This chapter applies to all public service companies subject to cybersecurity requirements in Public Utilities Article, §5-306, Annotated Code of Maryland. This chapter also broadly applies to all cybersecurity devices necessary for the adequate, economical, and efficient delivery of public service company services in Maryland. Applicable Standards. Unless otherwise specified by the Commission, the public service company shall use the applicable provisions in the latest revised version of the National Institute of Standards Special Publication 800-207, Zero Trust Architecture, August 2020 publication. In this subtitle, the following terms have the meanings indicated. Terms Defined. “Chief information security officer (CISO)” means a senior-level executive who oversees an organization's information, cyber, and technology security. The CISO's responsibilities include developing, implementing, and enforcing security policies to protect critical data. “Commission” means the Public Service Commission of Maryland. “Compliance order” means a document issued by the Commission's Office of Cybersecurity to a public service company directing compliance. “Consent order” means a document executed jointly by the Commission's Office of Cybersecurity and a public service company for the disposition of a case. “Cybersecurity” means processes or capabilities wherein systems, communications, and information are protected and defended against damage, unauthorized use or modification, and exploitation. “Cybersecurity device” means any combination of hardware, software, and related services, including informational technology systems, operational technology systems, and smart grid systems used for delivery of electricity, gas, or water, or systems that store customer information. “Cybersecurity Director” means the Director of the Commission's Office of Cybersecurity. “Cybersecurity framework” means a common mechanism for organizations to: Describe their current cybersecurity posture; Describe their target state for cybersecurity; Identify and prioritize opportunities for improvement within the context of a continuous and repeatable process; Assess progress toward the target state; and Communicate among internal and external stakeholders about cybersecurity risk. “Cybersecurity incident” means a malicious act or suspicious event that compromises, or was an attempt to compromise, a public service company’s cybersecurity device. “Cybersecurity maturity” is a quantitative and qualitative assessment of an organization's cybersecurity posture using a cybersecurity framework. “Cybersecurity standard” means a mandatory federal or state cybersecurity requirement to protect the cybersecurity devices of an organization. “Good cybersecurity practice” means cybersecurity plans that are designed, implemented, maintained, and operated in accordance with applicable industry cybersecurity standards and with the Cybersecurity and Infrastructure Security Agency’s Cross-Sector Cybersecurity Performance Goals (CPG), or a more stringent standard that is based on the National Institute of Standards and Technology (NIST) security frameworks. “Information technology system” means hardware and software related to electronic processing, and storage, retrieval, transmittal, and manipulation of data. “NOPV” means a notice of probable violation issued upon finding good cause to believe a violation of this subtitle or cybersecurity requirements in Public Utilities Article, §5-306, Annotated Code of Maryland. “Office of Cybersecurity” means the organization in the Commission responsible for implementing oversight of cybersecurity requirements in Public Utilities Article, §§2-108 and 5-306, Annotated Code of Maryland. “Operations technology system” means a system or network that monitors or controls electric, gas, or water system infrastructure used for utility operations. “Public service company” has the meaning stated in Public Utilities Article, §1-101, Annotated Code of Maryland, including investor-owned electric companies, electric cooperatives, municipal electric companies, gas companies, and water companies, but excluding public service companies that are a common carrier or a telephone company per Public Utilities Article, §5-306(b), Annotated Code of Maryland. “Smart grid system” means a system or network that enables a utility to gather and store personally identifiable customer information from customer devices or allows for the control of customer devices. “Zero trust” means a cybersecurity approach that is focused on cybersecurity resource protection, is based on the premise that trust is never granted implicitly but shall be continually evaluated, and is aligned with the tenets of the latest revised version of the National Institute of Standards Special Publication 800-207. All public service companies shall follow good cybersecurity practice. At a minimum, public service company cybersecurity plans shall address cybersecurity-related governance, risk management, procurement practices, personnel hiring, training policies, situational awareness, response, recovery, zero trust implementation, and transparent