Public Safety - Critical Infrastructure Protection
SB 825 establishes a new Critical Infrastructure Protection Branch within the Maryland Coordination and Analysis Center. The bill creates a Chief Critical Infrastructure Officer to run the branch, coordinate with state, local, federal, military, and industry partners, and advise the Governor on critical infrastructure security. It defines critical infrastructure broadly and expressly includes hospitals and health care facilities.
The bill directs the branch to identify current and emerging threats, prioritize critical infrastructure assets, assess cyber and physical risks, and help connect priority assets to resources for vulnerability remediation. It also calls for voluntary cyber and physical assessments, sharing best practices, and monitoring operational technology architecture through the Maryland Information Sharing and Analysis Center. In addition, the Department of Emergency Management must coordinate consequence management and response to cascading impacts from attacks on critical infrastructure.
SB 825 also requires the Department of Information Technology, in consultation with the Center, to allow critical infrastructure owners and operators to join the Maryland Information Sharing and Analysis Center and to provide up-to-date cybersecurity reporting standards. The bill states that it is not intended to override existing federal, state, or sector-specific cybersecurity regulations or authorities that already apply to critical infrastructure entities.
The bill’s impact on state law is to add a new subtitle to the Public Safety Article governing critical infrastructure protection and to formalize a statewide structure for threat identification, information sharing, and response coordination. It expands the role of state agencies in cybersecurity and physical security planning for essential systems and creates new coordination duties for emergency management and information technology agencies, while leaving existing regulatory frameworks intact.
The overall sentiment appears strongly favorable. The bill passed the Senate 43-0 and the House 127-0, indicating broad bipartisan support and little visible opposition in the recorded votes. No committee transcript was provided, but the unanimous votes suggest the measure was viewed as a public safety and preparedness initiative rather than a controversial policy change.
Notable points of contention are limited in the available record. The main policy sensitivity is the bill’s interaction with existing cybersecurity oversight, which the bill addresses by expressly preserving current federal, state, and sector-specific authorities. Another practical issue is the voluntary nature of some assessments and the reliance on coordination among multiple agencies and private operators, which may raise implementation and resource questions, but no recorded opposition is shown in the materials provided.
SB 825 adds a new Subtitle 14, Critical Infrastructure, to the Public Safety Article and creates a formal state-level critical infrastructure protection structure within the Maryland Coordination and Analysis Center. It assigns new duties to the Chief Critical Infrastructure Officer, the Department of Emergency Management, and the Department of Information Technology, including threat identification, vulnerability assessment, consequence management, cybersecurity coordination, and information-sharing access for infrastructure owners and operators. The bill also preserves existing federal, state, and sector-specific cybersecurity rules, so it supplements rather than displaces current regulatory schemes.
The bill appears to have had very strong support. It passed both chambers unanimously, with a 43-0 vote in the Senate and a 127-0 vote in the House. That voting record suggests broad agreement that protecting critical infrastructure is a public safety priority and that the bill’s coordination and preparedness framework was acceptable across party lines.
No major contention is evident in the available record, and no committee transcript was provided. The only potentially sensitive issues are the bill’s broad definition of critical infrastructure, including hospitals and health care facilities, and the new coordination and reporting roles assigned to state agencies and private operators. The bill anticipates one possible concern by stating that it does not supersede existing cybersecurity regulations or authorities, which may have helped reduce opposition.