MarylandSB 08712025 Regular SessionSenate

Department of the Environment - Community Water and Sewerage Systems - Cybersecurity Planning and Assessments

Sponsored By: Katie Fry Hester (Democratic)

Signed by Governor

EnvironmentCybersecurityAwareness and OutreachCertificationsCommittees and CommissionsCommunity Facilities and ServicesCommunications -see also- ElecComm; Intergov; Telecom; etc.DisclosureEmergency Management, Department ofEmergencies -see also- PandemicsEnvironment, Department of theEnvironmental Matters -see also- Conserv; Nat Resrce; PollutEquipment -see also- Charging; Med. Equip.; MV Equip; etc.Goods and Services -see also- Retail Sales; TermnSvc; TrfGdsIndependent ContractorsInformation Technology, Department ofIntergovernmental Cooperation -see also- AdmAgn; Cmts; etc.Investigations and Inquiries -see also- Crim Bckgrnd InvestJob Training -see also- Continuing Ed; Vocational RehabLocal Government MandatesPrivacyReportsRules and RegulationsSewageStandards and Best PracticesTelecommunications and Information TechnologyUtilities -see also- Recycl; Refuse; Sewage; Teleph; WaterWastewaterWater -see also- Coastal Bays; Riv,Str,Lks; Wastewater; etc.Work, Labor, and Employment -see also- JobTrn; Leave; etc.

Personalized for You

How does this bill affect your finances?

Personalize government policy and PRIA will tell you what this bill means for your household, plus every other piece of legislation we track. PRIA reads each provision against your financial profile to show you exactly what matters to your wallet.

Free to download

Bill Overview

Analyzed Economic Effects

6 provisions identified: 1 benefits, 1 costs, 4 mixed.

Larger water systems face cybersecurity checks

Beginning October 1, 2025, community water and sewer systems serving more than 3,300 customers must implement Maryland's cybersecurity standards. They must commit to a zero-trust approach and begin planning and putting it in place as appropriate for their systems. They must assess cybersecurity for both computer systems and equipment-control technology by July 1, 2026, then every two years. These duties aim to protect service but add compliance work for providers.

Water providers face new cybersecurity rules

Beginning October 1, 2025, Maryland must set water and sewer cybersecurity standards at least as strong as federal goals. State rules must require incident reports and cyber-related service disruption plans. Every community water and sewer provider must name a cybersecurity contact and attend annual training. New and renewed operator and superintendent certifications must include cybersecurity awareness. State agencies must coordinate this work, list approved training programs, and protect active operator lists while allowing legitimate access.

Water systems get state cybersecurity support

Beginning October 1, 2025, Maryland must employ a cybersecurity specialist trained to protect technology that controls water systems. All Maryland water and wastewater sector members can join the state's information-sharing center. State agencies must promote guidance meeting or exceeding federal cybersecurity goals, including stronger practices beyond minimum standards. The Cyber Preparedness Unit must give local emergency groups guidance on water-sector incidents and crisis communication. The Environment Department must post cyberattack information on its website, not necessarily its former “Know the Threats” site.

Required yearly water cyber exercises end

Beginning October 1, 2025, Maryland's Cyber Preparedness Unit no longer must host a yearly water and wastewater cyber exercise. The removed requirement called for at least one tabletop exercise each year to improve state and local responses. The law ends the requirement; it does not ban these exercises.

Public access to security records narrows

Beginning October 1, 2025, Maryland public-records officials must withhold portions of records containing system-security information. This covers computer systems, equipment-control technology, and critical infrastructure, including community water and sewer systems. The rule protects sensitive security details but limits what the public can inspect.

Water systems must report cyber incidents

Beginning October 1, 2025, each Maryland community water and sewer system must report cyber incidents to the State Security Operations Center. This includes attacks on computer systems and technology that controls equipment. The State Chief Information Security Officer sets reporting circumstances, methods, and deadlines in consultation with the Environment Department. The Center must immediately notify the appropriate state and local agencies. Households have no direct reporting duty.

Sponsors & Cosponsors

Sponsor

Katie Fry Hester
Democratic • Senate

Cosponsors

There are no cosponsors for this bill.

Roll Call Votes

All Roll Calls

Yes: 182 • No: 0

House vote • 4/7/2025

Third Reading Passed

Yes: 140 • No: 0 • Other: 1

Senate vote • 3/17/2025