In this subtitle the following words have the meanings indicated. “Council” means the Maryland Cybersecurity Coordinating Council. “Office” means the Office of Security Management.

There is an Office of Security Management within the Department.

The head of the Office is the State Chief Information Security Officer. The State Chief Information Security Officer shall: be appointed by the Governor with the advice and consent of the Senate; serve at the pleasure of the Governor; be supervised by the Secretary; and serve as the chief information security officer of the Department. An individual appointed as the State Chief Information Security Officer under subsection (b) of this section shall: at a minimum, hold a bachelor’s degree; hold appropriate information technology or cybersecurity certifications; have experience: identifying, implementing, or assessing security controls; in infrastructure, systems engineering, or cybersecurity; managing highly technical security, security operations centers, and incident response teams in a complex cloud environment and supporting multiple sites; and working with common information security management frameworks; have extensive knowledge of information technology and cybersecurity field concepts, best practices, and procedures, with an understanding of existing enterprise capabilities and limitations to ensure the secure integration and operation of security networks and systems; and have knowledge of current security regulations. The State Chief Information Security Officer shall provide cybersecurity advice and recommendations to the Governor on request. There is a Director of Local Cybersecurity, who shall be appointed by the State Chief Information Security Officer. The Director of Local Cybersecurity shall work in coordination with the Maryland Department of Emergency Management to provide technical assistance, coordinate resources, and improve cybersecurity preparedness for units of local government. There is a Director of State Cybersecurity, who shall be appointed by the State Chief Information Security Officer. The Director of State Cybersecurity is responsible for implementation of this section with respect to units of State government. The Department shall provide the Office with sufficient staff to perform the functions of this subtitle.

The Office is responsible for: the direction, coordination, and implementation of the overall cybersecurity strategy and policy for units of State government; and supporting and coordinating with the Maryland Department of Emergency Management Cyber Preparedness Unit during emergency response efforts. The Office is not responsible for the information technology installation and maintenance operations normally conducted by a unit of State government, a unit of local government, a local school board, a local school system, or a local health department. The Office shall: establish standards to categorize all information collected or maintained by or on behalf of each unit of State government; establish standards to categorize all information systems maintained by or on behalf of each unit of State government; develop guidelines governing the types of information and information systems to be included in each category; establish security requirements for information and information systems in each category; assess the categorization of information and information systems and the associated implementation of the security requirements established under item (4) of this subsection; if the State Chief Information Security Officer determines that there are security vulnerabilities or deficiencies in any information systems, determine and direct or take actions necessary to correct or remediate the vulnerabilities or deficiencies, which may include requiring the information system to be disconnected; if the State Chief Information Security Officer determines that there is a cybersecurity threat caused by, affecting, or potentially affecting an entity connected to the network established under § 3.5–404 of this title that introduces or may introduce a serious risk to entities connected to the network or to the State, take or direct actions required to mitigate the threat; manage security awareness training for all appropriate employees of units of State government; assist in the development of data management, data governance, and data specification standards to promote standardization and reduce risk; assist in the development of a digital identity standard and specification applicable to all parties communicating, interacting, or conducting business with or on behalf of a unit of State government; develop and maintain information technology security policy, standards, and guidance documents, consistent with best practices developed by the National Institute of Standards and Technology; to the extent practicable, seek, identify, and inform relevant stakeholders of any available financial assistance provided by the federal government or non–State entities to support the work of the Office; provide technical assistance to localities in mitigating and recovering from cybersecurity incidents; annually review and, if necessary, update the State minimum cybersecurity standards; provide technical services, advice, and guidance to units of local government to improve cybersecurity preparedness, prevention, response, and recovery practices; and support local governments in developing a vulnerability assessment and cyber assessment, including providing local governments with the resources and information on best practices to complete the assessments. The Office, in coordination with the Maryland Department of Emergency Management, shall: assist local political subdivisions, including counties, school systems, school boards, and local health departments, in implementing best practices and guidance developed by the Department; and connect local entities to appropriate resources for any other purpose related to cybersecurity preparedness and response. The Office, in coordination with the Maryland Department of Emergency Management, may: conduct regional exercises, as necessary, in coordination with the National Guard, local emergency managers, and other State and local entities; and establish regional assistance groups to deliver or coordinate support services to local political subdivisions, agencies, or regions. On or before December 31 each year, the Office shall report to the Governor and, in accordance with § 2–1257 of the State Government Article, the Senate Budget and Taxation Committee, the Senate Committee on Education, Energy, and the Environment, the House Appropriations Committee, the House Health and Government Operations Committee, and the Joint Committee on Cybersecurity, Information Technology, and Biotechnology on the activities of the Office and the state of cybersecurity preparedness in Maryland, including: the activities and accomplishments of the Office during the previous 12 months at the State and local levels; and a compilation and analysis of the data from the information contained in the reports received by the Office under § 3.5–405 of this title, including: a summary of the issues identified by the cybersecurity preparedness assessments conducted that year; the status of vulnerability assessments of all units of State government and a timeline for completion and cost to remediate any vulnerabilities exposed; recent audit findings of all units of State government and options to improve findings in future audits, including recommendations for staff, budget, and timing; efforts to secure financial support for cyber risk mitigation from federal or other non–State resources; key performance indicators on the cybersecurity strategies in the Department’s information technology master plan, including time, budget, and staff required for implementation; and any additional recommendations for improving State and local cybersecurity preparedness. A report submitted under this subsection may not contain information that reveals cybersecurity vulnerabilities and risks in the State. Except as provided in paragraph (2) of this subsection, on or before the third Wednesday in January each year, the Office shall report to the Governor and, in accordance with § 2–1257 of the State Government Article, the Senate Budget and Taxation Committee, the Senate Committee on Education, Energy, and the Environment, the House Appropriations Committee, the House Health and Government Operations Committee, and the Joint Committee on Cybersecurity, Information Technology, and Biotechnology on: the State’s expenditure on cybersecurity relative to overall information technology spending for the prior 3 years; and recommendations for changes to the budget, including the amount, purpose, and timing of funding to improve State and local cybersecurity preparedness. In a year with a newly elected Governor, the report required under paragraph (1) of this subsection shall be submitted on or before the third Friday of January.

