)
recommendations for changes to the budget, including the amount, purpose, and timing of funding to improve State and local cybersecurity preparedness.
(2)
In a year with a newly elected Governor, the report required under paragraph (1) of this subsection shall be submitted on or before the third Friday of January.
Md. Code Ann., State Fin. & Proc. § 3.5-2A-05 (2026)
Title 3.5. Department of Information Technology
Subtitle 2A. Office of Security Management
§ 3.5-2A-05LinkCopy Citation
(a)
There is a Maryland Cybersecurity Coordinating Council.
(b)
(1)
The Council consists of the following members:
(i)
the secretary of each of the principal departments listed in § 8–201 of the State Government Article, or a secretary’s designee;
(ii)
the State Chief Information Security Officer;
(iii)
the Adjutant General of the Maryland National Guard, or the Adjutant General’s designee;
(iv)
the Superintendent of State Police, or the Superintendent’s designee;
(v)
the Director of the Governor’s Office of Homeland Security, or the Director’s designee;
(vi)
the Executive Director of the Department of Legislative Services, or the Executive Director’s designee;
(vii)
one representative of the Administrative Office of the Courts;
(viii)
the Chancellor of the University System of Maryland, or the Chancellor’s designee; and
(ix)
any other stakeholder that the State Chief Information Security Officer deems appropriate.
(2)
If a designee serves on the Council in place of an official listed in paragraph (1) of this subsection, the designee shall report information from the Council meetings and other communications to the official.
(c)
In addition to the members listed under subsection (b) of this section, the following representatives may serve as nonvoting members of the Council:
(1)
one member of the Senate of Maryland, appointed by the President of the Senate;
(2)
one member of the House of Delegates, appointed by the Speaker of the House; and
(3)
one representative of the judiciary, appointed by the Chief Justice of the Supreme Court of Maryland.
(d)
The chair of the Council is the State Chief Information Security Officer.
(e)
The Council shall meet at least quarterly at the request of the chair.
(f)
The Council shall:
(1)
provide advice and recommendations to the State Chief Information Security Officer regarding:
(i)
the strategy and implementation of cybersecurity initiatives and recommendations; and
(ii)
building and sustaining the capability of the State to identify and mitigate cybersecurity risk and respond to and recover from cybersecurity–related incidents.
(2)
use the analysis compiled by the Office under § 3.5–2A–04(e)(1)(ii) of this subtitle to prioritize cybersecurity risk across the Executive Branch of State government and make corresponding recommendations for security investments in the Governor’s annual budget.
(g)
In carrying out the duties of the Council, the Council shall consult with outside experts, including experts in the private sector, government agencies, and institutions of higher education.
Md. Code Ann., State Fin. & Proc. § 3.5-2A-06 (2026)
Title 3.5. Department of Information Technology
Subtitle 2A. Office of Security Management
§ 3.5-2A-06LinkCopy Citation
The Council shall:
(1)
promote cybersecurity education and training opportunities to strengthen the State’s cybersecurity capabilities by expanding existing agreements with educational institutions; and
(2)
utilize relationships with institutions of higher education to advertise cybersecurity careers and job positions available in State or local government, including the Maryland Technology Internship Program established under Title 18, Subtitle 30 of the Education Article.
Subtitle 3. Information Processing
Md. Code Ann., State Fin. & Proc. § 3.5-301 (2026)
Title 3.5. Department of Information Technology
Subtitle 3. Information Processing
§ 3.5-301LinkCopy Citation
(a)
In this subtitle the following words have the meanings indicated.
(b)
“Artificial intelligence” has the meaning stated in § 3.5–801 of this title.
(c)
“Cybersecurity” means processes or capabilities wherein systems, communications, and information are protected and defended against damage, unauthorized use or modification, and exploitation.
(d)
“Cybersecurity strategy” means a vision, a plan of action, or guiding principles.
(e)
(1)
“Development” means all expenditures for a new information technology system or an enhancement to an existing system including system:
(i)
planning;
(ii)
creation;
(iii)
installation;
(iv)
testing; and
(v)
initial training.
(2)
“Development” does not include:
(i)
ongoing operating costs, software or hardware maintenance, routine upgrades, or modifications that merely allow for a continuation of the existing level of functionality; or
(ii)
expenditures made after a new or enhanced system has been legally accepted by the user and is being used for the business process for which it was intended.
(f)
“Expedited project” means a project that is not a major information technology development project that receives money from the Fund in a manner that allows for modernization projects consistent with the State Modernization Plan to move forward in a nimble and expedited manner.
(g)
“Fund” means the Information Technology Investment Fund.
(h)
“Information technology” means all electronic information processing, including:
(1)
maintenance;
(2)
networking;
(3)
telecommunications;
(4)
hardware;
(5)
software and applications; and
(6)
associated services.
(i)
“Information technology services” means information provided by electronic means by or on behalf of a unit of State government.
(j)
“Legacy system” means a hardware or software system that is end of support or end of life.
(k)
(1)
“Major information technology development project” means any information technology development project that meets one or more of the following criteria:
(i)
except as provided in paragraph (2) of this subsection, the estimated total cost of development equals or exceeds $5,000,000;
(ii)
the project is undertaken to support a critical business function associated with the public health, education, safety, or financial well–being of the residents of Maryland; or
(iii)
the Secretary determines that the project requires the special attention and consideration given to a major information technology development project due to:
(1)
the significance of the project’s potential benefits or risks;
(2)
the impact of the project on the public or local governments;
(3)
the public visibility of the project; or
(4)
other reasons as determined by the Secretary.
(2)
“Major information technology development project” does not include:
(i)
technology that is reoccurring, standard operating technology as determined by the Secretary and submitted to the Legislative Policy Committee for a 30–day review and comment period; or
(ii)
a project with an estimated total cost of development that is:
(1)
less than $5,000,000 and is funded with money set aside for expedited projects in the Fund; or
(2)
more than $5,000,000 and is funded with the money set aside for expedited projects in the Fund if the Secretary determines that:
(A)
the unit of State government has sufficient implementation resources, including human capital, subject matter expertise, and technological infrastructure, or has the means to obtain these resources before project initiation;
(B)
there is no sufficient alternative within the State’s information technology inventory; and
(C)
the project will result in a comprehensive solution designed to meet a cohesive set of business and technological objectives.
(l)
“Master plan” means the statewide information technology master plan and statewide cybersecurity strategy.
(m)
“Nonvisual access” means the ability, through keyboard control, synthesized speech, Braille, or other methods not requiring sight to receive, use, and manipulate information and operate controls necessary to access information technology in accordance with standards adopted under § 3.5–303(b) of this subtitle.
(n)
“Resource sharing” means the utilization of a State resource by private industry in exchange for the provision to the State of a communication service or other consideration.
(o)
“State Modernization Plan” means the plan developed and adopted by the Secretary to modernize State information technology.
(p)
“Systems development life cycle plan” means a plan that defines all actions, functions, or activities to be performed by a unit of State government in the definition, planning, acquisition, development, testing, implementation, operation, enhancement, and modification of information technology systems.
Md. Code Ann., State Fin. & Proc. § 3.5-302 (2026)
Title 3.5. Department of Information Technology
Subtitle 3. Information Processing
§ 3.5-302LinkCopy Citation
(a)
This subtitle does not apply to changes relating to or the purchase, lease, or rental of information technology by:
(1)
public institutions of higher education solely for academic or research purposes;
(2)
the Maryland Port Administration;
(3)
the University System of Maryland;
(4)
St. Mary’s College of Maryland;
(5)
Morgan State University;
(6)
the Maryland Stadium Authority;
(7)
Baltimore City Community College;
(8)
the Legislative Branch of State government;
(9)
the Judicial Branch of State government;
(10)
the Office of the Attorney General;
(11)
the Comptroller; or
(12)
the State Treasurer.
(b)
Except as provided in subsection (a) of this section, this subtitle applies to any project of a unit of the Executive Branch of State government that involves an agreement with a public institution of higher education for a portion of the development of the project, whether the work on the development is done directly or indirectly by the public institution of higher education.
(c)
Notwithstanding any other provision of law, except as provided in subsection (a) of this section and §§ 3.5–305, 3.5–307(a)(2), 3.5–308, and 3.5–309 of this subtitle, this subtitle applies to all units of the Executive Branch of State government including public institutions of higher education other than Morgan State University, the University System of Maryland, St. Mary’s College of Maryland, and Baltimore City Community College.
