1. A. Equipment, a system, or software required to be tested, certified, and approved under this chapter shall:

   1. (1) Conform to the minimum design standards of this regulation; and
   2. (2) If applicable, conform to any specific additional design standards enumerated in this chapter.

2. B. Equipment, a system, or software required to be tested, certified, and approved under this chapter shall, at a minimum, control logical access through:

   1. (1) Generation of daily monitoring logs documenting:

      1. (a) User access; and
      2. (b) Security incidents;

   2. (2) Assignment of rights and privileges to an individual user including specific protocols addressing:

      1. (a) Creation, modification, and termination of a unique system account for each user;

      2. (b) Password parameters which:

         1. (i) Require a minimum length;
         2. (ii) Incorporate an expiration interval; and
         3. (iii) Result in lockout; and
      3. (c) Administrator and override capabilities;

   3. (3) Use of access permissions to restrict an unauthorized user from performing any the following with regard to critical files and directories:

      1. (a) Reading;
      2. (b) Altering; or
      3. (c) Deleting; and

   4. (4) Restricted access to critical files and directories through:

      1. (a) Encryption; or

      2. (b) If approved by the Commission, internal controls provided the internal controls include:

         1. (i) The effective segregation of duties and responsibilities with regard to the system; and
         2. (ii) The automatic monitoring and recording by the system of access by an individual to its files and directories.

3. C. Equipment, a system or software required to be tested, certified, and approved under this chapter shall, at a minimum, control system operations through:

   1. (1) Generation of daily monitoring logs and alert messages documenting:

      1. (a) System performance;
      2. (b) Hardware problems; and
      3. (c) Software errors;
   2. (2) Authentication of the source of a data transmission;
   3. (3) Transmission completeness and accuracy checks;
   4. (4) Detection of corrupt or lost data packets;
   5. (5) Rejection of a transmission;
   6. (6) Use of cryptographic controls for critical transmissions of data; and
   7. (7) Daily synchronization of its real time clock with that of equipment, systems, or software to which it is linked.

4. D. Equipment, a system, or software required to be tested, certified, and approved under this chapter shall, at a minimum, control the integrity of data through:

   1. (1) Validation of inputs to critical fields including data:

      1. (a) Type; and
      2. (b) Format;
   2. (2) Rejection of corrupt data;
   3. (3) Automatic and independent recordation of critical data;
   4. (4) Independent verification of the accuracy of data; and
   5. (5) Segregation of all security critical system programs, files, and directories from other programs, files, and directories.

5. E. Equipment, a system, or software required to be tested, certified, and approved under this chapter shall, at a minimum, ensure continuity through:

   1. (1) Data redundancy to permit a complete and prompt recovery of all information in the event of malfunction or power interruption; and
   2. (2) Environmental protections, including an uninterruptible power supply to protect critical hardware.

Authority: State Government Article, §§9-1A-02, 9-1A-04, 9-1A-15, 9-1A-22, and 9-1A-24, Annotated Code of Maryland

Effective date:

Regulations .01—.32 adopted as an emergency provision effective March 1, 2013 (40:6 Md. R. 470); adopted permanently effective April 29, 2013 (40:8 Md. R. 725)

Regulation .01A amended effective October 27, 2014 (41:21 Md. R. 1262)

Regulation .11 amended effective November 14, 2022 (49:23 Md. R. 997)

Regulation .11D amended as an emergency provision effective December 12, 2023 (50:26 Md. R. 1130); amended permanently effective May 27, 2024 Md. R. 529)

Regulation .11E, I amended effective January 7, 2016 (42:26 Md. R. 1597)

Regulation .12C adopted effective October 7, 2019 (46:20 Md. R. 848)

Regulation .18 amended effective October 19, 2020 (47:21 Md. R. 905)

Regulation .18D, E amended effective October 22, 2018 (45:21 Md. R. 976)

Regulation .20A amended effective October 23, 2017 (44:21 Md. R. 985)

Regulation .20B amended effective February 16, 2015 (42:3 Md. R. 319)

Regulation .21 amended effective October 7, 2019 (46:20 Md. R. 848)

Regulation .21E amended effective October 22, 2018 (45:21 Md. R. 976)

Regulation .27B, D amended effective September 6, 2021 (48:18 Md. R. 695)

Regulation .28F amended effective September 26, 2016 (43:19 Md. R. 1073); October 19, 2020 (47:21 Md. R. 905)

Regulation .30D amended effective October 22, 2018 (45:21 Md. R. 976); September 6, 2021 (48:18 Md. R. 695)

Regulation .30D, E amended effective January 7, 2016 (42:26 Md. R. 1597)

Regulation .31C amended effective October 23, 2017 (44:21 Md. R. 985); October 22, 2018 (45:21 Md. R. 976); October 7, 2019 (46:20 Md. R. 848)