One year ago today, on September 30, 2025, Ohio’s new cybersecurity requirements for local governments took effect. Every county, city, township and other political subdivision is now required to have a formal cybersecurity program, and the deadlines to adopt one have passed.
The requirement came from House Bill 96, Ohio’s state operating budget, which Governor DeWine signed on June 30, 2025. It added a new section to the Ohio Revised Code, §9.64, requiring local governments to adopt a cybersecurity program built on recognized best practices, train employees, report cyber incidents to the state, and get formal approval before paying any ransom.
Here’s where things stand a year in, what the law requires, and how to catch up if your program isn’t finished.
One year in: the deadlines have passed
The Auditor of State set two adoption deadlines in its guidance on §9.64:
| Entity type | Program adoption deadline |
|---|---|
| Counties and cities | January 1, 2026 |
| All other political subdivisions | July 1, 2026 |
Both dates are now behind us. If your legislative authority hasn’t formally adopted a cybersecurity program, you’re out of compliance today.
Two more developments matter for the year ahead:
- Audits are coming. The Auditor has said compliance procedures for §9.64 will be built into the Ohio Compliance Supplement, the guide auditors use when they examine local governments. Expect auditors to ask for your adopted program and evidence that you follow it.
- Multi-factor authentication is expected. In July 2026, the Auditor recommended multi-factor authentication on every system, including email, cloud apps, payroll and vendor portals, with no exceptions for executives, administrators or vendors. It also recommended independent verification before changing vendor banking or payroll direct deposit details.
Who it applies to
The law applies to “political subdivisions,” defined in §9.64 as a county, township, municipal corporation, or “other body corporate and politic responsible for governmental activities in a geographic area smaller than that of the state.”
Counties, cities, villages and townships are clearly covered. For other public bodies, such as county boards of developmental disabilities, health districts and special districts, the law doesn’t name them specifically. If you lead one of these organizations, ask your legal counsel whether §9.64 applies to you. Either way, its requirements are a sensible baseline for any public entity that holds sensitive data.
What the cybersecurity program must include
Under §9.64(C), the legislative authority (your board of commissioners, council or trustees) must adopt a cybersecurity program that safeguards the political subdivision’s data, information technology and IT resources to ensure their availability, confidentiality and integrity. The program must be consistent with generally accepted best practices, such as the NIST Cybersecurity Framework and the Center for Internet Security (CIS) best practices.
The law lists six elements the program may include:
- Identify and address the critical functions and cybersecurity risks of the political subdivision.
- Identify the potential impacts of a cybersecurity breach.
- Specify mechanisms to detect potential threats and cybersecurity events.
- Specify procedures to establish communication channels, analyze incidents, and take actions to contain cybersecurity incidents.
- Establish procedures for repairing infrastructure impacted by a cybersecurity incident, and for maintaining security after the incident.
- Establish cybersecurity training requirements for all employees, with frequency, duration and detail matched to each employee’s duties.
The statute says “may include,” but in practice these six elements are what any credible program covers, and they line up closely with the NIST framework’s functions.
Incident reporting and ransomware
HB 96 also adds firm rules for when something goes wrong:
- Report to Ohio Homeland Security within 7 days. After discovering a cybersecurity or ransomware incident, notify the executive director of the Division of Homeland Security as soon as possible, and no later than seven days. The Auditor of State points agencies to the Ohio Cyber Integration Center (OCIC) for this report.
- Report to the Auditor of State within 30 days. The Auditor’s office has published a reporting form for this.
- No ransom without formal approval. A political subdivision may not pay or comply with a ransom demand unless its legislative authority approves the payment in a resolution or ordinance that states why paying is in the political subdivision’s best interest.
The law also keeps your cybersecurity program and incident reports out of public records requests, so documenting your program in detail doesn’t hand attackers a roadmap.
Seven days is not long. If your staff doesn’t know who to call and what to document, that clock can run out while you’re still trying to restore systems. That’s why incident response planning belongs in the program from day one.
NIST CSF or CIS Controls: which framework should you use?
The law names two frameworks as examples of generally accepted best practices. Either one gives you a defensible foundation.
NIST Cybersecurity Framework (CSF) 2.0. Updated in 2024, the CSF organizes cybersecurity into six functions: Govern, Identify, Protect, Detect, Respond and Recover. Under those sit 106 specific outcomes (subcategories). Rather than requiring all 106 on day one, the CSF lets you rate your current maturity for each outcome, set a target based on your risk assessment, and improve over time. That approach fits public budgets well.
CIS Critical Security Controls. The CIS Controls are a prioritized list of 18 safeguard areas, grouped into three Implementation Groups. Implementation Group 1 is a practical baseline for smaller organizations, and the higher groups add controls as your risk and resources grow.
Already doing HIPAA? County boards of DD, health departments and other agencies with health programs may already maintain a HIPAA security program. The good news is that HIPAA and NIST overlap heavily: risk assessment, policies, access control, training, incident response and disaster recovery. The difference is scope. HIPAA covers only electronic protected health information, while NIST covers all of your information and systems.
If you already have a HIPAA program, extending it to meet NIST and §9.64 is usually a matter of widening its scope, not starting over.
How to catch up
Here’s how each element of §9.64 translates into practical work:
| §9.64 requirement | What it looks like in practice |
|---|---|
| (C)(1) Identify critical functions and risks | A security risk assessment of your systems, data and vendors, plus written privacy and security standards |
| (C)(2) Identify the impact of a breach | Risk quantification: estimating what a breach or outage would cost in dollars and services, so you can budget appropriately |
| (C)(3) Detect threats | Endpoint and cloud monitoring (EDR/MDR) across PCs, servers, Microsoft 365 or Google, and key SaaS systems, ideally with a 24×7 security operations center |
| (C)(4) Communicate, analyze and contain incidents | An incident response plan that includes the 7-day and 30-day state reporting steps, tested with tabletop exercises |
| (C)(5) Repair and maintain security after an incident | A disaster recovery plan and tested backups, so you can restore services without paying a ransom |
| (C)(6) Role-based employee training | Security awareness training with simulated phishing, plus policy training for leadership, HR, finance and IT staff |
Two more best practices from the CIS Controls round out a strong program: continuous vulnerability management (CIS Control 7) and penetration testing (CIS Control 18). And given the Auditor’s July advisory, make multi-factor authentication everywhere a priority.
On training, the law notes that annual cybersecurity training provided by the state, or through the Ohio Persistent Cyber Initiative program of the Ohio Cyber Range Institute, satisfies the training requirement. Many agencies will want role-based training on top of that, so staff who handle sensitive data or systems get the detail their jobs need.
A practical sequence: start with a risk assessment, adopt policies and an incident response plan, put monitoring and training in place, then have your legislative authority formally adopt the program and review it each year.
How Eagle can help
Eagle Consulting Partners has helped Ohio public entities with privacy and security since 2002, including county boards of developmental disabilities, councils of governments and health departments. We can build your §9.64 program from the ground up, or extend your existing HIPAA program to cover it:
- Security risk assessments with risk quantification
- Cybersecurity policies and procedures aligned to NIST CSF and CIS
- Incident response and disaster recovery plans, with tabletop exercises
- Security awareness and role-based policy training
- Managed detection and response, vulnerability management and penetration testing
- Ongoing Privacy and Security Compliance as a Service
Behind on your program? Contact us or call (216) 503-0333 to talk through where your program stands. Learn more on our Government and Public Sector and Ohio County DD Boards pages.