Md. Code Ann., State Fin. & Proc. § 3.5-303 (2026)
Title 3.5. Department of Information Technology
Subtitle 3. Information Processing
§ 3.5-303LinkCopy Citation
(a)
The Secretary is responsible for carrying out the following duties:
(1)
developing, implementing, maintaining, revising, and enforcing information technology policies, procedures, and standards;
(2)
providing technical assistance, advice, and recommendations to the Governor and any unit of State government concerning information technology matters;
(3)
reviewing the annual project plan for each unit of State government to make information and services available to the public over the Internet;
(4)
developing and maintaining a statewide information technology master plan that will:
(i)
centralize the management and direction of information technology policy within the Executive Branch of State government under the control of the Department;
(ii)
include all aspects of State information technology including telecommunications, security, data processing, and information management;
(iii)
consider interstate transfers as a result of federal legislation and regulation;
(iv)
ensure that the State information technology plan and related policies and standards are consistent with State goals, objectives, and resources, and represent a long–range vision for using information technology to improve the overall effectiveness of State government;
(v)
include standards to assure nonvisual access to the information and services made available to the public over the Internet; and
(vi)
allow a State agency to maintain the agency’s own information technology unit that provides for information technology services to support the mission of the agency;
(5)
developing, implementing, and maintaining a statewide cybersecurity strategy that will:
(i)
centralize the management and direction of cybersecurity strategy within the Executive Branch of State government under the control of the Department; and
(ii)
serve as the basis for budget allocations for cybersecurity preparedness for the Executive Branch of State government;
(6)
adopting by regulation and enforcing nonvisual access standards to be used in the procurement of information technology services by or on behalf of units of State government in accordance with subsection (c) of this section;
(7)
in consultation with the Maryland Cybersecurity Coordinating Council, advising and overseeing a consistent cybersecurity strategy for units of State government, including institutions under the control of the governing boards of the public institutions of higher education;
(8)
advising and consulting with the Legislative and Judicial branches of State government regarding a cybersecurity strategy;
(9)
in consultation with the Maryland Cybersecurity Coordinating Council, developing guidance on consistent cybersecurity strategies for counties, municipal corporations, school systems, and all other political subdivisions of the State;
(10)
upgrading information technology and cybersecurity–related State government infrastructure;
(11)
annually evaluating:
(i)
the feasibility of units of State government providing public services using artificial intelligence, machine learning, commercial cloud computer services, device–as–a–service procurement models, and other emerging technologies; and
(ii)
the development of data analytics capabilities to enable data–driven policymaking by units of State government; and
(12)
conducting inventories of systems that employ artificial intelligence that are used by a unit of State government as required under § 3.5–803 of this title.
(b)
Nothing in subsection (a) of this section may be construed as establishing a mandate for any entity listed in subsection (a)(9) of this section.
(c)
On or before January 1, 2020, the Secretary, or the Secretary’s designee, shall:
(1)
adopt new nonvisual access procurement standards that:
(i)
provide an individual with disabilities with nonvisual access in a way that is fully and equally accessible to and independently usable by the individual with disabilities so that the individual is able to acquire the same information, engage in the same interactions, and enjoy the same services as users without disabilities, with substantially equivalent ease of use; and
(ii)
are consistent with the standards of § 508 of the federal Rehabilitation Act of 1973; and
(2)
establish a process for the Secretary or the Secretary’s designee to:
(i)
determine whether information technology meets the nonvisual access standards adopted under item (1) of this subsection; and
(ii)
(1)
for information technology procured by a State unit before January 1, 2020, and still used by the State unit on or after January 1, 2020, work with the vendor to modify the information technology to meet the nonvisual access standards, if practicable; or
(2)
for information technology procured by a State unit on or after January 1, 2020, enforce the nonvisual access clause developed under § 3.5–311 of this subtitle, including the enforcement of the civil penalty described in § 3.5–311(a)(2)(iii)1 of this subtitle.
(d)
(1)
The Governor shall include an appropriation in the annual budget bill in an amount necessary to cover the costs of implementing the statewide cybersecurity master plan developed under subsection (a) of this section without the need for the Department to operate a charge–back model for cybersecurity services provided to other units of State government or units of local government.
(2)
On or before January 31 each year, in a separate report or included within a general budget report, the Governor shall submit a report in accordance with § 2–1257 of the State Government Article to the Senate Budget and Taxation Committee and the House Appropriations Committee that includes:
(i)
specific information on the information technology budget and cybersecurity budget that the Governor has submitted to the General Assembly for the upcoming fiscal year; and
(ii)
how the budgets listed under item (i) of this paragraph compare to the annual overview of the U.S. President’s budget submission on information technology and cybersecurity to Congress conducted by the U.S. Office of Management and Budget.
Md. Code Ann., State Fin. & Proc. § 3.5-304 (2026)
Title 3.5. Department of Information Technology
Subtitle 3. Information Processing
§ 3.5-304LinkCopy Citation
(a)
The Secretary shall develop a statewide information technology master plan.
(b)
(1)
The plan developed under subsection (a) of this section shall be posted publicly on the Department’s website and, in accordance with § 2–1257 of the State Government Article, submitted to the General Assembly within 1 year after the date the Governor is inaugurated in each gubernatorial term.
(2)
If the Secretary is unable to meet the deadline established under paragraph (1) of this subsection, within 10 days after the missed deadline, the Secretary shall notify the Governor in writing and, in accordance with § 2–1257 of the State Government Article:
(i)
the Senate Budget and Taxation Committee;
(ii)
the Senate Committee on Education, Energy, and the Environment;
(iii)
the House Appropriations Committee;
(iv)
the House Government, Labor, and Elections Committee; and
(v)
the Joint Committee on Cybersecurity, Information Technology, and Biotechnology.
(3)
The notice required under paragraph (2) of this subsection shall include an explanation of why the plan is delayed and provide a date for its publication, not to exceed 3 months after the deadline established under paragraph (1) of this subsection.
(c)
Each year, the Secretary, or the Secretary’s designee, shall provide a briefing to the General Assembly on:
(1)
the implementation of the plan;
(2)
any material changes made to the plan; and
(3)
how the State intends to manage and deploy the initiatives included in the plan across the Executive Branch of State government.
Md. Code Ann., State Fin. & Proc. § 3.5-305 (2026)
Title 3.5. Department of Information Technology
Subtitle 3. Information Processing
§ 3.5-305LinkCopy Citation
(a)
(1)
In this section the following words have the meanings indicated.
(2)
(i)
“Spam e–mail” means unsolicited, phishing, solicitation, and bulk e–mails unrelated to State business.
(ii)
“Spam e–mail” does not include solicitation and bulk e–mails relating to State business, including bulk e–mail from State vendors, partners, and exclusive representatives.
(3)
“State business” means the furtherance of the State’s obligations:
(i)
under the Maryland Constitution, Maryland Code, and Code of Maryland regulations;
(ii)
under the laws of the United States; and
(iii)
by operation of contracts and similar obligations.
(b)
It is the policy of the State that e–mail systems and resources for State and higher education employees are intended to support State business and may not serve as a public forum.
(c)
Except as provided in subsection (d) of this section, in accordance with guidelines established by the Secretary, each unit of State government shall develop and submit to the Secretary:
(1)
information technology policies and standards;
(2)
an information technology plan; and
(3)
an annual project plan outlining the status of efforts to make information and services available to the public over the Internet.
(d)
(1)
The governing boards of the public institutions of higher education shall develop and submit information technology policies and standards and an information technology plan for their respective institutions or systems to the Secretary.
(2)
If the Secretary finds that the submissions required under this subsection are consistent with the master plan, the Secretary shall incorporate those submissions into the master plan.
(3)
If the Secretary finds that the submissions required under this subsection are not consistent with the master plan:
(i)
the Secretary shall return the submissions to the governing boards; and
(ii)
the governing boards shall revise the submissions as appropriate and submit the revised policies, standards, and plans to the Secretary.
(e)
(1)
In order to protect the information technology resources of the State, the policies, plans, and standards required under subsections (c) and (d) of this section shall include provisions to protect State and higher education employee e–mail services from spam e–mail and other use that does not support State business, including by implementing systems that automatically filter spam e–mail from State and higher education employees’ e–mail accounts.
(2)
The policies, plans, and standards required under subsections (c) and (d) of this section shall permit incidental personal use of information technology, including e–mail, by State employees that:
(i)
has a de minimis impact on resources; and
(ii)
is consistent with generally accepted professional business norms and expectations.
Md. Code Ann., State Fin. & Proc. § 3.5-306 (2026)
Title 3.5. Department of Information Technology
Subtitle 3. Information Processing
§ 3.5-306LinkCopy Citation
Information technology of each unit of State government shall be consistent with the master plan.
Md. Code Ann., State Fin. & Proc. § 3.5-307 (2026)
Title 3.5. Department of Information Technology
Subtitle 3. Information Processing
§ 3.5-307LinkCopy Citation
(a)
(1)
A unit of State government may not purchase, lease, contract for, or rent an information technology service or product unless consistent with the master plan, as determined by the Secretary.
(2)
A unit of State government other than a public institution of higher education may not make expenditures for major information technology development projects or cybersecurity projects except as provided in § 3.5–308 of this subtitle.
(b)
The Secretary may review any information technology project or cybersecurity project for consistency with the master plan.
(c)
(1)
A unit of State government shall advise the Secretary of any information technology proposal involving:
(i)
resource sharing;
(ii)
the exchange of goods or services;
(iii)
a gift, contribution, or grant of real or personal property; or
(iv)
the sale, lease, exchange, or other disposition of communications facilities or communications frequencies.
(2)
The Secretary shall determine if the value of the resources, services, property, or other consideration to be obtained by the State under the terms of any proposal submitted in accordance with paragraph (1) of this subsection equals or exceeds $100,000.
(3)
If the value of any proposal submitted in accordance with this subsection equals or exceeds $100,000 and the Secretary and unit agree to proceed with the proposal, information on the proposal shall be:
(i)
advertised for a period of at least 30 days in the eMaryland Marketplace; and
(ii)
submitted, simultaneously with the advertisement, to the Legislative Policy Committee for a 60–day review and comment period, during which time the Committee may recommend that the proposal be treated as a procurement contract under Division II of this article.
(4)
Following the period for review and comment by the Legislative Policy Committee under paragraph (3) of this subsection, the proposal is subject to approval by the Board of Public Works.
(5)
This subsection may not be construed as authorizing an exception from the requirements of Division II of this article for any contract that otherwise would be subject to the State procurement process.
(d)
(1)
The Department, in consultation with the Department of General Services, shall assess the procurement process for information technology projects involving modernization and make recommendations to increase the State’s ability to proceed with a modernization project in a rapid and responsive manner.
(2)
(i)
On or before July 1, 2025, the Department shall inventory and assess the State’s legacy systems and prioritize modernization.
