<section article="gsf" article_name="State Finance and Procurement" number="3.5-101" title_number="3.5" title_name="Department of Information Technology" subtitle_number="1"> <level label="a"> <text>In this title the following words have the meanings indicated.</text> </level> <level label="b"> <text>“Cloud computing” means a service that enables on–demand self–service network access to a shared pool of configurable computer resources, including data storage, analytics, commerce, streaming, e–mail, document sharing, and document editing.</text> </level> <level label="c"> <text>“Department” means the Department of Information Technology.</text> </level> <level label="d"> <level label="1"> <text>“Oversight of implementation” means management of the process to implement a new technology, system, or product into practice and use by a unit.</text> </level> <level label="2"> <text>“Oversight of implementation” includes:</text> <level label="i"> <text>planning and preparation to implement the product or practice; and</text> </level> <level label="ii"> <text>ongoing monitoring and support of the implementation team to ensure successful execution and that the project goals are met.</text> </level> </level> <level label="3"> <text>“Oversight of implementation” does not include:</text> <level label="i"> <text>responsibility for day–to–day management of any individual projects or products; or</text> </level> <level label="ii"> <text>responsibility for implementing individual–level process requirements for a project or product.</text> </level> </level> </level> <level label="e"> <text>“Secretary” means the Secretary of Information Technology.</text> </level> <level label="f"> <text>“State minimum cybersecurity standards” means the State minimum cybersecurity standards established by the Department of Information Technology.</text> </level> <level label="g"> <text>“Telecommunication” means the transmission of information, images, pictures, voice, or data by radio, video, or other electronic or impulse means.</text> </level> <level label="h"> <text>“Unit of State government” means an agency or unit of the Executive Branch of State government.</text> </level> </section> <section article="gsf" article_name="State Finance and Procurement" number="3.5-201" title_number="3.5" title_name="Department of Information Technology" subtitle_number="2"> <level label="a"> <text>There is a Department of Information Technology established as a principal department of State government.</text> </level> <level label="b"> <text>Subject to the provisions of § 3.5–302 of this title, it is the intent of the General Assembly that responsibility and oversight of the information technology projects for units of State government be centralized at the Department and that priority be given to funding information technology projects that address the needs for the public health, education, safety, or financial well–being of the residents of Maryland.</text> </level> </section> <section article="gsf" article_name="State Finance and Procurement" number="3.5-202" title_number="3.5" title_name="Department of Information Technology" subtitle_number="2"> <level label="a"> <text>The head of the Department is the Secretary of Information Technology, who shall be appointed by the Governor with the advice and consent of the Senate.</text> </level> <level label="b"> <text>The Secretary shall have experience in information technology, data processing, telecommunications, and systems procurement, planning, and management.</text> </level> <level label="c"> <text>Before taking office, the appointee shall take the oath required by Article I, § 9 of the Maryland Constitution.</text> </level> <level label="d"> <text>The Secretary shall advise the Governor on all matters assigned to the Department and is responsible for carrying out the Governor’s policies on those matters.</text> </level> <level label="e"> <text>The Secretary is responsible for the operation of the Department and may establish guidelines and procedures to promote the orderly and efficient administration of the Department.</text> </level> <level label="f"> <text>The Secretary may establish, reorganize, or abolish areas of responsibility in the Department necessary to fulfill the duties assigned to the Secretary.</text> </level> </section> <section article="gsf" article_name="State Finance and Procurement" number="3.5-203" title_number="3.5" title_name="Department of Information Technology" subtitle_number="2"> <level label="a"> <level label="1"> <text>With the approval of the Governor, the Secretary shall appoint a Deputy Secretary.</text> </level> <level label="2"> <text>The Deputy Secretary:</text> <level label="i"> <text>serves at the pleasure of the Secretary;</text> </level> <level label="ii"> <text>is entitled to the salary provided in the State budget; and</text> </level> <level label="iii"> <text>has the duties provided by law or delegated by the Secretary.</text> </level> </level> </level> <level label="b"> <text>Each assistant secretary and professional consultant is in the executive service, management service, or is a special appointment in the State personnel management system and is appointed by and serves at the pleasure of the Secretary.</text> </level> <level label="c"> <text>Except as provided in this section or otherwise by law, the Secretary shall appoint and remove all other staff in accordance with the provisions of the State Personnel and Pensions Article.</text> </level> <level label="d"> <text>The appointment of or removal of staff of any unit in the Department is subject to the approval of the Secretary.</text> </level> </section> <section article="gsf" article_name="State Finance and Procurement" number="3.5-204" title_number="3.5" title_name="Department of Information Technology" subtitle_number="2"> <level label="a"> <text>The Attorney General is legal adviser to the Department.</text> </level> <level label="b"> <text>At the request of the Governor, the Attorney General shall assign to the Department the number of assistant Attorneys General authorized by law to be assigned to the Department.</text> </level> <level label="c"> <level label="1"> <text>The Attorney General shall designate one of the assistant Attorneys General assigned to the Department as counsel to the Department.</text> </level> <level label="2"> <text>After the Attorney General designates the counsel to the Department, the Attorney General may not reassign the counsel without consulting the Secretary.</text> </level> <level label="3"> <level label="i"> <text>The counsel may have no other duty other than to:</text> <level label="1"> <text>give the legal aid, advice, and counsel required by the Secretary or any other official of the Department;</text> </level> <level label="2"> <text>supervise the other assistant Attorneys General assigned to the Department; and</text> </level> <level label="3"> <text>perform for the Department the duties that the Attorney General assigns.</text> </level> </level> <level label="ii"> <text>The counsel shall perform these duties subject to the control and supervision of the Attorney General.</text> </level> </level> </level> </section> <section article="gsf" article_name="State Finance and Procurement" number="3.5-205" title_number="3.5" title_name="Department of Information Technology" subtitle_number="2"> <level label="a"> <text>The Department shall establish a technical procurement team that includes individuals with expertise in technology procurement and agile procurement.</text> </level> <level label="b"> <text>The technical procurement team:</text> <level label="1"> <text>in collaboration with the Department of General Services, shall develop materials that encourage cost–effective and cost–efficient information technology services spending, including procurement templates, procurement contracts, and other procurement materials; and</text> </level> <level label="2"> <text>may assist a unit of State government, including the Department of General Services, to procure information technology services, including:</text> <level label="i"> <text>drafting requests for proposals;</text> </level> <level label="ii"> <text>reviewing bids and selecting vendors; and</text> </level> <level label="iii"> <text>developing information technology service contracts in a manner that encourages competition and full participation by vendors.</text> </level> </level> </level> </section> <section article="gsf" article_name="State Finance and Procurement" number="3.5-2A-01" title_number="3.5" title_name="Department of Information Technology" subtitle_number="2A" subtitle_name="Office of Security Management"> <level label="a"> <text>In this subtitle the following words have the meanings indicated.</text> </level> <level label="b"> <text>“Council” means the Maryland Cybersecurity Coordinating Council.</text> </level> <level label="c"> <text>“Office” means the Office of Security Management.</text> </level> </section> <section article="gsf" article_name="State Finance and Procurement" number="3.5-2A-02" title_number="3.5" title_name="Department of Information Technology" subtitle_number="2A" subtitle_name="Office of Security Management"> <text>There is an Office of Security Management within the Department.</text> </section> <section article="gsf" article_name="State Finance and Procurement" number="3.5-2A-03" title_number="3.5" title_name="Department of Information Technology" subtitle_number="2A" subtitle_name="Office of Security Management"> <level label="a"> <text>The head of the Office is the State Chief Information Security Officer.</text> </level> <level label="b"> <text>The State Chief Information Security Officer shall:</text> <level label="1"> <text>be appointed by the Governor with the advice and consent of the Senate;</text> </level> <level label="2"> <text>serve at the pleasure of the Governor;</text> </level> <level label="3"> <text>be supervised by the Secretary; and</text> </level> <level label="4"> <text>serve as the chief information security officer of the Department.</text> </level> </level> <level label="c"> <text>An individual appointed as the State Chief Information Security Officer under subsection (b) of this section shall:</text> <level label="1"> <text>at a minimum, hold a bachelor’s degree;</text> </level> <level label="2"> <text>hold appropriate information technology or cybersecurity certifications;</text> </level> <level label="3"> <text>have experience:</text> <level label="i"> <text>identifying, implementing, or assessing security controls;</text> </level> <level label="ii"> <text>in infrastructure, systems engineering, or cybersecurity;</text> </level> <level label="iii"> <text>managing highly technical security, security operations centers, and incident response teams in a complex cloud environment and supporting multiple sites; and</text> </level> <level label="iv"> <text>working with common information security management frameworks;</text> </level> </level> <level label="4"> <text>have extensive knowledge of information technology and cybersecurity field concepts, best practices, and procedures, with an understanding of existing enterprise capabilities and limitations to ensure the secure integration and operation of security networks and systems; and</text> </level> <level label="5"> <text>have knowledge of current security regulations.</text> </level> </level> <level label="d"> <text>The State Chief Information Security Officer shall provide cybersecurity advice and recommendations to the Governor on request.</text> </level> <level label="e"> <level label="1"> <level label="i"> <text>There is a Director of Local Cybersecurity, who shall be appointed by the State Chief Information Security Officer.</text> </level> <level label="ii"> <text>The Director of Local Cybersecurity shall work in coordination with the Maryland Department of Emergency Management to provide technical assistance, coordinate resources, and improve cybersecurity preparedness for units of local government.</text> </level> </level> <level label="2"> <level label="i"> <text>There is a Director of State Cybersecurity, who shall be appointed by the State Chief Information Security Officer.</text> </level> <level label="ii"> <text>The Director of State Cybersecurity is responsible for implementation of this section with respect to units of State government.</text> </level> </level> </level> <level label="f"> <text>The Department shall provide the Office with sufficient staff to perform the functions of this subtitle.</text> </level> </section> <section article="gsf" article_name="State Finance and Procurement" number="3.5-2A-04" title_number="3.5" title_name="Department of Information Technology" subtitle_number="2A" subtitle_name="Office of Security Management"> <level label="a"> <level label="1"> <text>The Office is responsible for:</text> <level label="i"> <text>the direction, coordination, and implementation of the overall cybersecurity strategy and policy for units of State government; and</text> </level> <level label="ii"> <text>supporting and coordinating with the Maryland Department of Emergency Management Cyber Preparedness Unit during emergency response efforts.</text> </level> </level> <level label="2"> <text>The Office is not responsible for the information technology installation and maintenance operations normally conducted by a unit of State government, a unit of local government, a local school board, a local school system, or a local health department.</text> </level> </level> <level label="b"> <text>The Office shall:</text> <level label="1"> <text>establish standards to categorize all information collected or maintained by or on behalf of each unit of State government;</text> </level> <level label="2"> <text>establish standards to categorize all information systems maintained by or on behalf of each unit of State government;</text> </level> <level label="3"> <text>develop guidelines governing the types of information and information systems to be included in each category;</text> </level> <level label="4"> <text>establish security requirements for information and information systems in each category;</text> </level> <level label="5"> <text>assess the categorization of information and information systems and the associated implementation of the security requirements established under item (4) of this subsection;</text> </level> <level label="6"> <text>if the State Chief Information Security Officer determines that there are security vulnerabilities or deficiencies in any information systems, determine and direct or take actions necessary to correct or remediate the vulnerabilities or deficiencies, which may include requiring the information system to be disconnected;</text> </level> <level label="7"> <text>if the State Chief Information Security Officer determines that there is a cybersecurity threat caused by, affecting, or potentially affecting an entity connected to the network established under § 3.5–404 of this title that introduces or may introduce a serious risk to entities connected to the network or to the State, take or direct actions required to mitigate the threat;</text> </level> <level label="8"> <text>manage security awareness training for all appropriate employees of units of State government;</text> </level> <level label="9"> <text>assist in the development of data management, data governance, and data specification standards to promote standardization and reduce risk;</text> </level> <level label="10"> <text>assist in the development of a digital identity standard and specification applicable to all parties communicating, interacting, or conducting business with or on behalf of a unit of State government;</text> </level> <level label="11"> <text>develop and maintain information technology security policy, standards, and guidance documents, consistent with best practices developed by the National Institute of Standards and Technology;</text> </level> <level label="12"> <text>to the extent practicable, seek, identify, and inform relevant stakeholders of any available financial assistance provided by the federal government or non–State entities to support the work of the Office;</text> </level> <level label="13"> <text>provide technical assistance to localities in mitigating and recovering from cybersecurity incidents;</text> </level> <level label="14"> <text>annually review and, if necessary, update the State minimum cybersecurity standards;</text> </level> <level label="15"> <text>provide technical services, advice, and guidance to units of local government to improve cybersecurity preparedness, prevention, response, and recovery practices; and</text> </level> <level label="16"> <text>support local governments in developing a vulnerability assessment and cyber assessment, including providing local governments with the resources and information on best practices to complete the assessments.</text> </level> </level> <level label="c"> <text>The Office, in coordination with the Maryland Department of Emergency Management, shall:</text> <level label="1"> <text>assist local political subdivisions, including counties, school systems, school boards, and local health departments, in implementing best practices and guidance developed by the Department; and</text> </level> <level label="2"> <text>connect local entities to appropriate resources for any other purpose related to cybersecurity preparedness and response.</text> </level> </level> <level label="d"> <text>The Office, in coordination with the Maryland Department of Emergency Management, may:</text> <level label="1"> <text>conduct regional exercises, as necessary, in coordination with the National Guard, local emergency managers, and other State and local entities; and</text> </level> <level label="2"> <text>establish regional assistance groups to deliver or coordinate support services to local political subdivisions, agencies, or regions.