Maryland 2024 Regular Session

Maryland Senate Bill SB981 Compare Versions

Only one version of the bill is available at this time.

Old	New	Differences
1	1
2	2
3	3	EXPLANATION: CAPITALS INDICATE MAT TER ADDED TO EXISTIN G LAW.
4	4	[Brackets] indicate matter deleted from existing law.
5	5	sb0981
6	6
7	7	SENATE BILL 981
8	8	F1, S2, B1 4lr2477
9	9
10	10	By: Senator Hester
11	11	Introduced and read first time: February 2, 2024
12	12	Assigned to: Education, Energy, and the Environment and Budget and Taxation
13	13
14	14	A BILL ENTITLED
15	15
16	16	AN ACT concerning 1
17	17
18	18	Local Cybersecurity Preparedness and Local Cybersecurity Support Fund – 2
19	19	Alterations 3
20	20
21	21	FOR the purpose of authorizing the Governor to include in the annual budget bill a certain 4
22	22	appropriation for certain fiscal years for the Local Cybersecurity Support Fund; 5
23	23	requiring the Department of Information Technology to provide a certain number of 6
24	24	regional information security officers to assist the Director of Local Cybersecurity; 7
25	25	requiring, by a certain date, a local school system to implement certain practices 8
26	26	regarding the network of the local school system; authorizing funds to be transferred 9
27	27	by budget amendment from the Dedicated Purpose Account in certain fiscal years to 10
28	28	implement this Act; and generally relating to local cybersecurity. 11
29	29
30	30	BY repealing and reenacting, with amendments, 12
31	31	Article – Public Safety 13
32	32	Section 14–104.2 14
33	33	Annotated Code of Maryland 15
34	34	(2022 Replacement Volume and 2023 Supplement) 16
35	35
36	36	BY repealing and reenacting, without amendments, 17
37	37	Article – State Finance and Procurement 18
38	38	Section 3.5–101(c), 3.5–2A–02, 3.5–301(a) and (b), and 3.5–407 19
39	39	Annotated Code of Maryland 20
40	40	(2021 Replacement Volume and 2023 Supplement) 21
41	41
42	42	BY repealing and reenacting, with amendments, 22
43	43	Article – State Finance and Procurement 23
44	44	Section 3.5–2A–03(e) and 3.5–405 24
45	45	Annotated Code of Maryland 25
46	46	(2021 Replacement Volume and 2023 Supplement) 26
47	47
48	48	SECTION 1. BE IT ENACTED BY THE GENERAL ASSE MBLY OF MARYLAND, 27 2 SENATE BILL 981
49	49
50	50
51	51	That the Laws of Maryland read as follows: 1
52	52
53	53	Article – Public Safety 2
54	54
55	55	14–104.2. 3
56	56
57	57	(a) (1) In this section the following words have the meanings indicated. 4
58	58
59	59	(2) “Fund” means the Local Cybersecurity Support Fund. 5
60	60
61	61	(3) “Local government” includes local school systems, local school boards, 6
62	62	and local health departments. 7
63	63
64	64	(b) (1) There is a Local Cybersecurity Support Fund. 8
65	65
66	66	(2) The purpose of the Fund is to: 9
67	67
68	68	(i) provide financial assistance to local governments to improve 10
69	69	cybersecurity preparedness, including: 11
70	70
71	71	1. updating current devices and networks with the most 12
72	72	up–to–date cybersecurity protections; 13
73	73
74	74	2. supporting the purchase of new hardware, software, 14
75	75	devices, and firewalls to improve cybersecurity preparedness; 15
76	76
77	77	3. recruiting and hiring information technology staff focused 16
78	78	on cybersecurity; 17
79	79
80	80	4. paying outside vendors for cybersecurity staff training; 18
81	81
82	82	5. conducting cybersecurity vulnerability assessments; 19
83	83
84	84	6. addressing high–risk cybersecurity vulnerabilities 20
85	85	identified by vulnerability assessments; 21
86	86
87	87	7. implementing and maintaining integrators and other 22
88	88	similar intelligence sharing infrastructure that enable connection with the Information 23
89	89	Sharing and Analysis Center in the Department of Information Technology; and 24
90	90
91	91	8. supporting the security of local wastewater treatment 25
92	92	plants, including bicounty, county, and municipal plants, by acquiring or implementing 26
93	93	cybersecurity–related upgrades to the plants; and 27
94	94
95	95	(ii) assist local governments applying for federal cybersecurity 28
96	96	preparedness grants. 29
97	97	SENATE BILL 981 3
98	98
99	99
100	100	(3) The Secretary shall administer the Fund. 1
101	101
102	102	(4) (i) The Fund is a special, nonlapsing fund that is not subject to § 2