reporting of cybersecurity incidents to State and federal entities. At a minimum, all public service companies shall comply with all cybersecurity standards applicable to their cybersecurity devices and align their cybersecurity practices with Cybersecurity and Infrastructure Security Agency’s Cross-Sector Cybersecurity Performance Goals (CPG) or a more stringent standard that is based on the National Institute of Standards and Technology (NIST) security frameworks. All public service companies that have 15,000 or more combined gas, electric, and water customers in Maryland shall provide periodic confidential cybersecurity briefings describing the company’s adherence to good cybersecurity practice, including the company’s cybersecurity maturity level trends, cybersecurity performance metric trends, or any other cybersecurity-related topics of current interest to the Commission and such additional representatives as the Commission designates. Periodic confidential cybersecurity briefings shall be held at a minimum of every 3 years, or as otherwise directed by the Commission. All public service companies shall report cybersecurity incidents no later than 24 hours to the State Security Operations Center according to the method specified by the Maryland Department of Information Technology. Public service companies shall include in such reports the following information: Contact information; Type and size of the organization; Start and end time of the incident; Generalized narrative of the incident; Degree or scope of impact from the incident on delivery of utility operation or service; Type and amount of involved utility customer information that was or may have been impacted pursuant to Commercial Law Article, §14-3501 et seq., Annotated Code of Maryland; and A follow up report, typically within 30 days, if further impact or exposure is discovered requiring revision of previous reported scope and impact. The State Security Operations Center shall notify appropriate entities of a cybersecurity incident reported, as required by Public Utilities Article, §5-306(d)(3), Annotated Code of Maryland, including the Commission. The Commission’s Office of Cybersecurity shall notify such additional representatives as the Commission designates. Depending on the circumstances of the cybersecurity incident, the public service company may be requested to provide additional cybersecurity incident related information to either the Department of Information Technology or the Office of Cybersecurity, which may not be unreasonably denied unless this information is superseded by applicable federal cybersecurity standards and regulations that prohibit such disclosures. The details of a public service company incident report may not be divulged except as directed by the Commission, or a court, as authorized by law, or as required by Public Utilities Article, §5-306(d)(3), Annotated Code of Maryland. The Office of Cybersecurity shall promptly notify a public service company upon the discovery of any unauthorized access, compromise, loss, or exfiltration of the public service company’s cybersecurity incident information. Public service companies shall implement a zero trust cybersecurity approach that is focused on cybersecurity resource protection and adopts and implements cybersecurity standards that meet or exceed regulations in this chapter. A public service company shall adopt a zero trust cybersecurity approach for on-premises services and cloud-based services. Levels of cybersecurity device risk and supply chain risk shall be defined by each public service company, consistent with industry standard practices, unless superseded by applicable federal or State cybersecurity standards. The process by which cybersecurity device risk and supply chain risk is determined shall be documented and subject to inspection by the Office of Cybersecurity unless such processes are superseded by applicable federal cybersecurity standards and regulations that prohibit such disclosures. A public service company shall establish minimum security standards for each cybersecurity device or grouping of cyber security devices, including security risks with supply chains based on the level of security risk each device or group of devices presents to the public service company’s ability to deliver utility services or protect customer information necessary for the adequate, economical, and efficient delivery of public service company services in Maryland. Public service companies shall provide evidence that they already or, where technically feasible, are planning to implement zero trust approaches in their Information Technology (IT) and Operational Technology (OT) devices and provide timelines or industry roadmaps for implementing zero trust approaches. Evidence of planning shall consist of the following: A documented good faith analysis to determine where public service companies can expand implementation of zero trust approaches; An overview of a specific utility’s approaches to zero trust; The incorporation of zero trust approaches as a criterion in IT and OT asset design and procurement policy as supported by