</text> </level> </level> <level label="e"> <level label="1"> <text>On or before December 31 each year, the Office shall report to the Governor and, in accordance with § 2–1257 of the State Government Article, the Senate Budget and Taxation Committee, the Senate Committee on Education, Energy, and the Environment, the House Appropriations Committee, the House Health and Government Operations Committee, and the Joint Committee on Cybersecurity, Information Technology, and Biotechnology on the activities of the Office and the state of cybersecurity preparedness in Maryland, including:</text> <level label="i"> <text>the activities and accomplishments of the Office during the previous 12 months at the State and local levels; and</text> </level> <level label="ii"> <text>a compilation and analysis of the data from the information contained in the reports received by the Office under § 3.5–405 of this title, including:</text> <level label="1"> <text>a summary of the issues identified by the cybersecurity preparedness assessments conducted that year;</text> </level> <level label="2"> <text>the status of vulnerability assessments of all units of State government and a timeline for completion and cost to remediate any vulnerabilities exposed;</text> </level> <level label="3"> <text>recent audit findings of all units of State government and options to improve findings in future audits, including recommendations for staff, budget, and timing;</text> </level> <level label="4"> <text>efforts to secure financial support for cyber risk mitigation from federal or other non–State resources;</text> </level> <level label="5"> <text>key performance indicators on the cybersecurity strategies in the Department’s information technology master plan, including time, budget, and staff required for implementation; and</text> </level> <level label="6"> <text>any additional recommendations for improving State and local cybersecurity preparedness.</text> </level> </level> </level> <level label="2"> <text>A report submitted under this subsection may not contain information that reveals cybersecurity vulnerabilities and risks in the State.</text> </level> </level> <level label="f"> <level label="1"> <text>Except as provided in paragraph (2) of this subsection, on or before the third Wednesday in January each year, the Office shall report to the Governor and, in accordance with § 2–1257 of the State Government Article, the Senate Budget and Taxation Committee, the Senate Committee on Education, Energy, and the Environment, the House Appropriations Committee, the House Health and Government Operations Committee, and the Joint Committee on Cybersecurity, Information Technology, and Biotechnology on:</text> <level label="i"> <text>the State’s expenditure on cybersecurity relative to overall information technology spending for the prior 3 years; and</text> </level> <level label="ii"> <text>recommendations for changes to the budget, including the amount, purpose, and timing of funding to improve State and local cybersecurity preparedness.</text> </level> </level> <level label="2"> <text>In a year with a newly elected Governor, the report required under paragraph (1) of this subsection shall be submitted on or before the third Friday of January.</text> </level> </level> </section> <section article="gsf" article_name="State Finance and Procurement" number="3.5-2A-05" title_number="3.5" title_name="Department of Information Technology" subtitle_number="2A" subtitle_name="Office of Security Management"> <level label="a"> <text>There is a Maryland Cybersecurity Coordinating Council.</text> </level> <level label="b"> <level label="1"> <text>The Council consists of the following members:</text> <level label="i"> <text>the secretary of each of the principal departments listed in § 8–201 of the State Government Article, or a secretary’s designee;</text> </level> <level label="ii"> <text>the State Chief Information Security Officer;</text> </level> <level label="iii"> <text>the Adjutant General of the Maryland National Guard, or the Adjutant General’s designee;</text> </level> <level label="iv"> <text>the Superintendent of State Police, or the Superintendent’s designee;</text> </level> <level label="v"> <text>the Director of the Governor’s Office of Homeland Security, or the Director’s designee;</text> </level> <level label="vi"> <text>the Executive Director of the Department of Legislative Services, or the Executive Director’s designee;</text> </level> <level label="vii"> <text>one representative of the Administrative Office of the Courts;</text> </level> <level label="viii"> <text>the Chancellor of the University System of Maryland, or the Chancellor’s designee; and</text> </level> <level label="ix"> <text>any other stakeholder that the State Chief Information Security Officer deems appropriate.</text> </level> </level> <level label="2"> <text>If a designee serves on the Council in place of an official listed in paragraph (1) of this subsection, the designee shall report information from the Council meetings and other communications to the official.</text> </level> </level> <level label="c"> <text>In addition to the members listed under subsection (b) of this section, the following representatives may serve as nonvoting members of the Council:</text> <level label="1"> <text>one member of the Senate of Maryland, appointed by the President of the Senate;</text> </level> <level label="2"> <text>one member of the House of Delegates, appointed by the Speaker of the House; and</text> </level> <level label="3"> <text>one representative of the judiciary, appointed by the Chief Justice of the Supreme Court of Maryland.</text> </level> </level> <level label="d"> <text>The chair of the Council is the State Chief Information Security Officer.</text> </level> <level label="e"> <text>The Council shall meet at least quarterly at the request of the chair.</text> </level> <level label="f"> <text>The Council shall:</text> <level label="1"> <text>provide advice and recommendations to the State Chief Information Security Officer regarding:</text> <level label="i"> <text>the strategy and implementation of cybersecurity initiatives and recommendations; and</text> </level> <level label="ii"> <text>building and sustaining the capability of the State to identify and mitigate cybersecurity risk and respond to and recover from cybersecurity–related incidents.</text> </level> </level> <level label="2"> <text>use the analysis compiled by the Office under § 3.5–2A–04(e)(1)(ii) of this subtitle to prioritize cybersecurity risk across the Executive Branch of State government and make corresponding recommendations for security investments in the Governor’s annual budget.</text> </level> </level> <level label="g"> <text>In carrying out the duties of the Council, the Council shall consult with outside experts, including experts in the private sector, government agencies, and institutions of higher education.</text> </level> </section> <section article="gsf" article_name="State Finance and Procurement" number="3.5-2A-06" title_number="3.5" title_name="Department of Information Technology" subtitle_number="2A" subtitle_name="Office of Security Management"> <text>The Council shall:</text> <level label="1"> <text>promote cybersecurity education and training opportunities to strengthen the State’s cybersecurity capabilities by expanding existing agreements with educational institutions; and</text> </level> <level label="2"> <text>utilize relationships with institutions of higher education to advertise cybersecurity careers and job positions available in State or local government, including the Maryland Technology Internship Program established under Title 18, Subtitle 30 of the Education Article.</text> </level> </section> <section article="gsf" article_name="State Finance and Procurement" number="3.5-301" title_number="3.5" title_name="Department of Information Technology" subtitle_number="3" subtitle_name="Information Processing"> <level label="a"> <text>In this subtitle the following words have the meanings indicated.</text> </level> <level label="b"> <text>“Artificial intelligence” has the meaning stated in § 3.5–801 of this title.</text> </level> <level label="c"> <text>“Cybersecurity” means processes or capabilities wherein systems, communications, and information are protected and defended against damage, unauthorized use or modification, and exploitation.</text> </level> <level label="d"> <text>“Cybersecurity strategy” means a vision, a plan of action, or guiding principles.</text> </level> <level label="e"> <level label="1"> <text>“Development” means all expenditures for a new information technology system or an enhancement to an existing system including system:</text> <level label="i"> <text>planning;</text> </level> <level label="ii"> <text>creation;</text> </level> <level label="iii"> <text>installation;</text> </level> <level label="iv"> <text>testing; and</text> </level> <level label="v"> <text>initial training.</text> </level> </level> <level label="2"> <text>“Development” does not include:</text> <level label="i"> <text>ongoing operating costs, software or hardware maintenance, routine upgrades, or modifications that merely allow for a continuation of the existing level of functionality; or</text> </level> <level label="ii"> <text>expenditures made after a new or enhanced system has been legally accepted by the user and is being used for the business process for which it was intended.</text> </level> </level> </level> <level label="f"> <text>“Expedited project” means a project that is not a major information technology development project that receives money from the Fund in a manner that allows for modernization projects consistent with the State Modernization Plan to move forward in a nimble and expedited manner.</text> </level> <level label="g"> <text>“Fund” means the Information Technology Investment Fund.</text> </level> <level label="h"> <text>“Information technology” means all electronic information processing, including:</text> <level label="1"> <text>maintenance;</text> </level> <level label="2"> <text>networking;</text> </level> <level label="3"> <text>telecommunications;</text> </level> <level label="4"> <text>hardware;</text> </level> <level label="5"> <text>software and applications; and</text> </level> <level label="6"> <text>associated services.</text> </level> </level> <level label="i"> <text>“Information technology services” means information provided by electronic means by or on behalf of a unit of State government.</text> </level> <level label="j"> <text>“Legacy system” means a hardware or software system that is end of support or end of life.</text> </level> <level label="k"> <level label="1"> <text>“Major information technology development project” means any information technology development project that meets one or more of the following criteria:</text> <level label="i"> <text>except as provided in paragraph (2) of this subsection, the estimated total cost of development equals or exceeds $5,000,000;</text> </level> <level label="ii"> <text>the project is undertaken to support a critical business function associated with the public health, education, safety, or financial well–being of the residents of Maryland; or</text> </level> <level label="iii"> <text>the Secretary determines that the project requires the special attention and consideration given to a major information technology development project due to:</text> <level label="1"> <text>the significance of the project’s potential benefits or risks;</text> </level> <level label="2"> <text>the impact of the project on the public or local governments;</text> </level> <level label="3"> <text>the public visibility of the project; or</text> </level> <level label="4"> <text>other reasons as determined by the Secretary.</text> </level> </level> </level> <level label="2"> <text>“Major information technology development project” does not include:</text> <level label="i"> <text>technology that is reoccurring, standard operating technology as determined by the Secretary and submitted to the Legislative Policy Committee for a 30–day review and comment period; or</text> </level> <level label="ii"> <text>a project with an estimated total cost of development that is:</text> <level label="1"> <text>less than $5,000,000 and is funded with money set aside for expedited projects in the Fund; or</text> </level> <level label="2"> <text>more than $5,000,000 and is funded with the money set aside for expedited projects in the Fund if the Secretary determines that:</text> </level> <level label="A"> <text>the unit of State government has sufficient implementation resources, including human capital, subject matter expertise, and technological infrastructure, or has the means to obtain these resources before project initiation;</text> </level> <level label="B"> <text>there is no sufficient alternative within the State’s information technology inventory; and</text> </level> <level label="C"> <text>the project will result in a comprehensive solution designed to meet a cohesive set of business and technological objectives.</text> </level> </level> </level> </level> <level label="l"> <text>“Master plan” means the statewide information technology master plan and statewide cybersecurity strategy.</text> </level> <level label="m"> <text>“Nonvisual access” means the ability, through keyboard control, synthesized speech, Braille, or other methods not requiring sight to receive, use, and manipulate information and operate controls necessary to access information technology in accordance with standards adopted under § 3.5–303(b) of this subtitle.</text> </level> <level label="n"> <text>“Resource sharing” means the utilization of a State resource by private industry in exchange for the provision to the State of a communication service or other consideration.</text> </level> <level label="o"> <text>“State Modernization Plan” means the plan developed and adopted by the Secretary to modernize State information technology.</text> </level> <level label="p"> <text>“Systems development life cycle plan” means a plan that defines all actions, functions, or activities to be performed by a unit of State government in the definition, planning, acquisition, development, testing, implementation, operation, enhancement, and modification of information technology systems.</text> </level> </section> <section article="gsf" article_name="State Finance and Procurement" number="3.5-302" title_number="3.5" title_name="Department of Information Technology" subtitle_number="3" subtitle_name="Information Processing"> <level label="a"> <text>This subtitle does not apply to changes relating to or the purchase, lease, or rental of information technology by:</text> <level label="1"> <text>public institutions of higher education solely for academic or research purposes;</text> </level> <level label="2"> <text>the Maryland Port Administration;</text> </level> <level label="3"> <text>the University System of Maryland;</text> </level> <level label="4"> <text>St. Mary’s College of Maryland;</text> </level> <level label="5"> <text>Morgan State University;</text> </level> <level label="6"> <text>the Maryland Stadium Authority;</text> </level> <level label="7"> <text>Baltimore City Community College;</text> </level> <level label="8"> <text>the Legislative Branch of State government;</text> </level> <level label="9"> <text>the Judicial Branch of State government;</text> </level> <level label="10"> <text>the Office of the Attorney General;</text> </level> <level label="11"> <text>the Comptroller; or</text> </level> <level label="12"> <text>the State Treasurer.</text> </level> </level> <level label="b"> <text>Except as provided in subsection (a) of this section, this subtitle applies to any project of a unit of the Executive Branch of State government that involves an agreement with a public institution of higher education for a portion of the development of the project, whether the work on the development is done directly or indirectly by the public institution of higher education.</text> </level> <level label="c"> <text>Notwithstanding any other provision of law, except as provided in subsection (a) of this section and §§ 3.5–305, 3.5–307(a)(2), 3.5–308, and 3.5–309 of this subtitle, this subtitle applies to all units of the Executive Branch of State government including public institutions of higher education other than Morgan State University, the University System of Maryland, St. Mary’s College of Maryland, and Baltimore City Community College.