Ohio’s operating budget, House Bill 96, was signed on June 30, 2025, and included a significant cybersecurity provision for local government. The new Ohio Revised Code section 9.64 took effect on September 30, 2025. It requires every Ohio political subdivision to adopt a formal cybersecurity program, report cyber incidents to the state, and follow a public approval process before paying any ransom.
Who is covered
The law applies to political subdivisions, defined broadly as counties, townships, municipal corporations, and other bodies corporate and politic responsible for governmental activities in an area smaller than the state. Legal commentators have noted that this includes school districts and other local governing bodies. County boards of developmental disabilities, library boards, and similar entities should confirm their status with legal counsel, but most should plan as if the law applies to them.
Deadlines to adopt a program
- Counties and cities: January 1, 2026
- All other political subdivisions: July 1, 2026
The program must be formally adopted by the entity’s legislative authority, such as the board of commissioners, city council, or board of education.
What the cybersecurity program must include
The program must safeguard the entity’s data and IT resources and be consistent with generally accepted best practices such as the NIST Cybersecurity Framework or the CIS Controls. At a minimum it must address:
- Identifying critical functions and cybersecurity risks
- Identifying the potential impact of a breach
- Mechanisms to detect threats and incidents
- Procedures to respond to and contain an incident
- Procedures to repair infrastructure and restore operations afterward
- Annual cybersecurity training for all employees, scaled to their job duties
Incident reporting
If a cybersecurity or ransomware incident occurs, the entity must report it:
- To the Ohio Department of Public Safety, Division of Homeland Security (Ohio Cyber Integration Center), as soon as possible and no later than 7 days after discovery
- To the Auditor of State as soon as possible and no later than 30 days after discovery
Ransom payments require public approval
A political subdivision may not pay a ransom unless its legislative authority formally approves the payment by resolution or ordinance that explains why paying is in the entity’s best interest. In practice, this means ransomware response plans need to account for a public vote before any payment decision.
Confidentiality
Cybersecurity program records and incident reports are not public records under Ohio law, and procurement records that identify cybersecurity products or vendors are treated as security records. This lets entities document their program in detail without publishing a roadmap for attackers.
Where to start
- Confirm which deadline applies to your organization.
- Complete a risk assessment against the NIST CSF or CIS Controls to identify gaps.
- Write or update your cybersecurity program, incident response plan, and ransomware procedures to include the new reporting and approval steps.
- Schedule annual role-based training for all staff.
- Present the program to your board or council for formal adoption before the deadline.
How Eagle can help
Eagle Consulting Partners has supported Ohio county boards of developmental disabilities and other public agencies for years. We can assess your current program against ORC 9.64, write the policies and procedures your board will adopt, provide security awareness training, and help you prepare for incident reporting. Contact us to talk about your timeline.
Sources: Ohio Revised Code 9.64; Bricker Graydon; Dinsmore & Shohl. This article is general information, not legal advice.
