Cybersecurity, Privacy, and Digitization Digitization, or the automation of processes, like the use of E-ZPass, is an important part of the MDTA’s modernization plan. However, increasing digitization
The MDTA’s processes and systems fully align with State and federal regulations on digitization, privacy, and cybersecurity. The MDTA’s Department of Information Technology (DoIT) maintains a close partnership with the MDOT network and security teams, and has developed a collaborative approach to monitoring and remediating cyber threats and events. This collaborative approach also leverages the State of Maryland's Security Office to assist with policy recommendations and other actions to protect the MDTA's vital systems. Information security for the MDTA applies to all aspects (both internal and external) of its operations and employees. During 2025, the MDTA DoIT adopted formal Cyber Incident Response Procedures including structured roles, workflows, and reporting protocols. Asset management controls have also matured, with verified reconciliation efforts and confirmed disposal oversight. Password complexity and Data Loss Prevention (DLP) enforcement meet baseline standards, and technical controls are in place to restrict unauthorized software installations and USB device use. The MDTA DoIT is also implementing Privileged Access Management (PAM) for elevated rights accounts to further fortify access control. Other items MDTA DoIT is pursuing over the next 12-18 months include the following: ③ A formal risk management framework ③ Incident response testing across all critical environments ③ Multi-factor authentication
also requires improved cybersecurity to protect digital systems and networks from attacks that can cause damage to or theft of hardware, software, or data, in addition to disruption of MDTA services. Management of Cybersecurity, Privacy, and Digitization Maintaining strong cybersecurity, privacy, and customer data protection as well as responsibly managing technology supports the success and security of the MDTA in an increasingly digital world. Information security for the MDTA applies to all aspects of MDTA’s operations, customers, and employees. The MDTA has already modernized its systems and advanced automation in its operations eight years ago. It is currently conducting readiness analyses for additional modernization, which includes modernizing both of the agency’s two data centers to replace uninterruptible power supply units and cooling units. The MDTA conducts full penetration testing every two years, and constantly monitors threats. Qualsys scans are run on all websites for vulnerabilities. If vul - nerabilities are identified, they are addressed imme- diately. The MDTA has established a robust Business Continuity and Disaster Recovery plan that outlines the process for identifying, addressing, and recover - ing from a potential data breach.
Fort McHenry Tunnel (I-95, I-395)
Federal Highway Administration (FHWA) Metrics for Compliance – Bridges and Tunnels Bridges and tunnels have compliance metrics that are audited annually by the FHWA. A random sampling of both MDTA and State Highway Administration (SHA) bridges is selected by the FHWA for audit. Per the revisions to the latest NBIS reporting standards, and Federal Regulations adopted in June 2022, a new compliance manual involving 25 metrics was developed and issued in May 2023. FHWA assessments are conducted at varying levels of depth, including cursory, intermediate (requiring proof via documentation), or in-depth (requiring proof via documentation, field reviews, other State reviews, and more). Assessment levels are determined by the FHWA and may vary by metric. Assessment results are categorized as Compliant (all metrics comply with all federal regulations), Substantially Compliant (all federal regulations are satisfied, but supporting information may lack clarity or details), or Non-Compliant (there may be missing information, or a lack of supporting information, or there is a breach of federal regulations). The MDTA has never been Non-Compliant. The MDTA received the FHWA's compliance review and the MDTA's inspection program was found to be in compliance. Further training will be implemented in September 2026 to support continued compliance.
Like the compliance metrics shown for Bridges, the FHWA administration performs audits on Tunnel Programs in accordance with the NTIS. In 2019, the NTIS adopted a list of 15 compliance metrics for tunnels. Both FHWA assessment levels and compliance results are the same for bridges and for tunnels. In 2024, the MDTA was issued an audit at an intermediate level on all 15 metrics. The MDTA was found Compliant in all metrics except one, in which MDTA was found to be Substantially Compliant. Personnel were hired and training is being implemented to address the issues observed in the singular metric. Lead and Asbestos Management The agency’s Office of the Environment, Safety and Risk Management has asbestos and lead paint management programs that develop and update site-specific lead and asbestos management plans. This includes coordinating medical monitoring, training and equipment needs as well as ensuring inclusion of lead or asbestos management requirements into facility maintenance, construction, renovation, and/or demolition plans. Additionally, the agency maintains programs for its fuel oil storage tanks (above and underground) as well as for managing hazardous waste generated during routine operations.
15
Governance, Risk, and Impact Report
16
Governance, Risk, and Impact Report
Made with FlippingBook Digital Proposal Creator