1. A. General.

   1. (1) The Office of Cybersecurity may issue a NOPV upon finding good cause to believe a violation of this subtitle or cybersecurity requirements in Public Utilities Article, §5-306, Annotated Code of Maryland, has occurred.
   2. (2) The NOPV may contain a proposed compliance order.
   3. (3) A public service company shall respond in writing within 30 days after receipt of a NOPV.
   4. (4) The Office of Cybersecurity may waive the requirements of §A(3) of this regulation upon written request from a public service company demonstrating good cause.

2. B. Contents of Notice of Probable Violation. A NOPV shall include:

   1. (1) A statement of the statute or regulation allegedly violated by a public service company;
   2. (2) A description of the evidence indicating a possible violation;
   3. (3) Notice of response options available to the public service company;
   4. (4) If appropriate, the amount of the proposed civil penalty and the maximum civil penalty applicable under law; and
   5. (5) If appropriate, a statement of the remedial action being sought in a compliance order.

3. C. Response Options. A public service company shall respond to the NOPV as follows:

   1. (1) If a NOPV contains a proposed compliance order, a public service company may:

      1. (a) Agree to the proposed compliance order;
      2. (b) Request the execution of a consent order;
      3. (c) Object to the proposed compliance order and submit written explanations, information, or other materials in answer to the allegations in the notice; or
      4. (d) Request a hearing under Public Utilities Article, §3-102, Annotated Code of Maryland; and

   2. (2) If the NOPV contains a proposed civil penalty, a public service company may:

      1. (a) Agree to pay the penalty;
      2. (b) Submit an offer in compromise of the proposed civil penalty;
      3. (c) Object to the proposed civil penalty and submit a written explanation, information, or other material to mitigate the proposed civil penalty; or
      4. (d) Request a hearing under Public Utilities Article, §3-102, Annotated Code of Maryland.
4. D. If a public service company objects to the proposed compliance order or civil penalty and submits a written explanation, information, or other materials in response to a NOPV, the Cybersecurity Director shall review the submissions and determine whether to negotiate further, modify, or withdraw the NOPV, or file a complaint under Public Utilities Article, §3-102, Annotated Code of Maryland.

Authority: Public Utilities Article, §§2-108, 2-112, 2-113, 2-121, 2-302, 2-309, 3-101, 3-102, 3-104, 3-113, 3-205, 5-306, 6-205, and 13-201,
Annotated Code of Maryland

Effective date: December 12, 2024 (51:24 1081)