There is a Maryland Cybersecurity Coordinating Council. The Council consists of the following members: the secretary of each of the principal departments listed in § 8–201 of the State Government Article, or a secretary’s designee; the State Chief Information Security Officer; the Adjutant General of the Maryland National Guard, or the Adjutant General’s designee; the Superintendent of State Police, or the Superintendent’s designee; the Director of the Governor’s Office of Homeland Security, or the Director’s designee; the Executive Director of the Department of Legislative Services, or the Executive Director’s designee; one representative of the Administrative Office of the Courts; the Chancellor of the University System of Maryland, or the Chancellor’s designee; and any other stakeholder that the State Chief Information Security Officer deems appropriate. If a designee serves on the Council in place of an official listed in paragraph (1) of this subsection, the designee shall report information from the Council meetings and other communications to the official. In addition to the members listed under subsection (b) of this section, the following representatives may serve as nonvoting members of the Council: one member of the Senate of Maryland, appointed by the President of the Senate; one member of the House of Delegates, appointed by the Speaker of the House; and one representative of the judiciary, appointed by the Chief Justice of the Supreme Court of Maryland. The chair of the Council is the State Chief Information Security Officer. The Council shall meet at least quarterly at the request of the chair. The Council shall: provide advice and recommendations to the State Chief Information Security Officer regarding: the strategy and implementation of cybersecurity initiatives and recommendations; and building and sustaining the capability of the State to identify and mitigate cybersecurity risk and respond to and recover from cybersecurity–related incidents. use the analysis compiled by the Office under § 3.5–2A–04(e)(1)(ii) of this subtitle to prioritize cybersecurity risk across the Executive Branch of State government and make corresponding recommendations for security investments in the Governor’s annual budget. In carrying out the duties of the Council, the Council shall consult with outside experts, including experts in the private sector, government agencies, and institutions of higher education.

The Council shall: promote cybersecurity education and training opportunities to strengthen the State’s cybersecurity capabilities by expanding existing agreements with educational institutions; and utilize relationships with institutions of higher education to advertise cybersecurity careers and job positions available in State or local government, including the Maryland Technology Internship Program established under Title 18, Subtitle 30 of the Education Article.