Md. Code Regs. 20.06.02.01

Current through Register Vol. 52, No. 1, January 10, 2025

Section 20.06.02.01 - Enforcement

A. General.

(1) The Office of Cybersecurity may issue a NOPV upon finding good cause to believe a violation of this subtitle or cybersecurity requirements in Public Utilities Article, §5-306, Annotated Code of Maryland, has occurred.

(2) The NOPV may contain a proposed compliance order.

(3) A public service company shall respond in writing within 30 days after receipt of a NOPV.

(4) The Office of Cybersecurity may waive the requirements of §A(3) of this regulation upon written request from a public service company demonstrating good cause.

B. Contents of Notice of Probable Violation. A NOPV shall include:

(1) A statement of the statute or regulation allegedly violated by a public service company;

(2) A description of the evidence indicating a possible violation;

(3) Notice of response options available to the public service company;

(4) If appropriate, the amount of the proposed civil penalty and the maximum civil penalty applicable under law; and

(5) If appropriate, a statement of the remedial action being sought in a compliance order.

C. Response Options. A public service company shall respond to the NOPV as follows:

(1) If a NOPV contains a proposed compliance order, a public service company may:

(a) Agree to the proposed compliance order;

(b) Request the execution of a consent order;

(c) Object to the proposed compliance order and submit written explanations, information, or other materials in answer to the allegations in the notice; or

(d) Request a hearing under Public Utilities Article, § 3-102, Annotated Code of Maryland; and

(2) If the NOPV contains a proposed civil penalty, a public service company may:

(a) Agree to pay the penalty;

(b) Submit an offer in compromise of the proposed civil penalty;

(c) Object to the proposed civil penalty and submit a written explanation, information, or other material to mitigate the proposed civil penalty; or

(d) Request a hearing under Public Utilities Article, § 3-102, Annotated Code of Maryland.

D. If a public service company objects to the proposed compliance order or civil penalty and submits a written explanation, information, or other materials in response to a NOPV, the Cybersecurity Director shall review the submissions and determine whether to negotiate further, modify, or withdraw the NOPV, or file a complaint under Public Utilities Article, § 3-102, Annotated Code of Maryland.

Md. Code Regs. 20.06.02.01

Regulations .01 adopted effective 51:24 Md. R. 1081, eff. 12/12/2024.