Title 20 — Subtitle 06. Cybersecurity

This chapter applies to all public service companies subject to cybersecurity requirements in Public Utilities Article, §5-306, Annotated Code of Maryland.

This chapter also broadly applies to all cybersecurity devices necessary for the adequate, economical, and efficient delivery of public service company services in Maryland.

Applicable Standards. Unless otherwise specified by the Commission, the public service company shall use the applicable provisions in the latest revised version of the National Institute of Standards Special Publication 800-207, Zero Trust Architecture, August 2020 publication.

In this subtitle, the following terms have the meanings indicated.

Terms Defined.

All public service companies shall follow good cybersecurity practice.

At a minimum, public service company cybersecurity plans shall address cybersecurity-related governance, risk management, procurement practices, personnel hiring, training policies, situational awareness, response, recovery, zero trust implementation, and transparent reporting of cybersecurity incidents to State and federal entities.

At a minimum, all public service companies shall comply with all cybersecurity standards applicable to their cybersecurity devices and align their cybersecurity practices with Cybersecurity and Infrastructure Security Agency’s Cross-Sector Cybersecurity Performance Goals (CPG) or a more stringent standard that is based on the National Institute of Standards and Technology (NIST) security frameworks.

All public service companies that have 15,000 or more combined gas, electric, and water customers in Maryland shall provide periodic confidential cybersecurity briefings describing the company’s adherence to good cybersecurity practice, including the company’s cybersecurity maturity level trends, cybersecurity performance metric trends, or any other cybersecurity-related topics of current interest to the Commission and such additional representatives as the Commission designates.

Periodic confidential cybersecurity briefings shall be held at a minimum of every 3 years, or as otherwise directed by the Commission.

All public service companies shall report cybersecurity incidents no later than 24 hours to the State Security Operations Center according to the method specified by the Maryland Department of Information Technology. Public service companies shall include in such reports the following information:

The State Security Operations Center shall notify appropriate entities of a cybersecurity incident reported, as required by Public Utilities Article, §5-306(d)(3), Annotated Code of Maryland, including the Commission. The Commission’s Office of Cybersecurity shall notify such additional representatives as the Commission designates.

Depending on the circumstances of the cybersecurity incident, the public service company may be requested to provide additional cybersecurity incident related information to either the Department of Information Technology or the Office of Cybersecurity, which may not be unreasonably denied unless this information is superseded by applicable federal cybersecurity standards and regulations that prohibit such disclosures.

The details of a public service company incident report may not be divulged except as directed by the Commission, or a court, as authorized by law, or as required by Public Utilities Article, §5-306(d)(3), Annotated Code of Maryland. The Office of Cybersecurity shall promptly notify a public service company upon the discovery of any unauthorized access, compromise, loss, or exfiltration of the public service company’s cybersecurity incident information.

Public service companies shall implement a zero trust cybersecurity approach that is focused on cybersecurity resource protection and adopts and implements cybersecurity standards that meet or exceed regulations in this chapter.

A public service company shall adopt a zero trust cybersecurity approach for on-premises services and cloud-based services.

Levels of cybersecurity device risk and supply chain risk shall be defined by each public service company, consistent with industry standard practices, unless superseded by applicable federal or State cybersecurity standards.

The process by which cybersecurity device risk and supply chain risk is determined shall be documented and subject to inspection by the Office of Cybersecurity unless such processes are superseded by applicable federal cybersecurity standards and regulations that prohibit such disclosures.

A public service company shall establish minimum security standards for each cybersecurity device or grouping of cyber security devices, including security risks with supply chains based on the level of security risk each device or group of devices presents to the public service company’s ability to deliver utility services or protect customer information necessary for the adequate, economical, and efficient delivery of public service company services in Maryland.

Public service companies shall provide evidence that they already or, where technically feasible, are planning to implement zero trust approaches in their Information Technology (IT) and Operational Technology (OT) devices and provide timelines or industry roadmaps for implementing zero trust approaches. Evidence of planning shall consist of the following:

On or before July 1, 2024, and on or before July 1 every other year thereafter, public service companies shall engage a third party to conduct an assessment of cybersecurity devices and supply chain risk based on either of the following cybersecurity frameworks:

The third party conducting the assessment of cybersecurity devices and supply chain risk shall be any non-affiliated entity that is qualified to perform an assessment based on applicable certifications, expertise, or past experience to conduct NIST and CPG cybersecurity framework-based assessments.

Multiple third-party assessments of cybersecurity devices and supply chain risk using applicable cybersecurity frameworks shall be used, if necessary, to cover all cybersecurity devices and supply chain risk under the scope of this chapter.

All cybersecurity assessments shall be anytime within a 2-year assessment cycle, with the first assessment cycle ending July 1, 2024, and subsequent assessment cycles ending on or before July 1 every other year thereafter.

A public service company shall confidentially e-file to the Commission, or alternatively submit to the Office of Cybersecurity, an attestation letter by the public service company CISO, or equivalent, on or before July 1, 2024, and on or before July 1 every other year thereafter. This attestation letter shall include the following information:

A public service company may develop a consolidated assessment of all third-party assessments in a cybersecurity assessment report. At a minimum, a third-party or consolidated public service company cybersecurity assessment report shall include:

A public service company shall arrange an in-person meeting with the Office of Cybersecurity at Commission offices or at another mutually agreeable location to review all individual third-party cybersecurity assessments or alternatively a public service company’s consolidated cybersecurity assessment report, within 90 days of the date of the certification of a public service company’s compliance attestation letter.

