Cybersecurity and privacy compliance for government agencies.
Counties, cities and townships hold sensitive resident data on tight budgets and small IT teams, and Ohio’s HB 96 now requires a formal cybersecurity program. Eagle gives you experienced security and privacy leadership, sized to the public sector.
Ohio HB 96 makes a cybersecurity program mandatory.
Since September 30, 2025, Ohio House Bill 96 has required every Ohio county, township, municipal corporation and other political subdivision to adopt a cybersecurity program consistent with best practices such as the NIST Cybersecurity Framework or CIS, including training scaled to each employee’s duties. Incidents must be reported to Ohio Homeland Security within 7 days and to the Auditor of State within 30 days, and a ransom may be paid only if the legislative authority approves it by resolution or ordinance.
The Auditor of State set adoption deadlines of January 1, 2026 for counties and cities and July 1, 2026 for all other political subdivisions, and plans to add compliance testing to its audits. If your program isn’t adopted and documented yet, you’re past the deadline.
Government agencies are frequent ransomware targets, and a single incident can shut down services residents depend on. Eagle assesses risk, writes policies staff can follow, trains employees, and helps you plan for incidents before they happen. For agencies without a full-time security officer, our Compliance as a Service program provides ongoing leadership at a predictable cost.
What a public sector program needs.
HB 96 cybersecurity program
A NIST- or CIS-aligned program, incident reporting procedures for the 7-day and 30-day deadlines, and role-based training, documented the way your auditor will expect.
Risk assessments
Identify where resident data lives and how well it’s protected.
Policies and procedures
Security and privacy policies sized to your agency, including vendor risk management.
Security awareness training
Phishing simulations and training for all staff, scaled to each role.
Incident response and tabletop exercises
A tested plan before ransomware strikes.
Compliance as a Service
An ongoing privacy and security officer function on a predictable budget.
How we work with agencies.
Assess
Review your systems, data and current controls against HB 96 and best practices.
Adopt
Document a cybersecurity program ready for your legislative authority to adopt.
Train
Deliver role-based training and incident reporting procedures.
Maintain
Keep the program current and audit-ready year over year.
For health and DD agencies
Talk with a public sector consultant.
Tell us where your HB 96 program stands. We will follow up to talk through what to tackle first.
Schedule a consultation