(ii)
On or before January 1, 2026, and every other January 1 thereafter, the Department, in consultation with each unit of State government, shall submit a report to the Governor, the Secretary, and, in accordance with § 2–1257 of the State Government Article, the General Assembly that provides:
(1)
an estimate of the funding required to modernize each legacy system in the unit; and
(2)
a 5–year projection of funding required to modernize each legacy system.
Md. Code Ann., State Fin. & Proc. § 3.5-308 (2026)
Title 3.5. Department of Information Technology
Subtitle 3. Information Processing
§ 3.5-308LinkCopy Citation
(a)
This section does not apply to a public institution of higher education.
(b)
Before submitting its information technology project requests, a unit of State government shall submit information in support of the request required by the Secretary for review and determination consistent with § 3.5–301(k) of this subtitle.
(c)
In reviewing information technology project requests, the Secretary may change a unit’s designation of a major information technology development project.
(d)
The Secretary shall review and, with the advice of the Secretary of Budget and Management, approve major information technology development projects and specifications for consistency with all statewide plans, policies, and standards, including a systems development life cycle plan.
(e)
(1)
Subject to paragraph (2) of this subsection, the Secretary shall be responsible for overseeing the implementation of major information technology development projects, regardless of fund source.
(2)
As part of the Secretary’s responsibilities under this section, the Secretary shall ensure that no funding is provided for the implementation of a major information technology development project unless:
(i)
the Secretary determines that the unit has the internal capacity to adequately support the project, program management, and responsibility over program activities, including:
(1)
human capital;
(2)
subject matter expertise; and
(3)
technical infrastructure;
(ii)
within 30 days of awarding a contract, the managing unit sends to the Board of Public Works and the Legislative Policy Committee, in accordance with § 2–1257 of the State Government Article, notice that:
(1)
identifies the project management team;
(2)
affirms that the Department has reviewed and approved the contract; and
(3)
is signed by the head of the unit acknowledging and accepting the accountability for the implementation of the information technology project or product; and
(iii)
while a unit is managing an active project or product, the unit agrees to report to the Department every 3 months on the project status in a manner requested by the Department.
(f)
(1)
With the advice of the Secretary of Budget and Management, expenditures for major information technology development projects shall be subject to the approval of the Secretary who shall approve expenditures only when those projects are consistent with statewide plans, policies, and standards.
(2)
(i)
The Secretary shall make a recommendation to the Secretary of Budget and Management to withhold project funds, regardless of fund source, if:
(1)
a unit of State government is not consistently reporting on the status of a project or projects to the Department in the form and manner required by the Department; or
(2)
the Department determines that project implementation issues exist, including project timeline delays, significant cost increases, vendor nonperformance, decreased agency capacity, or other issues that indicate issues of concern that could jeopardize successful implementation.
(ii)
Notwithstanding any other provision of law, and except as provided in subparagraph (iii) of this paragraph, the Secretary of Budget and Management shall withhold any unexpended funds appropriated in a fiscal year for a major information technology development project at the Secretary’s recommendation issued under subparagraph (i) of this paragraph.
(iii)
The Secretary of Budget and Management may release funds withheld under this paragraph at the direction of the Secretary if the Secretary determines that the issue leading to the initial withholding of funds has been addressed.
(3)
Within 30 days after funding is withheld in accordance with this subsection, the Department shall report on the purpose of the withholding:
(i)
to the Governor; and
(ii)
subject to § 2–1257 of the State Government Article, to:
(1)
the Senate Budget and Taxation Committee;
(2)
the Senate Committee on Education, Energy, and the Environment;
(3)
the House Appropriations Committee;
(4)
the House Health and Government Operations Committee; and
(5)
the Joint Committee on Cybersecurity, Information Technology, and Biotechnology.
(4)
(i)
Subject to subparagraph (ii) of this paragraph:
(1)
the Secretary may recommend to the Secretary of Budget and Management that funding withheld under this section be reallocated to other expenses of the Information Technology Investment Fund under § 3.5–309 of this subtitle; and
(2)
the Secretary of Budget and Management may, at their discretion, follow the Secretary’s recommendation to reallocate funds.
(ii)
If the reallocated funds exceed $500,000, the Secretary, in consultation with the Secretary of Budget and Management, shall submit a proposal to the Legislative Policy Committee for a 60–day review and comment period.
(g)
(1)
The Secretary shall approve funding for major information technology development projects, expedited projects, and other expenditures from the Fund only when:
(i)
the major information technology development projects or the expedited projects are in compliance with statewide plans, policies, and standards, as determined by the Secretary; and
(ii)
the major information technology development projects are supported by an approved systems development life cycle plan.
(2)
An approved systems development life cycle plan shall include submission of:
(i)
a project planning request that details initial planning for the project, including:
(1)
the project title, appropriation code, and summary;
(2)
a description of:
(A)
the business and technology outcomes to be achieved by the project;
(B)
the features available to the end user on completion, including user acceptance testing and accessibility plans;
(C)
the potential risks associated with the project;
(D)
possible alternatives; and
(E)
the scope and complexity of the project; and
(3)
an estimate of:
(A)
the total costs required to complete through planning; and
(B)
the fund sources available to support planning costs; and
(ii)
a project implementation request to begin full design, development, and implementation of the project after the completion of planning, including:
(1)
the project title, appropriation code, and summary;
(2)
a description of:
(A)
the business and technology outcomes to be achieved by the project and the metrics by which the success of those outcomes will be measured;
(B)
the features available to the end user on completion, including user acceptance testing and accessibility plans;
(C)
the potential risks associated with the project;
(D)
possible alternatives;
(E)
the scope and complexity of the project; and
(F)
how the project meets the goals of the statewide master plan; and
(3)
an estimate of:
(A)
the total project cost, by phase; and
(B)
the fund sources to be utilized.
(3)
The Secretary may approve funding incrementally, consistent with the systems development life cycle plan.
(h)
On or before July 1, 2026, the Department shall:
(1)
develop standards for units of State government to assist in identifying legacy systems that require modernization projects appropriate to be financed as an expedited project through the Fund;
(2)
adopt an Information Technology Investment Maturity Model that includes:
(i)
criteria to inform and prioritize investment decisions;
(ii)
processes to develop the information required to evaluate investment proposals against the criteria under item (i) of this item; and
(iii)
management processes to monitor the implementation of approved modernization projects; and
(3)
develop a State Modernization Plan.
Md. Code Ann., State Fin. & Proc. § 3.5-309 (2026)
Title 3.5. Department of Information Technology
Subtitle 3. Information Processing
§ 3.5-309LinkCopy Citation
(a)
There is an Information Technology Investment Fund.
(b)
The purpose of the Fund is to support major information technology development projects and expedited projects.
(c)
The Secretary:
(1)
shall administer the Fund in accordance with this section; and
(2)
subject to the provisions of § 2–201 of this article and § 3.5–307 of this subtitle, may receive and accept contributions, grants, or gifts of money or property.
(d)
(1)
The Fund is a special, nonlapsing fund that is not subject to § 7–302 of this article.
(2)
The State Treasurer shall hold the Fund separately and the Comptroller shall account for the Fund.
(3)
The State Treasurer shall invest and reinvest the money of the Fund in the same manner as other State money may be invested.
(4)
Any investment earnings of the Fund shall be paid into the Fund.
(e)
Except as provided in subsection (f) of this section, the Fund consists of:
(1)
money appropriated in the State budget to the Fund;
(2)
as approved by the Secretary, money received from:
(i)
the sale, lease, or exchange of communication sites, communication facilities, or communication frequencies for information technology purposes; or
(ii)
an information technology agreement involving resource sharing;
(3)
that portion of money earned from pay phone commissions to the extent that the commission rates exceed those in effect in December 1993;
(4)
money received and accepted as contributions, grants, or gifts as authorized under subsection (c) of this section;
(5)
general funds appropriated for major information technology development projects of any unit of State government other than a public institution of higher education that:
(i)
are unencumbered and unexpended at the end of a fiscal year;
(ii)
have been abandoned; or
(iii)
have been withheld by the General Assembly or the Secretary;
(6)
any investment earnings; and
(7)
any other money from any source accepted for the benefit of the Fund.
(f)
The Fund does not include any money:
(1)
received by the Department of Transportation, the Maryland Transportation Authority, Baltimore City Community College, or the Maryland Public Broadcasting Commission;
(2)
received by the Judicial or Legislative branches of State government; or
(3)
generated from pay phone commissions that are credited to other accounts or funds in accordance with other provisions of law or are authorized for other purposes in the State budget or through an approved budget amendment.
(g)
The Governor shall submit with the State budget:
(1)
a summary showing the unencumbered balance in the Fund as of the close of the prior fiscal year and a listing of any encumbrances;
(2)
an estimate of projected revenue from each of the sources specified in subsection (e) of this section for the fiscal year for which the State budget is submitted;
(3)
a descriptive listing of major information technology development projects reflecting projected costs for the fiscal year for which the State budget is submitted and any estimated future year costs; and
(4)
the amount proposed to be set aside for expedited projects.
(h)
Expenditures from the Fund shall be made only:
(1)
in accordance with an appropriation approved by the General Assembly in the annual State budget;
(2)
through an approved State budget amendment under Title 7, Subtitle 2, Part II of this article, provided that a State budget amendment for any project not requested as part of the State budget submission or for any project for which the scope or cost has increased by more than 5% or $250,000 shall be submitted to the budget committees allowing a 30–day period for their review and comment; or
(3)
for expedited project contracts approved for funding by the Secretary and approved by the Board of Public Works as provided in § 12–101 of this article.
