# COMAR Title 20 — Public Service Commission

## Subtitle 06 — Cybersecurity

### Chapter 02 — Compliance

#### Regulation .01 Enforcement.

*COMAR 20.06.02.01*

A. General.

  (1) The Office of Cybersecurity may issue a NOPV upon finding good cause to believe a violation of this subtitle or cybersecurity requirements in Public Utilities Article, §5-306, Annotated Code of Maryland, has occurred.

  (2) The NOPV may contain a proposed compliance order.

  (3) A public service company shall respond in writing within 30 days after receipt of a NOPV.

  (4) The Office of Cybersecurity may waive the requirements of §A(3) of this regulation upon written request from a public service company demonstrating good cause.

B. Contents of Notice of Probable Violation. A NOPV shall include:

  (1) A statement of the statute or regulation allegedly violated by a public service company;

  (2) A description of the evidence indicating a possible violation;

  (3) Notice of response options available to the public service company;

  (4) If appropriate, the amount of the proposed civil penalty and the maximum civil penalty applicable under law; and

  (5) If appropriate, a statement of the remedial action being sought in a compliance order.

C. Response Options. A public service company shall respond to the NOPV as follows:

  (1) If a NOPV contains a proposed compliance order, a public service company may:

    (a) Agree to the proposed compliance order;

    (b) Request the execution of a consent order;

    (c) Object to the proposed compliance order and submit written explanations, information, or other materials in answer to the allegations in the notice; or

    (d) Request a hearing under Public Utilities Article, §3-102, Annotated Code of Maryland; and

  (2) If the NOPV contains a proposed civil penalty, a public service company may:

    (a) Agree to pay the penalty;

    (b) Submit an offer in compromise of the proposed civil penalty;

    (c) Object to the proposed civil penalty and submit a written explanation, information, or other material to mitigate the proposed civil penalty; or

    (d) Request a hearing under Public Utilities Article, §3-102, Annotated Code of Maryland.

D. If a public service company objects to the proposed compliance order or civil penalty and submits a written explanation, information, or other materials in response to a NOPV, the Cybersecurity Director shall review the submissions and determine whether to negotiate further, modify, or withdraw the NOPV, or file a complaint under Public Utilities Article, §3-102, Annotated Code of Maryland.