On or before October 1, 2026, and every 2 years thereafter, the Office of Security Management in the Department of Information Technology shall:
(1) Collect certifications of each community water system and community sewerage system provider’s compliance with standards used in the assessments conducted under § 9–2705(b)(3) of this subtitle for cybersecurity–related policies and procedures; and
(2) Submit a report to the State Chief Information Security Officer, or the Officer’s designee.