DoIT outlines expanded cybersecurity program, launches bug-bounty and ISO assignments

Secretary Savage, head of the Maryland Department of Information Technology (DoIT), told the House Health and Government Operations Committee at its first briefing of the 2025 legislative session that the department has launched several new cybersecurity measures to strengthen state networks and help local governments.

Savage said DoIT is expanding its security operations and identity controls, and has introduced a bug-bounty program and a public vulnerability-disclosure program to surface problems before they become breaches. "A bug bounty is a scoped effort where we ask ethical security researchers to look at our websites and public facing assets and see if they can identify any vulnerabilities," Savage said.

DoIT described three concentric priorities: improving DoIT's internal cybersecurity posture; supporting statewide executive-branch agencies; and offering local governments technical assessments and services. As part of that work, Savage said DoIT has hired 15 information security officers (ISOs) to be assigned to executive-branch agencies to help remediate findings from the 2022 agency assessments and to centralize key protections such as endpoint…