Ohio Local Government Cybersecurity Law: What ORC 9.64 Requires and the 7-Day Report

This article was written with the help of AI. We used an AI assistant to draft it, then checked every requirement against the statute and state guidance. It is not legal advice. Sources are linked throughout.

Ohio's local government cybersecurity law is Ohio Revised Code section 9.64, enacted by House Bill 96 of the 136th General Assembly and in effect since September 30, 2025. It requires every political subdivision to adopt a cybersecurity program, train its employees, get formal council or board approval before paying a ransom, and report incidents to the state within 7 days and to the Auditor of State within 30.

The law covers counties, townships, municipal corporations and any "other body corporate and politic" governing an area smaller than the state. School districts are not named, but boards of education are bodies politic and corporate under R.C. 3313.17, so districts should assume it applies and confirm with counsel.

The Four Requirements

1. A cybersecurity program

The legislative authority must adopt a program that safeguards its data and IT systems and is consistent with generally accepted best practices. The statute names the NIST Cybersecurity Framework and the Center for Internet Security's best practices as examples. No certification is required. The statute lists what a program may include:

• Identifying critical functions and cybersecurity risks
• Assessing the potential impact of a breach
• Ways to detect threats and cybersecurity events
• Procedures for communication, incident analysis and containment
• Procedures for repairing affected systems and maintaining security afterward
• Employee training

The statute does not set an adoption deadline. The state's presentation on the new law says the Auditor of State expected counties and cities to have a program by January 1, 2026 and all other entities by July 1, 2026. Both dates have passed.

2. Training for every employee

Training must match each employee's duties. The statute says annual state-provided training, or training from the Ohio Persistent Cyber Initiative program of the Ohio Cyber Range Institute, satisfies the requirement. That training is a baseline. It does not write your program, map your systems or name your incident lead. Keep a roster with completion dates.

3. No ransom payment without a resolution

A political subdivision may not pay or comply with a ransom demand unless its legislative authority approves it by resolution or ordinance that specifically states why paying is in the subdivision's best interest. That decision cannot sit with IT staff or an outside provider. Work out with counsel now how the council or board would act quickly in an emergency, before you need it.

4. Incident reports within 7 and 30 days

After a cybersecurity or ransomware incident, the legislative authority must notify:

• The executive director of the Division of Homeland Security in the Ohio Department of Public Safety, as soon as possible and no later than 7 days after discovery. Ohio Homeland Security's reporting guidance names the Ohio Cyber Integration Center as the contact (OCIC@dps.ohio.gov, 614-387-1089).
• The Auditor of State, as soon as possible and no later than 30 days after discovery, in the manner the Auditor prescribes.

The definition of a cybersecurity incident includes unauthorized access caused by a compromise of a cloud provider, managed service provider or other third-party host. If your vendor is breached and your data is involved, the reporting duty is still yours.

The statute also says the program records and the incident reports are not public records.

Making the 7-Day Clock Workable

Seven days goes fast when facts are incomplete and several people are trying to help. These are internal targets we suggest, not deadlines in the law:

• Day 0: record when the incident was discovered, name an incident lead, preserve logs and evidence, and call counsel and your insurer as your policy requires.
• Day 1: get written facts from your IT provider and any cloud vendor involved, and decide with counsel whether the event is reportable.
• Days 2 to 4: build one factual timeline, mark unknowns as unknown, and submit the state report. Aiming for day 4 leaves room for problems.
• By day 30: file with the Auditor of State.

You do not need a finished root-cause analysis to file. You do need backup contacts for nights, weekends and holidays, because the clock does not stop for them.

Your IT Contract Has to Fit the Clock

A provider who promises to tell you about a breach "in a commercially reasonable time" can use up most of your seven days. Put these in writing:

• Notice of a suspected incident within a set number of hours
• Named primary and backup contacts, including after hours
• Preservation of logs, email and tickets
• Regular status updates while the scope is unclear
• Help preparing the state and Auditor reports
• Who pays for forensics, legal work and recovery

Ask any provider, including us, to answer those in writing.

What a Finished Program Looks Like

• An adopted written program mapped to NIST CSF or CIS
• A list of critical systems and data with an owner for each
• A training roster with dates
• An incident runbook with internal deadlines and a current contact sheet
• Vendor contracts with notification and evidence terms
• A ransom decision process that runs through the governing body
• Recent backup restore test results for critical systems

Our incident response playbook is a useful starting point for the runbook. Your legal counsel should review how the program fits your public-records and open-meetings obligations.

Sources

• Ohio Revised Code 9.64: Political subdivision cybersecurity program
• Ohio Revised Code 3313.17: Board of education as body politic and corporate
• CyberOhio: New Cybersecurity Requirements for Ohio Local Governments (HB 96 overview)
• Ohio Homeland Security: Ohio Cyber Incident Reporting Guidance
• NIST Cybersecurity Framework

Common questions