</text> </level> </section> <section article="gsf" article_name="State Finance and Procurement" number="3.5-303" title_number="3.5" title_name="Department of Information Technology" subtitle_number="3" subtitle_name="Information Processing"> <level label="a"> <text>The Secretary is responsible for carrying out the following duties:</text> <level label="1"> <text>developing, implementing, maintaining, revising, and enforcing information technology policies, procedures, and standards;</text> </level> <level label="2"> <text>providing technical assistance, advice, and recommendations to the Governor and any unit of State government concerning information technology matters;</text> </level> <level label="3"> <text>reviewing the annual project plan for each unit of State government to make information and services available to the public over the Internet;</text> </level> <level label="4"> <text>developing and maintaining a statewide information technology master plan that will:</text> <level label="i"> <text>centralize the management and direction of information technology policy within the Executive Branch of State government under the control of the Department;</text> </level> <level label="ii"> <text>include all aspects of State information technology including telecommunications, security, data processing, and information management;</text> </level> <level label="iii"> <text>consider interstate transfers as a result of federal legislation and regulation;</text> </level> <level label="iv"> <text>ensure that the State information technology plan and related policies and standards are consistent with State goals, objectives, and resources, and represent a long–range vision for using information technology to improve the overall effectiveness of State government;</text> </level> <level label="v"> <text>include standards to assure nonvisual access to the information and services made available to the public over the Internet; and</text> </level> <level label="vi"> <text>allow a State agency to maintain the agency’s own information technology unit that provides for information technology services to support the mission of the agency;</text> </level> </level> <level label="5"> <text>developing, implementing, and maintaining a statewide cybersecurity strategy that will:</text> <level label="i"> <text>centralize the management and direction of cybersecurity strategy within the Executive Branch of State government under the control of the Department; and</text> </level> <level label="ii"> <text>serve as the basis for budget allocations for cybersecurity preparedness for the Executive Branch of State government;</text> </level> </level> <level label="6"> <text>adopting by regulation and enforcing nonvisual access standards to be used in the procurement of information technology services by or on behalf of units of State government in accordance with subsection (c) of this section;</text> </level> <level label="7"> <text>in consultation with the Maryland Cybersecurity Coordinating Council, advising and overseeing a consistent cybersecurity strategy for units of State government, including institutions under the control of the governing boards of the public institutions of higher education;</text> </level> <level label="8"> <text>advising and consulting with the Legislative and Judicial branches of State government regarding a cybersecurity strategy;</text> </level> <level label="9"> <text>in consultation with the Maryland Cybersecurity Coordinating Council, developing guidance on consistent cybersecurity strategies for counties, municipal corporations, school systems, and all other political subdivisions of the State;</text> </level> <level label="10"> <text>upgrading information technology and cybersecurity–related State government infrastructure;</text> </level> <level label="11"> <text>annually evaluating:</text> <level label="i"> <text>the feasibility of units of State government providing public services using artificial intelligence, machine learning, commercial cloud computer services, device–as–a–service procurement models, and other emerging technologies; and</text> </level> <level label="ii"> <text>the development of data analytics capabilities to enable data–driven policymaking by units of State government; and</text> </level> </level> <level label="12"> <text>conducting inventories of systems that employ artificial intelligence that are used by a unit of State government as required under § 3.5–803 of this title.</text> </level> </level> <level label="b"> <text>Nothing in subsection (a) of this section may be construed as establishing a mandate for any entity listed in subsection (a)(9) of this section.</text> </level> <level label="c"> <text>On or before January 1, 2020, the Secretary, or the Secretary’s designee, shall:</text> <level label="1"> <text>adopt new nonvisual access procurement standards that:</text> <level label="i"> <text>provide an individual with disabilities with nonvisual access in a way that is fully and equally accessible to and independently usable by the individual with disabilities so that the individual is able to acquire the same information, engage in the same interactions, and enjoy the same services as users without disabilities, with substantially equivalent ease of use; and</text> </level> <level label="ii"> <text>are consistent with the standards of § 508 of the federal Rehabilitation Act of 1973; and</text> </level> </level> <level label="2"> <text>establish a process for the Secretary or the Secretary’s designee to:</text> <level label="i"> <text>determine whether information technology meets the nonvisual access standards adopted under item (1) of this subsection; and</text> </level> <level label="ii"> <level label="1"> <text>for information technology procured by a State unit before January 1, 2020, and still used by the State unit on or after January 1, 2020, work with the vendor to modify the information technology to meet the nonvisual access standards, if practicable; or</text> </level> <level label="2"> <text>for information technology procured by a State unit on or after January 1, 2020, enforce the nonvisual access clause developed under § 3.5–311 of this subtitle, including the enforcement of the civil penalty described in § 3.5–311(a)(2)(iii)1 of this subtitle.</text> </level> </level> </level> </level> <level label="d"> <level label="1"> <text>The Governor shall include an appropriation in the annual budget bill in an amount necessary to cover the costs of implementing the statewide cybersecurity master plan developed under subsection (a) of this section without the need for the Department to operate a charge–back model for cybersecurity services provided to other units of State government or units of local government.</text> </level> <level label="2"> <text>On or before January 31 each year, in a separate report or included within a general budget report, the Governor shall submit a report in accordance with § 2–1257 of the State Government Article to the Senate Budget and Taxation Committee and the House Appropriations Committee that includes:</text> <level label="i"> <text>specific information on the information technology budget and cybersecurity budget that the Governor has submitted to the General Assembly for the upcoming fiscal year; and</text> </level> <level label="ii"> <text>how the budgets listed under item (i) of this paragraph compare to the annual overview of the U.S. President’s budget submission on information technology and cybersecurity to Congress conducted by the U.S. Office of Management and Budget.</text> </level> </level> </level> </section> <section article="gsf" article_name="State Finance and Procurement" number="3.5-304" title_number="3.5" title_name="Department of Information Technology" subtitle_number="3" subtitle_name="Information Processing"> <level label="a"> <text>The Secretary shall develop a statewide information technology master plan.</text> </level> <level label="b"> <level label="1"> <text>The plan developed under subsection (a) of this section shall be posted publicly on the Department’s website and, in accordance with § 2–1257 of the State Government Article, submitted to the General Assembly within 1 year after the date the Governor is inaugurated in each gubernatorial term.</text> </level> <level label="2"> <text>If the Secretary is unable to meet the deadline established under paragraph (1) of this subsection, within 10 days after the missed deadline, the Secretary shall notify the Governor in writing and, in accordance with § 2–1257 of the State Government Article:</text> <level label="i"> <text>the Senate Budget and Taxation Committee;</text> </level> <level label="ii"> <text>the Senate Committee on Education, Energy, and the Environment;</text> </level> <level label="iii"> <text>the House Appropriations Committee;</text> </level> <level label="iv"> <text>the House Government, Labor, and Elections Committee; and</text> </level> <level label="v"> <text>the Joint Committee on Cybersecurity, Information Technology, and Biotechnology.</text> </level> </level> <level label="3"> <text>The notice required under paragraph (2) of this subsection shall include an explanation of why the plan is delayed and provide a date for its publication, not to exceed 3 months after the deadline established under paragraph (1) of this subsection.</text> </level> </level> <level label="c"> <text>Each year, the Secretary, or the Secretary’s designee, shall provide a briefing to the General Assembly on:</text> <level label="1"> <text>the implementation of the plan;</text> </level> <level label="2"> <text>any material changes made to the plan; and</text> </level> <level label="3"> <text>how the State intends to manage and deploy the initiatives included in the plan across the Executive Branch of State government.</text> </level> </level> </section> <section article="gsf" article_name="State Finance and Procurement" number="3.5-305" title_number="3.5" title_name="Department of Information Technology" subtitle_number="3" subtitle_name="Information Processing"> <level label="a"> <level label="1"> <text>In this section the following words have the meanings indicated.</text> </level> <level label="2"> <level label="i"> <text>“Spam e–mail” means unsolicited, phishing, solicitation, and bulk e–mails unrelated to State business.</text> </level> <level label="ii"> <text>“Spam e–mail” does not include solicitation and bulk e–mails relating to State business, including bulk e–mail from State vendors, partners, and exclusive representatives.</text> </level> </level> <level label="3"> <text>“State business” means the furtherance of the State’s obligations:</text> <level label="i"> <text>under the Maryland Constitution, Maryland Code, and Code of Maryland regulations;</text> </level> <level label="ii"> <text>under the laws of the United States; and</text> </level> <level label="iii"> <text>by operation of contracts and similar obligations.</text> </level> </level> </level> <level label="b"> <text>It is the policy of the State that e–mail systems and resources for State and higher education employees are intended to support State business and may not serve as a public forum.</text> </level> <level label="c"> <text>Except as provided in subsection (d) of this section, in accordance with guidelines established by the Secretary, each unit of State government shall develop and submit to the Secretary:</text> <level label="1"> <text>information technology policies and standards;</text> </level> <level label="2"> <text>an information technology plan; and</text> </level> <level label="3"> <text>an annual project plan outlining the status of efforts to make information and services available to the public over the Internet.</text> </level> </level> <level label="d"> <level label="1"> <text>The governing boards of the public institutions of higher education shall develop and submit information technology policies and standards and an information technology plan for their respective institutions or systems to the Secretary.</text> </level> <level label="2"> <text>If the Secretary finds that the submissions required under this subsection are consistent with the master plan, the Secretary shall incorporate those submissions into the master plan.</text> </level> <level label="3"> <text>If the Secretary finds that the submissions required under this subsection are not consistent with the master plan:</text> <level label="i"> <text>the Secretary shall return the submissions to the governing boards; and</text> </level> <level label="ii"> <text>the governing boards shall revise the submissions as appropriate and submit the revised policies, standards, and plans to the Secretary.</text> </level> </level> </level> <level label="e"> <level label="1"> <text>In order to protect the information technology resources of the State, the policies, plans, and standards required under subsections (c) and (d) of this section shall include provisions to protect State and higher education employee e–mail services from spam e–mail and other use that does not support State business, including by implementing systems that automatically filter spam e–mail from State and higher education employees’ e–mail accounts.</text> </level> <level label="2"> <text>The policies, plans, and standards required under subsections (c) and (d) of this section shall permit incidental personal use of information technology, including e–mail, by State employees that:</text> <level label="i"> <text>has a de minimis impact on resources; and</text> </level> <level label="ii"> <text>is consistent with generally accepted professional business norms and expectations.</text> </level> </level> </level> </section> <section article="gsf" article_name="State Finance and Procurement" number="3.5-306" title_number="3.5" title_name="Department of Information Technology" subtitle_number="3" subtitle_name="Information Processing"> <text>Information technology of each unit of State government shall be consistent with the master plan.</text> </section> <section article="gsf" article_name="State Finance and Procurement" number="3.5-307" title_number="3.5" title_name="Department of Information Technology" subtitle_number="3" subtitle_name="Information Processing"> <level label="a"> <level label="1"> <text>A unit of State government may not purchase, lease, contract for, or rent an information technology service or product unless consistent with the master plan, as determined by the Secretary.</text> </level> <level label="2"> <text>A unit of State government other than a public institution of higher education may not make expenditures for major information technology development projects or cybersecurity projects except as provided in § 3.5–308 of this subtitle.</text> </level> </level> <level label="b"> <text>The Secretary may review any information technology project or cybersecurity project for consistency with the master plan.</text> </level> <level label="c"> <level label="1"> <text>A unit of State government shall advise the Secretary of any information technology proposal involving:</text> <level label="i"> <text>resource sharing;</text> </level> <level label="ii"> <text>the exchange of goods or services;</text> </level> <level label="iii"> <text>a gift, contribution, or grant of real or personal property; or</text> </level> <level label="iv"> <text>the sale, lease, exchange, or other disposition of communications facilities or communications frequencies.</text> </level> </level> <level label="2"> <text>The Secretary shall determine if the value of the resources, services, property, or other consideration to be obtained by the State under the terms of any proposal submitted in accordance with paragraph (1) of this subsection equals or exceeds $100,000.</text> </level> <level label="3"> <text>If the value of any proposal submitted in accordance with this subsection equals or exceeds $100,000 and the Secretary and unit agree to proceed with the proposal, information on the proposal shall be:</text> <level label="i"> <text>advertised for a period of at least 30 days in the eMaryland Marketplace; and</text> </level> <level label="ii"> <text>submitted, simultaneously with the advertisement, to the Legislative Policy Committee for a 60–day review and comment period, during which time the Committee may recommend that the proposal be treated as a procurement contract under Division II of this article.</text> </level> </level> <level label="4"> <text>Following the period for review and comment by the Legislative Policy Committee under paragraph (3) of this subsection, the proposal is subject to approval by the Board of Public Works.</text> </level> <level label="5"> <text>This subsection may not be construed as authorizing an exception from the requirements of Division II of this article for any contract that otherwise would be subject to the State procurement process.</text> </level> </level> <level label="d"> <level label="1"> <text>The Department, in consultation with the Department of General Services, shall assess the procurement process for information technology projects involving modernization and make recommendations to increase the State’s ability to proceed with a modernization project in a rapid and responsive manner.</text> </level> <level label="2"> <level label="i"> <text>On or before July 1, 2025, the Department shall inventory and assess the State’s legacy systems and prioritize modernization.</text> </level> <level label="ii"> <text>On or before January 1, 2026, and every other January 1 thereafter, the Department, in consultation with each unit of State government, shall submit a report to the Governor, the Secretary, and, in accordance with § 2–1257 of the State Government Article, the General Assembly that provides:</text> <level label="1"> <text>an estimate of the funding required to modernize each legacy system in the unit; and</text> </level> <level label="2"> <text>a 5–year projection of funding required to modernize each legacy system.</text> </level> </level> </level> </level> </section> <section article="gsf" article_name="State Finance and Procurement" number="3.5-308" title_number="3.5" title_name="Department of Information Technology" subtitle_number="3" subtitle_name="Information Processing"> <level label="a"> <text>This section does not apply to a public institution of higher education.</text> </level> <level label="b"> <text>Before submitting its information technology project requests, a unit of State government shall submit information in support of the request required by the Secretary for review and determination consistent with § 3.5–301(k) of this subtitle.</text> </level> <level label="c"> <text>In reviewing information technology project requests, the Secretary may change a unit’s designation of a major information technology development project.</text> </level> <level label="d"> <text>The Secretary shall review and, with the advice of the Secretary of Budget and Management, approve major information technology development projects and specifications for consistency with all statewide plans, policies, and standards, including a systems development life cycle plan.</text> </level> <level label="e"> <level label="1"> <text>Subject to paragraph (2) of this subsection, the Secretary shall be responsible for overseeing the implementation of major information technology development projects, regardless of fund source.</text> </level> <level label="2"> <text>As part of the Secretary’s responsibilities under this section, the Secretary shall ensure that no funding is provided for the implementation of a major information technology development project unless:</text> <level label="i"> <text>the Secretary determines that the unit has the internal capacity to adequately support the project, program management, and responsibility over program activities, including:</text> <level label="1"> <text>human capital;</text> </level> <level label="2"> <text>subject matter expertise; and</text> </level> <level label="3"> <text>technical infrastructure;</text> </level> </level> <level label="ii"> <text>within 30 days of awarding a contract, the managing unit sends to the Board of Public Works and the Legislative Policy Committee, in accordance with § 2–1257 of the State Government Article, notice that:</text> <level label="1"> <text>identifies the project management team;</text> </level> <level label="2"> <text>affirms that the Department has reviewed and approved the contract; and</text> </level> <level label="3"> <text>is signed by the head of the unit acknowledging and accepting the accountability for the implementation of the information technology project or product; and</text> </level> </level> <level label="iii"> <text>while a unit is managing an active project or product, the unit agrees to report to the Department every 3 months on the project status in a manner requested by the Department.