industry; The existence of auditable asset investments demonstrably compliant with zero trust approaches; and Documented company plans with zero trust approach implementation timelines and dedicated resources. On or before July 1, 2024, and on or before July 1 every other year thereafter, public service companies shall engage a third party to conduct an assessment of cybersecurity devices and supply chain risk based on either of the following cybersecurity frameworks: The Cybersecurity and Infrastructure Security Agency’s Cross-Sector Cybersecurity Performance Goals (CPG); or A more stringent standard that is based on the National Institute of Standards and Technology (NIST) security frameworks. The third party conducting the assessment of cybersecurity devices and supply chain risk shall be any non-affiliated entity that is qualified to perform an assessment based on applicable certifications, expertise, or past experience to conduct NIST and CPG cybersecurity framework-based assessments. Multiple third-party assessments of cybersecurity devices and supply chain risk using applicable cybersecurity frameworks shall be used, if necessary, to cover all cybersecurity devices and supply chain risk under the scope of this chapter. All cybersecurity assessments shall be anytime within a 2-year assessment cycle, with the first assessment cycle ending July 1, 2024, and subsequent assessment cycles ending on or before July 1 every other year thereafter. A public service company shall confidentially e-file to the Commission, or alternatively submit to the Office of Cybersecurity, an attestation letter by the public service company CISO, or equivalent, on or before July 1, 2024, and on or before July 1 every other year thereafter. This attestation letter shall include the following information: The name of the public service company; The date of the public service company’s most recent cybersecurity assessments; The cybersecurity framework used in each cybersecurity assessment of the public service company; The name of the third-party entity that completed each cybersecurity assessment and their qualifications to conduct NIST or CPG cybersecurity framework-based assessments; A certification of the public service company’s compliance with the standards for the cybersecurity frameworks used in these cybersecurity assessments; and If applicable, an attestation that a North American Electric Reliability Corporation Critical Infrastructure Protection (NERC CIP) audit has been performed and the dates the last assessment was performed, or an inspection by the Transportation Security Administration (TSA) pursuant to TSA’s Gas Pipeline Security Directives, or TSA regulations that supersede the security directives. A public service company may develop a consolidated assessment of all third-party assessments in a cybersecurity assessment report. At a minimum, a third-party or consolidated public service company cybersecurity assessment report shall include: An executive summary that includes a general overview of cybersecurity technology and policies used by the public service company; A description of how the cybersecurity frameworks used in each third-party assessment is based on NIST or CPG; A description of the scope of the cybersecurity devices and supply chain risk assessed and the applicable cybersecurity framework used for each third-party assessment; The completion date of each third-party assessment; A description of the cybersecurity standards to which the public service company shall comply for the cybersecurity devices and supply chain risk included in the assessment; The assessment results for each third-party assessment, including a description of cybersecurity maturity and trends of cybersecurity maturity since the previous assessment, if applicable; and Conclusions and recommendations from each third-party assessor for corrective actions. A public service company shall arrange an in-person meeting with the Office of Cybersecurity at Commission offices or at another mutually agreeable location to review all individual third-party cybersecurity assessments or alternatively a public service company’s consolidated cybersecurity assessment report, within 90 days of the date of the certification of a public service company’s compliance attestation letter. A public service company shall maintain all consolidated cybersecurity assessment reports and all third-party assessments of cybersecurity devices under the scope of this regulation a minimum of two, 2-year assessment cycles, except for applicable North American Electric Reliability Corporation Critical Infrastructure Protection (NERC CIP) audits, or an inspection by the Transportation Security Administration (TSA) pursuant to TSA’s Gas Pipeline Security Directives, or TSA regulations that supersede the security directives which are performed on a 3-year cycle. These assessment reports shall be made available at Commission offices or at another mutually agreeable location for inspection by the Office of Cybersecurity, upon request. The details of a public service company’s cybersecurity assessments may not be divulged except as