Income Tax – Cybersecurity Technology and Service Tax Credit – Alterations

EXPLANATION: CAPITALS INDICATE MATTER ADDED TO EXISTING LAW.
[Brackets] indicate matter deleted from existing law.
*hb0290*

HOUSE BILL 290
Q3 6lr0256
(PRE–FILED) CF SB 25
By: Chair, Ways and Means Committee (By Request – Departmental – Commerce)
Requested: September 30, 2025
Introduced and read first time: January 14, 2026
Assigned to: Ways and Means

A BILL ENTITLED

AN ACT concerning 1

Income Tax – Cybersecurity Technology and Service Tax Credit – Alterations 2

FOR the purpose of designating the credit against the State income tax for certain costs 3
incurred to purchase certain cybersecurity technology and services as the Buy 4
Maryland Cybersecurity Tax Credit; stating the purpose of the credit; repealing the 5
authority of the Department of Commerce to establish a certain panel to assist the 6
Department in administering the credit; altering eligibility for the credit; altering 7
the aggregate amount of credits that may be issued for certain cybersecurity 8
purchases; making the credit refundable; repealing a certain requirement that the 9
Secretary award a certain percentage of tax credits to qualified buyers of 10
cybersecurity services; prohibiting the Department from approving the credit after a 11
certain taxable year; and generally relating to the Buy Maryland Cybersecurity Tax 12
Credit. 13

BY repealing and reenacting, with amendments, 14
Article – Tax – General 15
Section 10–733.1 16
Annotated Code of Maryland 17
(2022 Replacement Volume and 2025 Supplement) 18

SECTION 1. BE IT ENACTED BY THE GENERAL ASSEMBLY OF MARYLAND, 19
That the Laws of Maryland read as follows: 20

Article – Tax – General 21

10–733.1. 22

(a) (1) In this section the following words have the meanings indicated. 23

2 HOUSE BILL 290

(2) “Cybersecurity business” means an entity organized for profit that is 1
engaged primarily in the development of innovative and proprietary cybersecurity 2
technology or the provision of cybersecurity service. 3

(3) “Cybersecurity service” means an activity that is associated with a 4
category or subcategory identified under the Framework Core established by the National 5
Institute of Standards and Technology’s Cybersecurity Framework. 6

(4) “Cybersecurity technology” means products or goods intended to detect 7
or prevent activity intended to result in unauthorized access to, exfiltration of, 8
manipulation of, or impairment to the integrity, confidentiality, or availability of an 9
information system or information stored on or transiting an information system. 10

(5) “Department” means the Department of Commerce. 11

(6) [“Panel” means the panel that the Department may establish under 12
subsection (c) of this section composed of experts in the areas of cybersecurity technology 13
and cybersecurity service. 14

(7)] “Qualified buyer” means any entity [that has fewer than 50 employees 15
in the State and] that is required to file an income tax return in the State. 16

[(8)] (7) “Qualified seller” means a cybersecurity business that: 17

(i) has its headquarters and base of operations in the State; 18

(ii) 1. has less than [$5,000,000] $10,000,000 in annual 19
revenue; 20

2. IS OWNED BY AN INDIVIDU AL OR GROUP OF 21
INDIVIDUALS WHO BELONG TO A GROUP THAT H ISTORICALLY HAS BEEN DEPRIVED 22
OF ACCESS TO NORMAL ECONOMIC OR FINANCIAL RESOURCES; 23

3. is a [minority–owned, woman–owned,] veteran–owned[,] 24
or service–disabled–veteran–owned business; or 25

[3.] 4. is located in a historically underutilized business 26
zone designated by the United States Small Business Administration; 27

(iii) 1. owns or has properly licensed any proprietary 28
cybersecurity technology; or 29

2. provides a cybersecurity service; 30

(iv) is in good standing; 31

HOUSE BILL 290 3

(v) is current in the payment of all tax obligations to the State or any 1
unit or subdivision of the State; and 2

(vi) is not in default under the terms of any contract with, 3
indebtedness to, or grant from the State or any unit or subdivision of the State. 4

(b) (1) THERE IS A BUY MARYLAND CYBERSECURITY TAX CREDIT 5
ALLOWED UNDER THIS SECTION. 6

(2) THE BUY MARYLAND CYBERSECURITY TAX CREDIT IS INTENDED 7
TO PROMOTE THE CYBER SECURITY INDUSTRY IN THE STATE BY HELPING 8
MARYLAND BUSINESSES A ND NONPROFITS PURCHA SE CYBERSECURITY 9
TECHNOLOGIES AND SERVICES FROM MARYLAND CYBERSECURITY COMPANIES TO 10
PROTECT BUSINESS AND CUSTOMER INFORMATION. 11

