EXPLANATION: CAPITALS INDICATE MAT TER ADDED TO EXISTIN G LAW. [Brackets] indicate matter deleted from existing law. *hb1205* HOUSE BILL 1205 S2, P1, S1 2lr1777 CF SB 811 By: Delegates P. Young, Kerr, Feldmark, Bartlett, Kelly, Kipke, and McIntosh Introduced and read first time: February 11, 2022 Assigned to: Health and Government Operations and Appropriations A BILL ENTITLED AN ACT concerning 1 State Government – Information Technology and Cybersecurity –Related 2 Infrastructure 3 (Modernize Maryland Act of 2022) 4 FOR the purpose of authorizing the Maryland Stadium Authority to issue bonds and, in 5 consultation with the Department of Information Technology, finance projects 6 related to information technology and cybersecurity–related State government 7 infrastructure; establishing an Information Technology and Cybersecurity 8 Infrastructure Fund as a special, nonlapsing fund; requiring interest earnings of the 9 Fund to be credited to the Fund; altering the duties of the Secretary of Information 10 Technology; establishing a Statewide Reporting Framework and Oversight 11 Commission in the Department; requiring the Department to hire an independent 12 contractor to develop a framework for investments in technology and annually assess 13 the cybersecurity and information technology systems in each unit of State 14 government; specifying the use of proceeds from certain bonds; establishing that the 15 Department is a primary procurement unit and authorizing the Department to 16 engage in or control certain procurements; authorizing a certain independent 17 contractor to issue a certain change order; and generally relating to the development, 18 financing, and procurement of information technology and cybersecurity–related 19 State government infrastructure projects. 20 BY repealing and reenacting, with amendments, 21 Article – Economic Development 22 Section 10–628(a) 23 Annotated Code of Maryland 24 (2018 Replacement Volume and 2021 Supplement) 25 BY adding to 26 Article – Economic Development 27 Section 10–628(d), 10–650.1, and 10–657.5 28 Annotated Code of Maryland 29 2 HOUSE BILL 1205 (2018 Replacement Volume and 2021 Supplement) 1 BY repealing and reenacting, with amendments, 2 Article – State Finance and Procurement 3 Section 3A–303(a)(7) and (8), 6–226(a)(2)(ii)144. and 145., 11–101(m), 4 12–107(b)(2)(i)9. through 11., (3)(vi), and (4)(v), and 15–112(a)(1)(i) 5 Annotated Code of Maryland 6 (2021 Replacement Volume) 7 BY adding to 8 Article – State Finance and Procurement 9 Section 3A–303(a)(9), 3A–315 through 3A–317, 6–226(a)(2)(ii)146., 12–107(b)(5), and 10 15–112(b)(4) 11 Annotated Code of Maryland 12 (2021 Replacement Volume) 13 BY repealing and reenacting, without amendments, 14 Article – State Finance and Procurement 15 Section 6–226(a)(2)(i), 11–101(a), and 15–112(b)(3) 16 Annotated Code of Maryland 17 (2021 Replacement Volume) 18 SECTION 1. BE IT ENACTED BY THE GENERAL ASSEMBLY OF MARYLAND, 19 That the Laws of Maryland read as follows: 20 Article – Economic Development 21 10–628. 