Maryland Code, State Finance and Procurement § 3.5-317

(i) develop a framework for investments in technology; and

(ii) at least once every 2 years, in accordance with the framework, assess the cybersecurity and information technology systems in each unit of State government.

(i) security risks to the system;

(ii) system performance;

(iii) the system's dependence on other information technology or cybersecurity systems and data;

(iv) the system's ability to create an efficient and seamless experience for users;

(v) the system's effectiveness in achieving unit objectives;

(vi) the system's effectiveness in meeting the needs of citizens and customers;

(vii) the costs to maintain and operate the system;

(viii) the speed of government response time;

(ix) the effectiveness of the system in regard to the unit's objectives;

(x) improvements to the unit's relative audit findings attributable to the system; and

(xi) an assessment of the system using the National Institute of Standards and Technology Cybersecurity Framework.

(i) the Modernize Maryland Commission established under § 3.5-316 of this subtitle; and

(ii) in accordance with § 2-1257 of the State Government Article, the Senate Budget and Taxation Committee, the Senate Education, Health, and Environmental Affairs Committee, and the House Health and Government Operations Committee.