§ 2-108

(a) (1) The principal office of the Commission shall be in Baltimore City at the place that the Commission selects.

(2) Except for legal holidays, the offices of the Commission shall be open for business during regular business hours from Monday through Friday and at other times as the Commission considers necessary.

(b) (1) The Commission shall meet at the times and places in the State as the Commission considers necessary.

(2) For purposes of the Open Meetings Act, a project site visit or educational field tour may not be considered a meeting of the Commission if no organizational business is conducted.

(c) The Commission shall have a seal.

(d) (1) The State budget shall provide sufficient money for the Commission to hire, develop, and organize a staff to perform the functions of the Commission, including analyzing data submitted to the Commission and participating in proceedings as provided in § 3–104 of this article.

(2) (i) As the Commission considers necessary, the Commission shall hire experts including economists, cost of capital experts, rate design experts, accountants, engineers, transportation specialists, and lawyers.

(ii) To assist in the regulation of intrastate hazardous liquid pipelines under Title 11, Subtitle 2 of this article, the Commission shall include on its staff at least one engineer who specializes in the storage of and the transportation of hazardous liquid materials by pipeline.

(3) The Commission shall include on its staff one or more employees that are experts in cybersecurity to:

(i) advise the Chairman of the Commission and the commissioners on measures to improve oversight of the cybersecurity practices of public service companies;

(ii) consult with the Office of Security Management on cybersecurity issues related to utility regulation;

(iii) assist the Commission in monitoring the minimum security standards developed under § 5–306 of this article;

(iv) participate in briefings to discuss cybersecurity practices based on:

1. applicable National Association of Regulatory Utility Commissioners guidance; and

2. improvements to cybersecurity practices recommended in the cybersecurity assessments required under § 5–306 of this article; and

(v) support public service companies that do not meet minimum security standards with remediating vulnerabilities or addressing cybersecurity assessment findings.

(4) The Commission may retain on a case by case basis additional experts as required for a particular matter.

(5) The lawyers who represent the Commission staff in proceedings before the Commission shall be appointed by the Commission and shall be organized and operate independently of the office of General Counsel.

(6) (i) As required, the Commission shall hire public utility law judges.

(ii) Public utility law judges are a separate organizational unit and shall report directly to the Commission.

(7) The Commission shall hire personal staff members for each commissioner as required to provide advice, draft proposed orders and rulings, and perform other personal staff functions.

(8) (i) The Commission shall:

1. collaborate with the Office of Security Management to establish cybersecurity standards and best practices for regulated entities, taking into account utility needs and capabilities based on size;

2. periodically share information on cybersecurity initiatives and best practices with municipal electric utilities; and

3. beginning on or before January 1, 2025, and every 2 years thereafter:

A. collect certifications of a public service company’s compliance with standards used in the assessments conducted under § 5–306 of this article for cybersecurity–related policies and procedures; and

B. submit a report to the State Chief Information Security Officer, or the Officer’s designee.

(ii) The report required under subparagraph (i) of this paragraph shall include:

1. a general overview of cybersecurity technology and policies used by public service companies in the State, grouped by the following types:

A. investor–owned electric companies;

B. electric cooperatives;

C. municipal electric companies;

D. gas companies; and

E. water companies;

2. general recommendations for improving cybersecurity technology and policies used by public service companies in the State, grouped by the following types:

A. investor–owned electric companies;

B. electric cooperatives;

C. municipal electric companies;

D. gas companies; and

E. water companies; and

3. for each certification collected:

A. the name of the public service company;

B. the date of the public service company’s most recent cybersecurity assessment;

C. the cybersecurity framework used in the cybersecurity assessment of the public service company; and

D. the name of the entity that completed the cybersecurity assessment.

(9) Subject to § 3–104 of this article, the Commission may delegate to a commissioner or personnel the authority to perform an administrative function necessary to carry out a duty of the Commission.

(10) (i) Except as provided in subparagraph (ii) of this paragraph or otherwise by law, all personnel of the Commission are subject to the provisions of the State Personnel and Pensions Article.

(ii) The following are in the executive service, management service, or are special appointments in the State Personnel Management System:

1. each commissioner of the Commission;

2. the Executive Director;

3. the General Counsel and each assistant general counsel;

4. the Executive Secretary;

5. the commissioners’ personal staff members;

6. the chief public utility law judge; and

7. each license hearing officer.

(e) The compensation of the following personnel shall be determined by the Commission and, if possible, in accordance with the State pay plan:

(1) the Executive Director;

(2) the General Counsel;

(3) the special appointment attorneys in the office of General Counsel;

(4) the Executive Secretary;

(5) the chief public utility law judge;

(6) each license hearing officer; and

(7) all Commission personnel in positions in:

(i) the management service; and

(ii) professional and technical classifications unique to the Commission.

(f) (1) At least 45 days before the effective date of the change, the Commission shall submit to the Secretary of Budget and Management each change to salary plans that involves increases or decreases in salary ranges other than those associated with routine reclassifications and promotions or general salary increases approved by the General Assembly.

(2) Reportable changes include creation or abolition of classes, regrading the classes from one established range to another, changes in salary guidelines to administer the pay schedules, or creation of new pay schedules or ranges.

(3) The Secretary of Budget and Management shall:

(i) review the proposed changes; and

(ii) at least 15 days before the effective date of the proposed changes, advise the Commission whether the changes would have an adverse effect on comparable State jobs.

(4) Failure of the Secretary to respond in a timely manner is not considered a statement of adverse effect.

(g) On or before January 31 of each year, the Commission shall report to the Secretary of Budget and Management and, subject to § 2–1257 of the State Government Article, to the General Assembly setting forth all personnel positions, classifications, and salaries in the Commission as of the end of the preceding calendar year.