22 (a) Except as provided in subsections (b) [and], (c), AND (D) of this section and 23 subject to the prior approval of the Board of Public Works, the Authority may issue bonds 24 at any time for any corporate purpose of the Authority, including the establishment of 25 reserves and the payment of interest. 26 (D) UNLESS AUTHORIZED BY THE GENERAL ASSEMBLY, THE BOARD OF 27 PUBLIC WORKS MAY NOT APPROVE AN ISSUANCE BY T HE AUTHORITY OF BONDS , 28 WHETHER TAXABLE OR T AX EXEMPT, THAT CONSTITUTE TAX SUPPORTED DEBT OR 29 NONTAX SUPPORTED DEB T IF, AFTER ISSUANCE , THERE WOULD BE OUTST ANDING 30 AND UNPAID $1,500,000,000 FACE AMOUNTS OF THE BONDS FOR THE PURPOS E OF 31 FINANCING RESEARCH I NTO, ACQUISITION OF , INSTALLATION OF , MAINTENANCE 32 OF, AND RELATED EXPENSES FOR UPGRADES TO INFO RMATION TECHNOLOGY A ND 33 CYBERSECURITY –RELATED STATE GOVERNMENT INFR ASTRUCTURE . 34 10–650.1. 35 HOUSE BILL 1205 3 (A) THE AUTHORITY AND THE DEPARTMENT OF INFORMATION 1 TECHNOLOGY SHALL COMP LY WITH THIS SECTION TO FINANCE PROJECTS TO 2 RESEARCH, ACQUIRE, INSTALL, MAINTAIN, AND UPGRADE INFORMAT ION 3 TECHNOLOGY AND CYBER SECURITY–RELATED STATE GOVERNMENT 4 INFRASTRUCTURE . 5 (B) THE AUTHORITY SHALL TRANS FER TO THE DEPARTMENT OF 6 INFORMATION TECHNOLOGY T HE PROCEEDS OF BONDS ISSUED UNDER THIS 7 SUBTITLE FOR FINANCI NG INFORMATION TECHN OLOGY AND 8 CYBERSECURITY –RELATED STATE GOVERNMENT INFR ASTRUCTURE PROJECTS . 9 (C) AT LEAST 90 DAYS BEFORE PROVIDIN G THE WRITTEN NOTICE TO THE 10 FISCAL COMMITTEES OF THE GENERAL ASSEMBLY REQUIRED UNDER SUBSECTION 11 (D) OF THIS SECTION, THE AUTHORITY SHALL CONSU LT WITH THE DEPARTMENT OF 12 INFORMATION TECHNOLOGY TO DETERMI NE THE AMOUNT OF FUN DS NEEDED FOR 13 INFORMATION TECHNOLO GY AND CYBERSECURITY –RELATED STATE GOVERNMENT 14 INFRASTRUCTURE PROJ ECTS TO BE FINANCED WITH THE PROPOSED BO NDS. 15 (D) AT LEAST 45 DAYS BEFORE SEEKING APPROVAL OF THE BOARD OF 16 PUBLIC WORKS FOR EACH BOND I SSUE RELATED TO INFO RMATION TECHNOLOGY 17 AND CYBERSECURITY –RELATED STATE GOVERNMENT INFR ASTRUCTURE , THE 18 AUTHORITY SHALL PR OVIDE TO THE FISCAL COMMITTEES OF THE GENERAL 19 ASSEMBLY, IN ACCORDANCE WITH § 2–1257 OF THE STATE GOVERNMENT ARTICLE, 20 WRITTEN NOTICE OF : 21 (1) THE AGGREGATE AMOUNT OF FUNDS NEEDED FOR INFORMATION 22 TECHNOLOGY AND CYBER SECURITY–RELATED STATE