directed by the Commission, or a court, as authorized by law. The Office of Cybersecurity shall promptly notify a public service company upon the discovery of any unauthorized access, compromise, loss, or exfiltration of the public service company’s periodic assessment information. All public service companies shall provide a primary cybersecurity contact and alternate cybersecurity contact information to the Office of Cybersecurity that includes each contact’s name, company, position title, mail address, email address, cellular phone number, and office phone number. The Office of Cybersecurity shall share this information with the State Security Operations Center in the Department of Information Technology. A public service company’s primary cybersecurity contact shall either be the public service company’s CISO, or equivalent, or directly report to the public service company CISO, or equivalent. A public service company alternate cybersecurity contact shall either directly report to a public service company CISO, or equivalent, or directly report to the public service company primary cybersecurity contact. All public service companies shall provide an organization chart, or equivalent narrative description, that describes the organizational reporting relationships of the primary cybersecurity contact and alternate cybersecurity contact to the CISO. The Cybersecurity Director shall be notified of all changes to primary contact and alternate contact information, including the reporting relationship of the primary cybersecurity contact and alternate cybersecurity contact to the CISO, within 30 days of changes. The Office of Cybersecurity may send a public service company a specific information request for information related to cybersecurity incidents, standards, practices, procedures, or other information reasonably related to cybersecurity unless such processes are superseded by applicable federal cybersecurity standards and regulations that prohibit such disclosures. A public service company shall respond within 10 working days after receipt of a specific information request from the Office of Cybersecurity relating to a cybersecurity incident under Regulation .05 of this chapter. Except as provided under §B of this regulation, a public service company shall respond within 30 days after receipt of a specific information request from the Office of Cybersecurity. The Office of Cybersecurity may waive the requirements of §B or C of this regulation upon written request from a public service company demonstrating sufficient cause. The details of a public service company cybersecurity specific information request may not be divulged except as directed by the Commission, or a court, as authorized by law. The Office of Cybersecurity shall promptly notify a public service company upon the discovery of any unauthorized access, compromise, loss, or exfiltration of the public service company’s special information request information. Public Utilities Article, §§2-112, 2-113, 2-121, 3-101, 3-104, and 3-113, Annotated Code of Maryland Effective date: July 25, 2022 (49:15 Md. R. 739) Regulation .01 amended effective December 12, 2024 (51:24 1081) Regulation .02 amended effective December 12, 2024 (51:24 1081) Regulation .03 amended effective December 12, 2024 (51:24 1081) Regulation .04 amended effective December 12, 2024 (51:24 1081) Regulation .05 amended effective December 12, 2024 (51:24 1081) Regulation .06 adopted effective December 12, 2024 (51:24 1081) Regulation .07 adopted effective December 12, 2024 (51:24 1081) Regulation .08 adopted effective December 12, 2024 (51:24 1081) Regulation .09 adopted effective December 12, 2024 (51:24 1081) General. The Office of Cybersecurity may issue a NOPV upon finding good cause to believe a violation of this subtitle or cybersecurity requirements in Public Utilities Article, §5-306, Annotated Code of Maryland, has occurred. The NOPV may contain a proposed compliance order. A public service company shall respond in writing within 30 days after receipt of a NOPV. The Office of Cybersecurity may waive the requirements of §A(3) of this regulation upon written request from a public service company demonstrating good cause. Contents of Notice of Probable Violation. A NOPV shall include: A statement of the statute or regulation allegedly violated by a public service company; A description of the evidence indicating a possible violation; Notice of response options available to the public service company; If appropriate, the amount of the proposed civil penalty and the maximum civil penalty applicable under law; and If appropriate, a statement of the remedial action being sought in a compliance order. Response Options. A public service company shall respond to the NOPV as follows: If a NOPV contains a proposed compliance order, a public service company may: Agree to the proposed compliance order; Request the execution of a consent order; Object to the proposed compliance order and submit written explanations, information, or other materials in answer to the allegations in the notice; or Request a hearing under Public Utilities Article, §3-102, Annotated