(i)
The Fund may be used:
(1)
for major information technology development projects;
(2)
as provided in subsections (j) and (l) of this section;
(3)
notwithstanding § 3.5–301(e)(2) of this subtitle, for the costs of the first 12 months of operation and maintenance of a major information technology development project;
(4)
for expedited projects; or
(5)
for major information technology development projects and expedited projects through a revolving loan process through which an agency may reimburse the Fund in future fiscal years as established by the Secretary in regulation.
(j)
Notwithstanding subsection (b) of this section and except for the cost incurred in administering the Fund, each fiscal year up to $1,000,000 of this Fund may be used for:
(1)
educationally related information technology projects;
(2)
application service provider initiatives as provided for in Title 9, Subtitle 22 of the State Government Article; or
(3)
information technology projects, including:
(i)
pilots; and
(ii)
prototypes.
(k)
A unit of State government or local government may submit a request to the Secretary to support the cost of an information technology project with money under subsection (j) of this section.
(l)
(1)
Notwithstanding subsection (b) of this section and in accordance with paragraph (2) of this subsection, money paid into the Fund under subsection (e)(2) of this section:
(i)
shall be used to support:
(1)
the State telecommunication and computer network established under § 3.5–404 of this title, including program development for these activities; and
(2)
the Statewide Public Safety Interoperability Radio System, also known as Maryland First (first responder interoperable radio system team), under Title 1, Subtitle 5 of the Public Safety Article; and
(ii)
at the Secretary’s discretion, may be used to support State–owned communication sites, communications facilities, and telecommunications equipment used in connection with information technology agreements entered into under § 3.5–307 of this subtitle, including program management for these activities.
(2)
The Secretary may determine the portion of the money paid into the Fund that shall be allocated to each program described in paragraph (1) of this subsection.
(3)
(i)
On or before January 15 each year, the Secretary shall submit a report to the General Assembly, in accordance with § 2–1257 of the State Government Article, specifying the amount of money paid into the Fund that was allocated to each program described in paragraph (1) of this subsection.
(ii)
The report required under this paragraph shall include how funds were allocated at the Secretary’s discretion under paragraph (1)(ii) of this subsection.
(m)
(1)
On or before January 15 of each year, for each major information technology development project or expedited project currently in development or for which operations and maintenance funding is being provided in accordance with subsection (i)(3) of this section, subject to § 2–1257 of the State Government Article, the Secretary shall provide a summary report to the Department of Legislative Services with the most up–to–date project information including:
(i)
project funding decisions and project status, including:
(1)
estimated project or product costs;
(2)
funding sources; and
(3)
ongoing operating costs after the project is no longer a major development project or expedited project, including:
(A)
costs associated with procuring and maintaining licenses; and
(B)
support to continuously maintain and improve the project or product;
(ii)
any schedule, cost, and scope changes since the last annual report;
(iii)
a risk assessment provided by either the Department or the designated unit of State government that details the identified project or product risk, including:
(1)
a description of the type of risk, including:
(A)
governance;
(B)
resource availability or capability;
(C)
funding;
(D)
interdependencies with other systems;
(E)
technical issues;
(F)
organizational culture; or
(G)
ability to support in the long term;
(2)
the risk likelihood;
(3)
the risk priority;
(4)
the risk owner;
(5)
planned risk mitigation strategy; and
(6)
the risk status as of the report date;
(iv)
project tracking metrics, including:
(1)
describing the functionality and features that have been delivered as of the report date; and
(2)
qualitative and quantitative data showing progress towards project goals; and
(v)
any change in the monitoring or oversight status.
(2)
The report submitted under this subsection:
(i)
is confidential and not subject to disclosure under Title 4 of the General Provisions Article;
(ii)
shall communicate the requisite information in a clear and concise manner that, to the greatest extent possible, avoids the use of technical language or reliance on existing industry knowledge; and
(iii)
shall include an executive summary of key information, including:
(1)
the total value of the portfolio, including:
(A)
annual development costs;
(B)
funding sources; and
(C)
projected ongoing operating costs over the next 5 years; and
(2)
a summary of new projects including:
(A)
the advantages of the new projects; and
(B)
any new or innovative aspects of development processes.
(n)
(1)
The Department shall publish and maintain a publicly available project and portfolio dashboard on the Department’s website.
(2)
The dashboard shall include all major information technology development projects and expedited projects, organized by the accountable unit of State government.
(3)
For each project, the dashboard shall:
(i)
specify the schedule management for the project, including:
(1)
the project start date;
(2)
estimated length of the project, by phase;
(3)
planned milestones with estimated completion dates; and
(4)
completed milestones with completion dates;
(ii)
list the estimated project cost;
(iii)
list the total amount appropriated for the current fiscal year;
(iv)
list the total amount spent during the prior fiscal year, categorized by:
(1)
vendor costs;
(2)
agency labor;
(3)
software licenses, subscriptions, and other costs;
(4)
other expenses; and
(5)
total expenditures;
(v)
for projects in development:
(1)
the prior fiscal year forecast accompanied by actual data and the resulting variance; and
(2)
the current year forecast; and
(vi)
subject to subsection (o) of this section, identify major project or product risks, including:
(1)
risk description;
(2)
risk impact;
(3)
risk likelihood;
(4)
mitigation strategy; and
(5)
risk status.
(o)
(1)
The Department may redact specific risks identified under subsection (n)(3)(vi) of this section from the public dashboard if the Department determines that public sharing of the information could pose a risk to the project.
(2)
If a risk is redacted from the dashboard, the information shall be shared with the Legislative Policy Committee.
(3)
A risk redacted from the dashboard is confidential and not subject to disclosure under Title 4 of the General Provisions Article.
(p)
(1)
The Secretary may adopt regulations necessary to carry out this section.
(2)
The Secretary shall adopt regulations necessary to establish a process for units of State government to request and receive funding for an expedited project aligned with the State Modernization Plan that shall:
(i)
allow units of State government to apply for project funding biannually;
(ii)
be consistent with the goals and preferences established under Title 14 of this article and encourage small and minority business enterprise vendors; and
(iii)
provide measures that ensure compliance with this subtitle and the Department’s regulations by both vendors and units of State government.
(q)
The Chief Information Officer for a unit of State government with a planned or ongoing major information technology development project shall meet with the Secretary on a quarterly basis to report on and discuss the ongoing information technology development projects, including:
(1)
project budget;
(2)
project vendor performance or nonperformance;
(3)
project scope;
(4)
project schedule;
(5)
the capacity of the unit to implement the project; and
(6)
any other items the Secretary deems relevant to the successful implementation of the project.
Md. Code Ann., State Fin. & Proc. § 3.5-310 (2026)
Title 3.5. Department of Information Technology
Subtitle 3. Information Processing
§ 3.5-310LinkCopy Citation
This subtitle may not be construed to give the Secretary authority over:
(1)
the content of educational applications or curriculum at the State or local level; or
(2)
the entities that may participate in such educational programs.
Md. Code Ann., State Fin. & Proc. § 3.5-311 (2026)
Title 3.5. Department of Information Technology
Subtitle 3. Information Processing
§ 3.5-311LinkCopy Citation
(a)
(1)
The Secretary or the Secretary’s designee, in consultation with other units of State government, and after public comment, shall develop a nonvisual access clause for use in the procurement of information technology and information technology services that specifies that the technology and services:
(i)
must provide equivalent access for effective use by both visual and nonvisual means;
(ii)
will present information, including prompts used for interactive communications, in formats intended for both visual and nonvisual use;
(iii)
can be integrated into networks for obtaining, retrieving, and disseminating information used by individuals who are not blind or visually impaired; and
(iv)
shall be obtained, whenever possible, without modification for compatibility with software and hardware for nonvisual access.
(2)
On or after January 1, 2020, the nonvisual access clause developed in accordance with paragraph (1) of this subsection shall include a statement that:
(i)
within 18 months after the award of the procurement, the Secretary, or the Secretary’s designee, will determine whether the information technology meets the nonvisual access standards adopted in accordance with § 3.5–303(c) of this subtitle;
(ii)
if the information technology does not meet the nonvisual access standards, the Secretary, or the Secretary’s designee, will notify the vendor in writing that the vendor, at the vendor’s own expense, has 12 months after the date of the notification to modify the information technology in order to meet the nonvisual access standards; and
(iii)
if the vendor fails to modify the information technology to meet the nonvisual access standards within 12 months after the date of the notification, the vendor:
(1)
may be subject to a civil penalty of:
(A)
for a first offense, a fine not exceeding $5,000; and
(B)
for a subsequent offense, a fine not exceeding $10,000; and
(2)
shall indemnify the State for liability resulting from the use of information technology that does not meet the nonvisual access standards.
(b)
(1)
Except as provided in paragraph (2) of this subsection, the nonvisual access clause required under subsection (a) of this section shall be included in each invitation for bids or request for proposals and in each procurement contract or modification or renewal of a contract issued under Title 13 of this article, without regard to the method chosen under Title 13, Subtitle 1 of this article for the purchase of new or upgraded information technology and information technology services.
(2)
Except as provided in subsection (a)(1)(iv) of this section, the nonvisual access clause required under paragraph (1) of this subsection is not required if:
(i)
the information technology is not available with nonvisual access because the essential elements of the information technology are visual and nonvisual equivalence cannot be developed; or
(ii)
the cost of modifying the information technology for compatibility with software and hardware for nonvisual access would increase the price of the procurement by more than 15%.
Md. Code Ann., State Fin. & Proc. § 3.5-312 (2026)
Title 3.5. Department of Information Technology
Subtitle 3. Information Processing
§ 3.5-312LinkCopy Citation
The Secretary may delegate the duties set forth in this subtitle to carry out its purposes.