GOVERNMENT 23 INFRASTRUCTURE PROJE CTS TO BE FINANCED W ITH THE PROPOSED BON DS; 24 (2) THE ANTICIPATED TOTA L DEBT SERVICE FOR T HE PROPOSED 25 BOND ISSUE; AND 26 (3) THE ANTICIPATED TOTA L DEBT SERVICE WHEN COMBINED WITH 27 THE DEBT SERVICE FOR ALL PRIOR OUTSTANDIN G BOND ISSUES FOR INFORMATION 28 TECHNOLOGY AND CYBER SECURITY–RELATED STATE GOVERNMENT 29 INFRASTRUCTURE PROJE CTS. 30 (E) BEFORE EACH ISSUANCE OF BONDS TO FINANCE INFORMATION 31 TECHNOLOGY AND CYBER SECURITY–RELATED STATE GOVERNMENT 32 INFRASTRUCTURE PROJE CTS, THE AUTHORITY SHALL OBT AIN THE APPROVAL OF 33 THE BOARD OF PUBLIC WORKS OF THE AGGREGAT E AMOUNT OF THE PROP OSED 34 BOND ISSUE. 35 4 HOUSE BILL 1205 (F) FOR FISCAL YEAR 2024 AND EACH FISCAL YEAR THEREAFTER , UNTIL 1 THE BONDS THAT HAVE BEEN ISSUED TO FINAN CE INFORMATION TECHN OLOGY AND 2 CYBERSECURITY –RELATED STATE GOVERNMENT INFR ASTRUCTURE PROJECTS ARE 3 NO LONGER OUTSTANDIN G AND UNPAID , THE GOVERNOR SHALL INCLUD E IN THE 4 ANNUAL BUDGET BILL A N APPROPRIATION TO T HE INFORMATION TECHNOLOGY 5 AND CYBERSECURITY INFRASTRUCTURE FUND IN AN AMOUNT SUF FICIENT TO 6 COVER THE PR OJECTED DEBT SERVICE REQUIREMENTS FOR THE UPCOMING FISCAL 7 YEAR. 8 10–657.5. 9 (A) IN THIS SECTION , “FUND” MEANS THE INFORMATION TECHNOLOGY 10 AND CYBERSECURITY INFRASTRUCTURE FUND. 11 (B) THERE IS AN INFORMATION TECHNOLOGY AND CYBERSECURITY 12 INFRASTRUCTURE FUND. 13 (C) (1) THE FUND IS A SPECIAL , NONLAPSING FUND THAT IS NOT 14 SUBJECT TO § 7–302 OF THE STATE FINANCE AND PROCUREMENT ARTICLE AND 15 THAT SHALL BE AVAILA BLE IN PERPETUITY TO IMPLEMENT THIS SUBTI TLE 16 RELATED TO UPGRADES TO INFORMATION TECHN OLOGY AND 17 CYBERSECU RITY–RELATED STATE GOVERNMENT INFR ASTRUCTURE . 18 (2) THE AUTHORITY SHALL : 19 (I) USE THE FUND AS A REVOLVING F UND FOR CARRYING OUT 20 THE PROVISIONS OF TH IS SUBTITLE RELATED TO UPGRADES TO INFOR MATION 21 TECHNOLOGY AND CYBER SECURITY–RELATED STATE GOVERNMENT 22 INFRASTRUCTURE ; AND 23 (II) PAY ANY AND ALL EXPE NSES FROM THE FUND THAT ARE 24 INCURRED BY THE AUTHORITY OR THE DEPARTMENT OF INFORMATION 25 TECHNOLOGY RELATED TO UPGRADES TO INFORMAT ION TECHNOLOGY AND 26 CYBERSECURITY –RELATED STATE GOVERNMENT INFR ASTRUCTURE . 27 (D) THE FUND CONSISTS OF : 28 (1) FUNDS APPROPRIATED F OR DEPOSIT TO THE FUND; 29 (2) PROCEEDS FROM THE SA LE OF BONDS RELATED TO UPGRADES TO 30 INFORMATION TECHNOLO GY AND CYBERSECURITY –RELATED STATE GOVERNMENT 31 INFRASTRUCTURE PROJE CTS; 32 HOUSE BILL 1205 5 (3) REVENUES COLLECTED O R RECEIVED FROM ANY SO URCE UNDER 1 THIS SUBTITLE RELATE D TO UPGRADES TO INF ORMATION TECHNOLOGY AND 2 CYBERSECURITY –RELATED STATE GOVERNMENT INFR ASTRUCTURE PROJECTS ; 3 (4) INTEREST EARNINGS ; AND 4 (5) ANY ADDITIONAL MONEY MADE AVAILABLE FROM ANY PUBLIC OR 5 PRIVATE SOURCE FOR THE PU RPOSES ESTABLISHED F OR THE FUND. 6 (E) (1) THE STATE TREASURER SHALL INVES T THE MONEY OF THE FUND 7 IN THE SAME MANNER A S OTHER STATE FUNDS. 