Maryland enacts House Bill 1062 for cybersecurity reporting in water systems

Maryland's House Bill 1062 aims to bolster cybersecurity measures for community water and sewerage systems across the state. Introduced on April 5, 2025, the bill mandates that these systems report any cybersecurity incidents, including attacks on their information technology and operational technology systems, to the State Security Operations Center within the Department of Information Technology.

The bill outlines a structured reporting process that the State Chief Information Security Officer will establish in consultation with relevant departments. This process will detail the circumstances under which incidents must be reported, the reporting methods, and the timeframes for notification. The legislation emphasizes the importance of timely communication, requiring the State Security Operations Center to promptly inform state and local agencies of any reported incidents.

One of the key provisions of House Bill 1062 is the annual reporting requirement. Starting January 1, 2027, the Office of Security Management will publish a report detailing the number and types of cybersecurity incidents reported by community water and sewerage systems. Importantly, these reports will not disclose the identities of the affected systems, ensuring confidentiality while still providing oversight on cybersecurity trends.

The introduction of this bill comes amid growing concerns over the vulnerability of critical infrastructure to cyberattacks. Experts highlight that water and sewerage systems are increasingly targeted due to their essential role in public health and safety. By implementing a standardized reporting process, Maryland aims to enhance the resilience of these systems against potential threats.

While the bill has garnered support for its proactive approach to cybersecurity, some opposition has emerged regarding the potential administrative burden on smaller community systems. Critics argue that the requirements could strain resources, particularly for rural providers. However, proponents assert that the long-term benefits of improved security far outweigh these concerns.

As Maryland moves forward with House Bill 1062, the implications for public safety and infrastructure security are significant. By establishing clear protocols for incident reporting, the state is taking a crucial step toward safeguarding its water and sewerage systems from the growing threat of cyberattacks, ultimately aiming to protect the health and safety of its residents.