Md. Code Ann., State Fin. & Proc. § 3.5-313 (2026)
Title 3.5. Department of Information Technology
Subtitle 3. Information Processing
§ 3.5-313LinkCopy Citation
(a)
(1)
In this section the following words have the meanings indicated.
(2)
“Agency” includes a unit of State government that receives funds that are not appropriated in the annual budget bill.
(3)
(i)
“Payee” means any party who receives from the State an aggregate payment of $25,000 in a fiscal year.
(ii)
“Payee” does not include:
(1)
a State employee with respect to the employee’s compensation; or
(2)
a State retiree with respect to the retiree’s retirement allowance.
(4)
“Searchable website” means a website created in accordance with this section that displays and searches State payment data.
(b)
(1)
The Department shall develop and operate a single searchable website, accessible to the public at no cost through the Internet.
(2)
On or before the 15th day of the month that follows the month in which an agency makes a payment to a payee, the Department shall update the payment data on the searchable website.
(c)
The searchable website shall contain State payment data, including:
(1)
the name of a payee receiving a payment;
(2)
the location of a payee by postal zip code;
(3)
the amount of a payment; and
(4)
the name of an agency making a payment.
(d)
The searchable website shall allow the user to:
(1)
search data for fiscal year 2008 and each year thereafter; and
(2)
search by the following data fields:
(i)
a payee receiving a payment;
(ii)
an agency making a payment; and
(iii)
the zip code of a payee receiving a payment.
(e)
State agencies shall provide appropriate assistance to the Secretary to ensure the existence and ongoing operation of the single website.
(f)
This section may not be construed to require the disclosure of information that is confidential under State or federal law.
(g)
This section shall be known and may be cited as the “Maryland Funding Accountability and Transparency Act”.
Md. Code Ann., State Fin. & Proc. § 3.5-314 (2026)
Title 3.5. Department of Information Technology
Subtitle 3. Information Processing
§ 3.5-314LinkCopy Citation
(a)
In this section, “security–sensitive data” means information that is protected against unwarranted disclosure.
(b)
In accordance with guidelines established by the Secretary, each unit of State government shall develop a plan to:
(1)
identify unit personnel who handle security–sensitive data; and
(2)
establish annual security overview training or refresher security training for each employee who handles security–sensitive data as part of the employee’s duties.
Md. Code Ann., State Fin. & Proc. § 3.5-315 (2026)
Title 3.5. Department of Information Technology
Subtitle 3. Information Processing
§ 3.5-315LinkCopy Citation
(a)
There is an Information Sharing and Analysis Center in the Department.
(b)
The Information Sharing and Analysis Center shall:
(1)
coordinate information on cybersecurity by serving as a central location for information sharing across State and local government, federal government partners, and private entities;
(2)
with the Office of Security Management, support cybersecurity coordination between local units of government through existing local government stakeholder organizations;
(3)
provide support to the State Chief Information Security Officer and the Cyber Preparedness Unit, in the Maryland Department of Emergency Management, during cybersecurity incidents that affect State and local governments;
(4)
support risk–based planning for the use of federal resources; and
(5)
conduct analyses of cybersecurity incidents.
Md. Code Ann., State Fin. & Proc. § 3.5-317 (2026)
Title 3.5. Department of Information Technology
Subtitle 3. Information Processing
§ 3.5-317LinkCopy Citation
(a)
This section does not apply to:
(1)
the Maryland Port Administration;
(2)
the University System of Maryland;
(3)
St. Mary’s College of Maryland;
(4)
Morgan State University;
(5)
the Maryland Stadium Authority;
(6)
Baltimore City Community College;
(7)
the State Board of Elections;
(8)
the Office of the Attorney General;
(9)
the Comptroller; or
(10)
the State Treasurer.
(b)
(1)
The Department shall hire independent contractors to:
(i)
develop a framework for investments in technology; and
(ii)
at least once every 2 years, in accordance with the framework, assess the cybersecurity and information technology systems in each unit of State government.
(2)
The framework shall include the following criteria:
(i)
security risks to the system;
(ii)
system performance;
(iii)
the system’s dependence on other information technology or cybersecurity systems and data;
(iv)
the system’s ability to create an efficient and seamless experience for users;
(v)
the system’s effectiveness in achieving unit objectives;
(vi)
the system’s effectiveness in meeting the needs of citizens and customers;
(vii)
the costs to maintain and operate the system;
(viii)
the speed of government response time;
(ix)
the effectiveness of the system in regard to the unit’s objectives;
(x)
improvements to the unit’s relative audit findings attributable to the system; and
(xi)
an assessment of the system using the National Institute of Standards and Technology Cybersecurity Framework.
(c)
Each unit shall promptly provide a contractor employed under subsection (b) of this section with the information necessary to perform the assessments.
(d)
(1)
Every 2 years, a contractor shall provide the results of the assessments to:
(i)
the Modernize Maryland Commission established under § 3.5–316 of this subtitle; and
(ii)
in accordance with § 2–1257 of the State Government Article, the Senate Budget and Taxation Committee, the Senate Committee on Education, Energy, and the Environment, and the House Health and Government Operations Committee.
(2)
The report submitted under paragraph (1)(ii) of this subsection may not contain information about the security of an information system.
(e)
The Department may use multiple contractors at a time to meet the requirements of this section.
Md. Code Ann., State Fin. & Proc. § 3.5-318 (2026)
Title 3.5. Department of Information Technology
Subtitle 3. Information Processing
§ 3.5-318LinkCopy Citation
(a)
On or before December 1, 2024, and annually thereafter, each unit of State government shall conduct a data inventory that identifies data that meets the criteria established by the Chief Data Officer and that is:
(1)
(i)
necessary for the operation of the unit; or
(ii)
otherwise required to be collected:
(1)
as a condition to receive federal funds; or
(2)
by federal or State law; and
(2)
in a form prescribed by the Chief Data Officer, including when the data is used in artificial intelligence.
(b)
The Department shall develop and publish guidance on the policies and procedures for the inventory.
Md. Code Ann., State Fin. & Proc. § 3.5-319 (2026)
Title 3.5. Department of Information Technology
Subtitle 3. Information Processing
§ 3.5-319LinkCopy Citation
(a)
Each unit of State government shall designate a Privacy Officer to oversee compliance with this subtitle and coordinate with the Department and the Office of the Attorney General.
(b)
The Department shall adopt regulations, guidance, and model templates to support compliance with this subtitle, including standard Public Information Act formats and data protection protocols.
Subtitle 4
Md. Code Ann., State Fin. & Proc. § 3.5-401 (2026)
Title 3.5. Department of Information Technology
Subtitle 4
§ 3.5-401LinkCopy Citation
(a)
The Department shall:
(1)
coordinate the development, management, and operation of telecommunication equipment, systems, and services by State government;
(2)
acquire and manage common user telecommunication equipment, systems, or services and charge units of State government for their proportionate share of the costs of installation, maintenance, and operation of the common user telecommunication equipment, systems, or services;
(3)
promote compatibility of telecommunication systems by developing policies, procedures, and standards for the acquisition and use of telecommunication equipment, systems, and services by units of State government;
(4)
coordinate State government telecommunication systems and services by reviewing requests by units of State government for telecommunication equipment, systems, or services;
(5)
advise units of State government about planning, acquisition, and operation of telecommunication equipment, systems, or services; and
(6)
provide radio frequency coordination for State and local governments in accordance with regulations of the Federal Communications Commission.
(b)
The Department may make arrangement for a user other than a unit of State government to have access to and use of State telecommunication equipment, systems, and services and shall charge the user any appropriate amount to cover the cost of installation, maintenance, and operation of the telecommunication equipment, system, or service provided.
Md. Code Ann., State Fin. & Proc. § 3.5-402 (2026)
Title 3.5. Department of Information Technology
Subtitle 4
§ 3.5-402LinkCopy Citation
(a)
The provisions of this subtitle do not apply to a telecommunication system or service that is owned or operated by the University System of Maryland, Morgan State University, Baltimore City Community College, or a unit of the Legislative or Judicial Branch.
(b)
The provisions of this subtitle do not preempt the authority of the Maryland Public Broadcasting Commission to own, operate, or manage telecommunication equipment, systems, or services.
Md. Code Ann., State Fin. & Proc. § 3.5-403 (2026)
Title 3.5. Department of Information Technology
Subtitle 4
§ 3.5-403LinkCopy Citation
Telecommunications, including those of the Maryland Public Broadcasting System, shall be consistent with statewide information technology policies and standards and the statewide information technology master plan.
Md. Code Ann., State Fin. & Proc. § 3.5-404 (2026)
Title 3.5. Department of Information Technology
Subtitle 4
§ 3.5-404LinkCopy Citation
(a)
The General Assembly declares that:
(1)
it is the policy of the State to foster telecommunication and computer networking among State and local governments, their agencies, and educational institutions in the State;
(2)
there is a need to improve access, especially in rural areas, to efficient telecommunication and computer network connections;
(3)
improvement of telecommunication and computer networking for State and local governments and educational institutions promotes economic development, educational resource use and development, and efficiency in State and local administration;
(4)
rates for the intrastate inter–LATA telephone communications needed for effective integration of telecommunication and computer resources are prohibitive for many smaller governments, agencies, and institutions; and
(5)
the use of improved State telecommunication and computer networking under this section is intended not to compete with commercial access to advanced network technology, but rather to foster fundamental efficiencies in government and education for the public good.
(b)
(1)
The Department shall establish a telecommunication and computer network in the State.
