# State Finance and Procurement (GSF)

## Title 3.5. Department of Information Technology

### Subtitle 3. Information Processing

#### Section 3.5-301

(a) In this subtitle the following words have the meanings indicated.

(b) "Artificial intelligence" has the meaning stated in Sec. 3.5-801 of this title.

(c) "Cybersecurity" means processes or capabilities wherein systems, communications, and information are protected and defended against damage, unauthorized use or modification, and exploitation.

(d) "Cybersecurity strategy" means a vision, a plan of action, or guiding principles.

(e)

  (1) "Development" means all expenditures for a new information technology system or an enhancement to an existing system including system:

    (i) planning;

    (ii) creation;

    (iii) installation;

    (iv) testing; and

    (v) initial training.

  (2) "Development" does not include:

    (i) ongoing operating costs, software or hardware maintenance, routine upgrades, or modifications that merely allow for a continuation of the existing level of functionality; or

    (ii) expenditures made after a new or enhanced system has been legally accepted by the user and is being used for the business process for which it was intended.

(f) "Expedited project" means a project that is not a major information technology development project that receives money from the Fund in a manner that allows for modernization projects consistent with the State Modernization Plan to move forward in a nimble and expedited manner.

(g) "Fund" means the Information Technology Investment Fund.

(h) "Information technology" means all electronic information processing, including:

  (1) maintenance;

  (2) networking;

  (3) telecommunications;

  (4) hardware;

  (5) software and applications; and

  (6) associated services.

(i) "Information technology services" means information provided by electronic means by or on behalf of a unit of State government.

(j) "Legacy system" means a hardware or software system that is end of support or end of life.

(k)

  (1) "Major information technology development project" means any information technology development project that meets one or more of the following criteria:

    (i) except as provided in paragraph (2) of this subsection, the estimated total cost of development equals or exceeds $5,000,000;

    (ii) the project is undertaken to support a critical business function associated with the public health, education, safety, or financial well-being of the residents of Maryland; or

    (iii) the Secretary determines that the project requires the special attention and consideration given to a major information technology development project due to:

      (1) the significance of the project's potential benefits or risks;

      (2) the impact of the project on the public or local governments;

      (3) the public visibility of the project; or

      (4) other reasons as determined by the Secretary.

  (2) "Major information technology development project" does not include:

    (i) technology that is reoccurring, standard operating technology as determined by the Secretary and submitted to the Legislative Policy Committee for a 30-day review and comment period; or

    (ii) a project with an estimated total cost of development that is:

      (1) less than $5,000,000 and is funded with money set aside for expedited projects in the Fund; or

      (2) more than $5,000,000 and is funded with the money set aside for expedited projects in the Fund if the Secretary determines that:

      (A) the unit of State government has sufficient implementation resources, including human capital, subject matter expertise, and technological infrastructure, or has the means to obtain these resources before project initiation;

      (B) there is no sufficient alternative within the State's information technology inventory; and

      (C) the project will result in a comprehensive solution designed to meet a cohesive set of business and technological objectives.

(l) "Master plan" means the statewide information technology master plan and statewide cybersecurity strategy.

(m) "Nonvisual access" means the ability, through keyboard control, synthesized speech, Braille, or other methods not requiring sight to receive, use, and manipulate information and operate controls necessary to access information technology in accordance with standards adopted under Sec. 3.5-303(b) of this subtitle.

(n) "Resource sharing" means the utilization of a State resource by private industry in exchange for the provision to the State of a communication service or other consideration.

(o) "State Modernization Plan" means the plan developed and adopted by the Secretary to modernize State information technology.

(p) "Systems development life cycle plan" means a plan that defines all actions, functions, or activities to be performed by a unit of State government in the definition, planning, acquisition, development, testing, implementation, operation, enhancement, and modification of information technology systems.

#### Section 3.5-302

(a) This subtitle does not apply to changes relating to or the purchase, lease, or rental of information technology by:

  (1) public institutions of higher education solely for academic or research purposes;

  (2) the Maryland Port Administration;

  (3) the University System of Maryland;

  (4) St. Mary's College of Maryland;

  (5) Morgan State University;

  (6) the Maryland Stadium Authority;

  (7) Baltimore City Community College;

  (8) the Legislative Branch of State government;

  (9) the Judicial Branch of State government;

  (10) the Office of the Attorney General;

  (11) the Comptroller; or

  (12) the State Treasurer.

(b) Except as provided in subsection (a) of this section, this subtitle applies to any project of a unit of the Executive Branch of State government that involves an agreement with a public institution of higher education for a portion of the development of the project, whether the work on the development is done directly or indirectly by the public institution of higher education.

(c) Notwithstanding any other provision of law, except as provided in subsection (a) of this section and Sec.Sec. 3.5-305, 3.5-307(a)(2), 3.5-308, and 3.5-309 of this subtitle, this subtitle applies to all units of the Executive Branch of State government including public institutions of higher education other than Morgan State University, the University System of Maryland, St. Mary's College of Maryland, and Baltimore City Community College.

