Maine allows standing cybersecurity contracts outside usual purchasing rules

Maine’s chief information officer may arrange cybersecurity services through a retainer, a standing contract that keeps services available. A related purchasing provision covers information security or cybersecurity products and services provided under standing contracts. The officer must reasonably investigate and determine that cybersecurity services are necessary to prepare Maine to detect, prevent, and respond to cyberattacks. For cybersecurity services, this authority overrides the cited purchasing requirements and other conflicting laws or rules. The related provision for security products or services requires an investigation and a finding that the contract is necessary to detect, prevent, and respond to cyberattacks.

Maine’s chief information officer may use federal purchasing offerings for technology products or services. The provision covers United States General Services Administration purchasing offerings available to state and local governments. The officer must reasonably investigate and determine that using these offerings serves the State’s best interest.

The chief information officer or a chosen representative must approve agency technology use, develop employee training, and set written technology standards. These duties cover state agencies’ computer and telecommunications systems and state employees’ computer training. Technology approvals must follow written standards and involve the purchasing division within Maine’s Bureau of General Services. Written standards must cover information security and cybersecurity policies, procedures, and related operations. Agencies need prior written purchase approval from the commissioner, chief information officer, or the officer’s chosen representative. The State Controller needs evidence of that approval before paying.