8 (2) ANY INVESTMENT EARNIN GS SHALL BE CREDITED TO THE FUND. 9 (3) NO PART OF THE FUND MAY REVE RT OR BE CREDITED TO THE 10 GENERAL FUND OF THE STATE OR ANY SPECIAL FUND OF THE STATE. 11 Article – State Finance and Procurement 12 3A–303. 13 (a) The Secretary is responsible for carrying out the following duties: 14 (7) advising and consulting with the Legislative and Judicial branches of 15 State government regarding a cybersecurity strategy; [and] 16 (8) in consultation with the Attorney General, developing guidance on 17 consistent cybersecurity strategies for counties, municipal corporations, school systems, 18 and all other political subdivisions of the State; AND 19 (9) UPGRADING INFORMATIO N TECHNOLOGY AND 20 CYBERSECURITY –RELATED STATE GOVERNMENT INFR ASTRUCTURE . 21 3A–315. 22 (A) (1) IN THIS SECTION THE F OLLOWING WORDS HAVE THE MEANINGS 23 INDICATED. 24 (2) “CITIZEN ADVOCACY GROU P” MEANS AN ORGANIZATIO N WHOSE 25 MISSION IS TO PROVID E SUPPORT FOR INFORM ATION TECHNOLOGY AND 26 CYBERSECURITY POLICI ES. 27 (3) “COMMISSION” MEANS THE STATEWIDE REPORTING 28 FRAMEWORK AND OVERSIGHT COMMISSION. 29 6 HOUSE BILL 1205 (4) “CRITICAL SYSTEM ” MEANS AN INFORMATION TECHN OLOGY OR 1 CYBERSECURITY SYSTEM THAT IS SEVERELY OUT DATED. 2 (B) THERE IS A STATEWIDE REPORTING FRAMEWORK AND OVERSIGHT 3 COMMISSION IN THE DEPARTMENT . 4 (C) THE PURPOSE OF THE COMMISSION IS TO: 5 (1) ENSURE THE CONFIDENT IALITY, INTEGRITY, AND AVAILABILITY 6 OF INFORMATION HELD BY THE STATE CONCERNING STATE RESIDENTS ; AND 7 (2) DETERMINE THE APPROP RIATE INFORMATION TE CHNOLOGY AND 8 CYBERSECURITY INVEST MENTS AND UPGRADES . 9 (D) THE COMMISSION CONSISTS O F THE FOLLOWING MEMB ERS: 10 (1) THE SECRETARY; 11 (2) THE STATE CHIEF INFORMATION SECURITY OFFICER; 12 (3) THE STATE TREASURER; 13 (4) THE COCHAIRS OF THE JOINT COMMITTEE ON CYBERSECURITY , 14 INFORMATION TECHNOLOGY , AND BIOTECHNOLOGY ; 15 (5) THREE CHIEF INFORMAT ION SECURITY OFFICER S REPRESENTING 16 DIFFERENT UNITS OF STATE GOVERNMENT , APPOINTED BY THE GOVERNOR; 17 (6) FOUR INFORMATION TEC HNOLOGY EXPERTS IN T HE PRIVATE 18 SECTOR, APPOINTED BY THE GOVERNOR; 19 (7) ONE REPRESENTATIVE F ROM THE MARYLAND CHAMBER OF 20 COMMERCE; 21 (8) TWO REPRESENTATIVES FROM CITIZEN ADVOCACY GROU PS IN 22 THE STATE; 23 (9) ONE CHIEF INFORMATIO N SECURITY OFFICER F ROM THE PRIVATE 24 SECTOR WHO HAS COMPL ETED INFORMATION TEC HNOLOGY AND CYBERSEC URITY 25 UPGRADES FOR A BUSIN ESS WITH OVER 100 INFORMATION TECHNOLO GY SYSTEMS; 26 AND 27 HOUSE BILL 1205 7 (10) ONE CHIE F INFORMATION SECURI TY OFFICER FROM THE 1 EDUCATION SECTOR WHO HAS COMPLETED INFORM ATION TECHNOLOGY AND 2 CYBERSECURITY UPGRAD ES FOR AN EDUCATIONA L INSTITUTION WITH O VER 100 3 INFORMATION TECHNOLO GY SYSTEMS. 