[(1)] (3) Subject to paragraphs [(2) and (3)] (4) THROUGH (6) of this 12
subsection, a qualified buyer may claim a credit against the State income tax in an amount 13
equal to 50% of the cost incurred during the taxable year to purchase cybersecurity 14
technology or a cybersecurity service from one or more qualified sellers. 15

[(2)] (4) For any taxable year, the credit allowed under this section may 16
not exceed $50,000 for each qualified buyer. 17

(5) IF THE CREDIT ALLOWED UNDER THIS SECTION IN ANY TAXABLE 18
YEAR EXCEEDS THE STATE INCOME TAX FOR THAT TAXABLE YEAR , A QUALIFIED 19
BUYER MAY CLAIM A REFUND IN THE AMOUNT OF THE EXCESS. 20

[(3)] (6) For any taxable year, the aggregate credits claimed for 21
cybersecurity technology or cybersecurity service purchased from a single qualified seller 22
may not exceed [$200,000] $1,000,000. 23

(c) [(1) The Department, in consultation with the Maryland Technology 24
Development Corporation, may establish a panel composed of experts in the areas of 25
cybersecurity technology and cybersecurity service. 26

(2) The Department may establish the panel under service contracts with 27
independent reviewers. 28

(3) The panel shall assist the Department in its determination as to 29
whether a company is a qualified seller. 30

(4) A member of the panel is not eligible to receive any benefit, direct or 31
indirect, from the tax credit under this section. 32

4 HOUSE BILL 290

(5) (i) Except as provided in subparagraph (ii) of this paragraph, 1
Division II of the State Finance and Procurement Article does not apply to a service that 2
the Department obtains under this section. 3

(ii) The Department is subject to Title 12, Subtitle 4 of the State 4
Finance and Procurement Article for services the Department obtains under this section. 5

(d)] (1) (i) A qualified buyer eligible for the credit under this section may 6
apply to the Department for a credit certificate that states the amount of the credit the 7
qualified buyer may claim under subsection (b) of this section. 8

(ii) A qualified buyer shall attach the credit certificate to the income 9
tax return on which the qualified buyer claims the credit under subsection (b) of this 10
section. 11

(2) Subject to paragraph (3) of this subsection, the Secretary of Commerce 12
shall approve each application under paragraph (1) of this subsection that qualifies for a 13
credit certificate. 14

(3) [(i)] The total amount of the credit certificates approved by the 15
Secretary of Commerce under this subsection may not exceed: 16

[1.] (I) for taxable year 2018, $2,000,000; and 17

[2.] (II) for taxable year 2019 and each taxable year 18
thereafter, $4,000,000. 19

[(ii) For each taxable year, the Secretary of Commerce shall award 20
25% of the amount of tax credits authorized under subparagraph (i) of this paragraph to 21
qualified buyers that purchase cybersecurity services.] 22

[(e)] (D) (1) The Department may revoke its certification of a credit under 23
this section if any representation made in connection with the application for the 24
certification is determined by the Department to have been false. 25

(2) The revocation may be in full or in part as the Department may 26
determine and, subject to paragraph (3) of this subsection, shall be communicated to the 27
qualified buyer and the Comptroller. 28

(3) The qualified buyer shall have an opportunity to appeal any revocation 29
to the Department before notification of the Comptroller. 30

(4) The Comptroller may make an assessment against the qualified buyer 31
to recapture any amount of tax credit that the qualified buyer has already claimed. 32

HOUSE BILL 290 5

[(f)] (E) In accordance with § 2.5–109 of the Economic Development Article, the 1
Department shall submit a report on the credit certificates awarded under this section for 2
the calendar year. 3

[(g)] (F) The Department and the Comptroller jointly shall adopt regulations to 4
carry out this section and to specify criteria and procedures for application for, approval of, 5
and monitoring continuing eligibility for the tax credit under this section. 6

(G) THE DEPARTMENT MAY NOT APPROVE A CREDIT UNDER THIS SECTION 7
FOR A TAXABLE YEAR BEGINNING AFTER DECEMBER 31, 2030. 8

SECTION 2. AND BE IT FURTHER ENACTED, That this Act shall take effect July 9
1, 2026, and shall be applicable to all taxable years beginning after December 31, 2025. 10