This chapter applies to electricity supply services that a CCA or its designated agents provide to residential and small commercial electric customers. All CCAs shall follow good cybersecurity practice. As part of its Aggregation Plan, as described in COMAR 20.63.11.02, the CCA shall submit to the Commission a proposed cybersecurity plan, including: Cybersecurity-related governance, risk management, procurement practices, personnel hiring, training policies, situational awareness, response, recovery, and transparent reporting of cybersecurity incidents to State and federal entities; How the CCA will inform the Commission of a cybersecurity breach; and An explanation of the application of the county’s cybersecurity plan, policies, procedures, and support to the CCA, if applicable. A CCA or its Aggregation Supplier may not disclose customer information provided to the CCA or its Aggregation Suppliers by the electric company or collected from the customer as part of the CCA, including a customer’s billing, payment, enrollment, and credit information, to an entity other than the electric company without the customer’s written or electronic consent, except that a CCA may disclose a customer’s billing, payment, enrollment, and credit information but only if necessary to facilitate billing, bill collection, enrollment, or credit reporting. A CCA shall provide, upon request of the customer, a copy of the CCA’s customer information privacy policy via the CCA website or by mail. The Aggregation Supplier shall protect all customer information when it ceases to be the CCA’s Aggregation Supplier or the CCA is terminated, and the Aggregation Supplier may not use for marketing purposes any information obtained as the Aggregation Supplier once it ceases to be the Aggregation Supplier. Public Utilities Article, §§1–101(b), (f), and (k), 7–306(f)(5) and (h), 7–306.2(d)(3), 7–507(a), 7–510(f) and 7–510.3, Annotated Code of Maryland Effective date: February 5, 2024 (51:2 Md. R. 76)