4 (E) THE COMMISSION SHALL : 5 (1) DEVELOP A STRATEGI C ROADMAP WITH A TIM ELINE AND BUDGET 6 THAT WILL: 7 (I) REQUIRE THE UPDATES AND INVESTMENTS OF C RITICAL 8 INFORMATION TECHNOLO GY AND CYBERSECURITY SYSTEMS TO BE COMPLE TED ON 9 OR BEFORE DECEMBER 31, 2025; AND 10 (II) REQUIRE ALL UPDATES AND INVESTMENTS OF 11 INFORMATION TECHNOLOGY AND CYBERSECURITY TO BE MADE ON OR BEFORE 12 DECEMBER 31, 2030; 13 (2) MAKE PERIODIC RECOMM ENDATIONS ON INVESTM ENTS IN STATE 14 INFORMATION TECHNOLO GY STRUCTURES BASED ON THE ASSESSMENTS 15 COMPLETED IN ACCORDA NCE WITH THE FRAMEWO RK DEVELOPED IN § 3A–316 OF 16 THIS SUBTITLE; AND 17 (3) EACH YEAR, IN ACCORDANCE WITH § 2–1257 OF THE STATE 18 GOVERNMENT ARTICLE, REPORT ITS FINDINGS AND RECOMMENDATIONS TO THE 19 SENATE BUDGET AND TAXATION COMMITTEE, THE HOUSE APPROPRIATIONS 20 COMMITTEE, AND THE JOINT COMMITTEE ON CYBERSECURITY , INFORMATION 21 TECHNOLOGY , AND BIOTECHNOLOGY . 22 3A–316. 23 (A) (1) THE DEPARTMENT SHALL HIRE AN INDEPENDENT CONTR ACTOR 24 TO: 25 (I) DEVELOP A FRAMEWORK FOR INVESTMENTS IN 26 TECHNOLOGY ; AND 27 (II) IN ACCORDANCE WITH T HE FRAMEWORK , ANNUALLY 28 ASSESS THE CYBERSECU RITY AND INFORMATION TECHNOLOGY SYSTEMS I N EACH 29 UNIT OF STATE GOVERNMENT . 30 (2) THE FRAMEWORK SHALL I NCLUDE THE FOLLOWING CRITERIA: 31 8 HOUSE BILL 1205 (I) SECURITY RISKS TO TH E SYSTEM; 1 (II) SYSTEM PERFORMANCE ; 2 (III) THE SYSTEM ’S DEPENDENCE ON OTHER INFORMATION 3 TECHNOLOGY OR CYBERS ECURITY SYSTEMS AND DATA; 4 (IV) THE SYSTEM ’S ABILITY TO CREATE AN EFFICIENT AND 5 SEAMLESS EXPERIENCE FOR USERS; 6 (V) THE SYSTEM ’S EFFECTIVENESS IN A CHIEVING UNIT 7 OBJECTIVES; 8 (VI) THE SYSTEM’S EFFECTIVENESS IN MEETING THE NEEDS OF 9 CITIZENS AND CUSTOME RS; 10 (VII) THE COSTS TO MAINTAI N AND OPERATE THE SY STEM; 11 (VIII) THE SPEED OF GOVERNM ENT RESPONSE TIME ; 12 (IX) THE EFFECTIVENESS OF THE SYSTEM IN REGARD TO THE 13 UNIT’S OBJECTIVES; 14 (X) IMPROVEMENTS TO THE UNIT’S RELATIVE AUDIT FIN DINGS 15 ATTRIBUTABLE TO THE SYSTEM; AND 16 (XI) AN ASSESSMENT OF THE SYSTEM USING THE NATIONAL 17 INSTITUTE OF STANDARDS AND TECHNOLOGY CYBERSECURITY FRAMEWORK . 18 (B) EACH UNIT SHALL PROMP TLY PROVIDE THE CONT RACTOR WITH THE 19 INFORMATION NECESSARY TO P ERFORM THE ASSESSMEN TS. 20 (C) EACH YEAR, THE CONTRACTOR SHALL PROVIDE THE RESULTS OF THE 21 ASSESSMENTS TO THE STATEWIDE REPORTING FRAMEWORK AND OVERSIGHT 22 COMMISSION ESTABLISHE D UNDER § 3A–315 OF THIS SUBTITLE. 