§ 9-2705

(a) This section applies to a community water system or community sewerage system in the State that serves over 3,300 customers.

(b) Each community water system and community sewerage system provider shall:

(1) Adopt and implement cybersecurity standards that are equal to or exceed the standards adopted by the Department under § 9–2702(3)(ii) of this subtitle;

(2) Commit to adopting a zero–trust cybersecurity approach and begin planning and implementing the zero–trust approach, as appropriate for each system, modeled after the federal Cybersecurity and Infrastructure Security Agency’s zero–trust maturity model, for on–premises services and cloud–based services; and

(3) On or before July 1, 2026, and every 2 years thereafter, conduct a maturity assessment of its cybersecurity program for operational technology and information technology, based on the minimum cybersecurity standards established under § 9–2702(3)(ii) of this subtitle.