Md. Code, State Finance and Procurement § 3.5-406
This is the official text of Md. Code, State Finance and Procurement § 3.5-406, part of Maryland’s Code, State Finance and Procurement — governs the state budget and government contracting.
Not legal advice. This page reproduces the official text of a government statute for reference only. Laws change, and how a statute applies depends on your specific facts. For advice about your situation, consult a licensed attorney in your state.
§3.
Official statutory text
§3.5–406.
(a) This section does not apply to municipal governments.
(b) In a manner and frequency established in regulations adopted by the Department, each county government, local school system, and local health department shall:
(1) in consultation with the local emergency manager, create or update a cybersecurity preparedness and response plan; and
(2) complete a cybersecurity preparedness assessment.
(c) The assessment required under paragraph (b)(2) of this section may, in accordance with the preference of each county government, be performed by the Department or by a vendor authorized by the Department.
(d) (1) Each local government shall report a cybersecurity incident, including an attack on a State system being used by the local government, to the appropriate local emergency manager and the State Security Operations Center in the Department in accordance with paragraph (2) of this subsection.
(2) For the reporting of cybersecurity incidents to local emergency managers under subparagraph (i) of this paragraph, the State Chief Information Security Officer shall determine:
(i) the criteria for determining when an incident must be reported;
(ii) the manner in which to report; and
(iii) the time period within which a report must be made.
(3) The State Security Operations Center shall immediately notify the appropriate agencies of a cybersecurity incident reported under this subsection through the State Security Operations Center.
(a) This section does not apply to municipal governments.
(b) In a manner and frequency established in regulations adopted by the Department, each county government, local school system, and local health department shall:
(1) in consultation with the local emergency manager, create or update a cybersecurity preparedness and response plan; and
(2) complete a cybersecurity preparedness assessment.
(c) The assessment required under paragraph (b)(2) of this section may, in accordance with the preference of each county government, be performed by the Department or by a vendor authorized by the Department.
(d) (1) Each local government shall report a cybersecurity incident, including an attack on a State system being used by the local government, to the appropriate local emergency manager and the State Security Operations Center in the Department in accordance with paragraph (2) of this subsection.
(2) For the reporting of cybersecurity incidents to local emergency managers under subparagraph (i) of this paragraph, the State Chief Information Security Officer shall determine:
(i) the criteria for determining when an incident must be reported;
(ii) the manner in which to report; and
(iii) the time period within which a report must be made.
(3) The State Security Operations Center shall immediately notify the appropriate agencies of a cybersecurity incident reported under this subsection through the State Security Operations Center.
Status: in_force · Read it on the official government site
Need a lawyer in Maryland?
Find a Maryland lawyer
About this page: Statute text is reproduced from official government publishers via the
Open US Law dataset
(Vaquill AI, snapshot v2026.08, CC BY 4.0). Primary legislative text like this is public domain under the government-edicts doctrine
(Georgia v. Public.Resource.Org, 2020). We link every section back to its official source so you can verify it independently.