Code of Maryland; and If the NOPV contains a proposed civil penalty, a public service company may: Agree to pay the penalty; Submit an offer in compromise of the proposed civil penalty; Object to the proposed civil penalty and submit a written explanation, information, or other material to mitigate the proposed civil penalty; or Request a hearing under Public Utilities Article, §3-102, Annotated Code of Maryland. If a public service company objects to the proposed compliance order or civil penalty and submits a written explanation, information, or other materials in response to a NOPV, the Cybersecurity Director shall review the submissions and determine whether to negotiate further, modify, or withdraw the NOPV, or file a complaint under Public Utilities Article, §3-102, Annotated Code of Maryland. Before the issuance of a compliance order, the Office of Cybersecurity may execute a consent order jointly with a public service company. A proposed consent order shall contain the following: An admission by a public service company of all jurisdictional facts; and A description of any action required by a public service company and the time by which the actions shall be accomplished. Procedure. Following an investigation and a determination by the Office of Cybersecurity, if there exists good cause to believe that a public service company violated Public Utilities Article, §5-306, Annotated Code of Maryland, or regulations in this subtitle, the Office of Cybersecurity may assess or negotiate a civil penalty under Public Utilities Article, §13-201, Annotated Code of Maryland, for violations and under Public Utilities Article, §13-205, Annotated Code of Maryland, for failures to submit reports and information with the prescribed form, contents, and deadlines. Penalty Considerations. In proposing a civil penalty for violations of Public Utilities Article, §5-306, Annotated Code of Maryland, or regulations in this subtitle, the Office of Cybersecurity shall consider the criteria stated in Public Utilities Article, §13-201, Annotated Code of Maryland. Filing with the Commission. Any proposed civil penalty shall be subject to approval, modification, or further hearing in accordance with Regulation .04 of this chapter. Payment Procedures. A public service company shall pay a civil penalty by submitting to the Commission a certified check or money order in the correct amount, payable to the Maryland Public Service Commission. Proposed Consent Orders and Civil Penalties. All proposed consent orders and proposed civil penalties that have been agreed to by a public service company and the Office of Cybersecurity shall be maintained as confidential and filed with the Commission for final determination. A notice and a copy of the confidential consent orders and proposed civil penalties shall be received by the following entities: The Office of Cybersecurity; The public service company that is subject to the order; The Commission; Office of People’s Counsel; and Any additional entities as determined by the Commission. On a case-by-case basis, the Commission may, on its own or by request of an entity identified in §A(2) of this regulation, determine if and when any portion of the proposed consent order or proposed civil penalty order can be filed publicly. A request made by an entity identified in §A(2) of this regulation shall be made in a manner specified by the Commission. Prior to ordering any public filing under this section, the Commission shall provide reasonable notice to the public service company that is subject to the order and allow that public service company a reasonable opportunity to provide confidential comments on the potential security risks posed by publicly releasing details of an order. The Commission shall approve, modify, or initiate a hearing on all proposed civil penalties and consent orders. If the Commission modifies a proposed consent order or a proposed civil penalty, the public service company may: Agree to the modified consent order or civil penalty; or Request a hearing. A public service company may petition the Office of Cybersecurity for a stay of enforcement for good cause. The Office of Cybersecurity may issue a stay of enforcement for a regulation in this subtitle for good cause shown. All cybersecurity compliance information in this subtitle may not be divulged outside of the Commission except as directed by the Commission, or a court, or as authorized by law. The Office of Cybersecurity shall share cybersecurity compliance information collected in this chapter upon request with additional representatives as the Commission designates. These representatives shall be subject to the confidentiality requirements in §A of this regulation. The Office of Cybersecurity shall promptly notify a public service company upon the discovery of any unauthorized access, compromise, loss, or exfiltration of the public service company’s compliance information. Public Utilities Article, §§2-108, 2-112, 2-113, 2-121, 2-302, 2-309, 3-101, 3-102, 3-104, 3-113, 3-205, 5-306, 6-205, and 13-201, Annotated Code of Maryland Effective date: December 12, 2024 (51:24 1081)