Chapter 01. General

This chapter applies to all public service companies subject to cybersecurity requirements in Public Utilities Article, §5-306, Annotated Code of Maryland.

This chapter also broadly applies to all cybersecurity devices necessary for the adequate, economical, and efficient delivery of public service company services in Maryland.

Applicable Standards. Unless otherwise specified by the Commission, the public service company shall use the applicable provisions in the latest revised version of the National Institute of Standards Special Publication 800-207, Zero Trust Architecture, August 2020 publication.

In this subtitle, the following terms have the meanings indicated.

Terms Defined.

All public service companies shall follow good cybersecurity practice.

At a minimum, public service company cybersecurity plans shall address cybersecurity-related governance, risk management, procurement practices, personnel hiring, training policies, situational awareness, response, recovery, zero trust implementation, and transparent reporting of cybersecurity incidents to State and federal entities.

At a minimum, all public service companies shall comply with all cybersecurity standards applicable to their cybersecurity devices and align their cybersecurity practices with Cybersecurity and Infrastructure Security Agency’s Cross-Sector Cybersecurity Performance Goals (CPG) or a more stringent standard that is based on the National Institute of Standards and Technology (NIST) security frameworks.

All public service companies that have 15,000 or more combined gas, electric, and water customers in Maryland shall provide periodic confidential cybersecurity briefings describing the company’s adherence to good cybersecurity practice, including the company’s cybersecurity maturity level trends, cybersecurity performance metric trends, or any other cybersecurity-related topics of current interest to the Commission and such additional representatives as the Commission designates.

Periodic confidential cybersecurity briefings shall be held at a minimum of every 3 years, or as otherwise directed by the Commission.

All public service companies shall report cybersecurity incidents no later than 24 hours to the State Security Operations Center according to the method specified by the Maryland Department of Information Technology. Public service companies shall include in such reports the following information:

The State Security Operations Center shall notify appropriate entities of a cybersecurity incident reported, as required by Public Utilities Article, §5-306(d)(3), Annotated Code of Maryland, including the Commission. The Commission’s Office of Cybersecurity shall notify such additional representatives as the Commission designates.

Depending on the circumstances of the cybersecurity incident, the public service company may be requested to provide additional cybersecurity incident related information to either the Department of Information Technology or the Office of Cybersecurity, which may not be unreasonably denied unless this information is superseded by applicable federal cybersecurity standards and regulations that prohibit such disclosures.

The details of a public service company incident report may not be divulged except as directed by the Commission, or a court, as authorized by law, or as required by Public Utilities Article, §5-306(d)(3), Annotated Code of Maryland. The Office of Cybersecurity shall promptly notify a public service company upon the discovery of any unauthorized access, compromise, loss, or exfiltration of the public service company’s cybersecurity incident information.

Public service companies shall implement a zero trust cybersecurity approach that is focused on cybersecurity resource protection and adopts and implements cybersecurity standards that meet or exceed regulations in this chapter.

A public service company shall adopt a zero trust cybersecurity approach for on-premises services and cloud-based services.

Levels of cybersecurity device risk and supply chain risk shall be defined by each public service company, consistent with industry standard practices, unless superseded by applicable federal or State cybersecurity standards.

The process by which cybersecurity device risk and supply chain risk is determined shall be documented and subject to inspection by the Office of Cybersecurity unless such processes are superseded by applicable federal cybersecurity standards and regulations that prohibit such disclosures.

A public service company shall establish minimum security standards for each cybersecurity device or grouping of cyber security devices, including security risks with supply chains based on the level of security risk each device or group of devices presents to the public service company’s ability to deliver utility services or protect customer information necessary for the adequate, economical, and efficient delivery of public service company services in Maryland.

Public service companies shall provide evidence that they already or, where technically feasible, are planning to implement zero trust approaches in their Information Technology (IT) and Operational Technology (OT) devices and provide timelines or industry roadmaps for implementing zero trust approaches. Evidence of planning shall consist of the following:

On or before July 1, 2024, and on or before July 1 every other year thereafter, public service companies shall engage a third party to conduct an assessment of cybersecurity devices and supply chain risk based on either of the following cybersecurity frameworks:

The third party conducting the assessment of cybersecurity devices and supply chain risk shall be any non-affiliated entity that is qualified to perform an assessment based on applicable certifications, expertise, or past experience to conduct NIST and CPG cybersecurity framework-based assessments.

