All utilities shall report confirmed cybersecurity breaches of a smart grid system, information technology system, or operations technology system to a Commission-designated representative without divulging energy/electric infrastructure information, as defined by 18 CFR § 388.113, no later than 1 business day after confirmation, unless prohibited or recommended by law enforcement to avoid compromising an investigation.
Md. Code Regs. 20.06.01.05