Maryland § 3.5-404

§ 3.5-404.

    (a)    The General Assembly declares that:

        (1)    it is the policy of the State to foster telecommunication and computer networking among State and local governments, their agencies, and educational institutions in the State;

        (2)    there is a need to improve access, especially in rural areas, to efficient telecommunication and computer network connections;

        (3)    improvement of telecommunication and computer networking for State and local governments and educational institutions promotes economic development, educational resource use and development, and efficiency in State and local administration;

        (4)    rates for the intrastate inter–LATA telephone communications needed for effective integration of telecommunication and computer resources are prohibitive for many smaller governments, agencies, and institutions; and

        (5)    the use of improved State telecommunication and computer networking under this section is intended not to compete with commercial access to advanced network technology, but rather to foster fundamental efficiencies in government and education for the public good.

    (b)    (1)    The Department shall establish a telecommunication and computer network in the State.

        (2)    The network shall consist of:

            (i)    one or more connection facilities for telecommunication and computer connection in each local access transport area (LATA) in the State; and

            (ii)    facilities, auxiliary equipment, and services required to support the network in a reliable and secure manner.

    (c)    The network shall be accessible through direct connection and through local intra–LATA telecommunications to State and local governments and public and private educational institutions in the State.

    (d)    In a manner and frequency established in regulations adopted by the Department, each unit of local government and any local agencies that use the network established under subsection (b) of this section shall certify to the Department that the unit is in compliance with the Department’s minimum security standards.

    (e)    (1)    The Office shall ensure that at least once every 2 years, or more often if required by regulations adopted by the Department, each unit of State government shall complete an external assessment.

        (2)    The Office shall assist each unit to remediate any security vulnerabilities or high–risk configurations identified in the assessment required under paragraph (1) of this subsection.

    (f)    (1)    In this subsection, “IT unit” means a unit of the Legislative Branch or Judicial Branch of State government, the Office of the Attorney General, the Office of the Comptroller, or the Office of the State Treasurer that provides information technology services for another unit of government.

        (2)    Each IT unit shall:

            (i)    be evaluated by an independent auditor with cybersecurity expertise to determine whether the IT unit, and the units it provides information technology services for, meet relevant cybersecurity standards recommended by the National Institute of Standards and Technology; and

            (ii)    certify compliance with the recommended National Institutes of Standards and Technology cybersecurity standards to:

                1.    if the IT unit is part of the Legislative Branch, the President of the Senate and the Speaker of the House;

                2.    if the IT unit is part of the Office of the Attorney General, to the Attorney General;

                3.    if the IT unit is part of the Comptroller’s Office, to the Comptroller;

                4.    if the IT unit is part of the State Treasurer’s Office, to the State Treasurer; and

                5.    if the IT unit is part of the Judicial Branch of State government, the Chief Judge.