</text> </level> </level> </level> <level label="f"> <level label="1"> <text>With the advice of the Secretary of Budget and Management, expenditures for major information technology development projects shall be subject to the approval of the Secretary who shall approve expenditures only when those projects are consistent with statewide plans, policies, and standards.</text> </level> <level label="2"> <level label="i"> <text>The Secretary shall make a recommendation to the Secretary of Budget and Management to withhold project funds, regardless of fund source, if:</text> <level label="1"> <text>a unit of State government is not consistently reporting on the status of a project or projects to the Department in the form and manner required by the Department; or</text> </level> <level label="2"> <text>the Department determines that project implementation issues exist, including project timeline delays, significant cost increases, vendor nonperformance, decreased agency capacity, or other issues that indicate issues of concern that could jeopardize successful implementation.</text> </level> </level> <level label="ii"> <text>Notwithstanding any other provision of law, and except as provided in subparagraph (iii) of this paragraph, the Secretary of Budget and Management shall withhold any unexpended funds appropriated in a fiscal year for a major information technology development project at the Secretary’s recommendation issued under subparagraph (i) of this paragraph.</text> </level> <level label="iii"> <text>The Secretary of Budget and Management may release funds withheld under this paragraph at the direction of the Secretary if the Secretary determines that the issue leading to the initial withholding of funds has been addressed.</text> </level> </level> <level label="3"> <text>Within 30 days after funding is withheld in accordance with this subsection, the Department shall report on the purpose of the withholding:</text> <level label="i"> <text>to the Governor; and</text> </level> <level label="ii"> <text>subject to § 2–1257 of the State Government Article, to:</text> <level label="1"> <text>the Senate Budget and Taxation Committee;</text> </level> <level label="2"> <text>the Senate Committee on Education, Energy, and the Environment;</text> </level> <level label="3"> <text>the House Appropriations Committee;</text> </level> <level label="4"> <text>the House Health and Government Operations Committee; and</text> </level> <level label="5"> <text>the Joint Committee on Cybersecurity, Information Technology, and Biotechnology.</text> </level> </level> </level> <level label="4"> <level label="i"> <text>Subject to subparagraph (ii) of this paragraph:</text> <level label="1"> <text>the Secretary may recommend to the Secretary of Budget and Management that funding withheld under this section be reallocated to other expenses of the Information Technology Investment Fund under § 3.5–309 of this subtitle; and</text> </level> <level label="2"> <text>the Secretary of Budget and Management may, at their discretion, follow the Secretary’s recommendation to reallocate funds.</text> </level> </level> <level label="ii"> <text>If the reallocated funds exceed $500,000, the Secretary, in consultation with the Secretary of Budget and Management, shall submit a proposal to the Legislative Policy Committee for a 60–day review and comment period.</text> </level> </level> </level> <level label="g"> <level label="1"> <text>The Secretary shall approve funding for major information technology development projects, expedited projects, and other expenditures from the Fund only when:</text> <level label="i"> <text>the major information technology development projects or the expedited projects are in compliance with statewide plans, policies, and standards, as determined by the Secretary; and</text> </level> <level label="ii"> <text>the major information technology development projects are supported by an approved systems development life cycle plan.</text> </level> </level> <level label="2"> <text>An approved systems development life cycle plan shall include submission of:</text> <level label="i"> <text>a project planning request that details initial planning for the project, including:</text> <level label="1"> <text>the project title, appropriation code, and summary;</text> </level> <level label="2"> <text>a description of:</text> </level> <level label="A"> <text>the business and technology outcomes to be achieved by the project;</text> </level> <level label="B"> <text>the features available to the end user on completion, including user acceptance testing and accessibility plans;</text> </level> <level label="C"> <text>the potential risks associated with the project;</text> </level> <level label="D"> <text>possible alternatives; and</text> </level> <level label="E"> <text>the scope and complexity of the project; and</text> </level> <level label="3"> <text>an estimate of:</text> </level> <level label="A"> <text>the total costs required to complete through planning; and</text> </level> <level label="B"> <text>the fund sources available to support planning costs; and</text> </level> </level> <level label="ii"> <text>a project implementation request to begin full design, development, and implementation of the project after the completion of planning, including:</text> <level label="1"> <text>the project title, appropriation code, and summary;</text> </level> <level label="2"> <text>a description of:</text> </level> <level label="A"> <text>the business and technology outcomes to be achieved by the project and the metrics by which the success of those outcomes will be measured;</text> </level> <level label="B"> <text>the features available to the end user on completion, including user acceptance testing and accessibility plans;</text> </level> <level label="C"> <text>the potential risks associated with the project;</text> </level> <level label="D"> <text>possible alternatives;</text> </level> <level label="E"> <text>the scope and complexity of the project; and</text> </level> <level label="F"> <text>how the project meets the goals of the statewide master plan; and</text> </level> <level label="3"> <text>an estimate of:</text> </level> <level label="A"> <text>the total project cost, by phase; and</text> </level> <level label="B"> <text>the fund sources to be utilized.</text> </level> </level> </level> <level label="3"> <text>The Secretary may approve funding incrementally, consistent with the systems development life cycle plan.</text> </level> </level> <level label="h"> <text>On or before July 1, 2026, the Department shall:</text> <level label="1"> <text>develop standards for units of State government to assist in identifying legacy systems that require modernization projects appropriate to be financed as an expedited project through the Fund;</text> </level> <level label="2"> <text>adopt an Information Technology Investment Maturity Model that includes:</text> <level label="i"> <text>criteria to inform and prioritize investment decisions;</text> </level> <level label="ii"> <text>processes to develop the information required to evaluate investment proposals against the criteria under item (i) of this item; and</text> </level> <level label="iii"> <text>management processes to monitor the implementation of approved modernization projects; and</text> </level> </level> <level label="3"> <text>develop a State Modernization Plan.</text> </level> </level> </section> <section article="gsf" article_name="State Finance and Procurement" number="3.5-309" future_version_removed="true" title_number="3.5" title_name="Department of Information Technology" subtitle_number="3" subtitle_name="Information Processing"> <level label="a"> <text>There is an Information Technology Investment Fund.</text> </level> <level label="b"> <text>The purpose of the Fund is to support major information technology development projects and expedited projects.</text> </level> <level label="c"> <text>The Secretary:</text> <level label="1"> <text>shall administer the Fund in accordance with this section; and</text> </level> <level label="2"> <text>subject to the provisions of § 2–201 of this article and § 3.5–307 of this subtitle, may receive and accept contributions, grants, or gifts of money or property.</text> </level> </level> <level label="d"> <level label="1"> <text>The Fund is a special, nonlapsing fund that is not subject to § 7–302 of this article.</text> </level> <level label="2"> <text>The State Treasurer shall hold the Fund separately and the Comptroller shall account for the Fund.</text> </level> <level label="3"> <text>The State Treasurer shall invest and reinvest the money of the Fund in the same manner as other State money may be invested.</text> </level> <level label="4"> <text>Any investment earnings of the Fund shall be paid into the Fund.</text> </level> </level> <level label="e"> <text>Except as provided in subsection (f) of this section, the Fund consists of:</text> <level label="1"> <text>money appropriated in the State budget to the Fund;</text> </level> <level label="2"> <text>as approved by the Secretary, money received from:</text> <level label="i"> <text>the sale, lease, or exchange of communication sites, communication facilities, or communication frequencies for information technology purposes; or</text> </level> <level label="ii"> <text>an information technology agreement involving resource sharing;</text> </level> </level> <level label="3"> <text>that portion of money earned from pay phone commissions to the extent that the commission rates exceed those in effect in December 1993;</text> </level> <level label="4"> <text>money received and accepted as contributions, grants, or gifts as authorized under subsection (c) of this section;</text> </level> <level label="5"> <text>general funds appropriated for major information technology development projects of any unit of State government other than a public institution of higher education that:</text> <level label="i"> <text>are unencumbered and unexpended at the end of a fiscal year;</text> </level> <level label="ii"> <text>have been abandoned; or</text> </level> <level label="iii"> <text>have been withheld by the General Assembly or the Secretary;</text> </level> </level> <level label="6"> <text>any investment earnings; and</text> </level> <level label="7"> <text>any other money from any source accepted for the benefit of the Fund.</text> </level> </level> <level label="f"> <text>The Fund does not include any money:</text> <level label="1"> <text>received by the Department of Transportation, the Maryland Transportation Authority, Baltimore City Community College, or the Maryland Public Broadcasting Commission;</text> </level> <level label="2"> <text>received by the Judicial or Legislative branches of State government; or</text> </level> <level label="3"> <text>generated from pay phone commissions that are credited to other accounts or funds in accordance with other provisions of law or are authorized for other purposes in the State budget or through an approved budget amendment.</text> </level> </level> <level label="g"> <text>The Governor shall submit with the State budget:</text> <level label="1"> <text>a summary showing the unencumbered balance in the Fund as of the close of the prior fiscal year and a listing of any encumbrances;</text> </level> <level label="2"> <text>an estimate of projected revenue from each of the sources specified in subsection (e) of this section for the fiscal year for which the State budget is submitted;</text> </level> <level label="3"> <text>a descriptive listing of major information technology development projects reflecting projected costs for the fiscal year for which the State budget is submitted and any estimated future year costs; and</text> </level> <level label="4"> <text>the amount proposed to be set aside for expedited projects.</text> </level> </level> <level label="h"> <text>Expenditures from the Fund shall be made only:</text> <level label="1"> <text>in accordance with an appropriation approved by the General Assembly in the annual State budget;</text> </level> <level label="2"> <text>through an approved State budget amendment under Title 7, Subtitle 2, Part II of this article, provided that a State budget amendment for any project not requested as part of the State budget submission or for any project for which the scope or cost has increased by more than 5% or $250,000 shall be submitted to the budget committees allowing a 30–day period for their review and comment; or</text> </level> <level label="3"> <text>for expedited project contracts approved for funding by the Secretary and approved by the Board of Public Works as provided in § 12–101 of this article.</text> </level> </level> <level label="i"> <text>The Fund may be used:</text> <level label="1"> <text>for major information technology development projects;</text> </level> <level label="2"> <text>as provided in subsections (j) and (l) of this section;</text> </level> <level label="3"> <text>notwithstanding § 3.5–301(e)(2) of this subtitle, for the costs of the first 12 months of operation and maintenance of a major information technology development project;</text> </level> <level label="4"> <text>for expedited projects; or</text> </level> <level label="5"> <text>for major information technology development projects and expedited projects through a revolving loan process through which an agency may reimburse the Fund in future fiscal years as established by the Secretary in regulation.</text> </level> </level> <level label="j"> <text>Notwithstanding subsection (b) of this section and except for the cost incurred in administering the Fund, each fiscal year up to $1,000,000 of this Fund may be used for:</text> <level label="1"> <text>educationally related information technology projects;</text> </level> <level label="2"> <text>application service provider initiatives as provided for in Title 9, Subtitle 22 of the State Government Article; or</text> </level> <level label="3"> <text>information technology projects, including:</text> <level label="i"> <text>pilots; and</text> </level> <level label="ii"> <text>prototypes.</text> </level> </level> </level> <level label="k"> <text>A unit of State government or local government may submit a request to the Secretary to support the cost of an information technology project with money under subsection (j) of this section.</text> </level> <level label="l"> <level label="1"> <text>Notwithstanding subsection (b) of this section and in accordance with paragraph (2) of this subsection, money paid into the Fund under subsection (e)(2) of this section:</text> <level label="i"> <text>shall be used to support:</text> <level label="1"> <text>the State telecommunication and computer network established under § 3.5–404 of this title, including program development for these activities; and</text> </level> <level label="2"> <text>the Statewide Public Safety Interoperability Radio System, also known as Maryland First (first responder interoperable radio system team), under Title 1, Subtitle 5 of the Public Safety Article; and</text> </level> </level> <level label="ii"> <text>at the Secretary’s discretion, may be used to support State–owned communication sites, communications facilities, and telecommunications equipment used in connection with information technology agreements entered into under § 3.5–307 of this subtitle, including program management for these activities.</text> </level> </level> <level label="2"> <text>The Secretary may determine the portion of the money paid into the Fund that shall be allocated to each program described in paragraph (1) of this subsection.</text> </level> <level label="3"> <level label="i"> <text>On or before January 15 each year, the Secretary shall submit a report to the General Assembly, in accordance with § 2–1257 of the State Government Article, specifying the amount of money paid into the Fund that was allocated to each program described in paragraph (1) of this subsection.</text> </level> <level label="ii"> <text>The report required under this paragraph shall include how funds were allocated at the Secretary’s discretion under paragraph (1)(ii) of this subsection.