(2)
The network shall consist of:
(i)
one or more connection facilities for telecommunication and computer connection in each local access transport area (LATA) in the State; and
(ii)
facilities, auxiliary equipment, and services required to support the network in a reliable and secure manner.
(c)
The network shall be accessible through direct connection and through local intra–LATA telecommunications to State and local governments and public and private educational institutions in the State.
(d)
In a manner and frequency established in regulations adopted by the Department, each unit of local government and any local agencies that use the network established under subsection (b) of this section shall certify to the Department that the unit is in compliance with the Department’s minimum security standards.
(e)
(1)
The Office shall ensure that at least once every 2 years, or more often if required by regulations adopted by the Department, each unit of State government shall complete an external assessment.
(2)
The Office shall assist each unit to remediate any security vulnerabilities or high–risk configurations identified in the assessment required under paragraph (1) of this subsection.
(f)
(1)
In this subsection, “IT unit” means a unit of the Legislative Branch or Judicial Branch of State government, the Office of the Attorney General, the Office of the Comptroller, or the Office of the State Treasurer that provides information technology services for another unit of government.
(2)
Each IT unit shall:
(i)
be evaluated by an independent auditor with cybersecurity expertise to determine whether the IT unit, and the units it provides information technology services for, meet relevant cybersecurity standards recommended by the National Institute of Standards and Technology; and
(ii)
certify compliance with the recommended National Institutes of Standards and Technology cybersecurity standards to:
(1)
if the IT unit is part of the Legislative Branch, the President of the Senate and the Speaker of the House;
(2)
if the IT unit is part of the Office of the Attorney General, to the Attorney General;
(3)
if the IT unit is part of the Comptroller’s Office, to the Comptroller;
(4)
if the IT unit is part of the State Treasurer’s Office, to the State Treasurer; and
(5)
if the IT unit is part of the Judicial Branch of State government, the Chief Judge.
Md. Code Ann., State Fin. & Proc. § 3.5-405 (2026)
Title 3.5. Department of Information Technology
Subtitle 4
§ 3.5-405LinkCopy Citation
(a)
On or before December 1 each year, each unit of State government shall:
(1)
report the results of any cybersecurity preparedness assessments performed in the prior year to the Office of Security Management in accordance with guidelines developed by the Office; and
(2)
submit a report to the Governor and the Office of Security Management that includes:
(i)
an inventory of all information systems and applications used or maintained by the unit;
(ii)
a full data inventory of the unit;
(iii)
a list of all cloud or statistical analysis system solutions used by the unit;
(iv)
a list of all permanent and transient vendor interconnections that are in place;
(v)
the number of unit employees who have received cybersecurity training;
(vi)
the total number of unit employees who use the network;
(vii)
the number of information technology staff positions, including vacancies;
(viii)
the number of noninformation technology staff positions, including vacancies;
(ix)
the unit’s information technology budget, itemized to include the following categories:
(1)
services;
(2)
equipment;
(3)
applications;
(4)
personnel;
(5)
software licensing;
(6)
development;
(7)
network projects;
(8)
maintenance; and
(9)
cybersecurity;
(x)
any major information technology initiatives to modernize the unit’s information technology systems or improve customer access to State and local services;
(xi)
the unit’s plans for future fiscal years to implement the unit’s information technology goals;
(xii)
compliance with timelines and metrics provided in the Department’s master plan; and
(xiii)
any other key performance indicators required by the Office of Security Management to track compliance or consistency with the Department’s statewide information technology master plan.
(b)
(1)
Each unit of State government shall report a cybersecurity incident in accordance with paragraph (2) of this subsection to the State Chief Information Security Officer.
(2)
For the reporting of cybersecurity incidents under paragraph (1) of this subsection, the State Chief Information Security Officer shall determine:
(i)
the criteria for determining when an incident must be reported;
(ii)
the manner in which to report; and
(iii)
the time period within which a report must be made.
Md. Code Ann., State Fin. & Proc. § 3.5-406 (2026)
Title 3.5. Department of Information Technology
Subtitle 4
§ 3.5-406LinkCopy Citation
(a)
This section does not apply to municipal governments.
(b)
In a manner and frequency established in regulations adopted by the Department, each county government, local school system, and local health department shall:
(1)
in consultation with the local emergency manager, create or update a cybersecurity preparedness and response plan; and
(2)
complete a cybersecurity preparedness assessment.
(c)
The assessment required under paragraph (b)(2) of this section may, in accordance with the preference of each county government, be performed by the Department or by a vendor authorized by the Department.
(d)
(1)
On request, the Department shall advise local school systems on:
(i)
compliance with the State minimum cybersecurity standards;
(ii)
conducting cybersecurity maturity assessments every 2 years; and
(iii)
remediation efforts.
(2)
The Department is not responsible for the successful performance of or day–to–day management of the duties of a local school system described in paragraph (1) of this subsection.
(e)
(1)
Each local government shall report a cybersecurity incident, including an attack on a State system being used by the local government, to the appropriate local emergency manager and the State Security Operations Center in the Department in accordance with paragraph (2) of this subsection.
(2)
For the reporting of cybersecurity incidents to local emergency managers under paragraph (1) of this subsection, the State Chief Information Security Officer shall determine:
(i)
the criteria for determining when an incident must be reported;
(ii)
the manner in which to report; and
(iii)
the time period within which a report must be made.
(3)
The State Security Operations Center shall immediately notify the appropriate agencies of a cybersecurity incident reported under this subsection through the State Security Operations Center.
Subtitle 7. Senior Call–check and Social Connections Program
Md. Code Ann., State Fin. & Proc. § 3.5-701 (2026)
Title 3.5. Department of Information Technology
Subtitle 7. Senior Call–check and Social Connections Program
§ 3.5-701LinkCopy Citation
(a)
In this subtitle the following words have the meanings indicated.
(b)
“Eligible participant” means a resident of the State who is at least 60 years old.
(c)
“Person of record” includes a local law enforcement unit or other local government agency or a designee of the participant that chooses to participate in the Program.
(d)
“Program” means the Senior Call–Check and Social Connections Program.
(e)
(1)
“Senior call–check and social connections” means regular, direct communication from the Department of Aging or the Department of Aging’s designee to an eligible participant.
(2)
“Senior call–check and social connections” includes:
(i)
an automated or live telephone call or other direct communication initiated by an eligible participant or received by an eligible participant at a regularly scheduled time each day;
(ii)
if the eligible participant does not answer or initiate the regularly scheduled call or other direct communication and the Secretary of Aging designs the Program to require this action, one or more automated or live telephone calls or other direct communications to the eligible participant;
(iii)
if the eligible participant does not answer a telephone call or other direct communication made under item (ii) of this paragraph, an additional automated or live telephone call or other direct communication to notify a person of record whose name has been provided to the Department of Aging; and
(iv)
a notification to the eligible participant regarding information that the Secretary of Aging has determined to be relevant.
(f)
“Regular, direct communication” means regular interactions initiated or received by the Department of Aging or the Department’s designee that:
(1)
may include telephone calls, text messages, web–based, virtual, video, or in–person communications, and other forms of communication approved by the Department; and
(2)
are accessible to eligible participants with disabilities.
(g)
“Village” means local, volunteer–led organizations that aim to support community members who choose to age in place, including by:
(1)
organizing events; and
(2)
fostering social connections through activities and coordinating volunteer help at home using the neighbor–helping–neighbor model.
Md. Code Ann., State Fin. & Proc. § 3.5-702 (2026)
Title 3.5. Department of Information Technology
Subtitle 7. Senior Call–check and Social Connections Program
§ 3.5-702LinkCopy Citation
(a)
The Department of Aging shall:
(1)
establish and administer the Program to provide senior call–check and social connections to eligible participants; and
(2)
adopt regulations necessary to implement the Program.
(b)
The purpose of the Program is to provide regular, direct communication from the Department of Aging or the Department’s designee to an eligible participant to promote wellness and purposeful social engagement.
(c)
The Department of Aging shall integrate services with the Telecommunications Access of Maryland Program established under § 7–902 of the Human Services Article by promoting awareness of the availability of accessible telecommunications equipment and using educational outreach materials produced by the Telecommunications Access of Maryland Program.
(d)
(1)
The Department of Aging may enter into agreements or contracts as appropriate with a private vendor, a nonprofit organization, a village incorporated in and serving older adults in the State, an area agency on aging, or any other person to provide Program services.
(2)
The Department of Aging may enter into interagency agreements with other State or local governmental entities to provide Program services.
(3)
The Department of Aging may accept funds provided by other public and private sources, including gifts and grants to be used to provide Program services.
(e)
(1)
The State Tort Claims Act and the Local Government Tort Claims Act, as appropriate, apply to a State or local unit and to an employee or agent of a State or local unit that participates in the Program for services the unit or person provides under the Program in accordance with regulations of the Department of Aging.
(2)
A person of record, a private vendor, a nonprofit organization, a village incorporated in and serving older adults in the State, an area agency on aging, any other entity under an agreement or contract with the Department, or a volunteer may not be liable for reasonable acts or omissions directly arising from services provided under the Program in accordance with regulations of the Department of Aging.
Subtitle 8. Internship and Registered Apprenticeship Program
Md. Code Ann., State Fin. & Proc. § 3.5-801 (2026)
Title 3.5. Department of Information Technology
Subtitle 8. Internship and Registered Apprenticeship Program
§ 3.5-801LinkCopy Citation
(a)
In this subtitle the following words have the meanings indicated.
(b)
(1)
“Algorithmic decision system” means a computational process that facilitates decision making.
(2)
“Algorithmic decision system” includes decisions derived from machines, statistics, facial recognition, and decisions on paper.