#### Section 3.5-303

(a) The Secretary is responsible for carrying out the following duties:

  (1) developing, implementing, maintaining, revising, and enforcing information technology policies, procedures, and standards;

  (2) providing technical assistance, advice, and recommendations to the Governor and any unit of State government concerning information technology matters;

  (3) reviewing the annual project plan for each unit of State government to make information and services available to the public over the Internet;

  (4) developing and maintaining a statewide information technology master plan that will:

    (i) centralize the management and direction of information technology policy within the Executive Branch of State government under the control of the Department;

    (ii) include all aspects of State information technology including telecommunications, security, data processing, and information management;

    (iii) consider interstate transfers as a result of federal legislation and regulation;

    (iv) ensure that the State information technology plan and related policies and standards are consistent with State goals, objectives, and resources, and represent a long-range vision for using information technology to improve the overall effectiveness of State government;

    (v) include standards to assure nonvisual access to the information and services made available to the public over the Internet; and

    (vi) allow a State agency to maintain the agency's own information technology unit that provides for information technology services to support the mission of the agency;

  (5) developing, implementing, and maintaining a statewide cybersecurity strategy that will:

    (i) centralize the management and direction of cybersecurity strategy within the Executive Branch of State government under the control of the Department; and

    (ii) serve as the basis for budget allocations for cybersecurity preparedness for the Executive Branch of State government;

  (6) adopting by regulation and enforcing nonvisual access standards to be used in the procurement of information technology services by or on behalf of units of State government in accordance with subsection (c) of this section;

  (7) in consultation with the Maryland Cybersecurity Coordinating Council, advising and overseeing a consistent cybersecurity strategy for units of State government, including institutions under the control of the governing boards of the public institutions of higher education;

  (8) advising and consulting with the Legislative and Judicial branches of State government regarding a cybersecurity strategy;

  (9) in consultation with the Maryland Cybersecurity Coordinating Council, developing guidance on consistent cybersecurity strategies for counties, municipal corporations, school systems, and all other political subdivisions of the State;

  (10) upgrading information technology and cybersecurity-related State government infrastructure;

  (11) annually evaluating:

    (i) the feasibility of units of State government providing public services using artificial intelligence, machine learning, commercial cloud computer services, device-as-a-service procurement models, and other emerging technologies; and

    (ii) the development of data analytics capabilities to enable data-driven policymaking by units of State government; and

  (12) conducting inventories of systems that employ artificial intelligence that are used by a unit of State government as required under Sec. 3.5-803 of this title.

(b) Nothing in subsection (a) of this section may be construed as establishing a mandate for any entity listed in subsection (a)(9) of this section.

(c) On or before January 1, 2020, the Secretary, or the Secretary's designee, shall:

  (1) adopt new nonvisual access procurement standards that:

    (i) provide an individual with disabilities with nonvisual access in a way that is fully and equally accessible to and independently usable by the individual with disabilities so that the individual is able to acquire the same information, engage in the same interactions, and enjoy the same services as users without disabilities, with substantially equivalent ease of use; and

    (ii) are consistent with the standards of Sec. 508 of the federal Rehabilitation Act of 1973; and

  (2) establish a process for the Secretary or the Secretary's designee to:

    (i) determine whether information technology meets the nonvisual access standards adopted under item (1) of this subsection; and

    (ii)

      (1) for information technology procured by a State unit before January 1, 2020, and still used by the State unit on or after January 1, 2020, work with the vendor to modify the information technology to meet the nonvisual access standards, if practicable; or

      (2) for information technology procured by a State unit on or after January 1, 2020, enforce the nonvisual access clause developed under Sec. 3.5-311 of this subtitle, including the enforcement of the civil penalty described in Sec. 3.5-311(a)(2)(iii)1 of this subtitle.

(d)

  (1) The Governor shall include an appropriation in the annual budget bill in an amount necessary to cover the costs of implementing the statewide cybersecurity master plan developed under subsection (a) of this section without the need for the Department to operate a charge-back model for cybersecurity services provided to other units of State government or units of local government.

  (2) On or before January 31 each year, in a separate report or included within a general budget report, the Governor shall submit a report in accordance with Sec. 2-1257 of the State Government Article to the Senate Budget and Taxation Committee and the House Appropriations Committee that includes:

    (i) specific information on the information technology budget and cybersecurity budget that the Governor has submitted to the General Assembly for the upcoming fiscal year; and

    (ii) how the budgets listed under item (i) of this paragraph compare to the annual overview of the U.S. President's budget submission on information technology and cybersecurity to Congress conducted by the U.S. Office of Management and Budget.

#### Section 3.5-304

(a) The Secretary shall develop a statewide information technology master plan.

(b)

  (1) The plan developed under subsection (a) of this section shall be posted publicly on the Department's website and, in accordance with Sec. 2-1257 of the State Government Article, submitted to the General Assembly within 1 year after the date the Governor is inaugurated in each gubernatorial term.