</text> </level> </level> </level> <level label="m"> <level label="1"> <text>On or before January 15 of each year, for each major information technology development project or expedited project currently in development or for which operations and maintenance funding is being provided in accordance with subsection (i)(3) of this section, subject to § 2–1257 of the State Government Article, the Secretary shall provide a summary report to the Department of Legislative Services with the most up–to–date project information including:</text> <level label="i"> <text>project funding decisions and project status, including:</text> <level label="1"> <text>estimated project or product costs;</text> </level> <level label="2"> <text>funding sources; and</text> </level> <level label="3"> <text>ongoing operating costs after the project is no longer a major development project or expedited project, including:</text> </level> <level label="A"> <text>costs associated with procuring and maintaining licenses; and</text> </level> <level label="B"> <text>support to continuously maintain and improve the project or product;</text> </level> </level> <level label="ii"> <text>any schedule, cost, and scope changes since the last annual report;</text> </level> <level label="iii"> <text>a risk assessment provided by either the Department or the designated unit of State government that details the identified project or product risk, including:</text> <level label="1"> <text>a description of the type of risk, including:</text> </level> <level label="A"> <text>governance;</text> </level> <level label="B"> <text>resource availability or capability;</text> </level> <level label="C"> <text>funding;</text> </level> <level label="D"> <text>interdependencies with other systems;</text> </level> <level label="E"> <text>technical issues;</text> </level> <level label="F"> <text>organizational culture; or</text> </level> <level label="G"> <text>ability to support in the long term;</text> </level> <level label="2"> <text>the risk likelihood;</text> </level> <level label="3"> <text>the risk priority;</text> </level> <level label="4"> <text>the risk owner;</text> </level> <level label="5"> <text>planned risk mitigation strategy; and</text> </level> <level label="6"> <text>the risk status as of the report date;</text> </level> </level> <level label="iv"> <text>project tracking metrics, including:</text> <level label="1"> <text>describing the functionality and features that have been delivered as of the report date; and</text> </level> <level label="2"> <text>qualitative and quantitative data showing progress towards project goals; and</text> </level> </level> <level label="v"> <text>any change in the monitoring or oversight status.</text> </level> </level> <level label="2"> <text>The report submitted under this subsection:</text> <level label="i"> <text>is confidential and not subject to disclosure under Title 4 of the General Provisions Article;</text> </level> <level label="ii"> <text>shall communicate the requisite information in a clear and concise manner that, to the greatest extent possible, avoids the use of technical language or reliance on existing industry knowledge; and</text> </level> <level label="iii"> <text>shall include an executive summary of key information, including:</text> <level label="1"> <text>the total value of the portfolio, including:</text> </level> <level label="A"> <text>annual development costs;</text> </level> <level label="B"> <text>funding sources; and</text> </level> <level label="C"> <text>projected ongoing operating costs over the next 5 years; and</text> </level> <level label="2"> <text>a summary of new projects including:</text> </level> <level label="A"> <text>the advantages of the new projects; and</text> </level> <level label="B"> <text>any new or innovative aspects of development processes.</text> </level> </level> </level> </level> <level label="n"> <level label="1"> <text>The Department shall publish and maintain a publicly available project and portfolio dashboard on the Department’s website.</text> </level> <level label="2"> <text>The dashboard shall include all major information technology development projects and expedited projects, organized by the accountable unit of State government.</text> </level> <level label="3"> <text>For each project, the dashboard shall:</text> <level label="i"> <text>specify the schedule management for the project, including:</text> <level label="1"> <text>the project start date;</text> </level> <level label="2"> <text>estimated length of the project, by phase;</text> </level> <level label="3"> <text>planned milestones with estimated completion dates; and</text> </level> <level label="4"> <text>completed milestones with completion dates;</text> </level> </level> <level label="ii"> <text>list the estimated project cost;</text> </level> <level label="iii"> <text>list the total amount appropriated for the current fiscal year;</text> </level> <level label="iv"> <text>list the total amount spent during the prior fiscal year, categorized by:</text> <level label="1"> <text>vendor costs;</text> </level> <level label="2"> <text>agency labor;</text> </level> <level label="3"> <text>software licenses, subscriptions, and other costs;</text> </level> <level label="4"> <text>other expenses; and</text> </level> <level label="5"> <text>total expenditures;</text> </level> </level> <level label="v"> <text>for projects in development:</text> <level label="1"> <text>the prior fiscal year forecast accompanied by actual data and the resulting variance; and</text> </level> <level label="2"> <text>the current year forecast; and</text> </level> </level> <level label="vi"> <text>subject to subsection (o) of this section, identify major project or product risks, including:</text> <level label="1"> <text>risk description;</text> </level> <level label="2"> <text>risk impact;</text> </level> <level label="3"> <text>risk likelihood;</text> </level> <level label="4"> <text>mitigation strategy; and</text> </level> <level label="5"> <text>risk status.</text> </level> </level> </level> </level> <level label="o"> <level label="1"> <text>The Department may redact specific risks identified under subsection (n)(3)(vi) of this section from the public dashboard if the Department determines that public sharing of the information could pose a risk to the project.</text> </level> <level label="2"> <text>If a risk is redacted from the dashboard, the information shall be shared with the Legislative Policy Committee.</text> </level> <level label="3"> <text>A risk redacted from the dashboard is confidential and not subject to disclosure under Title 4 of the General Provisions Article.</text> </level> </level> <level label="p"> <level label="1"> <text>The Secretary may adopt regulations necessary to carry out this section.</text> </level> <level label="2"> <text>The Secretary shall adopt regulations necessary to establish a process for units of State government to request and receive funding for an expedited project aligned with the State Modernization Plan that shall:</text> <level label="i"> <text>allow units of State government to apply for project funding biannually;</text> </level> <level label="ii"> <text>be consistent with the goals and preferences established under Title 14 of this article and encourage small and minority business enterprise vendors; and</text> </level> <level label="iii"> <text>provide measures that ensure compliance with this subtitle and the Department’s regulations by both vendors and units of State government.</text> </level> </level> </level> <level label="q"> <text>The Chief Information Officer for a unit of State government with a planned or ongoing major information technology development project shall meet with the Secretary on a quarterly basis to report on and discuss the ongoing information technology development projects, including:</text> <level label="1"> <text>project budget;</text> </level> <level label="2"> <text>project vendor performance or nonperformance;</text> </level> <level label="3"> <text>project scope;</text> </level> <level label="4"> <text>project schedule;</text> </level> <level label="5"> <text>the capacity of the unit to implement the project; and</text> </level> <level label="6"> <text>any other items the Secretary deems relevant to the successful implementation of the project.</text> </level> </level> </section> <section article="gsf" article_name="State Finance and Procurement" number="3.5-310" title_number="3.5" title_name="Department of Information Technology" subtitle_number="3" subtitle_name="Information Processing"> <text>This subtitle may not be construed to give the Secretary authority over:</text> <level label="1"> <text>the content of educational applications or curriculum at the State or local level; or</text> </level> <level label="2"> <text>the entities that may participate in such educational programs.</text> </level> </section> <section article="gsf" article_name="State Finance and Procurement" number="3.5-311" title_number="3.5" title_name="Department of Information Technology" subtitle_number="3" subtitle_name="Information Processing"> <level label="a"> <level label="1"> <text>The Secretary or the Secretary’s designee, in consultation with other units of State government, and after public comment, shall develop a nonvisual access clause for use in the procurement of information technology and information technology services that specifies that the technology and services:</text> <level label="i"> <text>must provide equivalent access for effective use by both visual and nonvisual means;</text> </level> <level label="ii"> <text>will present information, including prompts used for interactive communications, in formats intended for both visual and nonvisual use;</text> </level> <level label="iii"> <text>can be integrated into networks for obtaining, retrieving, and disseminating information used by individuals who are not blind or visually impaired; and</text> </level> <level label="iv"> <text>shall be obtained, whenever possible, without modification for compatibility with software and hardware for nonvisual access.</text> </level> </level> <level label="2"> <text>On or after January 1, 2020, the nonvisual access clause developed in accordance with paragraph (1) of this subsection shall include a statement that:</text> <level label="i"> <text>within 18 months after the award of the procurement, the Secretary, or the Secretary’s designee, will determine whether the information technology meets the nonvisual access standards adopted in accordance with § 3.5–303(c) of this subtitle;</text> </level> <level label="ii"> <text>if the information technology does not meet the nonvisual access standards, the Secretary, or the Secretary’s designee, will notify the vendor in writing that the vendor, at the vendor’s own expense, has 12 months after the date of the notification to modify the information technology in order to meet the nonvisual access standards; and</text> </level> <level label="iii"> <text>if the vendor fails to modify the information technology to meet the nonvisual access standards within 12 months after the date of the notification, the vendor:</text> <level label="1"> <text>may be subject to a civil penalty of:</text> </level> <level label="A"> <text>for a first offense, a fine not exceeding $5,000; and</text> </level> <level label="B"> <text>for a subsequent offense, a fine not exceeding $10,000; and</text> </level> <level label="2"> <text>shall indemnify the State for liability resulting from the use of information technology that does not meet the nonvisual access standards.</text> </level> </level> </level> </level> <level label="b"> <level label="1"> <text>Except as provided in paragraph (2) of this subsection, the nonvisual access clause required under subsection (a) of this section shall be included in each invitation for bids or request for proposals and in each procurement contract or modification or renewal of a contract issued under Title 13 of this article, without regard to the method chosen under Title 13, Subtitle 1 of this article for the purchase of new or upgraded information technology and information technology services.</text> </level> <level label="2"> <text>Except as provided in subsection (a)(1)(iv) of this section, the nonvisual access clause required under paragraph (1) of this subsection is not required if:</text> <level label="i"> <text>the information technology is not available with nonvisual access because the essential elements of the information technology are visual and nonvisual equivalence cannot be developed; or</text> </level> <level label="ii"> <text>the cost of modifying the information technology for compatibility with software and hardware for nonvisual access would increase the price of the procurement by more than 15%.</text> </level> </level> </level> </section> <section article="gsf" article_name="State Finance and Procurement" number="3.5-312" title_number="3.5" title_name="Department of Information Technology" subtitle_number="3" subtitle_name="Information Processing"> <text>The Secretary may delegate the duties set forth in this subtitle to carry out its purposes.</text> </section> <section article="gsf" article_name="State Finance and Procurement" number="3.5-313" title_number="3.5" title_name="Department of Information Technology" subtitle_number="3" subtitle_name="Information Processing"> <level label="a"> <level label="1"> <text>In this section the following words have the meanings indicated.</text> </level> <level label="2"> <text>“Agency” includes a unit of State government that receives funds that are not appropriated in the annual budget bill.</text> </level> <level label="3"> <level label="i"> <text>“Payee” means any party who receives from the State an aggregate payment of $25,000 in a fiscal year.</text> </level> <level label="ii"> <text>“Payee” does not include:</text> <level label="1"> <text>a State employee with respect to the employee’s compensation; or</text> </level> <level label="2"> <text>a State retiree with respect to the retiree’s retirement allowance.</text> </level> </level> </level> <level label="4"> <text>“Searchable website” means a website created in accordance with this section that displays and searches State payment data.</text> </level> </level> <level label="b"> <level label="1"> <text>The Department shall develop and operate a single searchable website, accessible to the public at no cost through the Internet.</text> </level> <level label="2"> <text>On or before the 15th day of the month that follows the month in which an agency makes a payment to a payee, the Department shall update the payment data on the searchable website.</text> </level> </level> <level label="c"> <text>The searchable website shall contain State payment data, including:</text> <level label="1"> <text>the name of a payee receiving a payment;</text> </level> <level label="2"> <text>the location of a payee by postal zip code;</text> </level> <level label="3"> <text>the amount of a payment; and</text> </level> <level label="4"> <text>the name of an agency making a payment.</text> </level> </level> <level label="d"> <text>The searchable website shall allow the user to:</text> <level label="1"> <text>search data for fiscal year 2008 and each year thereafter; and</text> </level> <level label="2"> <text>search by the following data fields:</text> <level label="i"> <text>a payee receiving a payment;</text> </level> <level label="ii"> <text>an agency making a payment; and</text> </level> <level label="iii"> <text>the zip code of a payee receiving a payment.</text> </level> </level> </level> <level label="e"> <text>State agencies shall provide appropriate assistance to the Secretary to ensure the existence and ongoing operation of the single website.</text> </level> <level label="f"> <text>This section may not be construed to require the disclosure of information that is confidential under State or federal law.</text> </level> <level label="g"> <text>This section shall be known and may be cited as the “Maryland Funding Accountability and Transparency Act”.</text> </level> </section> <section article="gsf" article_name="State Finance and Procurement" number="3.5-314" title_number="3.5" title_name="Department of Information Technology" subtitle_number="3" subtitle_name="Information Processing"> <level label="a"> <text>In this section, “security–sensitive data” means information that is protected against unwarranted disclosure.</text> </level> <level label="b"> <text>In accordance with guidelines established by the Secretary, each unit of State government shall develop a plan to:</text> <level label="1"> <text>identify unit personnel who handle security–sensitive data; and</text> </level> <level label="2"> <text>establish annual security overview training or refresher security training for each employee who handles security–sensitive data as part of the employee’s duties.</text> </level> </level> </section> <section article="gsf" article_name="State Finance and Procurement" number="3.5-315" title_number="3.5" title_name="Department of Information Technology" subtitle_number="3" subtitle_name="Information Processing"> <level label="a"> <text>There is an Information Sharing and Analysis Center in the Department.</text> </level> <level label="b"> <text>The Information Sharing and Analysis Center shall:</text> <level label="1"> <text>coordinate information on cybersecurity by serving as a central location for information sharing across State and local government, federal government partners, and private entities;</text> </level> <level label="2"> <text>with the Office of Security Management, support cybersecurity coordination between local units of government through existing local government stakeholder organizations;</text> </level> <level label="3"> <text>provide support to the State Chief Information Security Officer and the Cyber Preparedness Unit, in the Maryland Department of Emergency Management, during cybersecurity incidents that affect State and local governments;</text> </level> <level label="4"> <text>support risk–based planning for the use of federal resources; and</text> </level> <level label="5"> <text>conduct analyses of cybersecurity incidents.</text> </level> </level> </section> <section article="gsf" article_name="State Finance and Procurement" number="3.5-317" title_number="3.5" title_name="Department of Information Technology" subtitle_number="3" subtitle_name="Information Processing"> <level label="a"> <text>This section does not apply to:</text> <level label="1"> <text>the Maryland Port Administration;</text> </level> <level label="2"> <text>the University System of Maryland;</text> </level> <level label="3"> <text>St. Mary’s College of Maryland;</text> </level> <level label="4"> <text>Morgan State University;</text> </level> <level label="5"> <text>the Maryland Stadium Authority;</text> </level> <level label="6"> <text>Baltimore City Community College;</text> </level> <level label="7"> <text>the State Board of Elections;</text> </level> <level label="8"> <text>the Office of the Attorney General;</text> </level> <level label="9"> <text>the Comptroller; or</text> </level> <level label="10"> <text>the State Treasurer.</text> </level> </level> <level label="b"> <level label="1"> <text>The Department shall hire independent contractors to:</text> <level label="i"> <text>develop a framework for investments in technology; and</text> </level> <level label="ii"> <text>at least once every 2 years, in accordance with the framework, assess the cybersecurity and information technology systems in each unit of State government.