<?xml version='1.0' encoding='utf-8'?>
<section article="gsf" article_name="State Finance and Procurement" number="3.5-2A-05" title_number="3.5" title_name="Department of Information Technology" subtitle_number="2A" subtitle_name="Office of Security Management">
  <level label="a">
    <text>There is a Maryland Cybersecurity Coordinating Council.</text>
  </level>
  <level label="b">
    <level label="1">
      <text>The Council consists of the following members:</text>
      <level label="i">
        <text>the secretary of each of the principal departments listed in § 8–201 of the State Government Article, or a secretary’s designee;</text>
      </level>
      <level label="ii">
        <text>the State Chief Information Security Officer;</text>
      </level>
      <level label="iii">
        <text>the Adjutant General of the Maryland National Guard, or the Adjutant General’s designee;</text>
      </level>
      <level label="iv">
        <text>the Superintendent of State Police, or the Superintendent’s designee;</text>
      </level>
      <level label="v">
        <text>the Director of the Governor’s Office of Homeland Security, or the Director’s designee;</text>
      </level>
      <level label="vi">
        <text>the Executive Director of the Department of Legislative Services, or the Executive Director’s designee;</text>
      </level>
      <level label="vii">
        <text>one representative of the Administrative Office of the Courts;</text>
      </level>
      <level label="viii">
        <text>the Chancellor of the University System of Maryland, or the Chancellor’s designee; and</text>
      </level>
      <level label="ix">
        <text>any other stakeholder that the State Chief Information Security Officer deems appropriate.</text>
      </level>
    </level>
    <level label="2">
      <text>If a designee serves on the Council in place of an official listed in paragraph (1) of this subsection, the designee shall report information from the Council meetings and other communications to the official.</text>
    </level>
  </level>
  <level label="c">
    <text>In addition to the members listed under subsection (b) of this section, the following representatives may serve as nonvoting members of the Council:</text>
    <level label="1">
      <text>one member of the Senate of Maryland, appointed by the President of the Senate;</text>
    </level>
    <level label="2">
      <text>one member of the House of Delegates, appointed by the Speaker of the House; and</text>
    </level>
    <level label="3">
      <text>one representative of the judiciary, appointed by the Chief Justice of the Supreme Court of Maryland.</text>
    </level>
  </level>
  <level label="d">
    <text>The chair of the Council is the State Chief Information Security Officer.</text>
  </level>
  <level label="e">
    <text>The Council shall meet at least quarterly at the request of the chair.</text>
  </level>
  <level label="f">
    <text>The Council shall:</text>
    <level label="1">
      <text>provide advice and recommendations to the State Chief Information Security Officer regarding:</text>
      <level label="i">
        <text>the strategy and implementation of cybersecurity initiatives and recommendations; and</text>
      </level>
      <level label="ii">
        <text>building and sustaining the capability of the State to identify and mitigate cybersecurity risk and respond to and recover from cybersecurity–related incidents.</text>
      </level>
    </level>
    <level label="2">
      <text>use the analysis compiled by the Office under § 3.5–2A–04(e)(1)(ii) of this subtitle to prioritize cybersecurity risk across the Executive Branch of State government and make corresponding recommendations for security investments in the Governor’s annual budget.</text>
    </level>
  </level>
  <level label="g">
    <text>In carrying out the duties of the Council, the Council  shall consult with outside experts, including experts in the private sector, government agencies, and institutions of higher education.</text>
  </level>
</section>