  (2) If the Secretary is unable to meet the deadline established under paragraph (1) of this subsection, within 10 days after the missed deadline, the Secretary shall notify the Governor in writing and, in accordance with Sec. 2-1257 of the State Government Article:

    (i) the Senate Budget and Taxation Committee;

    (ii) the Senate Committee on Education, Energy, and the Environment;

    (iii) the House Appropriations Committee;

    (iv) the House Government, Labor, and Elections Committee; and

    (v) the Joint Committee on Cybersecurity, Information Technology, and Biotechnology.

  (3) The notice required under paragraph (2) of this subsection shall include an explanation of why the plan is delayed and provide a date for its publication, not to exceed 3 months after the deadline established under paragraph (1) of this subsection.

(c) Each year, the Secretary, or the Secretary's designee, shall provide a briefing to the General Assembly on:

  (1) the implementation of the plan;

  (2) any material changes made to the plan; and

  (3) how the State intends to manage and deploy the initiatives included in the plan across the Executive Branch of State government.

#### Section 3.5-305

(a)

  (1) In this section the following words have the meanings indicated.

  (2)

    (i) "Spam e-mail" means unsolicited, phishing, solicitation, and bulk e-mails unrelated to State business.

    (ii) "Spam e-mail" does not include solicitation and bulk e-mails relating to State business, including bulk e-mail from State vendors, partners, and exclusive representatives.

  (3) "State business" means the furtherance of the State's obligations:

    (i) under the Maryland Constitution, Maryland Code, and Code of Maryland regulations;

    (ii) under the laws of the United States; and

    (iii) by operation of contracts and similar obligations.

(b) It is the policy of the State that e-mail systems and resources for State and higher education employees are intended to support State business and may not serve as a public forum.

(c) Except as provided in subsection (d) of this section, in accordance with guidelines established by the Secretary, each unit of State government shall develop and submit to the Secretary:

  (1) information technology policies and standards;

  (2) an information technology plan; and

  (3) an annual project plan outlining the status of efforts to make information and services available to the public over the Internet.

(d)

  (1) The governing boards of the public institutions of higher education shall develop and submit information technology policies and standards and an information technology plan for their respective institutions or systems to the Secretary.

  (2) If the Secretary finds that the submissions required under this subsection are consistent with the master plan, the Secretary shall incorporate those submissions into the master plan.

  (3) If the Secretary finds that the submissions required under this subsection are not consistent with the master plan:

    (i) the Secretary shall return the submissions to the governing boards; and

    (ii) the governing boards shall revise the submissions as appropriate and submit the revised policies, standards, and plans to the Secretary.

(e)

  (1) In order to protect the information technology resources of the State, the policies, plans, and standards required under subsections (c) and (d) of this section shall include provisions to protect State and higher education employee e-mail services from spam e-mail and other use that does not support State business, including by implementing systems that automatically filter spam e-mail from State and higher education employees' e-mail accounts.

  (2) The policies, plans, and standards required under subsections (c) and (d) of this section shall permit incidental personal use of information technology, including e-mail, by State employees that:

    (i) has a de minimis impact on resources; and

    (ii) is consistent with generally accepted professional business norms and expectations.

#### Section 3.5-306

Information technology of each unit of State government shall be consistent with the master plan.

#### Section 3.5-307

(a)

  (1) A unit of State government may not purchase, lease, contract for, or rent an information technology service or product unless consistent with the master plan, as determined by the Secretary.

  (2) A unit of State government other than a public institution of higher education may not make expenditures for major information technology development projects or cybersecurity projects except as provided in Sec. 3.5-308 of this subtitle.

(b) The Secretary may review any information technology project or cybersecurity project for consistency with the master plan.

(c)

  (1) A unit of State government shall advise the Secretary of any information technology proposal involving:

    (i) resource sharing;

    (ii) the exchange of goods or services;

    (iii) a gift, contribution, or grant of real or personal property; or

    (iv) the sale, lease, exchange, or other disposition of communications facilities or communications frequencies.

  (2) The Secretary shall determine if the value of the resources, services, property, or other consideration to be obtained by the State under the terms of any proposal submitted in accordance with paragraph (1) of this subsection equals or exceeds $100,000.

  (3) If the value of any proposal submitted in accordance with this subsection equals or exceeds $100,000 and the Secretary and unit agree to proceed with the proposal, information on the proposal shall be:

    (i) advertised for a period of at least 30 days in the eMaryland Marketplace; and

    (ii) submitted, simultaneously with the advertisement, to the Legislative Policy Committee for a 60-day review and comment period, during which time the Committee may recommend that the proposal be treated as a procurement contract under Division II of this article.

  (4) Following the period for review and comment by the Legislative Policy Committee under paragraph (3) of this subsection, the proposal is subject to approval by the Board of Public Works.

  (5) This subsection may not be construed as authorizing an exception from the requirements of Division II of this article for any contract that otherwise would be subject to the State procurement process.