</text> </level> </level> <level label="2"> <text>The framework shall include the following criteria:</text> <level label="i"> <text>security risks to the system;</text> </level> <level label="ii"> <text>system performance;</text> </level> <level label="iii"> <text>the system’s dependence on other information technology or cybersecurity systems and data;</text> </level> <level label="iv"> <text>the system’s ability to create an efficient and seamless experience for users;</text> </level> <level label="v"> <text>the system’s effectiveness in achieving unit objectives;</text> </level> <level label="vi"> <text>the system’s effectiveness in meeting the needs of citizens and customers;</text> </level> <level label="vii"> <text>the costs to maintain and operate the system;</text> </level> <level label="viii"> <text>the speed of government response time;</text> </level> <level label="ix"> <text>the effectiveness of the system in regard to the unit’s objectives;</text> </level> <level label="x"> <text>improvements to the unit’s relative audit findings attributable to the system; and</text> </level> <level label="xi"> <text>an assessment of the system using the National Institute of Standards and Technology Cybersecurity Framework.</text> </level> </level> </level> <level label="c"> <text>Each unit shall promptly provide a contractor employed under subsection (b) of this section with the information necessary to perform the assessments.</text> </level> <level label="d"> <level label="1"> <text>Every 2 years, a contractor shall provide the results of the assessments to:</text> <level label="i"> <text>the Modernize Maryland Commission established under § 3.5–316 of this subtitle; and</text> </level> <level label="ii"> <text>in accordance with § 2–1257 of the State Government Article, the Senate Budget and Taxation Committee, the Senate Committee on Education, Energy, and the Environment, and the House Health and Government Operations Committee.</text> </level> </level> <level label="2"> <text>The report submitted under paragraph (1)(ii) of this subsection may not contain information about the security of an information system.</text> </level> </level> <level label="e"> <text>The Department may use multiple contractors at a time to meet the requirements of this section.</text> </level> </section> <section article="gsf" article_name="State Finance and Procurement" number="3.5-318" title_number="3.5" title_name="Department of Information Technology" subtitle_number="3" subtitle_name="Information Processing"> <level label="a"> <text>On or before December 1, 2024, and annually thereafter, each unit of State government shall conduct a data inventory that identifies data that meets the criteria established by the Chief Data Officer and that is:</text> <level label="1"> <level label="i"> <text>necessary for the operation of the unit; or</text> </level> <level label="ii"> <text>otherwise required to be collected:</text> <level label="1"> <text>as a condition to receive federal funds; or</text> </level> <level label="2"> <text>by federal or State law; and</text> </level> </level> </level> <level label="2"> <text>in a form prescribed by the Chief Data Officer, including when the data is used in artificial intelligence.</text> </level> </level> <level label="b"> <text>The Department shall develop and publish guidance on the policies and procedures for the inventory.</text> </level> </section> <section article="gsf" article_name="State Finance and Procurement" number="3.5-319" title_number="3.5" title_name="Department of Information Technology" subtitle_number="3" subtitle_name="Information Processing"> <level label="a"> <text>Each unit of State government shall designate a Privacy Officer to oversee compliance with this subtitle and coordinate with the Department and the Office of the Attorney General.</text> </level> <level label="b"> <text>The Department shall adopt regulations, guidance, and model templates to support compliance with this subtitle, including standard Public Information Act formats and data protection protocols.</text> </level> </section> <section article="gsf" article_name="State Finance and Procurement" number="3.5-401" title_number="3.5" title_name="Department of Information Technology" subtitle_number="4"> <level label="a"> <text>The Department shall:</text> <level label="1"> <text>coordinate the development, management, and operation of telecommunication equipment, systems, and services by State government;</text> </level> <level label="2"> <text>acquire and manage common user telecommunication equipment, systems, or services and charge units of State government for their proportionate share of the costs of installation, maintenance, and operation of the common user telecommunication equipment, systems, or services;</text> </level> <level label="3"> <text>promote compatibility of telecommunication systems by developing policies, procedures, and standards for the acquisition and use of telecommunication equipment, systems, and services by units of State government;</text> </level> <level label="4"> <text>coordinate State government telecommunication systems and services by reviewing requests by units of State government for telecommunication equipment, systems, or services;</text> </level> <level label="5"> <text>advise units of State government about planning, acquisition, and operation of telecommunication equipment, systems, or services; and</text> </level> <level label="6"> <text>provide radio frequency coordination for State and local governments in accordance with regulations of the Federal Communications Commission.</text> </level> </level> <level label="b"> <text>The Department may make arrangement for a user other than a unit of State government to have access to and use of State telecommunication equipment, systems, and services and shall charge the user any appropriate amount to cover the cost of installation, maintenance, and operation of the telecommunication equipment, system, or service provided.</text> </level> </section> <section article="gsf" article_name="State Finance and Procurement" number="3.5-402" title_number="3.5" title_name="Department of Information Technology" subtitle_number="4"> <level label="a"> <text>The provisions of this subtitle do not apply to a telecommunication system or service that is owned or operated by the University System of Maryland, Morgan State University, Baltimore City Community College, or a unit of the Legislative or Judicial Branch.</text> </level> <level label="b"> <text>The provisions of this subtitle do not preempt the authority of the Maryland Public Broadcasting Commission to own, operate, or manage telecommunication equipment, systems, or services.</text> </level> </section> <section article="gsf" article_name="State Finance and Procurement" number="3.5-403" title_number="3.5" title_name="Department of Information Technology" subtitle_number="4"> <text>Telecommunications, including those of the Maryland Public Broadcasting System, shall be consistent with statewide information technology policies and standards and the statewide information technology master plan.</text> </section> <section article="gsf" article_name="State Finance and Procurement" number="3.5-404" title_number="3.5" title_name="Department of Information Technology" subtitle_number="4"> <level label="a"> <text>The General Assembly declares that:</text> <level label="1"> <text>it is the policy of the State to foster telecommunication and computer networking among State and local governments, their agencies, and educational institutions in the State;</text> </level> <level label="2"> <text>there is a need to improve access, especially in rural areas, to efficient telecommunication and computer network connections;</text> </level> <level label="3"> <text>improvement of telecommunication and computer networking for State and local governments and educational institutions promotes economic development, educational resource use and development, and efficiency in State and local administration;</text> </level> <level label="4"> <text>rates for the intrastate inter–LATA telephone communications needed for effective integration of telecommunication and computer resources are prohibitive for many smaller governments, agencies, and institutions; and</text> </level> <level label="5"> <text>the use of improved State telecommunication and computer networking under this section is intended not to compete with commercial access to advanced network technology, but rather to foster fundamental efficiencies in government and education for the public good.</text> </level> </level> <level label="b"> <level label="1"> <text>The Department shall establish a telecommunication and computer network in the State.</text> </level> <level label="2"> <text>The network shall consist of:</text> <level label="i"> <text>one or more connection facilities for telecommunication and computer connection in each local access transport area (LATA) in the State; and</text> </level> <level label="ii"> <text>facilities, auxiliary equipment, and services required to support the network in a reliable and secure manner.</text> </level> </level> </level> <level label="c"> <text>The network shall be accessible through direct connection and through local intra–LATA telecommunications to State and local governments and public and private educational institutions in the State.</text> </level> <level label="d"> <text>In a manner and frequency established in regulations adopted by the Department, each unit of local government and any local agencies that use the network established under subsection (b) of this section shall certify to the Department that the unit is in compliance with the Department’s minimum security standards.</text> </level> <level label="e"> <level label="1"> <text>The Office shall ensure that at least once every 2 years, or more often if required by regulations adopted by the Department, each unit of State government shall complete an external assessment.</text> </level> <level label="2"> <text>The Office shall assist each unit to remediate any security vulnerabilities or high–risk configurations identified in the assessment required under paragraph (1) of this subsection.</text> </level> </level> <level label="f"> <level label="1"> <text>In this subsection, “IT unit” means a unit of the Legislative Branch or Judicial Branch of State government, the Office of the Attorney General, the Office of the Comptroller, or the Office of the State Treasurer that provides information technology services for another unit of government.</text> </level> <level label="2"> <text>Each IT unit shall:</text> <level label="i"> <text>be evaluated by an independent auditor with cybersecurity expertise to determine whether the IT unit, and the units it provides information technology services for, meet relevant cybersecurity standards recommended by the National Institute of Standards and Technology; and</text> </level> <level label="ii"> <text>certify compliance with the recommended National Institutes of Standards and Technology cybersecurity standards to:</text> <level label="1"> <text>if the IT unit is part of the Legislative Branch, the President of the Senate and the Speaker of the House;</text> </level> <level label="2"> <text>if the IT unit is part of the Office of the Attorney General, to the Attorney General;</text> </level> <level label="3"> <text>if the IT unit is part of the Comptroller’s Office, to the Comptroller;</text> </level> <level label="4"> <text>if the IT unit is part of the State Treasurer’s Office, to the State Treasurer; and</text> </level> <level label="5"> <text>if the IT unit is part of the Judicial Branch of State government, the Chief Judge.</text> </level> </level> </level> </level> </section> <section article="gsf" article_name="State Finance and Procurement" number="3.5-405" title_number="3.5" title_name="Department of Information Technology" subtitle_number="4"> <level label="a"> <text>On or before December 1 each year, each unit of State government shall:</text> <level label="1"> <text>report the results of any cybersecurity preparedness assessments performed in the prior year to the Office of Security Management in accordance with guidelines developed by the Office; and</text> </level> <level label="2"> <text>submit a report to the Governor and the Office of Security Management that includes:</text> <level label="i"> <text>an inventory of all information systems and applications used or maintained by the unit;</text> </level> <level label="ii"> <text>a full data inventory of the unit;</text> </level> <level label="iii"> <text>a list of all cloud or statistical analysis system solutions used by the unit;</text> </level> <level label="iv"> <text>a list of all permanent and transient vendor interconnections that are in place;</text> </level> <level label="v"> <text>the number of unit employees who have received cybersecurity training;</text> </level> <level label="vi"> <text>the total number of unit employees who use the network;</text> </level> <level label="vii"> <text>the number of information technology staff positions, including vacancies;</text> </level> <level label="viii"> <text>the number of noninformation technology staff positions, including vacancies;</text> </level> <level label="ix"> <text>the unit’s information technology budget, itemized to include the following categories:</text> <level label="1"> <text>services;</text> </level> <level label="2"> <text>equipment;</text> </level> <level label="3"> <text>applications;</text> </level> <level label="4"> <text>personnel;</text> </level> <level label="5"> <text>software licensing;</text> </level> <level label="6"> <text>development;</text> </level> <level label="7"> <text>network projects;</text> </level> <level label="8"> <text>maintenance; and</text> </level> <level label="9"> <text>cybersecurity;</text> </level> </level> <level label="x"> <text>any major information technology initiatives to modernize the unit’s information technology systems or improve customer access to State and local services;</text> </level> <level label="xi"> <text>the unit’s plans for future fiscal years to implement the unit’s information technology goals;</text> </level> <level label="xii"> <text>compliance with timelines and metrics provided in the Department’s master plan; and</text> </level> <level label="xiii"> <text>any other key performance indicators required by the Office of Security Management to track compliance or consistency with the Department’s statewide information technology master plan.</text> </level> </level> </level> <level label="b"> <level label="1"> <text>Each unit of State government shall report a cybersecurity incident in accordance with paragraph (2) of this subsection to the State Chief Information Security Officer.</text> </level> <level label="2"> <text>For the reporting of cybersecurity incidents under paragraph (1) of this subsection, the State Chief Information Security Officer shall determine:</text> <level label="i"> <text>the criteria for determining when an incident must be reported;</text> </level> <level label="ii"> <text>the manner in which to report; and</text> </level> <level label="iii"> <text>the time period within which a report must be made.</text> </level> </level> </level> </section> <section article="gsf" article_name="State Finance and Procurement" number="3.5-406" title_number="3.5" title_name="Department of Information Technology" subtitle_number="4"> <level label="a"> <text>This section does not apply to municipal governments.</text> </level> <level label="b"> <text>In a manner and frequency established in regulations adopted by the Department, each county government, local school system, and local health department shall:</text> <level label="1"> <text>in consultation with the local emergency manager, create or update a cybersecurity preparedness and response plan; and</text> </level> <level label="2"> <text>complete a cybersecurity preparedness assessment.</text> </level> </level> <level label="c"> <text>The assessment required under paragraph (b)(2) of this section may, in accordance with the preference of each county government, be performed by the Department or by a vendor authorized by the Department.</text> </level> <level label="d"> <level label="1"> <text>On request, the Department shall advise local school systems on:</text> <level label="i"> <text>compliance with the State minimum cybersecurity standards;</text> </level> <level label="ii"> <text>conducting cybersecurity maturity assessments every 2 years; and</text> </level> <level label="iii"> <text>remediation efforts.</text> </level> </level> <level label="2"> <text>The Department is not responsible for the successful performance of or day–to–day management of the duties of a local school system described in paragraph (1) of this subsection.</text> </level> </level> <level label="e"> <level label="1"> <text>Each local government shall report a cybersecurity incident, including an attack on a State system being used by the local government, to the appropriate local emergency manager and the State Security Operations Center in the Department in accordance with paragraph (2) of this subsection.</text> </level> <level label="2"> <text>For the reporting of cybersecurity incidents to local emergency managers under paragraph (1) of this subsection, the State Chief Information Security Officer shall determine:</text> <level label="i"> <text>the criteria for determining when an incident must be reported;</text> </level> <level label="ii"> <text>the manner in which to report; and</text> </level> <level label="iii"> <text>the time period within which a report must be made.</text> </level> </level> <level label="3"> <text>The State Security Operations Center shall immediately notify the appropriate agencies of a cybersecurity incident reported under this subsection through the State Security Operations Center.