What a Maine business has to have in writing

Investigate promptly after learning of a possible breach, then send written notice to each affected Maine resident as quickly as possible and no later than 30 days after discovery, and send the same notice to the Attorney General or, for a regulated firm, to the Bureau of its regulator. If more than 1,000 people are affected, also notify the national consumer reporting agencies of the timing and scope.

Post the state sexual harassment poster where employees can see it and give every employee an individual written notice each year covering what harassment is, the internal complaint route, how to file with the Maine Human Rights Commission and the ban on retaliation. Employers with 15 or more employees must also train every new hire within a year, run extra supervisor training, build the program off the Department of Labor compliance checklist and keep training records for at least three years.

Public employers follow the standards the Maine Department of Labor adopts, post the state job safety and health poster, keep injury and illness records and report fatalities and hospitalizations. Private employers in Maine post the federal OSHA poster and follow federal recordkeeping instead; Maine's Bureau of Labor Standards offers free consultation to both.

A procurement condition set by the state Chief Information Officer, not a statute and not a certification scheme. A cloud provider under contract must file a defined package of reports with the agency contract administrator at contract inception and every year after: physical access controls, its security awareness training curriculum, a twice-yearly self-audit of software and hardware changes, backup and disaster recovery procedures with test results, incident response, change management and event logging procedures, and any third-party risk, audit or vulnerability assessment report it holds. Where a provider cannot meet the annual assurance requirements it must supply a current compliance report instead; the Chief Information Security Officer may ease reporting or grant an interim authority to operate, but a third-party audit report on its own buys no blanket exemption. State data must stay in the continental United States and off shared multi-tenant infrastructure for non-public data, and the provider carries remediation costs for breaches traced to its own negligence. MaineIT separately runs a Vendor Technology Oversight review of vendor technology during procurement, and GovRAMP lists the State of Maine as a participating government organization, which is voluntary participation rather than a supplier mandate.

Let employees accrue one hour of paid leave for every 40 hours worked, usable for any reason, up to 40 hours a year, and carry the balance over. Publish the accrual, notice and carryover terms in a written paid leave policy, post the Department of Labor earned paid leave notice and apply any waiting period consistently.

Post the state PFML workplace notice and give each employee written notice of the program, contribution rates, benefit amounts, job protection and the anti-retaliation rule at hire and when terms change. Employers remit quarterly premiums or run an approved private plan, and must document how leave requests are handled and how workers return to their role.

Display the Department of Labor's current poster set where employees gather: minimum wage, regulation of employment, video display terminal notice, whistleblower protection, sexual harassment, earned paid leave, paid family and medical leave, child labor, workers' compensation and unemployment. The department supplies the posters free.

Handbooks, offer letters and confidentiality rules must not bar an employee from disclosing their own pay or asking about a colleague's pay where the purpose is to enforce equal pay rights. Application forms, screening questions and interview scripts must not seek an applicant's compensation history, from the applicant or from a current or former employer, until an offer stating all terms of compensation has been made.

In every job posting, state the range of pay you will offer a successful applicant, including postings made through a third party; a commission-only job says instead that the pay is based solely on commission. When an employee asks, tell them the pay range for the position they hold, and keep a record of each position an employee holds and the pay history in each for the length of employment plus three years.

File formation or foreign-qualification documents with the Secretary of State, keep a registered agent on record and file the annual report by June 1 each year to stay in good standing.

Write a substance use testing policy and submit it to the Maine Department of Labor for approval before any testing; employers with a collective bargaining unit must negotiate the policy. The policy has to set out who may be tested and on what grounds, the collection and confirmation procedure, confidentiality, consequences and rehabilitation. Employers with 20 or more employees must also run a substance use education program, and every employee gets a written copy of the approved policy.

Tell applicants in the job posting or before an offer that a noncompete will be required, then deliver the actual agreement at least three business days before it must be signed. A noncompete cannot take effect until the employee has worked a year or been employed six months, whichever is later.

Use a written, signed contract that names the parties, describes the work and materials, sets the price and payment schedule, gives start and completion dates, states warranty terms, explains how change orders are handled and tells the homeowner about the dispute resolution option. Maine does not license general contractors, so the written contract is the compliance artifact.

Apply to the Health Inspection Program for an eating establishment license before opening, renew it annually, pass inspections and keep a person in charge on site who can demonstrate the food safety knowledge the Maine Food Code expects.

Build a written information security program sized to the business and grounded in a risk assessment, with third-party service provider oversight, a written incident response plan and at least annual reporting to the board. Domestic insurance carriers file a written certification of compliance with the Superintendent by April 15 each year and keep the supporting records for five years; cybersecurity events get reported to the Superintendent.