Multiple third-party assessments of cybersecurity devices and supply chain risk using applicable cybersecurity frameworks shall be used, if necessary, to cover all cybersecurity devices and supply chain risk under the scope of this chapter.

All cybersecurity assessments shall be anytime within a 2-year assessment cycle, with the first assessment cycle ending July 1, 2024, and subsequent assessment cycles ending on or before July 1 every other year thereafter.

A public service company shall confidentially e-file to the Commission, or alternatively submit to the Office of Cybersecurity, an attestation letter by the public service company CISO, or equivalent, on or before July 1, 2024, and on or before July 1 every other year thereafter. This attestation letter shall include the following information:

A public service company may develop a consolidated assessment of all third-party assessments in a cybersecurity assessment report. At a minimum, a third-party or consolidated public service company cybersecurity assessment report shall include:

A public service company shall arrange an in-person meeting with the Office of Cybersecurity at Commission offices or at another mutually agreeable location to review all individual third-party cybersecurity assessments or alternatively a public service company’s consolidated cybersecurity assessment report, within 90 days of the date of the certification of a public service company’s compliance attestation letter.

A public service company shall maintain all consolidated cybersecurity assessment reports and all third-party assessments of cybersecurity devices under the scope of this regulation a minimum of two, 2-year assessment cycles, except for applicable North American Electric Reliability Corporation Critical Infrastructure Protection (NERC CIP) audits, or an inspection by the Transportation Security Administration (TSA) pursuant to TSA’s Gas Pipeline Security Directives, or TSA regulations that supersede the security directives which are performed on a 3-year cycle. These assessment reports shall be made available at Commission offices or at another mutually agreeable location for inspection by the Office of Cybersecurity, upon request.

The details of a public service company’s cybersecurity assessments may not be divulged except as directed by the Commission, or a court, as authorized by law. The Office of Cybersecurity shall promptly notify a public service company upon the discovery of any unauthorized access, compromise, loss, or exfiltration of the public service company’s periodic assessment information.

All public service companies shall provide a primary cybersecurity contact and alternate cybersecurity contact information to the Office of Cybersecurity that includes each contact’s name, company, position title, mail address, email address, cellular phone number, and office phone number. The Office of Cybersecurity shall share this information with the State Security Operations Center in the Department of Information Technology.

A public service company’s primary cybersecurity contact shall either be the public service company’s CISO, or equivalent, or directly report to the public service company CISO, or equivalent.

A public service company alternate cybersecurity contact shall either directly report to a public service company CISO, or equivalent, or directly report to the public service company primary cybersecurity contact.

All public service companies shall provide an organization chart, or equivalent narrative description, that describes the organizational reporting relationships of the primary cybersecurity contact and alternate cybersecurity contact to the CISO.

The Cybersecurity Director shall be notified of all changes to primary contact and alternate contact information, including the reporting relationship of the primary cybersecurity contact and alternate cybersecurity contact to the CISO, within 30 days of changes.

The Office of Cybersecurity may send a public service company a specific information request for information related to cybersecurity incidents, standards, practices, procedures, or other information reasonably related to cybersecurity unless such processes are superseded by applicable federal cybersecurity standards and regulations that prohibit such disclosures.

A public service company shall respond within 10 working days after receipt of a specific information request from the Office of Cybersecurity relating to a cybersecurity incident under Regulation .05 of this chapter.

Except as provided under §B of this regulation, a public service company shall respond within 30 days after receipt of a specific information request from the Office of Cybersecurity.

The Office of Cybersecurity may waive the requirements of §B or C of this regulation upon written request from a public service company demonstrating sufficient cause.

The details of a public service company cybersecurity specific information request may not be divulged except as directed by the Commission, or a court, as authorized by law. The Office of Cybersecurity shall promptly notify a public service company upon the discovery of any unauthorized access, compromise, loss, or exfiltration of the public service company’s special information request information.