# COMAR Title 20 — Public Service Commission

## Subtitle 06 — Cybersecurity

### Chapter 01 — General

#### Regulation .03 Good Cybersecurity Practice.

*COMAR 20.06.01.03*

A. All public service companies shall follow good cybersecurity practice.

B. At a minimum, public service company cybersecurity plans shall address cybersecurity-related governance, risk management, procurement practices, personnel hiring, training policies, situational awareness, response, recovery, zero trust implementation, and transparent reporting of cybersecurity incidents to State and federal entities.

C. At a minimum, all public service companies shall comply with all cybersecurity standards applicable to their cybersecurity devices and align their cybersecurity practices with Cybersecurity and Infrastructure Security Agency’s Cross-Sector Cybersecurity Performance Goals (CPG) or a more stringent standard that is based on the National Institute of Standards and Technology (NIST) security frameworks.