Cyberattacks against public organizations are becoming more frequent, and local governments and school districts are increasingly targeted. To address these risks, Ohio recently passed House Bill 96 (HB 96), which introduces new cybersecurity requirements for public entities across the state.
Signed into law on June 30, 2025, HB 96 establishes a statewide framework to help local governments strengthen their cybersecurity practices and respond more effectively to cyber incidents.
For many organizations, this law represents a shift in how cybersecurity is managed. Instead of being treated as a technical issue handled solely by IT teams, cybersecurity is now considered a critical responsibility that requires formal policies, training, and reporting procedures.
Who Must Comply?
The new requirements apply to Ohio political subdivisions, which include:
- Counties
- Cities and municipalities
- Townships
- School districts
- Other local public entities
Each of these organizations must implement cybersecurity safeguards designed to protect their systems, data, and digital services.
Key Requirements Under HB 96
HB 96 outlines several steps organizations must take to improve cybersecurity preparedness.
1. Adopt a Cybersecurity Program
Local governments and school districts must develop and formally adopt a cybersecurity program that protects the availability, confidentiality, and integrity of their data and IT systems.
These programs should align with widely accepted frameworks such as the NIST Cybersecurity Framework or the CIS Critical Security Controls, which provide guidance for identifying risks, detecting threats, and responding to incidents.
A comprehensive cybersecurity program typically includes:
- Risk identification and vulnerability assessments
- Threat detection and monitoring procedures
- Incident response planning
- Recovery and system restoration processes
- Cybersecurity awareness training for employees
2. Report Cybersecurity Incidents
HB 96 also introduces strict reporting requirements when a cybersecurity event occurs.
If a local government experiences a cyber incident or ransomware attack, it must notify:
- The Ohio Department of Public Safety (Division of Homeland Security) within 7 days of discovering the incident
- The Ohio Auditor of State within 30 days of discovery
These reporting timelines help state agencies track cyber threats and coordinate support when incidents occur.
3. Restrictions on Ransomware Payments
The law also addresses ransomware attacks directly. If a public entity is targeted, it cannot pay a ransom unless its governing body formally approves the payment through a resolution or ordinance.
This requirement adds transparency and oversight when public funds could potentially be used to respond to a cyberattack.
When Do the Requirements Take Effect?
HB 96 took effect on September 30, 2025, meaning public entities should already be reviewing their cybersecurity practices and aligning them with the law’s requirements.
The legislation also establishes phased deadlines for implementing formal cybersecurity programs:
- January 1, 2026 for counties and municipalities
- July 1, 2026 for other political subdivisions
Organizations that have not yet implemented a cybersecurity framework should begin evaluating their current systems, policies, and incident response procedures to ensure they are prepared.
Next Steps for Meeting HB 96 Requirements
For many local governments and school districts, meeting these requirements starts with understanding their current cybersecurity posture. Conducting a cybersecurity assessment, documenting policies, and aligning security practices with recognized frameworks such as NIST or CIS can help organizations move toward compliance.
Working with experienced cybersecurity professionals can also help public organizations identify gaps, implement safeguards, and build a cybersecurity program that meets the expectations of HB 96.
Not sure where your organization stands? Obviam can help assess your current cybersecurity posture and guide you through the steps needed to meet HB 96 requirements. Contact our team to get started.