(d)

  (1) The Department, in consultation with the Department of General Services, shall assess the procurement process for information technology projects involving modernization and make recommendations to increase the State's ability to proceed with a modernization project in a rapid and responsive manner.

  (2)

    (i) On or before July 1, 2025, the Department shall inventory and assess the State's legacy systems and prioritize modernization.

    (ii) On or before January 1, 2026, and every other January 1 thereafter, the Department, in consultation with each unit of State government, shall submit a report to the Governor, the Secretary, and, in accordance with Sec. 2-1257 of the State Government Article, the General Assembly that provides:

      (1) an estimate of the funding required to modernize each legacy system in the unit; and

      (2) a 5-year projection of funding required to modernize each legacy system.

#### Section 3.5-308

(a) This section does not apply to a public institution of higher education.

(b) Before submitting its information technology project requests, a unit of State government shall submit information in support of the request required by the Secretary for review and determination consistent with Sec. 3.5-301(k) of this subtitle.

(c) In reviewing information technology project requests, the Secretary may change a unit's designation of a major information technology development project.

(d) The Secretary shall review and, with the advice of the Secretary of Budget and Management, approve major information technology development projects and specifications for consistency with all statewide plans, policies, and standards, including a systems development life cycle plan.

(e)

  (1) Subject to paragraph (2) of this subsection, the Secretary shall be responsible for overseeing the implementation of major information technology development projects, regardless of fund source.

  (2) As part of the Secretary's responsibilities under this section, the Secretary shall ensure that no funding is provided for the implementation of a major information technology development project unless:

    (i) the Secretary determines that the unit has the internal capacity to adequately support the project, program management, and responsibility over program activities, including:

      (1) human capital;

      (2) subject matter expertise; and

      (3) technical infrastructure;

    (ii) within 30 days of awarding a contract, the managing unit sends to the Board of Public Works and the Legislative Policy Committee, in accordance with Sec. 2-1257 of the State Government Article, notice that:

      (1) identifies the project management team;

      (2) affirms that the Department has reviewed and approved the contract; and

      (3) is signed by the head of the unit acknowledging and accepting the accountability for the implementation of the information technology project or product; and

    (iii) while a unit is managing an active project or product, the unit agrees to report to the Department every 3 months on the project status in a manner requested by the Department.

(f)

  (1) With the advice of the Secretary of Budget and Management, expenditures for major information technology development projects shall be subject to the approval of the Secretary who shall approve expenditures only when those projects are consistent with statewide plans, policies, and standards.

  (2)

    (i) The Secretary shall make a recommendation to the Secretary of Budget and Management to withhold project funds, regardless of fund source, if:

      (1) a unit of State government is not consistently reporting on the status of a project or projects to the Department in the form and manner required by the Department; or

      (2) the Department determines that project implementation issues exist, including project timeline delays, significant cost increases, vendor nonperformance, decreased agency capacity, or other issues that indicate issues of concern that could jeopardize successful implementation.

    (ii) Notwithstanding any other provision of law, and except as provided in subparagraph (iii) of this paragraph, the Secretary of Budget and Management shall withhold any unexpended funds appropriated in a fiscal year for a major information technology development project at the Secretary's recommendation issued under subparagraph (i) of this paragraph.

    (iii) The Secretary of Budget and Management may release funds withheld under this paragraph at the direction of the Secretary if the Secretary determines that the issue leading to the initial withholding of funds has been addressed.

  (3) Within 30 days after funding is withheld in accordance with this subsection, the Department shall report on the purpose of the withholding:

    (i) to the Governor; and

    (ii) subject to Sec. 2-1257 of the State Government Article, to:

      (1) the Senate Budget and Taxation Committee;

      (2) the Senate Committee on Education, Energy, and the Environment;

      (3) the House Appropriations Committee;

      (4) the House Health and Government Operations Committee; and

      (5) the Joint Committee on Cybersecurity, Information Technology, and Biotechnology.

  (4)

    (i) Subject to subparagraph (ii) of this paragraph:

      (1) the Secretary may recommend to the Secretary of Budget and Management that funding withheld under this section be reallocated to other expenses of the Information Technology Investment Fund under Sec. 3.5-309 of this subtitle; and

      (2) the Secretary of Budget and Management may, at their discretion, follow the Secretary's recommendation to reallocate funds.

    (ii) If the reallocated funds exceed $500,000, the Secretary, in consultation with the Secretary of Budget and Management, shall submit a proposal to the Legislative Policy Committee for a 60-day review and comment period.

(g)

  (1) The Secretary shall approve funding for major information technology development projects, expedited projects, and other expenditures from the Fund only when:

    (i) the major information technology development projects or the expedited projects are in compliance with statewide plans, policies, and standards, as determined by the Secretary; and

    (ii) the major information technology development projects are supported by an approved systems development life cycle plan.