23 (D) THE DEPARTMENT MAY US E FUNDS AVAILABLE FR OM THE ISSUANCE OF 24 BONDS IN ACCORDANCE WITH § 10–650.1 OF THE ECONOMIC DEVELOPMENT 25 ARTICLE TO PAY FOR TH E INDEPENDENT CONTRA CTOR REQUIRED UNDER THIS 26 SECTION. 27 3A–317. 28 HOUSE BILL 1205 9 (A) THE DEPARTMENT SHALL CONS ULT WITH THE MARYLAND STADIUM 1 AUTHORITY REGARDING T HE ISSUANCE OF BONDS FOR UPGRADES TO 2 INFORMATION TECHNOLO GY AND CYBERSECURITY –RELATED STATE GOVERNMENT 3 INFRASTRUCTURE IN AC CORDANCE WITH § 10–650.1 OF THE ECONOMIC 4 DEVELOPMENT ARTICLE. 5 (B) THE DEPARTMENT MAY USE TH E PROCEEDS FROM BON DS ISSUED FOR 6 UPGRADES TO INFORMAT ION TECHNOLOGY AND C YBERSECURITY –RELATED STATE 7 GOVERNMENT INFRASTRU CTURE UNDER § 10–650.1 OF THE ECONOMIC 8 DEVELOPMENT ARTICLE ONLY FOR PROJ ECTS THAT RELATE TO RESEARCH INTO , 9 ACQUISITION OF , INSTALLATION OF , MAINTENANCE OF , AND RELATED EXPENSES 10 FOR UPGRADES TO INFO RMATION TECHNOLOGY A ND CYBERSECURITY –RELATED 11 STATE GOVERNMENT INFR ASTRUCTURE . 12 6–226. 13 (a) (2) (i) Notwithstanding any other provision of law, and unless 14 inconsistent with a federal law, grant agreement, or other federal requirement or with the 15 terms of a gift or settlement agreement, net interest on all State money allocated by the 16 State Treasurer under this section to special funds or accounts, and otherwise entitled to 17 receive interest earnings, as accounted for by the Comptroller, shall accrue to the General 18 Fund of the State. 19 (ii) The provisions of subparagraph (i) of this paragraph do not apply 20 to the following funds: 21 144. the Health Equity Resource Community Reserve Fund; 22 [and] 23 145. the Access to Counsel in Evictions Special Fund; AND 24 146. THE INFORMATION TECHNOLOGY AND 25 CYBERSECURITY INFRASTRUCTURE FUND. 26 11–101. 27 (a) In this Division II the following words have the meanings indicated unless: 28 (1) the context clearly requires a different meaning; or 29 (2) a different definition is provided for a particular title or provision. 30 (m) “Primary procurement units” means: 31 (1) the State Treasurer; 32 10 HOUSE BILL 1205 (2) the Department of General Services; 1 (3) the Department of Transportation; 2 (4) the University System of Maryland; 3 (5) the Maryland Port Commission; 4 (6) the Morgan State University; [and] 5 (7) the St. Mary’s College of Maryland; AND 6 (8) THE DEPARTMENT OF INFORMATION TECHNOLOGY . 7 12–107. 