<?xml version='1.0' encoding='utf-8'?>
<section article="gsf" article_name="State Finance and Procurement" number="3.5-2A-03" title_number="3.5" title_name="Department of Information Technology" subtitle_number="2A" subtitle_name="Office of Security Management">
  <level label="a">
    <text>The head of the Office is the State Chief Information Security Officer.</text>
  </level>
  <level label="b">
    <text>The State Chief Information Security Officer shall:</text>
    <level label="1">
      <text>be appointed by the Governor with the advice and consent of the Senate;</text>
    </level>
    <level label="2">
      <text>serve at the pleasure of the Governor;</text>
    </level>
    <level label="3">
      <text>be supervised by the Secretary; and</text>
    </level>
    <level label="4">
      <text>serve as the chief information security officer of the Department.</text>
    </level>
  </level>
  <level label="c">
    <text>An individual appointed as the State Chief Information Security Officer under subsection (b) of this section shall:</text>
    <level label="1">
      <text>at a minimum, hold a bachelor’s degree;</text>
    </level>
    <level label="2">
      <text>hold appropriate information technology or cybersecurity certifications;</text>
    </level>
    <level label="3">
      <text>have experience:</text>
      <level label="i">
        <text>identifying, implementing, or assessing security controls;</text>
      </level>
      <level label="ii">
        <text>in infrastructure, systems engineering, or cybersecurity;</text>
      </level>
      <level label="iii">
        <text>managing highly technical security, security operations centers, and incident response teams in a complex cloud environment and supporting multiple sites; and</text>
      </level>
      <level label="iv">
        <text>working with common information security management frameworks;</text>
      </level>
    </level>
    <level label="4">
      <text>have extensive knowledge of information technology and cybersecurity field concepts, best practices, and procedures, with an understanding of existing enterprise capabilities and limitations to ensure the secure integration and operation of security networks and systems; and</text>
    </level>
    <level label="5">
      <text>have knowledge of current security regulations.</text>
    </level>
  </level>
  <level label="d">
    <text>The State Chief Information Security Officer shall provide cybersecurity advice and recommendations to the Governor on request.</text>
  </level>
  <level label="e">
    <level label="1">
      <level label="i">
        <text>There is a Director of Local Cybersecurity, who shall be appointed by the State Chief Information Security Officer.</text>
      </level>
      <level label="ii">
        <text>The Director of Local Cybersecurity shall work in coordination with the Maryland Department of Emergency Management to provide technical assistance, coordinate resources, and improve cybersecurity preparedness for units of local government.</text>
      </level>
    </level>
    <level label="2">
      <level label="i">
        <text>There is a Director of State Cybersecurity, who shall be appointed by the State Chief Information Security Officer.</text>
      </level>
      <level label="ii">
        <text>The Director of State Cybersecurity is responsible for implementation of this section with respect to units of State government.</text>
      </level>
    </level>
  </level>
  <level label="f">
    <text>The Department shall provide the Office with sufficient staff to perform the functions of this subtitle.</text>
  </level>
</section>