  (2) An approved systems development life cycle plan shall include submission of:

    (i) a project planning request that details initial planning for the project, including:

      (1) the project title, appropriation code, and summary;

      (2) a description of:

      (A) the business and technology outcomes to be achieved by the project;

      (B) the features available to the end user on completion, including user acceptance testing and accessibility plans;

      (C) the potential risks associated with the project;

      (D) possible alternatives; and

      (E) the scope and complexity of the project; and

      (3) an estimate of:

      (A) the total costs required to complete through planning; and

      (B) the fund sources available to support planning costs; and

    (ii) a project implementation request to begin full design, development, and implementation of the project after the completion of planning, including:

      (1) the project title, appropriation code, and summary;

      (2) a description of:

      (A) the business and technology outcomes to be achieved by the project and the metrics by which the success of those outcomes will be measured;

      (B) the features available to the end user on completion, including user acceptance testing and accessibility plans;

      (C) the potential risks associated with the project;

      (D) possible alternatives;

      (E) the scope and complexity of the project; and

      (F) how the project meets the goals of the statewide master plan; and

      (3) an estimate of:

      (A) the total project cost, by phase; and

      (B) the fund sources to be utilized.

  (3) The Secretary may approve funding incrementally, consistent with the systems development life cycle plan.

(h) On or before July 1, 2026, the Department shall:

  (1) develop standards for units of State government to assist in identifying legacy systems that require modernization projects appropriate to be financed as an expedited project through the Fund;

  (2) adopt an Information Technology Investment Maturity Model that includes:

    (i) criteria to inform and prioritize investment decisions;

    (ii) processes to develop the information required to evaluate investment proposals against the criteria under item (i) of this item; and

    (iii) management processes to monitor the implementation of approved modernization projects; and

  (3) develop a State Modernization Plan.

#### Section 3.5-309

(a) There is an Information Technology Investment Fund.

(b) The purpose of the Fund is to support major information technology development projects and expedited projects.

(c) The Secretary:

  (1) shall administer the Fund in accordance with this section; and

  (2) subject to the provisions of Sec. 2-201 of this article and Sec. 3.5-307 of this subtitle, may receive and accept contributions, grants, or gifts of money or property.

(d)

  (1) The Fund is a special, nonlapsing fund that is not subject to Sec. 7-302 of this article.

  (2) The State Treasurer shall hold the Fund separately and the Comptroller shall account for the Fund.

  (3) The State Treasurer shall invest and reinvest the money of the Fund in the same manner as other State money may be invested.

  (4) Any investment earnings of the Fund shall be paid into the Fund.

(e) Except as provided in subsection (f) of this section, the Fund consists of:

  (1) money appropriated in the State budget to the Fund;

  (2) as approved by the Secretary, money received from:

    (i) the sale, lease, or exchange of communication sites, communication facilities, or communication frequencies for information technology purposes; or

    (ii) an information technology agreement involving resource sharing;

  (3) that portion of money earned from pay phone commissions to the extent that the commission rates exceed those in effect in December 1993;

  (4) money received and accepted as contributions, grants, or gifts as authorized under subsection (c) of this section;

  (5) general funds appropriated for major information technology development projects of any unit of State government other than a public institution of higher education that:

    (i) are unencumbered and unexpended at the end of a fiscal year;

    (ii) have been abandoned; or

    (iii) have been withheld by the General Assembly or the Secretary;

  (6) any investment earnings; and

  (7) any other money from any source accepted for the benefit of the Fund.

(f) The Fund does not include any money:

  (1) received by the Department of Transportation, the Maryland Transportation Authority, Baltimore City Community College, or the Maryland Public Broadcasting Commission;

  (2) received by the Judicial or Legislative branches of State government; or

  (3) generated from pay phone commissions that are credited to other accounts or funds in accordance with other provisions of law or are authorized for other purposes in the State budget or through an approved budget amendment.

(g) The Governor shall submit with the State budget:

  (1) a summary showing the unencumbered balance in the Fund as of the close of the prior fiscal year and a listing of any encumbrances;

  (2) an estimate of projected revenue from each of the sources specified in subsection (e) of this section for the fiscal year for which the State budget is submitted;

  (3) a descriptive listing of major information technology development projects reflecting projected costs for the fiscal year for which the State budget is submitted and any estimated future year costs; and

  (4) the amount proposed to be set aside for expedited projects.

(h) Expenditures from the Fund shall be made only:

  (1) in accordance with an appropriation approved by the General Assembly in the annual State budget;

  (2) through an approved State budget amendment under Title 7, Subtitle 2, Part II of this article, provided that a State budget amendment for any project not requested as part of the State budget submission or for any project for which the scope or cost has increased by more than 5% or $250,000 shall be submitted to the budget committees allowing a 30-day period for their review and comment; or

  (3) for expedited project contracts approved for funding by the Secretary and approved by the Board of Public Works as provided in Sec. 12-101 of this article.

