title: US-MD — Operational Resilience & Critical Infrastructure (W3) | World Payments Monitor canonical: https://payments.gi/jurisdictions/united-states-maryland/w3/ ### W3 Operational Resilience & Critical Infrastructure Probable re-verified 2026-10-18 · changed 2026-07-05 Maryland lacks a dedicated payments-sector operational-resilience statute equivalent to DORA; resilience obligations for payments/financial entities instead flow from the state's general data-breach notification law (PIPA), sector-specific insurance-carrier cybersecurity-event reporting rules, and an OFR-issued Emergency Preparedness Guide for state-chartered depository institutions. Kept on Dataprotection.gi, not restated here: data and cloud switching obligations on service providers, including notice periods and charges. [Open its jurisdiction pages on Dataprotection.gi →](https://dataprotection.gi/jurisdictions/) Standing sub-brief · as of 5 July 2026 176 words · last cycle 2026-07-05 #### Operational Resilience & Critical Infrastructure Maryland has no payments-specific operational-resilience statute equivalent to the EU's DORA. The backstop instead runs through the Personal Information Protection Act, Commercial Law §14-3504, which requires businesses handling Maryland residents' personal data to notify affected individuals no later than 45 days after breach discovery absent a finding that misuse is unlikely. Insurance carriers face a tighter clock: Insurance Article cybersecurity-event reporting rules require notification to the Insurance Commissioner within 3 business days of determining a reportable event has occurred. For state-chartered depositories, OFR's Depository Supervision Unit maintains an Emergency Preparedness Guide, last revised August 2023, as its operational-resilience expectation. A federal layer sits atop all of this: under CIRCIA, Maryland-based critical-infrastructure entities must report substantial cyber incidents to CISA within 72 hours. #### Outlook This module's trajectory is stable rather than escalating: absent a dedicated payments-resilience statute, Maryland's posture will continue to be read as an assembly of general breach law, sector-specific insurance rules, and the federal CIRCIA backstop, a structural gap relative to EU/UK peers that this monitor will keep tracking. no periodic updates on record for this sub-brief ** Sources and findings (5 unique sources · R-3/R-4)** 1. [W3-E1] T1 Derived: Confirmed [in_force https://mgaleg.maryland.gov/mgawebsite/laws/StatuteText?article=gcl§ion=14-3504&enactments=False&archived=False](https://mgaleg.maryland.gov/mgawebsite/laws/StatuteText?article=gcl§ion=14-3504&enactments=False&archived=False) re-verified 2026-07-05 A business that owns, licenses, or maintains computerized personal information of a Maryland resident must conduct a good-faith investigation upon a breach and, unless misuse is unlikely, notify affected individuals as soon as reasonably practicable but not later than 45 days after discovery. 2. [W3-E2] T2 Derived: Confirmed [in_force https://www.constangy.com/data-privacy-us-md](https://www.constangy.com/data-privacy-us-md) re-verified 2026-07-05 A carrier must notify the Maryland Insurance Commissioner as promptly as possible but no later than 3 business days from determining a cybersecurity event involving nonpublic information has occurred, where Maryland is the state of domicile or the event has a reasonable likelihood of consumer harm. 3. [W3-E3] T1 Derived: Confirmed [in_force https://labor.maryland.gov/finance/banks/](https://labor.maryland.gov/finance/banks/) re-verified 2026-07-05 OFR's Depository Supervision Unit, responsible for regulation, supervision, and examination of all Maryland-chartered banks, credit unions, and trust companies, maintains an Emergency Preparedness Guide (revised August 16, 2023) as part of its operational-resilience expectations. 4. [W3-E4] T3 Derived: Probable [in_force https://www.mwe.com/insights/maryland-joins-growing-ranks-and-passes-its-own-consumer-data-privacy-law/](https://www.mwe.com/insights/maryland-joins-growing-ranks-and-passes-its-own-consumer-data-privacy-law/) re-verified 2026-07-05 MODPA requires controllers to conduct data protection assessments for processing activities presenting heightened risk of harm, including profiling that could result in unfair, abusive, or deceptive treatment, with data protection assessment requirements applying to processing on or after October 1, 2025. 5. [W3-E5] T3 Derived: Probable [in_force https://pivitstrategy.com/maryland-cybersecurity-laws-you-should-know-2026/](https://pivitstrategy.com/maryland-cybersecurity-laws-you-should-know-2026/) re-verified 2026-07-05 Under CIRCIA, critical infrastructure entities in Maryland must report substantial cyber incidents to the federal Cybersecurity and Infrastructure Security Agency (CISA) within 72 hours, layering a federal resilience backstop atop Maryland's state breach-notification regime.