The Department shall: coordinate the development, management, and operation of telecommunication equipment, systems, and services by State government; acquire and manage common user telecommunication equipment, systems, or services and charge units of State government for their proportionate share of the costs of installation, maintenance, and operation of the common user telecommunication equipment, systems, or services; promote compatibility of telecommunication systems by developing policies, procedures, and standards for the acquisition and use of telecommunication equipment, systems, and services by units of State government; coordinate State government telecommunication systems and services by reviewing requests by units of State government for telecommunication equipment, systems, or services; advise units of State government about planning, acquisition, and operation of telecommunication equipment, systems, or services; and provide radio frequency coordination for State and local governments in accordance with regulations of the Federal Communications Commission. The Department may make arrangement for a user other than a unit of State government to have access to and use of State telecommunication equipment, systems, and services and shall charge the user any appropriate amount to cover the cost of installation, maintenance, and operation of the telecommunication equipment, system, or service provided.

The provisions of this subtitle do not apply to a telecommunication system or service that is owned or operated by the University System of Maryland, Morgan State University, Baltimore City Community College, or a unit of the Legislative or Judicial Branch. The provisions of this subtitle do not preempt the authority of the Maryland Public Broadcasting Commission to own, operate, or manage telecommunication equipment, systems, or services.

Telecommunications, including those of the Maryland Public Broadcasting System, shall be consistent with statewide information technology policies and standards and the statewide information technology master plan.

The General Assembly declares that: it is the policy of the State to foster telecommunication and computer networking among State and local governments, their agencies, and educational institutions in the State; there is a need to improve access, especially in rural areas, to efficient telecommunication and computer network connections; improvement of telecommunication and computer networking for State and local governments and educational institutions promotes economic development, educational resource use and development, and efficiency in State and local administration; rates for the intrastate inter–LATA telephone communications needed for effective integration of telecommunication and computer resources are prohibitive for many smaller governments, agencies, and institutions; and the use of improved State telecommunication and computer networking under this section is intended not to compete with commercial access to advanced network technology, but rather to foster fundamental efficiencies in government and education for the public good. The Department shall establish a telecommunication and computer network in the State. The network shall consist of: one or more connection facilities for telecommunication and computer connection in each local access transport area (LATA) in the State; and facilities, auxiliary equipment, and services required to support the network in a reliable and secure manner. The network shall be accessible through direct connection and through local intra–LATA telecommunications to State and local governments and public and private educational institutions in the State. In a manner and frequency established in regulations adopted by the Department, each unit of local government and any local agencies that use the network established under subsection (b) of this section shall certify to the Department that the unit is in compliance with the Department’s minimum security standards. The Office shall ensure that at least once every 2 years, or more often if required by regulations adopted by the Department, each unit of State government shall complete an external assessment. The Office shall assist each unit to remediate any security vulnerabilities or high–risk configurations identified in the assessment required under paragraph (1) of this subsection. In this subsection, “IT unit” means a unit of the Legislative Branch or Judicial Branch of State government, the Office of the Attorney General, the Office of the Comptroller, or the Office of the State Treasurer that provides information technology services for another unit of government. Each IT unit shall: be evaluated by an independent auditor with cybersecurity expertise to determine whether the IT unit, and the units it provides information technology services for, meet relevant cybersecurity standards recommended by the National Institute of Standards and Technology; and certify compliance with the recommended National Institutes of Standards and Technology cybersecurity standards to: if the IT unit is part of the Legislative Branch, the President of the Senate and the Speaker of the House; if the IT unit is part of the Office of the Attorney General, to the Attorney General; if the IT unit is part of the Comptroller’s Office, to the Comptroller; if the IT unit is part of the State Treasurer’s Office, to the State Treasurer; and if the IT unit is part of the Judicial Branch of State government, the Chief Judge.

On or before December 1 each year, each unit of State government shall: report the results of any cybersecurity preparedness assessments performed in the prior year to the Office of Security Management in accordance with guidelines developed by the Office; and submit a report to the Governor and the Office of Security Management that includes: an inventory of all information systems and applications used or maintained by the unit; a full data inventory of the unit; a list of all cloud or statistical analysis system solutions used by the unit; a list of all permanent and transient vendor interconnections that are in place; the number of unit employees who have received cybersecurity training; the total number of unit employees who use the network; the number of information technology staff positions, including vacancies; the number of noninformation technology staff positions, including vacancies; the unit’s information technology budget, itemized to include the following categories: services; equipment; applications; personnel; software licensing; development; network projects; maintenance; and cybersecurity; any major information technology initiatives to modernize the unit’s information technology systems or improve customer access to State and local services; the unit’s plans for future fiscal years to implement the unit’s information technology goals; compliance with timelines and metrics provided in the Department’s master plan; and any other key performance indicators required by the Office of Security Management to track compliance or consistency with the Department’s statewide information technology master plan. Each unit of State government shall report a cybersecurity incident in accordance with paragraph (2) of this subsection to the State Chief Information Security Officer. For the reporting of cybersecurity incidents under paragraph (1) of this subsection, the State Chief Information Security Officer shall determine: the criteria for determining when an incident must be reported; the manner in which to report; and the time period within which a report must be made.

This section does not apply to municipal governments. In a manner and frequency established in regulations adopted by the Department, each county government, local school system, and local health department shall: in consultation with the local emergency manager, create or update a cybersecurity preparedness and response plan; and complete a cybersecurity preparedness assessment. The assessment required under paragraph (b)(2) of this section may, in accordance with the preference of each county government, be performed by the Department or by a vendor authorized by the Department. On request, the Department shall advise local school systems on: compliance with the State minimum cybersecurity standards; conducting cybersecurity maturity assessments every 2 years; and remediation efforts. The Department is not responsible for the successful performance of or day–to–day management of the duties of a local school system described in paragraph (1) of this subsection. Each local government shall report a cybersecurity incident, including an attack on a State system being used by the local government, to the appropriate local emergency manager and the State Security Operations Center in the Department in accordance with paragraph (2) of this subsection. For the reporting of cybersecurity incidents to local emergency managers under paragraph (1) of this subsection, the State Chief Information Security Officer shall determine: the criteria for determining when an incident must be reported; the manner in which to report; and the time period within which a report must be made. The State Security Operations Center shall immediately notify the appropriate agencies of a cybersecurity incident reported under this subsection through the State Security Operations Center.