(i) The Fund may be used:

  (1) for major information technology development projects;

  (2) as provided in subsections (j) and (l) of this section;

  (3) notwithstanding Sec. 3.5-301(e)(2) of this subtitle, for the costs of the first 12 months of operation and maintenance of a major information technology development project;

  (4) for expedited projects; or

  (5) for major information technology development projects and expedited projects through a revolving loan process through which an agency may reimburse the Fund in future fiscal years as established by the Secretary in regulation.

(j) Notwithstanding subsection (b) of this section and except for the cost incurred in administering the Fund, each fiscal year up to $1,000,000 of this Fund may be used for:

  (1) educationally related information technology projects;

  (2) application service provider initiatives as provided for in Title 9, Subtitle 22 of the State Government Article; or

  (3) information technology projects, including:

    (i) pilots; and

    (ii) prototypes.

(k) A unit of State government or local government may submit a request to the Secretary to support the cost of an information technology project with money under subsection (j) of this section.

(l)

  (1) Notwithstanding subsection (b) of this section and in accordance with paragraph (2) of this subsection, money paid into the Fund under subsection (e)(2) of this section:

    (i) shall be used to support:

      (1) the State telecommunication and computer network established under Sec. 3.5-404 of this title, including program development for these activities; and

      (2) the Statewide Public Safety Interoperability Radio System, also known as Maryland First (first responder interoperable radio system team), under Title 1, Subtitle 5 of the Public Safety Article; and

    (ii) at the Secretary's discretion, may be used to support State-owned communication sites, communications facilities, and telecommunications equipment used in connection with information technology agreements entered into under Sec. 3.5-307 of this subtitle, including program management for these activities.

  (2) The Secretary may determine the portion of the money paid into the Fund that shall be allocated to each program described in paragraph (1) of this subsection.

  (3)

    (i) On or before January 15 each year, the Secretary shall submit a report to the General Assembly, in accordance with Sec. 2-1257 of the State Government Article, specifying the amount of money paid into the Fund that was allocated to each program described in paragraph (1) of this subsection.

    (ii) The report required under this paragraph shall include how funds were allocated at the Secretary's discretion under paragraph (1)(ii) of this subsection.

(m)

  (1) On or before January 15 of each year, for each major information technology development project or expedited project currently in development or for which operations and maintenance funding is being provided in accordance with subsection (i)(3) of this section, subject to Sec. 2-1257 of the State Government Article, the Secretary shall provide a summary report to the Department of Legislative Services with the most up-to-date project information including:

    (i) project funding decisions and project status, including:

      (1) estimated project or product costs;

      (2) funding sources; and

      (3) ongoing operating costs after the project is no longer a major development project or expedited project, including:

      (A) costs associated with procuring and maintaining licenses; and

      (B) support to continuously maintain and improve the project or product;

    (ii) any schedule, cost, and scope changes since the last annual report;

    (iii) a risk assessment provided by either the Department or the designated unit of State government that details the identified project or product risk, including:

      (1) a description of the type of risk, including:

      (A) governance;

      (B) resource availability or capability;

      (C) funding;

      (D) interdependencies with other systems;

      (E) technical issues;

      (F) organizational culture; or

      (G) ability to support in the long term;

      (2) the risk likelihood;

      (3) the risk priority;

      (4) the risk owner;

      (5) planned risk mitigation strategy; and

      (6) the risk status as of the report date;

    (iv) project tracking metrics, including:

      (1) describing the functionality and features that have been delivered as of the report date; and

      (2) qualitative and quantitative data showing progress towards project goals; and

    (v) any change in the monitoring or oversight status.

  (2) The report submitted under this subsection:

    (i) is confidential and not subject to disclosure under Title 4 of the General Provisions Article;

    (ii) shall communicate the requisite information in a clear and concise manner that, to the greatest extent possible, avoids the use of technical language or reliance on existing industry knowledge; and

    (iii) shall include an executive summary of key information, including:

      (1) the total value of the portfolio, including:

      (A) annual development costs;

      (B) funding sources; and

      (C) projected ongoing operating costs over the next 5 years; and

      (2) a summary of new projects including:

      (A) the advantages of the new projects; and

      (B) any new or innovative aspects of development processes.

(n)

  (1) The Department shall publish and maintain a publicly available project and portfolio dashboard on the Department's website.

  (2) The dashboard shall include all major information technology development projects and expedited projects, organized by the accountable unit of State government.

  (3) For each project, the dashboard shall:

    (i) specify the schedule management for the project, including:

      (1) the project start date;

      (2) estimated length of the project, by phase;

      (3) planned milestones with estimated completion dates; and

      (4) completed milestones with completion dates;

    (ii) list the estimated project cost;

    (iii) list the total amount appropriated for the current fiscal year;

    (iv) list the total amount spent during the prior fiscal year, categorized by:

      (1) vendor costs;

      (2) agency labor;

      (3) software licenses, subscriptions, and other costs;

      (4) other expenses; and

      (5) total expenditures;

    (v) for projects in development:

      (1) the prior fiscal year forecast accompanied by actual data and the resulting variance; and

      (2) the current year forecast; and

    (vi) subject to subsection (o) of this section, identify major project or product risks, including:

      (1) risk description;

      (2) risk impact;

      (3) risk likelihood;

      (4) mitigation strategy; and

      (5) risk status.

