Title 3.5. Department of Information Technology — Subtitle 2A. Office of Security Management

be appointed by the Governor with the advice and consent of the Senate;

serve at the pleasure of the Governor;

be supervised by the Secretary; and

serve as the chief information security officer of the Department.

at a minimum, hold a bachelor’s degree;

hold appropriate information technology or cybersecurity certifications;

have experience:

have extensive knowledge of information technology and cybersecurity field concepts, best practices, and procedures, with an understanding of existing enterprise capabilities and limitations to ensure the secure integration and operation of security networks and systems; and

have knowledge of current security regulations.

The Office is responsible for:

The Office is not responsible for the information technology installation and maintenance operations normally conducted by a unit of State government, a unit of local government, a local school board, a local school system, or a local health department.

establish standards to categorize all information collected or maintained by or on behalf of each unit of State government;

establish standards to categorize all information systems maintained by or on behalf of each unit of State government;

develop guidelines governing the types of information and information systems to be included in each category;

establish security requirements for information and information systems in each category;

assess the categorization of information and information systems and the associated implementation of the security requirements established under item (4) of this subsection;

if the State Chief Information Security Officer determines that there are security vulnerabilities or deficiencies in any information systems, determine and direct or take actions necessary to correct or remediate the vulnerabilities or deficiencies, which may include requiring the information system to be disconnected;

if the State Chief Information Security Officer determines that there is a cybersecurity threat caused by, affecting, or potentially affecting an entity connected to the network established under § 3.5–404 of this title that introduces or may introduce a serious risk to entities connected to the network or to the State, take or direct actions required to mitigate the threat;

manage security awareness training for all appropriate employees of units of State government;

assist in the development of data management, data governance, and data specification standards to promote standardization and reduce risk;

assist in the development of a digital identity standard and specification applicable to all parties communicating, interacting, or conducting business with or on behalf of a unit of State government;

develop and maintain information technology security policy, standards, and guidance documents, consistent with best practices developed by the National Institute of Standards and Technology;

to the extent practicable, seek, identify, and inform relevant stakeholders of any available financial assistance provided by the federal government or non–State entities to support the work of the Office;

provide technical assistance to localities in mitigating and recovering from cybersecurity incidents;

annually review and, if necessary, update the State minimum cybersecurity standards;

provide technical services, advice, and guidance to units of local government to improve cybersecurity preparedness, prevention, response, and recovery practices; and

support local governments in developing a vulnerability assessment and cyber assessment, including providing local governments with the resources and information on best practices to complete the assessments.

assist local political subdivisions, including counties, school systems, school boards, and local health departments, in implementing best practices and guidance developed by the Department; and

connect local entities to appropriate resources for any other purpose related to cybersecurity preparedness and response.

conduct regional exercises, as necessary, in coordination with the National Guard, local emergency managers, and other State and local entities; and

establish regional assistance groups to deliver or coordinate support services to local political subdivisions, agencies, or regions.

On or before December 31 each year, the Office shall report to the Governor and, in accordance with § 2–1257 of the State Government Article, the Senate Budget and Taxation Committee, the Senate Committee on Education, Energy, and the Environment, the House Appropriations Committee, the House Health and Government Operations Committee, and the Joint Committee on Cybersecurity, Information Technology, and Biotechnology on the activities of the Office and the state of cybersecurity preparedness in Maryland, including:

A report submitted under this subsection may not contain information that reveals cybersecurity vulnerabilities and risks in the State.

Except as provided in paragraph (2) of this subsection, on or before the third Wednesday in January each year, the Office shall report to the Governor and, in accordance with § 2–1257 of the State Government Article, the Senate Budget and Taxation Committee, the Senate Committee on Education, Energy, and the Environment, the House Appropriations Committee, the House Health and Government Operations Committee, and the Joint Committee on Cybersecurity, Information Technology, and Biotechnology on:

In a year with a newly elected Governor, the report required under paragraph (1) of this subsection shall be submitted on or before the third Friday of January.

The Council consists of the following members:

If a designee serves on the Council in place of an official listed in paragraph (1) of this subsection, the designee shall report information from the Council meetings and other communications to the official.

one member of the Senate of Maryland, appointed by the President of the Senate;

one member of the House of Delegates, appointed by the Speaker of the House; and

one representative of the judiciary, appointed by the Chief Justice of the Supreme Court of Maryland.

provide advice and recommendations to the State Chief Information Security Officer regarding:

use the analysis compiled by the Office under § 3.5–2A–04(e)(1)(ii) of this subtitle to prioritize cybersecurity risk across the Executive Branch of State government and make corresponding recommendations for security investments in the Governor’s annual budget.