General. The Office of Cybersecurity may issue a NOPV upon finding good cause to believe a violation of this subtitle or cybersecurity requirements in Public Utilities Article, §5-306, Annotated Code of Maryland, has occurred. The NOPV may contain a proposed compliance order. A public service company shall respond in writing within 30 days after receipt of a NOPV. The Office of Cybersecurity may waive the requirements of §A(3) of this regulation upon written request from a public service company demonstrating good cause. Contents of Notice of Probable Violation. A NOPV shall include: A statement of the statute or regulation allegedly violated by a public service company; A description of the evidence indicating a possible violation; Notice of response options available to the public service company; If appropriate, the amount of the proposed civil penalty and the maximum civil penalty applicable under law; and If appropriate, a statement of the remedial action being sought in a compliance order. Response Options. A public service company shall respond to the NOPV as follows: If a NOPV contains a proposed compliance order, a public service company may: Agree to the proposed compliance order; Request the execution of a consent order; Object to the proposed compliance order and submit written explanations, information, or other materials in answer to the allegations in the notice; or Request a hearing under Public Utilities Article, §3-102, Annotated Code of Maryland; and If the NOPV contains a proposed civil penalty, a public service company may: Agree to pay the penalty; Submit an offer in compromise of the proposed civil penalty; Object to the proposed civil penalty and submit a written explanation, information, or other material to mitigate the proposed civil penalty; or Request a hearing under Public Utilities Article, §3-102, Annotated Code of Maryland. If a public service company objects to the proposed compliance order or civil penalty and submits a written explanation, information, or other materials in response to a NOPV, the Cybersecurity Director shall review the submissions and determine whether to negotiate further, modify, or withdraw the NOPV, or file a complaint under Public Utilities Article, §3-102, Annotated Code of Maryland. Before the issuance of a compliance order, the Office of Cybersecurity may execute a consent order jointly with a public service company. A proposed consent order shall contain the following: An admission by a public service company of all jurisdictional facts; and A description of any action required by a public service company and the time by which the actions shall be accomplished. Procedure. Following an investigation and a determination by the Office of Cybersecurity, if there exists good cause to believe that a public service company violated Public Utilities Article, §5-306, Annotated Code of Maryland, or regulations in this subtitle, the Office of Cybersecurity may assess or negotiate a civil penalty under Public Utilities Article, §13-201, Annotated Code of Maryland, for violations and under Public Utilities Article, §13-205, Annotated Code of Maryland, for failures to submit reports and information with the prescribed form, contents, and deadlines. Penalty Considerations. In proposing a civil penalty for violations of Public Utilities Article, §5-306, Annotated Code of Maryland, or regulations in this subtitle, the Office of Cybersecurity shall consider the criteria stated in Public Utilities Article, §13-201, Annotated Code of Maryland. Filing with the Commission. Any proposed civil penalty shall be subject to approval, modification, or further hearing in accordance with Regulation .04 of this chapter. Payment Procedures. A public service company shall pay a civil penalty by submitting to the Commission a certified check or money order in the correct amount, payable to the Maryland Public Service Commission. Proposed Consent Orders and Civil Penalties. All proposed consent orders and proposed civil penalties that have been agreed to by a public service company and the Office of Cybersecurity shall be maintained as confidential and filed with the Commission for final determination. A notice and a copy of the confidential consent orders and proposed civil penalties shall be received by the following entities: The Office of Cybersecurity; The public service company that is subject to the order; The Commission; Office of People’s Counsel; and Any additional entities as determined by the Commission. On a case-by-case basis, the Commission may, on its own or by request of an entity identified in §A(2) of this regulation, determine if and when any portion of the proposed consent order or proposed civil penalty order can be filed publicly. A request made by an entity identified in §A(2) of this regulation shall be made in a manner specified by the Commission. Prior to ordering any public filing under this section, the Commission shall provide reasonable notice to the public service company that is subject to the order and allow that public service company a reasonable opportunity to provide confidential comments on the potential security risks posed by publicly releasing details of an order. The Commission shall approve, modify, or initiate a hearing on all proposed civil penalties and consent orders. If the Commission modifies a proposed consent order or a proposed civil penalty, the public service company may: Agree to the modified consent order or civil penalty; or Request a hearing. A public service company may petition the Office of Cybersecurity for a stay of enforcement for good cause. The Office of Cybersecurity may issue a stay of enforcement for a regulation in this subtitle for good cause shown. All cybersecurity compliance information in this subtitle may not be divulged outside of the Commission except as directed by the Commission, or a court, or as authorized by law. The Office of Cybersecurity shall share cybersecurity compliance information collected in this chapter upon request with additional representatives as the Commission designates. These representatives shall be subject to the confidentiality requirements in §A of this regulation. The Office of Cybersecurity shall promptly notify a public service company upon the discovery of any unauthorized access, compromise, loss, or exfiltration of the public service company’s compliance information. Public Utilities Article, §§2-108, 2-112, 2-113, 2-121, 2-302, 2-309, 3-101, 3-102, 3-104, 3-113, 3-205, 5-306, 6-205, and 13-201, Annotated Code of Maryland Effective date: December 12, 2024 (51:24 1081)