</text> </level> </level> </section> <section article="gsf" article_name="State Finance and Procurement" number="3.5-701" title_number="3.5" title_name="Department of Information Technology" subtitle_number="7" subtitle_name="Senior Call–check and Social Connections Program"> <level label="a"> <text>In this subtitle the following words have the meanings indicated.</text> </level> <level label="b"> <text>“Eligible participant” means a resident of the State who is at least 60 years old.</text> </level> <level label="c"> <text>“Person of record” includes a local law enforcement unit or other local government agency or a designee of the participant that chooses to participate in the Program.</text> </level> <level label="d"> <text>“Program” means the Senior Call–Check and Social Connections Program.</text> </level> <level label="e"> <level label="1"> <text>“Senior call–check and social connections” means regular, direct communication from the Department of Aging or the Department of Aging’s designee to an eligible participant.</text> </level> <level label="2"> <text>“Senior call–check and social connections” includes:</text> <level label="i"> <text>an automated or live telephone call or other direct communication initiated by an eligible participant or received by an eligible participant at a regularly scheduled time each day;</text> </level> <level label="ii"> <text>if the eligible participant does not answer or initiate the regularly scheduled call or other direct communication and the Secretary of Aging designs the Program to require this action, one or more automated or live telephone calls or other direct communications to the eligible participant;</text> </level> <level label="iii"> <text>if the eligible participant does not answer a telephone call or other direct communication made under item (ii) of this paragraph, an additional automated or live telephone call or other direct communication to notify a person of record whose name has been provided to the Department of Aging; and</text> </level> <level label="iv"> <text>a notification to the eligible participant regarding information that the Secretary of Aging has determined to be relevant.</text> </level> </level> </level> <level label="f"> <text>“Regular, direct communication” means regular interactions initiated or received by the Department of Aging or the Department’s designee that:</text> <level label="1"> <text>may include telephone calls, text messages, web–based, virtual, video, or in–person communications, and other forms of communication approved by the Department; and</text> </level> <level label="2"> <text>are accessible to eligible participants with disabilities.</text> </level> </level> <level label="g"> <text>“Village” means local, volunteer–led organizations that aim to support community members who choose to age in place, including by:</text> <level label="1"> <text>organizing events; and</text> </level> <level label="2"> <text>fostering social connections through activities and coordinating volunteer help at home using the neighbor–helping–neighbor model.</text> </level> </level> </section> <section article="gsf" article_name="State Finance and Procurement" number="3.5-702" title_number="3.5" title_name="Department of Information Technology" subtitle_number="7" subtitle_name="Senior Call–check and Social Connections Program"> <level label="a"> <text>The Department of Aging shall:</text> <level label="1"> <text>establish and administer the Program to provide senior call–check and social connections to eligible participants; and</text> </level> <level label="2"> <text>adopt regulations necessary to implement the Program.</text> </level> </level> <level label="b"> <text>The purpose of the Program is to provide regular, direct communication from the Department of Aging or the Department’s designee to an eligible participant to promote wellness and purposeful social engagement.</text> </level> <level label="c"> <text>The Department of Aging shall integrate services with the Telecommunications Access of Maryland Program established under § 7–902 of the Human Services Article by promoting awareness of the availability of accessible telecommunications equipment and using educational outreach materials produced by the Telecommunications Access of Maryland Program.</text> </level> <level label="d"> <level label="1"> <text>The Department of Aging may enter into agreements or contracts as appropriate with a private vendor, a nonprofit organization, a village incorporated in and serving older adults in the State, an area agency on aging, or any other person to provide Program services.</text> </level> <level label="2"> <text>The Department of Aging may enter into interagency agreements with other State or local governmental entities to provide Program services.</text> </level> <level label="3"> <text>The Department of Aging may accept funds provided by other public and private sources, including gifts and grants to be used to provide Program services.</text> </level> </level> <level label="e"> <level label="1"> <text>The State Tort Claims Act and the Local Government Tort Claims Act, as appropriate, apply to a State or local unit and to an employee or agent of a State or local unit that participates in the Program for services the unit or person provides under the Program in accordance with regulations of the Department of Aging.</text> </level> <level label="2"> <text>A person of record, a private vendor, a nonprofit organization, a village incorporated in and serving older adults in the State, an area agency on aging, any other entity under an agreement or contract with the Department, or a volunteer may not be liable for reasonable acts or omissions directly arising from services provided under the Program in accordance with regulations of the Department of Aging.</text> </level> </level> </section> <section article="gsf" article_name="State Finance and Procurement" number="3.5-801" title_number="3.5" title_name="Department of Information Technology" subtitle_number="8" subtitle_name="Internship and Registered Apprenticeship Program"> <level label="a"> <text>In this subtitle the following words have the meanings indicated.</text> </level> <level label="b"> <level label="1"> <text>“Algorithmic decision system” means a computational process that facilitates decision making.</text> </level> <level label="2"> <text>“Algorithmic decision system” includes decisions derived from machines, statistics, facial recognition, and decisions on paper.</text> </level> </level> <level label="c"> <text>“Artificial intelligence” means a machine–based system that:</text> <level label="1"> <text>can, for a given set of human–defined objectives, make predictions, recommendations, or decisions influencing real or virtual environments;</text> </level> <level label="2"> <text>uses machine and human–based inputs to perceive real and virtual environments and abstracts those perceptions into models through analysis in an automated manner; and</text> </level> <level label="3"> <text>uses model inference to formulate options for information or action.</text> </level> </level> <level label="d"> <level label="1"> <text>“High–risk artificial intelligence” means artificial intelligence that is a risk to individuals or communities, as defined under regulations adopted by the Department in consultation with the Governor’s Artificial Intelligence Subcabinet.</text> </level> <level label="2"> <text>“High–risk artificial intelligence” includes rights–impacting artificial intelligence and safety–impacting artificial intelligence.</text> </level> </level> <level label="e"> <text>“Impact assessment” means an assessment of artificial intelligence systems made under regulations adopted by the Department in consultation with the Governor’s Artificial Intelligence Subcabinet and required under § 3.5–803 of this subtitle.</text> </level> <level label="f"> <text>“Public senior higher education institution” means:</text> <level label="1"> <text>the constituent institutions of the University System of Maryland and the University of Maryland Center for Environmental Science;</text> </level> <level label="2"> <text>Morgan State University; or</text> </level> <level label="3"> <text>St. Mary’s College of Maryland.</text> </level> </level> <level label="g"> <text>“Rights–impacting artificial intelligence” means artificial intelligence whose output serves as a basis for decision or action that is significantly likely to affect civil rights, civil liberties, equal opportunities, access to critical resources, or privacy.</text> </level> <level label="h"> <text>“Safety–impacting artificial intelligence” means artificial intelligence that has the potential to significantly impact the safety of human life, well–being, or critical infrastructure.</text> </level> </section> <section article="gsf" article_name="State Finance and Procurement" number="3.5-802" title_number="3.5" title_name="Department of Information Technology" subtitle_number="8" subtitle_name="Internship and Registered Apprenticeship Program"> <level label="a"> <level label="1"> <text>Except as provided in paragraph (2) of this subsection, this subtitle does not apply to:</text> <level label="i"> <text>the Office of the Attorney General;</text> </level> <level label="ii"> <text>the Comptroller; or</text> </level> <level label="iii"> <text>the State Treasurer.</text> </level> </level> <level label="2"> <text>On or before June 1, 2025, each entity listed under paragraph (1) of this subsection shall establish policies and procedures that are functionally compatible with the policies and procedures adopted under § 3.5–804(a) of this subtitle for the development, procurement, deployment, use, and ongoing assessment of systems that employ high–risk artificial intelligence.</text> </level> </level> <level label="b"> <level label="1"> <text>Except as provided in paragraph (2) of this subsection, this subtitle applies to each public senior higher education institution and Baltimore City Community College.</text> </level> <level label="2"> <text>This subtitle does not apply to artificial intelligence deployed by a public senior higher education institution or Baltimore City Community College that is used solely for a research or academic purpose, including in partnership with a unit of State government for the development, procurement, deployment, or use of artificial intelligence.</text> </level> <level label="3"> <text>On or before June 1, 2025, each public senior higher education institution and Baltimore City Community College shall establish policies and procedures that are functionally compatible with the policies and procedures adopted under § 3.5–804(a) of this subtitle for the development, procurement, deployment, use, and ongoing assessment of systems that employ high–risk artificial intelligence used solely for a research or academic purpose.</text> </level> <level label="4"> <text>On or before September 1, 2025, and each year thereafter, each public senior higher education institution and Baltimore City Community College shall submit to the Department a report on all high–risk artificial intelligence procured and deployed for a research or academic purpose.</text> </level> </level> </section> <section article="gsf" article_name="State Finance and Procurement" number="3.5-803" title_number="3.5" title_name="Department of Information Technology" subtitle_number="8" subtitle_name="Internship and Registered Apprenticeship Program"> <level label="a"> <text>On or before December 1, 2025, and regularly thereafter, each unit of State government shall:</text> <level label="1"> <text>conduct an inventory of systems that employ high–risk artificial intelligence; and</text> </level> <level label="2"> <text>provide the inventory to the Department in a format required by the Department.</text> </level> </level> <level label="b"> <text>For each system, the inventory required by this section shall include:</text> <level label="1"> <text>the name of the system;</text> </level> <level label="2"> <text>the vendor that provided the system, if applicable;</text> </level> <level label="3"> <text>a description of the capabilities of the system;</text> </level> <level label="4"> <text>a statement of the purpose and the intended uses of the system;</text> </level> <level label="5"> <text>whether the system underwent an impact assessment prior to being deployed;</text> </level> <level label="6"> <text>whether the system is used to independently make a decision or judgment or to inform or support a decision or judgment determined by the Department to involve high–risk artificial intelligence; and</text> </level> <level label="7"> <text>a summary of the results of the most recent impact assessment.</text> </level> </level> <level label="c"> <text>The Department shall make an aggregated statewide inventory publicly available on its website.</text> </level> <level label="d"> <level label="1"> <text>The Department may not make publicly available on the Department’s website information from the inventories required by this section that relate to the safety and security of State systems if the publication of the information is likely to compromise the security or integrity of the system.</text> </level> <level label="2"> <text>On request, the Department shall provide to the Governor, members of the General Assembly, and law enforcement the information described in paragraph (1) of this subsection.</text> </level> </level> <level label="e"> <level label="1"> <text>On or before December 31, 2026, each unit of State government shall conduct an impact assessment of a system procured on or after February 1, 2026, that involves high–risk artificial intelligence.</text> </level> <level label="2"> <text>On or before July 1, 2027, each unit of State government shall conduct an impact assessment of a system procured before February 1, 2026, that involves high–risk artificial intelligence.</text> </level> </level> </section> <section article="gsf" article_name="State Finance and Procurement" number="3.5-804" title_number="3.5" title_name="Department of Information Technology" subtitle_number="8" subtitle_name="Internship and Registered Apprenticeship Program"> <level label="a"> <text>On or before December 1, 2024, the Department, in consultation with the Governor’s Artificial Intelligence Subcabinet, shall adopt policies and procedures concerning the development, procurement, deployment, use, and ongoing assessment of systems that employ high–risk artificial intelligence by a unit of State government.</text> </level> <level label="b"> <text>The policies and procedures required by subsection (a) of this section shall:</text> <level label="1"> <text>subject to any other applicable law, govern the procurement, deployment, and ongoing assessment of systems that employ high–risk artificial intelligence by a unit of State government;</text> </level> <level label="2"> <text>define the criteria for an inventory of systems that employ high–risk artificial intelligence;</text> </level> <level label="3"> <text>be sufficient to ensure that the use of any system that employs artificial intelligence by a unit of State government is governed by adequate guardrails to protect individuals and communities;</text> </level> <level label="4"> <text>if the Department is notified that an individual or group of individuals may have been negatively impacted by a system that employs high–risk artificial intelligence, require the Department to:</text> <level label="i"> <text>notify an individual or a group of individuals determined to have been negatively impacted; and</text> </level> <level label="ii"> <text>provide guidance to an individual or a group of individuals determined to have been negatively impacted on available options to opt out of the system; and</text> </level> </level> <level label="5"> <text>provide guidance to units of State government on procurement of a system that employs high–risk artificial intelligence that ensures data privacy and compliance with applicable statutes and regulations.</text> </level> </level> <level label="c"> <text>The Department shall make the policies and procedures required by subsection (a) of this section publicly available on its website within 45 days after the policies and procedures are adopted.</text> </level> </section> <section article="gsf" article_name="State Finance and Procurement" number="3.5-805" title_number="3.5" title_name="Department of Information Technology" subtitle_number="8" subtitle_name="Internship and Registered Apprenticeship Program"> <level label="a"> <text>Beginning July 1, 2025, a unit of State government may not procure or deploy a new system that employs artificial intelligence unless the system complies with the policies and procedures adopted under § 3.5–804 of this subtitle.</text> </level> <level label="b"> <text>A unit of State government that employs high–risk artificial intelligence shall conduct regular impact assessments, as determined by the Governor’s Artificial Intelligence Subcabinet of the Governor’s Executive Council.</text> </level> </section> <section article="gsf" article_name="State Finance and Procurement" number="3.5-806" title_number="3.5" title_name="Department of Information Technology" subtitle_number="8" subtitle_name="Internship and Registered Apprenticeship Program"> <level label="a"> <text>There is a Governor’s Artificial Intelligence Subcabinet of the Governor’s Executive Council.</text> </level> <level label="b"> <text>The purpose of the Subcabinet is to facilitate and enhance cooperation among units of State government, in consultation with academic institutions and industries utilizing artificial intelligence.</text> </level> <level label="c"> <text>The Subcabinet consists of the following members:</text> <level label="1"> <text>the Secretary, or the Secretary’s designee;</text> </level> <level label="2"> <text>the Secretary of Budget and Management, or the Secretary’s designee;</text> </level> <level label="3"> <text>the Secretary of General Services, or the Secretary’s designee;</text> </level> <level label="4"> <text>the Secretary of Labor, or the Secretary’s designee;</text> </level> <level label="5"> <text>the Secretary of Commerce, or the Secretary’s designee;</text> </level> <level label="6"> <text>the Director of the Governor’s Office of Homeland Security, or the Director’s designee;</text> </level> <level label="7"> <text>the Chief Privacy Officer, or the Chief Privacy Officer’s designee;</text> </level> <level label="8"> <text>the Chief Data Officer, or the Chief Data Officer’s designee;</text> </level> <level label="9"> <text>the Chief Information Security Officer, or the Chief Information Security Officer’s designee;</text> </level> <level label="10"> <text>the Governor’s Senior Advisor for Responsible Artificial Intelligence, or the Senior Advisor’s designee; and</text> </level> <level label="11"> <text>any other member of the Governor’s Executive Council, appointed by the Governor.