A public service company shall maintain all consolidated cybersecurity assessment reports and all third-party assessments of cybersecurity devices under the scope of this regulation a minimum of two, 2-year assessment cycles, except for applicable North American Electric Reliability Corporation Critical Infrastructure Protection (NERC CIP) audits, or an inspection by the Transportation Security Administration (TSA) pursuant to TSA’s Gas Pipeline Security Directives, or TSA regulations that supersede the security directives which are performed on a 3-year cycle. These assessment reports shall be made available at Commission offices or at another mutually agreeable location for inspection by the Office of Cybersecurity, upon request.

The details of a public service company’s cybersecurity assessments may not be divulged except as directed by the Commission, or a court, as authorized by law. The Office of Cybersecurity shall promptly notify a public service company upon the discovery of any unauthorized access, compromise, loss, or exfiltration of the public service company’s periodic assessment information.

All public service companies shall provide a primary cybersecurity contact and alternate cybersecurity contact information to the Office of Cybersecurity that includes each contact’s name, company, position title, mail address, email address, cellular phone number, and office phone number. The Office of Cybersecurity shall share this information with the State Security Operations Center in the Department of Information Technology.

A public service company’s primary cybersecurity contact shall either be the public service company’s CISO, or equivalent, or directly report to the public service company CISO, or equivalent.

A public service company alternate cybersecurity contact shall either directly report to a public service company CISO, or equivalent, or directly report to the public service company primary cybersecurity contact.

All public service companies shall provide an organization chart, or equivalent narrative description, that describes the organizational reporting relationships of the primary cybersecurity contact and alternate cybersecurity contact to the CISO.

The Cybersecurity Director shall be notified of all changes to primary contact and alternate contact information, including the reporting relationship of the primary cybersecurity contact and alternate cybersecurity contact to the CISO, within 30 days of changes.

The Office of Cybersecurity may send a public service company a specific information request for information related to cybersecurity incidents, standards, practices, procedures, or other information reasonably related to cybersecurity unless such processes are superseded by applicable federal cybersecurity standards and regulations that prohibit such disclosures.

A public service company shall respond within 10 working days after receipt of a specific information request from the Office of Cybersecurity relating to a cybersecurity incident under Regulation .05 of this chapter.

Except as provided under §B of this regulation, a public service company shall respond within 30 days after receipt of a specific information request from the Office of Cybersecurity.

The Office of Cybersecurity may waive the requirements of §B or C of this regulation upon written request from a public service company demonstrating sufficient cause.

The details of a public service company cybersecurity specific information request may not be divulged except as directed by the Commission, or a court, as authorized by law. The Office of Cybersecurity shall promptly notify a public service company upon the discovery of any unauthorized access, compromise, loss, or exfiltration of the public service company’s special information request information.

General.

Contents of Notice of Probable Violation. A NOPV shall include:

Response Options. A public service company shall respond to the NOPV as follows:

If a public service company objects to the proposed compliance order or civil penalty and submits a written explanation, information, or other materials in response to a NOPV, the Cybersecurity Director shall review the submissions and determine whether to negotiate further, modify, or withdraw the NOPV, or file a complaint under Public Utilities Article, §3-102, Annotated Code of Maryland.

Before the issuance of a compliance order, the Office of Cybersecurity may execute a consent order jointly with a public service company.

A proposed consent order shall contain the following:

Procedure. Following an investigation and a determination by the Office of Cybersecurity, if there exists good cause to believe that a public service company violated Public Utilities Article, §5-306, Annotated Code of Maryland, or regulations in this subtitle, the Office of Cybersecurity may assess or negotiate a civil penalty under Public Utilities Article, §13-201, Annotated Code of Maryland, for violations and under Public Utilities Article, §13-205, Annotated Code of Maryland, for failures to submit reports and information with the prescribed form, contents, and deadlines.

Penalty Considerations. In proposing a civil penalty for violations of Public Utilities Article, §5-306, Annotated Code of Maryland, or regulations in this subtitle, the Office of Cybersecurity shall consider the criteria stated in Public Utilities Article, §13-201, Annotated Code of Maryland.

Filing with the Commission. Any proposed civil penalty shall be subject to approval, modification, or further hearing in accordance with Regulation .04 of this chapter.

Payment Procedures. A public service company shall pay a civil penalty by submitting to the Commission a certified check or money order in the correct amount, payable to the Maryland Public Service Commission.

Proposed Consent Orders and Civil Penalties.

The Commission shall approve, modify, or initiate a hearing on all proposed civil penalties and consent orders.

If the Commission modifies a proposed consent order or a proposed civil penalty, the public service company may:

A public service company may petition the Office of Cybersecurity for a stay of enforcement for good cause.

The Office of Cybersecurity may issue a stay of enforcement for a regulation in this subtitle for good cause shown.

All cybersecurity compliance information in this subtitle may not be divulged outside of the Commission except as directed by the Commission, or a court, or as authorized by law.

The Office of Cybersecurity shall share cybersecurity compliance information collected in this chapter upon request with additional representatives as the Commission designates. These representatives shall be subject to the confidentiality requirements in §A of this regulation.

The Office of Cybersecurity shall promptly notify a public service company upon the discovery of any unauthorized access, compromise, loss, or exfiltration of the public service company’s compliance information.