8 (b) Subject to the authority of the Board, jurisdiction over procurement is as 9 follows: 10 (2) the Department of General Services may: 11 (i) engage in or control procurement of: 12 9. supplies, materials, and equipment in support of 13 construction and construction–related services for State correctional facilities in 14 accordance with this Division II and Title 2 and Title 10, Subtitle 1 of the Correctional 15 Services Article; AND 16 10. [information processing equipment and associated 17 services, as provided in Title 3A, Subtitle 3 of this article; and 18 11.] telecommunication equipment, systems, or services, as 19 provided in Title 3A, Subtitle 4 of this article; 20 (3) the Department of Transportation and the Maryland Transportation 21 Authority, without the approval of any of the other primary procurement units, may engage 22 in the procurement of: 23 (vi) services for aeronautics related activities, including information 24 processing services, but excluding banking and financial services under the authority of the 25 State Treasurer under item (1) of this subsection; [and] 26 (4) the Maryland Port Commission, without the approval of any of the 27 other primary procurement units, may engage in the procurement of: 28 HOUSE BILL 1205 11 (v) leases of real property for port related activities unless the lease 1 payments are from the General Fund of the State; AND 2 (5) THE DEPARTMENT OF INFORMATION TECHNOLOGY , WITHOUT 3 THE APPROVAL OF ANY OTHER PRIMARY PROCUR EMENT UNIT, MAY ENGAGE IN OR 4 CONTROL PROCUREMENT OF: 5 (I) INFORMATION PROCESSI NG EQUIPMENT AND ASS OCIATED 6 SERVICES, AS PROVIDED IN TITLE 3A, SUBTITLE 3 OF THIS ARTICLE; AND 7 (II) INFORMATION TECHNOLO GY SYSTEM AND CYBERS ECURITY 8 UPGRADES AND MODERNI ZATION, AS PROVIDED IN TITLE 3A, SUBTITLE 3 OF THIS 9 ARTICLE. 10 15–112. 11 (a) (1) (i) Except as provided in subparagraph (ii) of this paragraph, this 12 section applies to State procurement contracts for: 13 1. construction; 14 2. INFORMATION PROCESSI NG EQUIPMENT AND 15 ASSOCIATED SERVICES ; AND 16 3. IN ACCORDANCE WITH TITLE 3A, SUBTITLE 3 OF THIS 17 ARTICLE, INFORMATION TECHNOLO GY SYSTEM AND CYBERSECU RITY UPGRADES 18 AND MODERNIZATION . 19 (b) (3) (i) If a unit is to pay for a contract or a part of a contract using a 20 unit price methodology, a change order may not be required for work to continue and be 21 completed beyond the estimated quantities in the contract. 22 (ii) After work is completed, a unit shall: 23 1. determine the actual quantity used to complete the 24 contract; and 25 2. if necessary, issue a final adjustment change order to the 26 contractor. 27 (4) AN INDEPENDENT CONTRA CTOR WHO PERFORMS AN 28 ASSESSMENT UNDER § 3A–316 OF THIS ARTICLE MAY ISSUE A CHANGE ORDER ON 29 THE ORIGINAL ASSESSM ENT CONTRACT FOR ANY SUBSEQUENT CYBERSECU RITY 30 UPGRADES. 31 12 HOUSE BILL 1205 SECTION 2. AND BE IT FURTHER ENACTED, That this Act shall take effect July 1 1, 2022. 2