103	103	7–302 of the State Finance and Procurement Article. 3
104	104
105	105	(ii) The State Treasurer shall hold the Fund separately, and the 4
106	106	Comptroller shall account for the Fund. 5
107	107
108	108	(5) The Fund consists of: 6
109	109
110	110	(i) money appropriated in the State budget to the Fund; 7
111	111
112	112	(ii) interest earnings; and 8
113	113
114	114	(iii) any other money from any other source accepted for the benefit 9
115	115	of the Fund. 10
116	116
117	117	(6) The Fund may be used only: 11
118	118
119	119	(i) to provide financial assistance to local governments to improve 12
120	120	cybersecurity preparedness, including: 13
121	121
122	122	1. updating current devices and networks with the most 14
123	123	up–to–date cybersecurity protections; 15
124	124
125	125	2. supporting the purchase of new hardware, software, 16
126	126	devices, and firewalls to improve cybersecurity preparedness; 17
127	127
128	128	3. recruiting and hiring information technology staff focused 18
129	129	on cybersecurity; 19
130	130
131	131	4. paying outside vendors for cybersecurity staff training; 20
132	132
133	133	5. conducting cybersecurity vulnerability assessments; 21
134	134
135	135	6. addressing high–risk cybersecurity vulnerabilities 22
136	136	identified by vulnerability assessments; 23
137	137
138	138	7. implementing or maintaining integrators and other 24
139	139	similar intelligence sharing infrastructure that enable connection with the Information 25
140	140	Sharing and Analysis Center in the Department of Information Technology; and 26
141	141
142	142	8. supporting the security of local wastewater treatment 27
143	143	plants, including bicounty, county, and municipal plants, by acquiring or implementing 28
144	144	cybersecurity–related upgrades to the plants; 29
145	145
146	146	(ii) to assist local governments applying for federal cybersecurity 30 4 SENATE BILL 981
147	147
148	148
149	149	preparedness grants; and 1
150	150
151	151	(iii) for administrative expenses associated with providing the 2
152	152	assistance described under item (i) of this paragraph. 3
153	153
154	154	(7) (i) The State Treasurer shall invest the money of the Fund in the 4
155	155	same manner as other State money may be invested. 5
156	156
157	157	(ii) Any interest earnings of the Fund shall be credited to the Fund. 6
158	158
159	159	(8) Expenditures from the Fund may be made only in accordance with the 7
160	160	State budget. 8
161	161
162	162	(c) To be eligible to receive assistance from the Fund, a local government shall: 9
163	163
164	164	(1) provide proof to the Department of Information Technology that the 10
165	165	local government conducted a cybersecurity preparedness assessment in the previous 12 11
166	166	months; or 12
167	167
168	168	(2) within 12 months undergo a cybersecurity preparedness assessment 13
169	169	provided by, in accordance with the preference of the local government: 14
170	170
171	171	(i) the Department of Information Technology at a cost to the local 15
172	172	government that does not exceed the cost to the Department of Information Technology of 16
173	173	providing the assessment; or 17
174	174
175	175	(ii) a vendor authorized by the Department of Information 18
176	176	Technology to complete cybersecurity preparedness assessments. 19
177	177
178	178	(D) FOR FISCAL YEARS 2026 AND 2027, THE GOVERNOR MAY INCLUDE IN 20
179	179	THE ANNUAL BUDGET BI LL AN APPROPRIATION OF $10,000,000 FOR THE FUND. 21
180	180
181	181	Article – State Finance and Procurement 22
182	182
183	183	3.5–101. 23
184	184
185	185	(c) “Department” means the Department of Information Technology. 24
186	186
187	187	3.5–2A–02. 25
188	188
189	189	There is an Office of Security Management within the Department. 26
190	190
191	191	3.5–2A–03. 27
192	192
193	193	(e) (1) (i) There is a Director of Local Cybersecurity, who shall be 28
194	194	appointed by the State Chief Information Security Officer. 29
195	195	SENATE BILL 981 5
196	196
197	197
198	198	(ii) The Director of Local Cybersecurity shall work in coordination 1
199	199	with the Maryland Department of Emergency Management to provide technical assistance, 2
200	200	coordinate resources, and improve cybersecurity preparedness for units of local 3