(o)

  (1) The Department may redact specific risks identified under subsection (n)(3)(vi) of this section from the public dashboard if the Department determines that public sharing of the information could pose a risk to the project.

  (2) If a risk is redacted from the dashboard, the information shall be shared with the Legislative Policy Committee.

  (3) A risk redacted from the dashboard is confidential and not subject to disclosure under Title 4 of the General Provisions Article.

(p)

  (1) The Secretary may adopt regulations necessary to carry out this section.

  (2) The Secretary shall adopt regulations necessary to establish a process for units of State government to request and receive funding for an expedited project aligned with the State Modernization Plan that shall:

    (i) allow units of State government to apply for project funding biannually;

    (ii) be consistent with the goals and preferences established under Title 14 of this article and encourage small and minority business enterprise vendors; and

    (iii) provide measures that ensure compliance with this subtitle and the Department's regulations by both vendors and units of State government.

(q) The Chief Information Officer for a unit of State government with a planned or ongoing major information technology development project shall meet with the Secretary on a quarterly basis to report on and discuss the ongoing information technology development projects, including:

  (1) project budget;

  (2) project vendor performance or nonperformance;

  (3) project scope;

  (4) project schedule;

  (5) the capacity of the unit to implement the project; and

  (6) any other items the Secretary deems relevant to the successful implementation of the project.

#### Section 3.5-310

This subtitle may not be construed to give the Secretary authority over:

(1) the content of educational applications or curriculum at the State or local level; or

(2) the entities that may participate in such educational programs.

#### Section 3.5-311

(a)

  (1) The Secretary or the Secretary's designee, in consultation with other units of State government, and after public comment, shall develop a nonvisual access clause for use in the procurement of information technology and information technology services that specifies that the technology and services:

    (i) must provide equivalent access for effective use by both visual and nonvisual means;

    (ii) will present information, including prompts used for interactive communications, in formats intended for both visual and nonvisual use;

    (iii) can be integrated into networks for obtaining, retrieving, and disseminating information used by individuals who are not blind or visually impaired; and

    (iv) shall be obtained, whenever possible, without modification for compatibility with software and hardware for nonvisual access.

  (2) On or after January 1, 2020, the nonvisual access clause developed in accordance with paragraph (1) of this subsection shall include a statement that:

    (i) within 18 months after the award of the procurement, the Secretary, or the Secretary's designee, will determine whether the information technology meets the nonvisual access standards adopted in accordance with Sec. 3.5-303(c) of this subtitle;

    (ii) if the information technology does not meet the nonvisual access standards, the Secretary, or the Secretary's designee, will notify the vendor in writing that the vendor, at the vendor's own expense, has 12 months after the date of the notification to modify the information technology in order to meet the nonvisual access standards; and

    (iii) if the vendor fails to modify the information technology to meet the nonvisual access standards within 12 months after the date of the notification, the vendor:

      (1) may be subject to a civil penalty of:

      (A) for a first offense, a fine not exceeding $5,000; and

      (B) for a subsequent offense, a fine not exceeding $10,000; and

      (2) shall indemnify the State for liability resulting from the use of information technology that does not meet the nonvisual access standards.

(b)

  (1) Except as provided in paragraph (2) of this subsection, the nonvisual access clause required under subsection (a) of this section shall be included in each invitation for bids or request for proposals and in each procurement contract or modification or renewal of a contract issued under Title 13 of this article, without regard to the method chosen under Title 13, Subtitle 1 of this article for the purchase of new or upgraded information technology and information technology services.

  (2) Except as provided in subsection (a)(1)(iv) of this section, the nonvisual access clause required under paragraph (1) of this subsection is not required if:

    (i) the information technology is not available with nonvisual access because the essential elements of the information technology are visual and nonvisual equivalence cannot be developed; or

    (ii) the cost of modifying the information technology for compatibility with software and hardware for nonvisual access would increase the price of the procurement by more than 15%.

#### Section 3.5-312

The Secretary may delegate the duties set forth in this subtitle to carry out its purposes.

#### Section 3.5-313

(a)

  (1) In this section the following words have the meanings indicated.

  (2) "Agency" includes a unit of State government that receives funds that are not appropriated in the annual budget bill.

  (3)

    (i) "Payee" means any party who receives from the State an aggregate payment of $25,000 in a fiscal year.

    (ii) "Payee" does not include:

      (1) a State employee with respect to the employee's compensation; or

      (2) a State retiree with respect to the retiree's retirement allowance.

  (4) "Searchable website" means a website created in accordance with this section that displays and searches State payment data.

(b)

  (1) The Department shall develop and operate a single searchable website, accessible to the public at no cost through the Internet.