(c)
“Artificial intelligence” means a machine–based system that:
(1)
can, for a given set of human–defined objectives, make predictions, recommendations, or decisions influencing real or virtual environments;
(2)
uses machine and human–based inputs to perceive real and virtual environments and abstracts those perceptions into models through analysis in an automated manner; and
(3)
uses model inference to formulate options for information or action.
(d)
(1)
“High–risk artificial intelligence” means artificial intelligence that is a risk to individuals or communities, as defined under regulations adopted by the Department in consultation with the Governor’s Artificial Intelligence Subcabinet.
(2)
“High–risk artificial intelligence” includes rights–impacting artificial intelligence and safety–impacting artificial intelligence.
(e)
“Impact assessment” means an assessment of artificial intelligence systems made under regulations adopted by the Department in consultation with the Governor’s Artificial Intelligence Subcabinet and required under § 3.5–803 of this subtitle.
(f)
“Public senior higher education institution” means:
(1)
the constituent institutions of the University System of Maryland and the University of Maryland Center for Environmental Science;
(2)
Morgan State University; or
(3)
St. Mary’s College of Maryland.
(g)
“Rights–impacting artificial intelligence” means artificial intelligence whose output serves as a basis for decision or action that is significantly likely to affect civil rights, civil liberties, equal opportunities, access to critical resources, or privacy.
(h)
“Safety–impacting artificial intelligence” means artificial intelligence that has the potential to significantly impact the safety of human life, well–being, or critical infrastructure.
Md. Code Ann., State Fin. & Proc. § 3.5-802 (2026)
Title 3.5. Department of Information Technology
Subtitle 8. Internship and Registered Apprenticeship Program
§ 3.5-802LinkCopy Citation
(a)
(1)
Except as provided in paragraph (2) of this subsection, this subtitle does not apply to:
(i)
the Office of the Attorney General;
(ii)
the Comptroller; or
(iii)
the State Treasurer.
(2)
On or before June 1, 2025, each entity listed under paragraph (1) of this subsection shall establish policies and procedures that are functionally compatible with the policies and procedures adopted under § 3.5–804(a) of this subtitle for the development, procurement, deployment, use, and ongoing assessment of systems that employ high–risk artificial intelligence.
(b)
(1)
Except as provided in paragraph (2) of this subsection, this subtitle applies to each public senior higher education institution and Baltimore City Community College.
(2)
This subtitle does not apply to artificial intelligence deployed by a public senior higher education institution or Baltimore City Community College that is used solely for a research or academic purpose, including in partnership with a unit of State government for the development, procurement, deployment, or use of artificial intelligence.
(3)
On or before June 1, 2025, each public senior higher education institution and Baltimore City Community College shall establish policies and procedures that are functionally compatible with the policies and procedures adopted under § 3.5–804(a) of this subtitle for the development, procurement, deployment, use, and ongoing assessment of systems that employ high–risk artificial intelligence used solely for a research or academic purpose.
(4)
On or before September 1, 2025, and each year thereafter, each public senior higher education institution and Baltimore City Community College shall submit to the Department a report on all high–risk artificial intelligence procured and deployed for a research or academic purpose.
Md. Code Ann., State Fin. & Proc. § 3.5-803 (2026)
Title 3.5. Department of Information Technology
Subtitle 8. Internship and Registered Apprenticeship Program
§ 3.5-803LinkCopy Citation
(a)
On or before December 1, 2025, and regularly thereafter, each unit of State government shall:
(1)
conduct an inventory of systems that employ high–risk artificial intelligence; and
(2)
provide the inventory to the Department in a format required by the Department.
(b)
For each system, the inventory required by this section shall include:
(1)
the name of the system;
(2)
the vendor that provided the system, if applicable;
(3)
a description of the capabilities of the system;
(4)
a statement of the purpose and the intended uses of the system;
(5)
whether the system underwent an impact assessment prior to being deployed;
(6)
whether the system is used to independently make a decision or judgment or to inform or support a decision or judgment determined by the Department to involve high–risk artificial intelligence; and
(7)
a summary of the results of the most recent impact assessment.
(c)
The Department shall make an aggregated statewide inventory publicly available on its website.
(d)
(1)
The Department may not make publicly available on the Department’s website information from the inventories required by this section that relate to the safety and security of State systems if the publication of the information is likely to compromise the security or integrity of the system.
(2)
On request, the Department shall provide to the Governor, members of the General Assembly, and law enforcement the information described in paragraph (1) of this subsection.
(e)
(1)
On or before December 31, 2026, each unit of State government shall conduct an impact assessment of a system procured on or after February 1, 2026, that involves high–risk artificial intelligence.
(2)
On or before July 1, 2027, each unit of State government shall conduct an impact assessment of a system procured before February 1, 2026, that involves high–risk artificial intelligence.
Md. Code Ann., State Fin. & Proc. § 3.5-804 (2026)
Title 3.5. Department of Information Technology
Subtitle 8. Internship and Registered Apprenticeship Program
§ 3.5-804LinkCopy Citation
(a)
On or before December 1, 2024, the Department, in consultation with the Governor’s Artificial Intelligence Subcabinet, shall adopt policies and procedures concerning the development, procurement, deployment, use, and ongoing assessment of systems that employ high–risk artificial intelligence by a unit of State government.
(b)
The policies and procedures required by subsection (a) of this section shall:
(1)
subject to any other applicable law, govern the procurement, deployment, and ongoing assessment of systems that employ high–risk artificial intelligence by a unit of State government;
(2)
define the criteria for an inventory of systems that employ high–risk artificial intelligence;
(3)
be sufficient to ensure that the use of any system that employs artificial intelligence by a unit of State government is governed by adequate guardrails to protect individuals and communities;
(4)
if the Department is notified that an individual or group of individuals may have been negatively impacted by a system that employs high–risk artificial intelligence, require the Department to:
(i)
notify an individual or a group of individuals determined to have been negatively impacted; and
(ii)
provide guidance to an individual or a group of individuals determined to have been negatively impacted on available options to opt out of the system; and
(5)
provide guidance to units of State government on procurement of a system that employs high–risk artificial intelligence that ensures data privacy and compliance with applicable statutes and regulations.
(c)
The Department shall make the policies and procedures required by subsection (a) of this section publicly available on its website within 45 days after the policies and procedures are adopted.
Md. Code Ann., State Fin. & Proc. § 3.5-805 (2026)
Title 3.5. Department of Information Technology
Subtitle 8. Internship and Registered Apprenticeship Program
§ 3.5-805LinkCopy Citation
(a)
Beginning July 1, 2025, a unit of State government may not procure or deploy a new system that employs artificial intelligence unless the system complies with the policies and procedures adopted under § 3.5–804 of this subtitle.
(b)
A unit of State government that employs high–risk artificial intelligence shall conduct regular impact assessments, as determined by the Governor’s Artificial Intelligence Subcabinet of the Governor’s Executive Council.
Md. Code Ann., State Fin. & Proc. § 3.5-806 (2026)
Title 3.5. Department of Information Technology
Subtitle 8. Internship and Registered Apprenticeship Program
§ 3.5-806LinkCopy Citation
(a)
There is a Governor’s Artificial Intelligence Subcabinet of the Governor’s Executive Council.
(b)
The purpose of the Subcabinet is to facilitate and enhance cooperation among units of State government, in consultation with academic institutions and industries utilizing artificial intelligence.
(c)
The Subcabinet consists of the following members:
(1)
the Secretary, or the Secretary’s designee;
(2)
the Secretary of Budget and Management, or the Secretary’s designee;
(3)
the Secretary of General Services, or the Secretary’s designee;
(4)
the Secretary of Labor, or the Secretary’s designee;
(5)
the Secretary of Commerce, or the Secretary’s designee;
(6)
the Director of the Governor’s Office of Homeland Security, or the Director’s designee;
(7)
the Chief Privacy Officer, or the Chief Privacy Officer’s designee;
(8)
the Chief Data Officer, or the Chief Data Officer’s designee;
(9)
the Chief Information Security Officer, or the Chief Information Security Officer’s designee;
(10)
the Governor’s Senior Advisor for Responsible Artificial Intelligence, or the Senior Advisor’s designee; and
(11)
any other member of the Governor’s Executive Council, appointed by the Governor.
(d)
The Secretary shall chair the Subcabinet.
(e)
The Subcabinet shall:
(1)
develop strategy, policy, and monitoring processes for responsible and productive use of artificial intelligence and associated data by units of State government;
(2)
oversee the State’s implementation of:
(i)
artificial intelligence inventory;
(ii)
artificial intelligence impact assessments;
(iii)
monitoring of high–risk artificial intelligence; and
(iv)
compliance with State policies and procedures;
(3)
support artificial intelligence and data innovation across units of State government;
(4)
develop and implement a comprehensive action plan for responsible and productive use of artificial intelligence and associated data by units of State government;
(5)
establish partnerships, memoranda of understanding, and contracts to support the aims of this section;
(6)
promote artificial intelligence knowledge, skills, and talent in State government; and
(7)
identify artificial intelligence use cases and build foundational infrastructure by requiring:
(i)
the Department to evaluate relevant infrastructure to safely, securely, and efficiently test artificial intelligence proofs of concept and pilots;
(ii)
the Department of General Services, in consultation with the Department, to create a model for running and procuring artificial intelligence proofs of concept and pilots, in accordance with State laws, regulations, and policies; and
(iii)
the Department, in consultation with the Subcabinet, to coordinate with agencies to provide support in identifying and prioritizing use cases and executing proofs of concept and pilots aligned with the Governor’s priorities.
