US-MD v2.0 Sign in

US-MD (US-MD) · Module W3 · Derived Confidence: Probable

US-MD: Operational Resilience & Critical Infrastructure

← Full US-MD Dossier (14 modules) Open US-MD in Co-Pilot ↗ Request Bespoke Deeper Dive

#

Maryland lacks a dedicated payments-sector operational-resilience statute equivalent to DORA; resilience obligations for payments/financial entities instead flow from the state's general data-breach notification law (PIPA), sector-specific insurance-carrier cybersecurity-event reporting rules, and an OFR-issued Emergency Preparedness Guide for state-chartered depository institutions.

Kept on Dataprotection.gi, not restated here: data and cloud switching obligations on service providers, including notice periods and charges. Open its jurisdiction pages on Dataprotection.gi →

Standing sub-brief · as of 5 July 2026176 words · last cycle 2026-07-05

Operational Resilience & Critical Infrastructure

Maryland has no payments-specific operational-resilience statute equivalent to the EU's DORA. The backstop instead runs through the Personal Information Protection Act, Commercial Law §14-3504, which requires businesses handling Maryland residents' personal data to notify affected individuals no later than 45 days after breach discovery absent a finding that misuse is unlikely. Insurance carriers face a tighter clock: Insurance Article cybersecurity-event reporting rules require notification to the Insurance Commissioner within 3 business days of determining a reportable event has occurred. For state-chartered depositories, OFR's Depository Supervision Unit maintains an Emergency Preparedness Guide, last revised August 2023, as its operational-resilience expectation. A federal layer sits atop all of this: under CIRCIA, Maryland-based critical-infrastructure entities must report substantial cyber incidents to CISA within 72 hours.

Outlook

This module's trajectory is stable rather than escalating: absent a dedicated payments-resilience statute, Maryland's posture will continue to be read as an assembly of general breach law, sector-specific insurance rules, and the federal CIRCIA backstop, a structural gap relative to EU/UK peers that this monitor will keep tracking.

no periodic updates on record for this sub-brief

Sources and findings (5 unique sources · R-3/R-4)
  1. [W3-E1] T1 Derived: Confirmed in_forcehttps://mgaleg.maryland.gov/mgawebsite/laws/StatuteText?article=gcl&section=14-3504&enactments=False&archived=False re-verified

    A business that owns, licenses, or maintains computerized personal information of a Maryland resident must conduct a good-faith investigation upon a breach and, unless misuse is unlikely, notify affected individuals as soon as reasonably practicable but not later than 45 days after discovery.

  2. [W3-E2] T2 Derived: Confirmed in_forcehttps://www.constangy.com/data-privacy-us-md re-verified

    A carrier must notify the Maryland Insurance Commissioner as promptly as possible but no later than 3 business days from determining a cybersecurity event involving nonpublic information has occurred, where Maryland is the state of domicile or the event has a reasonable likelihood of consumer harm.

  3. [W3-E3] T1 Derived: Confirmed in_forcehttps://labor.maryland.gov/finance/banks/ re-verified

    OFR's Depository Supervision Unit, responsible for regulation, supervision, and examination of all Maryland-chartered banks, credit unions, and trust companies, maintains an Emergency Preparedness Guide (revised August 16, 2023) as part of its operational-resilience expectations.

  4. [W3-E4] T3 Derived: Probable in_forcehttps://www.mwe.com/insights/maryland-joins-growing-ranks-and-passes-its-own-consumer-data-privacy-law/ re-verified

    MODPA requires controllers to conduct data protection assessments for processing activities presenting heightened risk of harm, including profiling that could result in unfair, abusive, or deceptive treatment, with data protection assessment requirements applying to processing on or after October 1, 2025.

  5. [W3-E5] T3 Derived: Probable in_forcehttps://pivitstrategy.com/maryland-cybersecurity-laws-you-should-know-2026/ re-verified

    Under CIRCIA, critical infrastructure entities in Maryland must report substantial cyber incidents to the federal Cybersecurity and Infrastructure Security Agency (CISA) within 72 hours, layering a federal resilience backstop atop Maryland's state breach-notification regime.