Maryland Code, State Finance and Procurement § 3.5-406

(i) an inventory of all information systems and applications used or maintained by the unit;

(ii) a full data inventory of the unit;

(iii) a list of all cloud or statistical analysis system solutions used by the unit;

(iv) a list of all permanent and transient vendor interconnections that are in place;

(v) the number of unit employees who have received cybersecurity training;

(vi) the total number of unit employees who use the network;

(vii) the number of information technology staff positions, including vacancies;

(viii) the number of noninformation technology staff positions, including vacancies;

(ix) the unit's information technology budget, itemized to include the following categories:

(x) any major information technology initiatives to modernize the unit's information technology systems or improve customer access to State and local services;

(xi) the unit's plans for future fiscal years to implement the unit's information technology goals;

(xii) compliance with timelines and metrics provided in the Department's master plan; and

(xiii) any other key performance indicators required by the Office of Security Management to track compliance or consistency with the Department's statewide information technology master plan.

(i) the criteria for determining when an incident must be reported;

(ii) the manner in which to report; and

(iii) the time period within which a report must be made.