(f)
The Subcabinet may request research to be completed under § 14–111 of the Education Article.
(g)
The Governor shall provide the Subcabinet with sufficient resources to perform the functions of this section.
Md. Code Ann., State Fin. & Proc. § 3.5-807 (2026)
Title 3.5. Department of Information Technology
Subtitle 8. Internship and Registered Apprenticeship Program
§ 3.5-807LinkCopy Citation
(a)
There is a Workgroup on Artificial Intelligence Implementation.
(b)
The Workgroup consists of the following members:
(1)
two members of the Senate of Maryland, appointed by the President of the Senate;
(2)
two members of the House of Delegates, appointed by the Speaker of the House;
(3)
the Attorney General, or the Attorney General’s designee;
(4)
the Chief Executive Officer of the Maryland Technology Development Corporation, or the Chief Executive Officer’s designee; and
(5)
(i)
the following members, appointed by the Governor:
(1)
three representatives from the Maryland Technology Council;
(2)
two representatives from the e–commerce industry;
(3)
two representatives from the biotechnology industry;
(4)
two representatives from the real estate community;
(5)
two representatives from the health care sector, including at least one representative with clinical experience;
(6)
two representatives from the education sector;
(7)
three representatives from academia with expertise in the development, operation, or social implications of data science, artificial intelligence, or machine learning;
(8)
two representatives from nonprofit organizations that focus on civil rights and liberties; and
(9)
one representative from the Maryland Veterans Chamber of Commerce with artificial intelligence expertise;
(ii)
the following members, appointed by the President of the Senate:
(1)
two representatives from nonprofit organizations with artificial intelligence expertise that focus on consumer protections; and
(2)
two representatives from the cybersecurity sector with expertise in artificial intelligence; and
(iii)
the following members, appointed by the Speaker of the House:
(1)
two representatives from nonprofit organizations that focus on establishing data privacy protections; and
(2)
two representatives that work with the AFL–CIO Tech Institute.
(c)
The President of the Senate and the Speaker of the House jointly shall designate the chair of the Workgroup.
(d)
It is the intent of the General Assembly that the Workgroup shall coordinate with the Maryland Cybersecurity Council in a manner agreed on by the chairs of the Workgroup and the Council.
(e)
The University of Maryland Center for Health and Homeland Security shall provide staff for the Workgroup.
(f)
A member of the Workgroup:
(1)
may not receive compensation as a member of the Workgroup; but
(2)
is entitled to reimbursement for expenses under the Standard State Travel Regulations, as provided in the State budget.
(g)
The Workgroup shall monitor issues and make recommendations related to artificial intelligence including:
(1)
the regulation of artificial intelligence used in decisions that significantly impact the livelihood and life opportunities of individuals in the State;
(2)
deployer and developer obligations related to labor and employment and protection of individual privacy rights;
(3)
protection of consumer rights;
(4)
current private sector use of artificial intelligence;
(5)
general artificial intelligence disclosures for all consumers;
(6)
enforcement authority for the Office of the Attorney General’s Consumer Protection Division; and
(7)
the impact of the use of artificial intelligence in the determination of government benefits.
(h)
On or before July 1, 2026, and each year thereafter, the Workgroup shall report its findings and recommendations, in accordance with § 2–1257 of the State Government Article, to the Senate Finance Committee and the House Economic Matters Committee.
(i)
For fiscal year 2027 and each fiscal year thereafter, the Governor may include in the annual budget bill an appropriation of $100,000 to support the Workgroup.
Subtitle 9. Maryland Office of Digital Experience
Md. Code Ann., State Fin. & Proc. § 3.5-901 (2026)
Title 3.5. Department of Information Technology
Subtitle 9. Maryland Office of Digital Experience
§ 3.5-901LinkCopy Citation
(a)
In this subtitle the following words have the meanings indicated.
(b)
“Division” means the Major Information Technology Development Project Oversight Division.
(c)
“Office” means the Maryland Office of Digital Experience.
(d)
“Service” means the Maryland Digital Service Unit.
Md. Code Ann., State Fin. & Proc. § 3.5-902 (2026)
Title 3.5. Department of Information Technology
Subtitle 9. Maryland Office of Digital Experience
§ 3.5-902LinkCopy Citation
(a)
There is a Maryland Office of Digital Experience.
(b)
The purpose of the Office is to:
(1)
provide oversight, leadership, intervention, and strategic modernization for major information technology development projects, including large–scale, high impact, multi–agency projects, in a transparent manner that ensures a positive return on investment; and
(2)
direct the development of modernized systems in a manner that:
(i)
when appropriate, prioritizes a product–based approach to the development of modernized systems over a project–based approach;
(ii)
is cost–effective;
(iii)
lowers risks;
(iv)
delivers value faster; and
(v)
otherwise improves the delivery of services for residents of the State.
Md. Code Ann., State Fin. & Proc. § 3.5-903 (2026)
Title 3.5. Department of Information Technology
Subtitle 9. Maryland Office of Digital Experience
§ 3.5-903LinkCopy Citation
The Secretary shall appoint a Chief Digital Experience Officer to serve as the head of the Office.
Md. Code Ann., State Fin. & Proc. § 3.5-904 (2026)
Title 3.5. Department of Information Technology
Subtitle 9. Maryland Office of Digital Experience
§ 3.5-904LinkCopy Citation
(a)
(1)
The Office may employ or retain regular or contractual employees at the discretion of the Chief Digital Services Officer and Chief of the Division as necessary to meet the requirements of the Office.
(2)
(i)
Subject to subparagraph (ii) of this paragraph, the Chief Digital Services Officer and Chief of the Division may set the compensation for Office employees.
(ii)
The Secretary of Budget and Management shall approve any compensation proposed under this subsection.
(b)
The Office may use a short–term contract or contractual hiring to support human resource needs to support the rapid hiring of Office employees and contractors.
(c)
To meet the requirements of this subtitle, the Office may require a unit to provide reimbursement for services provided by the Office from funds provided to the unit from the Information Technology Investment Fund or other funds allocated to the unit for an information technology project or product.
Md. Code Ann., State Fin. & Proc. § 3.5-905 (2026)
Title 3.5. Department of Information Technology
Subtitle 9. Maryland Office of Digital Experience
§ 3.5-905LinkCopy Citation
(a)
There is a Maryland Digital Service Unit in the Office.
(b)
The Service shall collaborate with units of State government to support improved service delivery to State residents and agency staff to implement:
(1)
user–centered design;
(2)
software development; and
(3)
project management best practices.
(c)
The Service is responsible for:
(1)
assisting units of State government to prioritize the development and procurement of user–friendly, accessible, and multilingual digital platforms to ensure that all State residents, including those with disabilities, can easily access and use government services and information;
(2)
working collaboratively with units of State government to:
(i)
consolidate and streamline State websites and digital applications to reduce redundancy, complexity, and maintenance costs; and
(ii)
prioritize projects that are financially efficient and drive positive outcomes for State residents; and
(3)
overseeing the implementation of user–centered design principles, accessibility standards, and best practices across units of State government.
(d)
Units of State government shall collaborate with the Service to ensure that the alignment and funding of a digital initiative is consistent with:
(1)
the overall goals and priorities of the State; and
(2)
the Statewide Information Technology Master Plan.
Md. Code Ann., State Fin. & Proc. § 3.5-906 (2026)
Title 3.5. Department of Information Technology
Subtitle 9. Maryland Office of Digital Experience
§ 3.5-906LinkCopy Citation
(a)
There is a Major Information Technology Development Project Oversight Division in the Office.
(b)
The Division, in consultation with the Department, shall:
(1)
adopt new standards by which major information technology development projects and expedited projects are required to comply, in alignment with the State System Development Life Cycle;
(2)
monitor the performance of project management teams for major information technology development projects and expedited projects and ensure the teams have the appropriate talent and expertise necessary to deliver the intended project value; and
(3)
provide expertise, support, and intervention as necessary for the project management team to successfully implement a project in a manner consistent with standards adopted under item (1) of this subsection.
(c)
The Division shall establish and staff a Discovery Team to deploy team members to help units of State government assist the unit in identifying:
(1)
what problem the use of an information technology project or product is solving;
(2)
who the users of the project or product will be;
(3)
what a successful solution would look like; and
(4)
other issues to ensure successful implementation of the project or product.
(d)
Notwithstanding any other provision of law, the Secretary may delegate any major information technology development project to the Division that the Secretary determines is appropriate to serve as a pilot project for the Division to provide the services described in this section.
Md. Code Ann., State Fin. & Proc. § 3.5-907 (2026)
Title 3.5. Department of Information Technology
Subtitle 9. Maryland Office of Digital Experience
§ 3.5-907LinkCopy Citation
Beginning December 31, 2025, and each July 1 and December 31 thereafter, the Department of General Services, in consultation with the Department, shall report to the Senate Budget and Taxation Committee and the House Health and Government Operations Committee, in accordance with § 2–1257 of the State Government Article, on any projects over $1,000,000 undertaken by a unit of State government under a master contract for Statewide Agile Resources and Teams contract or work order approved by the Board of Public Works in fiscal year 2025, including:
(1)
the contract or work order amount and total estimated project cost;
(2)
whether the Secretary of General Services and the Secretary have determined that the unit has the internal capacity to adequately support the project and program management responsibilities, including adequate:
(i)
human capital;
(ii)
subject matter expertise; and
(iii)
technical infrastructure;
(3)
whether the head of the unit accepted accountability for the oversight and implementation of the project;
(4)
the members of the project management team; and
(5)
affirmative agreements that, as part of the contract or work order approval, the unit of State government submits a report regarding project status to the Department every 3 months.