§ 3.5-305
Statutes in effect as of October 1, 2026.
Md. Code Ann., State Fin. & Proc. § 3.5-305 (2026)
Title 3.5. Department of Information Technology
Subtitle 3. Information Processing
§ 3.5-305LinkCopy Citation
(a)
(1)
In this section the following words have the meanings indicated.
(2)
(i)
“Spam e–mail” means unsolicited, phishing, solicitation, and bulk e–mails unrelated to State business.
(ii)
“Spam e–mail” does not include solicitation and bulk e–mails relating to State business, including bulk e–mail from State vendors, partners, and exclusive representatives.
(3)
“State business” means the furtherance of the State’s obligations:
(i)
under the Maryland Constitution, Maryland Code, and Code of Maryland regulations;
(ii)
under the laws of the United States; and
(iii)
by operation of contracts and similar obligations.
(b)
It is the policy of the State that e–mail systems and resources for State and higher education employees are intended to support State business and may not serve as a public forum.
(c)
Except as provided in subsection (d) of this section, in accordance with guidelines established by the Secretary, each unit of State government shall develop and submit to the Secretary:
(1)
information technology policies and standards;
(2)
an information technology plan; and
(3)
an annual project plan outlining the status of efforts to make information and services available to the public over the Internet.
(d)
(1)
The governing boards of the public institutions of higher education shall develop and submit information technology policies and standards and an information technology plan for their respective institutions or systems to the Secretary.
(2)
If the Secretary finds that the submissions required under this subsection are consistent with the master plan, the Secretary shall incorporate those submissions into the master plan.
(3)
If the Secretary finds that the submissions required under this subsection are not consistent with the master plan:
(i)
the Secretary shall return the submissions to the governing boards; and
(ii)
the governing boards shall revise the submissions as appropriate and submit the revised policies, standards, and plans to the Secretary.
(e)
(1)
In order to protect the information technology resources of the State, the policies, plans, and standards required under subsections (c) and (d) of this section shall include provisions to protect State and higher education employee e–mail services from spam e–mail and other use that does not support State business, including by implementing systems that automatically filter spam e–mail from State and higher education employees’ e–mail accounts.
(2)
The policies, plans, and standards required under subsections (c) and (d) of this section shall permit incidental personal use of information technology, including e–mail, by State employees that:
(i)
has a de minimis impact on resources; and
(ii)
is consistent with generally accepted professional business norms and expectations.