  (2) On or before the 15th day of the month that follows the month in which an agency makes a payment to a payee, the Department shall update the payment data on the searchable website.

(c) The searchable website shall contain State payment data, including:

  (1) the name of a payee receiving a payment;

  (2) the location of a payee by postal zip code;

  (3) the amount of a payment; and

  (4) the name of an agency making a payment.

(d) The searchable website shall allow the user to:

  (1) search data for fiscal year 2008 and each year thereafter; and

  (2) search by the following data fields:

    (i) a payee receiving a payment;

    (ii) an agency making a payment; and

    (iii) the zip code of a payee receiving a payment.

(e) State agencies shall provide appropriate assistance to the Secretary to ensure the existence and ongoing operation of the single website.

(f) This section may not be construed to require the disclosure of information that is confidential under State or federal law.

(g) This section shall be known and may be cited as the "Maryland Funding Accountability and Transparency Act".

#### Section 3.5-314

(a) In this section, "security-sensitive data" means information that is protected against unwarranted disclosure.

(b) In accordance with guidelines established by the Secretary, each unit of State government shall develop a plan to:

  (1) identify unit personnel who handle security-sensitive data; and

  (2) establish annual security overview training or refresher security training for each employee who handles security-sensitive data as part of the employee's duties.

#### Section 3.5-315

(a) There is an Information Sharing and Analysis Center in the Department.

(b) The Information Sharing and Analysis Center shall:

  (1) coordinate information on cybersecurity by serving as a central location for information sharing across State and local government, federal government partners, and private entities;

  (2) with the Office of Security Management, support cybersecurity coordination between local units of government through existing local government stakeholder organizations;

  (3) provide support to the State Chief Information Security Officer and the Cyber Preparedness Unit, in the Maryland Department of Emergency Management, during cybersecurity incidents that affect State and local governments;

  (4) support risk-based planning for the use of federal resources; and

  (5) conduct analyses of cybersecurity incidents.

#### Section 3.5-317

(a) This section does not apply to:

  (1) the Maryland Port Administration;

  (2) the University System of Maryland;

  (3) St. Mary's College of Maryland;

  (4) Morgan State University;

  (5) the Maryland Stadium Authority;

  (6) Baltimore City Community College;

  (7) the State Board of Elections;

  (8) the Office of the Attorney General;

  (9) the Comptroller; or

  (10) the State Treasurer.

(b)

  (1) The Department shall hire independent contractors to:

    (i) develop a framework for investments in technology; and

    (ii) at least once every 2 years, in accordance with the framework, assess the cybersecurity and information technology systems in each unit of State government.

  (2) The framework shall include the following criteria:

    (i) security risks to the system;

    (ii) system performance;

    (iii) the system's dependence on other information technology or cybersecurity systems and data;

    (iv) the system's ability to create an efficient and seamless experience for users;

    (v) the system's effectiveness in achieving unit objectives;

    (vi) the system's effectiveness in meeting the needs of citizens and customers;

    (vii) the costs to maintain and operate the system;

    (viii) the speed of government response time;

    (ix) the effectiveness of the system in regard to the unit's objectives;

    (x) improvements to the unit's relative audit findings attributable to the system; and

    (xi) an assessment of the system using the National Institute of Standards and Technology Cybersecurity Framework.

(c) Each unit shall promptly provide a contractor employed under subsection (b) of this section with the information necessary to perform the assessments.

(d)

  (1) Every 2 years, a contractor shall provide the results of the assessments to:

    (i) the Modernize Maryland Commission established under Sec. 3.5-316 of this subtitle; and

    (ii) in accordance with Sec. 2-1257 of the State Government Article, the Senate Budget and Taxation Committee, the Senate Committee on Education, Energy, and the Environment, and the House Health and Government Operations Committee.

  (2) The report submitted under paragraph (1)(ii) of this subsection may not contain information about the security of an information system.

(e) The Department may use multiple contractors at a time to meet the requirements of this section.

#### Section 3.5-318

(a) On or before December 1, 2024, and annually thereafter, each unit of State government shall conduct a data inventory that identifies data that meets the criteria established by the Chief Data Officer and that is:

  (1)

    (i) necessary for the operation of the unit; or

    (ii) otherwise required to be collected:

      (1) as a condition to receive federal funds; or

      (2) by federal or State law; and

  (2) in a form prescribed by the Chief Data Officer, including when the data is used in artificial intelligence.

(b) The Department shall develop and publish guidance on the policies and procedures for the inventory.

#### Section 3.5-319

(a) Each unit of State government shall designate a Privacy Officer to oversee compliance with this subtitle and coordinate with the Department and the Office of the Attorney General.

(b) The Department shall adopt regulations, guidance, and model templates to support compliance with this subtitle, including standard Public Information Act formats and data protection protocols.

---

Md. Code Ann., State Fin. & Proc. (as displayed at mgaleg.maryland.gov, October 16, 2026)