</text> </level> </level> <level label="d"> <text>The Secretary shall chair the Subcabinet.</text> </level> <level label="e"> <text>The Subcabinet shall:</text> <level label="1"> <text>develop strategy, policy, and monitoring processes for responsible and productive use of artificial intelligence and associated data by units of State government;</text> </level> <level label="2"> <text>oversee the State’s implementation of:</text> <level label="i"> <text>artificial intelligence inventory;</text> </level> <level label="ii"> <text>artificial intelligence impact assessments;</text> </level> <level label="iii"> <text>monitoring of high–risk artificial intelligence; and</text> </level> <level label="iv"> <text>compliance with State policies and procedures;</text> </level> </level> <level label="3"> <text>support artificial intelligence and data innovation across units of State government;</text> </level> <level label="4"> <text>develop and implement a comprehensive action plan for responsible and productive use of artificial intelligence and associated data by units of State government;</text> </level> <level label="5"> <text>establish partnerships, memoranda of understanding, and contracts to support the aims of this section;</text> </level> <level label="6"> <text>promote artificial intelligence knowledge, skills, and talent in State government; and</text> </level> <level label="7"> <text>identify artificial intelligence use cases and build foundational infrastructure by requiring:</text> <level label="i"> <text>the Department to evaluate relevant infrastructure to safely, securely, and efficiently test artificial intelligence proofs of concept and pilots;</text> </level> <level label="ii"> <text>the Department of General Services, in consultation with the Department, to create a model for running and procuring artificial intelligence proofs of concept and pilots, in accordance with State laws, regulations, and policies; and</text> </level> <level label="iii"> <text>the Department, in consultation with the Subcabinet, to coordinate with agencies to provide support in identifying and prioritizing use cases and executing proofs of concept and pilots aligned with the Governor’s priorities.</text> </level> </level> </level> <level label="f"> <text>The Subcabinet may request research to be completed under § 14–111 of the Education Article.</text> </level> <level label="g"> <text>The Governor shall provide the Subcabinet with sufficient resources to perform the functions of this section.</text> </level> </section> <section article="gsf" article_name="State Finance and Procurement" number="3.5-807" effective_note="EFFECTIVE UNTIL JUNE 30, 2029 PER CHAPTER 105 OF 2025" title_number="3.5" title_name="Department of Information Technology" subtitle_number="8" subtitle_name="Internship and Registered Apprenticeship Program"> <level label="a"> <text>There is a Workgroup on Artificial Intelligence Implementation.</text> </level> <level label="b"> <text>The Workgroup consists of the following members:</text> <level label="1"> <text>two members of the Senate of Maryland, appointed by the President of the Senate;</text> </level> <level label="2"> <text>two members of the House of Delegates, appointed by the Speaker of the House;</text> </level> <level label="3"> <text>the Attorney General, or the Attorney General’s designee;</text> </level> <level label="4"> <text>the Chief Executive Officer of the Maryland Technology Development Corporation, or the Chief Executive Officer’s designee; and</text> </level> <level label="5"> <level label="i"> <text>the following members, appointed by the Governor:</text> <level label="1"> <text>three representatives from the Maryland Technology Council;</text> </level> <level label="2"> <text>two representatives from the e–commerce industry;</text> </level> <level label="3"> <text>two representatives from the biotechnology industry;</text> </level> <level label="4"> <text>two representatives from the real estate community;</text> </level> <level label="5"> <text>two representatives from the health care sector, including at least one representative with clinical experience;</text> </level> <level label="6"> <text>two representatives from the education sector;</text> </level> <level label="7"> <text>three representatives from academia with expertise in the development, operation, or social implications of data science, artificial intelligence, or machine learning;</text> </level> <level label="8"> <text>two representatives from nonprofit organizations that focus on civil rights and liberties; and</text> </level> <level label="9"> <text>one representative from the Maryland Veterans Chamber of Commerce with artificial intelligence expertise;</text> </level> </level> <level label="ii"> <text>the following members, appointed by the President of the Senate:</text> <level label="1"> <text>two representatives from nonprofit organizations with artificial intelligence expertise that focus on consumer protections; and</text> </level> <level label="2"> <text>two representatives from the cybersecurity sector with expertise in artificial intelligence; and</text> </level> </level> <level label="iii"> <text>the following members, appointed by the Speaker of the House:</text> <level label="1"> <text>two representatives from nonprofit organizations that focus on establishing data privacy protections; and</text> </level> <level label="2"> <text>two representatives that work with the AFL–CIO Tech Institute.</text> </level> </level> </level> </level> <level label="c"> <text>The President of the Senate and the Speaker of the House jointly shall designate the chair of the Workgroup.</text> </level> <level label="d"> <text>It is the intent of the General Assembly that the Workgroup shall coordinate with the Maryland Cybersecurity Council in a manner agreed on by the chairs of the Workgroup and the Council.</text> </level> <level label="e"> <text>The University of Maryland Center for Health and Homeland Security shall provide staff for the Workgroup.</text> </level> <level label="f"> <text>A member of the Workgroup:</text> <level label="1"> <text>may not receive compensation as a member of the Workgroup; but</text> </level> <level label="2"> <text>is entitled to reimbursement for expenses under the Standard State Travel Regulations, as provided in the State budget.</text> </level> </level> <level label="g"> <text>The Workgroup shall monitor issues and make recommendations related to artificial intelligence including:</text> <level label="1"> <text>the regulation of artificial intelligence used in decisions that significantly impact the livelihood and life opportunities of individuals in the State;</text> </level> <level label="2"> <text>deployer and developer obligations related to labor and employment and protection of individual privacy rights;</text> </level> <level label="3"> <text>protection of consumer rights;</text> </level> <level label="4"> <text>current private sector use of artificial intelligence;</text> </level> <level label="5"> <text>general artificial intelligence disclosures for all consumers;</text> </level> <level label="6"> <text>enforcement authority for the Office of the Attorney General’s Consumer Protection Division; and</text> </level> <level label="7"> <text>the impact of the use of artificial intelligence in the determination of government benefits.</text> </level> </level> <level label="h"> <text>On or before July 1, 2026, and each year thereafter, the Workgroup shall report its findings and recommendations, in accordance with § 2–1257 of the State Government Article, to the Senate Finance Committee and the House Economic Matters Committee.</text> </level> <level label="i"> <text>For fiscal year 2027 and each fiscal year thereafter, the Governor may include in the annual budget bill an appropriation of $100,000 to support the Workgroup.</text> </level> </section> <section article="gsf" article_name="State Finance and Procurement" number="3.5-901" title_number="3.5" title_name="Department of Information Technology" subtitle_number="9" subtitle_name="Maryland Office of Digital Experience"> <level label="a"> <text>In this subtitle the following words have the meanings indicated.</text> </level> <level label="b"> <text>“Division” means the Major Information Technology Development Project Oversight Division.</text> </level> <level label="c"> <text>“Office” means the Maryland Office of Digital Experience.</text> </level> <level label="d"> <text>“Service” means the Maryland Digital Service Unit.</text> </level> </section> <section article="gsf" article_name="State Finance and Procurement" number="3.5-902" title_number="3.5" title_name="Department of Information Technology" subtitle_number="9" subtitle_name="Maryland Office of Digital Experience"> <level label="a"> <text>There is a Maryland Office of Digital Experience.</text> </level> <level label="b"> <text>The purpose of the Office is to:</text> <level label="1"> <text>provide oversight, leadership, intervention, and strategic modernization for major information technology development projects, including large–scale, high impact, multi–agency projects, in a transparent manner that ensures a positive return on investment; and</text> </level> <level label="2"> <text>direct the development of modernized systems in a manner that:</text> <level label="i"> <text>when appropriate, prioritizes a product–based approach to the development of modernized systems over a project–based approach;</text> </level> <level label="ii"> <text>is cost–effective;</text> </level> <level label="iii"> <text>lowers risks;</text> </level> <level label="iv"> <text>delivers value faster; and</text> </level> <level label="v"> <text>otherwise improves the delivery of services for residents of the State.</text> </level> </level> </level> </section> <section article="gsf" article_name="State Finance and Procurement" number="3.5-903" title_number="3.5" title_name="Department of Information Technology" subtitle_number="9" subtitle_name="Maryland Office of Digital Experience"> <text>The Secretary shall appoint a Chief Digital Experience Officer to serve as the head of the Office.</text> </section> <section article="gsf" article_name="State Finance and Procurement" number="3.5-904" title_number="3.5" title_name="Department of Information Technology" subtitle_number="9" subtitle_name="Maryland Office of Digital Experience"> <level label="a"> <level label="1"> <text>The Office may employ or retain regular or contractual employees at the discretion of the Chief Digital Services Officer and Chief of the Division as necessary to meet the requirements of the Office.</text> </level> <level label="2"> <level label="i"> <text>Subject to subparagraph (ii) of this paragraph, the Chief Digital Services Officer and Chief of the Division may set the compensation for Office employees.</text> </level> <level label="ii"> <text>The Secretary of Budget and Management shall approve any compensation proposed under this subsection.</text> </level> </level> </level> <level label="b"> <text>The Office may use a short–term contract or contractual hiring to support human resource needs to support the rapid hiring of Office employees and contractors.</text> </level> <level label="c"> <text>To meet the requirements of this subtitle, the Office may require a unit to provide reimbursement for services provided by the Office from funds provided to the unit from the Information Technology Investment Fund or other funds allocated to the unit for an information technology project or product.</text> </level> </section> <section article="gsf" article_name="State Finance and Procurement" number="3.5-905" title_number="3.5" title_name="Department of Information Technology" subtitle_number="9" subtitle_name="Maryland Office of Digital Experience"> <level label="a"> <text>There is a Maryland Digital Service Unit in the Office.</text> </level> <level label="b"> <text>The Service shall collaborate with units of State government to support improved service delivery to State residents and agency staff to implement:</text> <level label="1"> <text>user–centered design;</text> </level> <level label="2"> <text>software development; and</text> </level> <level label="3"> <text>project management best practices.</text> </level> </level> <level label="c"> <text>The Service is responsible for:</text> <level label="1"> <text>assisting units of State government to prioritize the development and procurement of user–friendly, accessible, and multilingual digital platforms to ensure that all State residents, including those with disabilities, can easily access and use government services and information;</text> </level> <level label="2"> <text>working collaboratively with units of State government to:</text> <level label="i"> <text>consolidate and streamline State websites and digital applications to reduce redundancy, complexity, and maintenance costs; and</text> </level> <level label="ii"> <text>prioritize projects that are financially efficient and drive positive outcomes for State residents; and</text> </level> </level> <level label="3"> <text>overseeing the implementation of user–centered design principles, accessibility standards, and best practices across units of State government.</text> </level> </level> <level label="d"> <text>Units of State government shall collaborate with the Service to ensure that the alignment and funding of a digital initiative is consistent with:</text> <level label="1"> <text>the overall goals and priorities of the State; and</text> </level> <level label="2"> <text>the Statewide Information Technology Master Plan.</text> </level> </level> </section> <section article="gsf" article_name="State Finance and Procurement" number="3.5-906" title_number="3.5" title_name="Department of Information Technology" subtitle_number="9" subtitle_name="Maryland Office of Digital Experience"> <level label="a"> <text>There is a Major Information Technology Development Project Oversight Division in the Office.</text> </level> <level label="b"> <text>The Division, in consultation with the Department, shall:</text> <level label="1"> <text>adopt new standards by which major information technology development projects and expedited projects are required to comply, in alignment with the State System Development Life Cycle;</text> </level> <level label="2"> <text>monitor the performance of project management teams for major information technology development projects and expedited projects and ensure the teams have the appropriate talent and expertise necessary to deliver the intended project value; and</text> </level> <level label="3"> <text>provide expertise, support, and intervention as necessary for the project management team to successfully implement a project in a manner consistent with standards adopted under item (1) of this subsection.</text> </level> </level> <level label="c"> <text>The Division shall establish and staff a Discovery Team to deploy team members to help units of State government assist the unit in identifying:</text> <level label="1"> <text>what problem the use of an information technology project or product is solving;</text> </level> <level label="2"> <text>who the users of the project or product will be;</text> </level> <level label="3"> <text>what a successful solution would look like; and</text> </level> <level label="4"> <text>other issues to ensure successful implementation of the project or product.</text> </level> </level> <level label="d"> <text>Notwithstanding any other provision of law, the Secretary may delegate any major information technology development project to the Division that the Secretary determines is appropriate to serve as a pilot project for the Division to provide the services described in this section.</text> </level> </section> <section article="gsf" article_name="State Finance and Procurement" number="3.5-907" title_number="3.5" title_name="Department of Information Technology" subtitle_number="9" subtitle_name="Maryland Office of Digital Experience"> <text>Beginning December 31, 2025, and each July 1 and December 31 thereafter, the Department of General Services, in consultation with the Department, shall report to the Senate Budget and Taxation Committee and the House Health and Government Operations Committee, in accordance with § 2–1257 of the State Government Article, on any projects over $1,000,000 undertaken by a unit of State government under a master contract for Statewide Agile Resources and Teams contract or work order approved by the Board of Public Works in fiscal year 2025, including:</text> <level label="1"> <text>the contract or work order amount and total estimated project cost;</text> </level> <level label="2"> <text>whether the Secretary of General Services and the Secretary have determined that the unit has the internal capacity to adequately support the project and program management responsibilities, including adequate:</text> <level label="i"> <text>human capital;</text> </level> <level label="ii"> <text>subject matter expertise; and</text> </level> <level label="iii"> <text>technical infrastructure;</text> </level> </level> <level label="3"> <text>whether the head of the unit accepted accountability for the oversight and implementation of the project;</text> </level> <level label="4"> <text>the members of the project management team; and</text> </level> <level label="5"> <text>affirmative agreements that, as part of the contract or work order approval, the unit of State government submits a report regarding project status to the Department every 3 months.</text> </level> </section>