201	201	government. 4
202	202
203	203	(III) THE DEPARTMENT SHALL PROVIDE SUFFICIENT 5
204	204	INFORMATION SECURITY OFFICERS TO ASSIST THE DIRECTOR OF LOCAL 6
205	205	CYBERSECURITY . 7
206	206
207	207	(2) (i) There is a Director of State Cybersecurity, who shall be 8
208	208	appointed by the State Chief Information Security Officer. 9
209	209
210	210	(ii) The Director of State Cybersecurity is responsible for 10
211	211	implementation of this section with respect to units of State government. 11
212	212
213	213	3.5–301. 12
214	214
215	215	(a) In this subtitle the following words have the meanings indicated. 13
216	216
217	217	(b) “Cybersecurity” means processes or capabilities wherein systems, 14
218	218	communications, and information are protected and defended against damage, 15
219	219	unauthorized use or modification, and exploitation. 16
220	220
221	221	3.5–405. 17
222	222
223	223	(a) This section does not apply to municipal governments. 18
224	224
225	225	(b) In a manner and frequency established in regulations adopted by the 19
226	226	Department, each county government, local school system, and local health department 20
227	227	shall in consultation with the local emergency manager, create or update a cybersecurity 21
228	228	preparedness and response plan and complete a cybersecurity preparedness assessment. 22
229	229
230	230	(C) BY JULY 1, 2025, A LOCAL SCHOOL SYSTE M SHALL IMPLEMENT: 23
231	231
232	232	(1) MULTIFACTOR AUTHENTI CATION FOR ALL SCHOOL EMPLO YEES; 24
233	233
234	234	(2) ENDPOINT DETECTION A ND RESPONSE ON ALL SYSTEM –OWNED 25
235	235	DEVICES ACCESSED BY EMPLOYEES; AND 26
236	236
237	237	(3) NETWORK MONITORING . 27
238	238
239	239	(D) EACH YEAR , A LOCAL SCHOOL SYSTEM SHALL REPORT IN A 28
240	240	CYBERSECURITY ASSESS MENT REQUIRED UNDER § 3.5–407 OF THIS SUBTITLE THE 29
241	241	PERCENTAGE OF EMPLOY EES THAT COMPLY WITH THE REQUIREMENTS OF EACH 30
242	242	ITEM OF SUBSECTION (C) OF THIS SECTION. 31
243	243	6 SENATE BILL 981
244	244
245	245
246	246	3.5–407. 1
247	247
248	248	(a) This section does not apply to municipal governments. 2
249	249
250	250	(b) In a manner and frequency established in regulations adopted by the 3
251	251	Department, each county government, local school system, and local health department 4
252	252	shall: 5
253	253
254	254	(1) in consultation with the local emergency manager, create or update a 6
255	255	cybersecurity preparedness and response plan; and 7
256	256
257	257	(2) complete a cybersecurity preparedness assessment. 8
258	258
259	259	(c) The assessment required under paragraph (b)(2) of this section may, in 9
260	260	accordance with the preference of each county government, be performed by the 10
261	261	Department or by a vendor authorized by the Department. 11
262	262
263	263	(d) (1) Each local government shall report a cybersecurity incident, including 12
264	264	an attack on a State system being used by the local government, to the appropriate local 13
265	265	emergency manager and the State Security Operations Center in the Department in 14
266	266	accordance with paragraph (2) of this subsection. 15
267	267
268	268	(2) For the reporting of cybersecurity incidents to local emergency 16
269	269	managers under subparagraph (i) of this paragraph, the State Chief Information Security 17
270	270	Officer shall determine: 18
271	271
272	272	(i) the criteria for determining when an incident must be reported; 19
273	273
274	274	(ii) the manner in which to report; and 20
275	275
276	276	(iii) the time period within which a report must be made. 21
277	277
278	278	(3) The State Security Operations Center shall immediately notify the 22
279	279	appropriate agencies of a cybersecurity incident reported under this subsection through the 23
280	280	State Security Operations Center. 24
281	281
282	282	SECTION 2. AND BE IT FURTHER ENACTED, That , for fiscal years 2026 and 25
283	283	2027, funds from the Dedicated Purpose Account may be transferred by budget 26
284	284	amendment, in accordance with § 7–310 of the State Finance and Procurement Article, to 27
285	285	implement this Act. 28
286	286
287	287	SECTION 3. AND BE IT FURTHER ENACTED, That this Act shall take effect July 29
288	288	1, 2024. 30