Ohio HB 96: what the cybersecurity law asks of cities, townships and schools.
Ohio's budget bill added a short section of law, Ohio Revised Code 9.64, that every county, township, city and school district now has to follow. What it requires, the reporting deadlines, and where your network and phone contracts fit in.
Rings Jonathan and the team 24x7.
Carriers and platforms we compare.
The short version
- HB 96 enacted Ohio Revised Code 9.64, effective September 30, 2025. It covers counties, townships, cities and other local governments, and Ohio school boards are following it too.
- Your council, trustees or board has to adopt a cybersecurity program that follows accepted best practices such as the NIST Cybersecurity Framework or CIS.
- Report a cybersecurity or ransomware incident to Ohio Homeland Security within 7 days and to the Auditor of State within 30 days.
- No ransom can be paid unless the legislative authority approves it in a resolution or ordinance saying why it is in the public body's best interest.
Who the law covers
ORC 9.64 applies to every "political subdivision," which the law defines as a county, township, municipal corporation, or other body corporate and politic responsible for governmental activities in an area smaller than the state.
That reaches past cities and townships. The Ohio School Boards Association tells school districts the requirements apply to them, with the board of education acting as the body that adopts the program and approves any ransom payment. Library boards, park districts and other local bodies should ask their counsel.
This post isn't legal advice. Your law director, solicitor or board counsel decides how the law applies to you.
What ORC 9.64 requires
The section is short. These are its working parts.
Adopt a cybersecurity program
The legislative authority adopts a program that protects the public body's data and IT and follows accepted best practices such as the NIST Cybersecurity Framework and CIS. The law lists what it may cover: critical functions and risks, impacts of a breach, threat detection, incident response, repair and recovery.
Train every employee
Training requirements for all employees, scaled to each person's duties. Annual training provided by the state, and the Ohio Persistent Cyber Initiative from the Ohio Cyber Range Institute, satisfy this part.
Report incidents on a deadline
After a cybersecurity or ransomware incident, notify the executive director of Ohio Homeland Security within 7 days of discovering it, and the Auditor of State within 30 days.
Vote before paying a ransom
No ransom payment unless council, trustees or the board approve it in a resolution or ordinance that says specifically why paying is in the public body's best interest.
Dates, audits and public records
- Effective date. ORC 9.64 took effect September 30, 2025. The incident reporting and ransom rules have applied since then.
- When the program is expected. The Auditor of State's Bulletin 2025-007 lists January 1, 2026 for counties and cities, and July 1, 2026 for all other entity types. For school districts, the Ohio School Boards Association reports that Auditor compliance checks begin July 1, 2026. Both dates have passed, so a public body without an adopted program is already behind.
- A policy alone may not be enough. The Ohio School Boards Association notes that the program requirements are not automatically met by adopting a policy. The program has to describe what you actually do.
- Records. Program documents and incident reports are not public records under the law. Records that identify the cybersecurity products, services and vendors you use or are considering are treated as security records. Keep that in mind when you write an RFP.
Where your network and phones fit in
The law's definition of an incident includes a substantial loss of availability of your network, and unauthorized access through a cloud service provider, managed service provider or supply chain. So the contracts behind your circuits and phone system belong in the program. A few practical questions:
- Do you have a current list of every circuit, phone line and contract for each building, with who holds the admin logins?
- If the main internet line at City Hall or a dispatch site fails, is there a second path on a separate route?
- Which vendor do you call first during an incident, and does that number work if your own phones are down?
- Do your managed service and cloud contracts say how fast the vendor must tell you about a breach on their side, so you can meet your own 7-day deadline?
How we help
We aren't a law firm or an auditor, and we don't write your cybersecurity program. What we do: list every circuit, line and contract across your buildings, get quotes for diverse paths and backup connections, and bring in managed security and security assessment partners if you want outside help with the program itself. We work inside your purchasing rules. See how we work with Ohio cities, townships and counties.
How we get paid: the carriers and partners pay us a monthly commission of 5% to 18% of what you spend with them, and your price is the same as going direct. We put that in writing before you sign.
Sources (checked November 2, 2026)
Questions we get on the first call
Does Ohio HB 96 apply to school districts?
Who do we report a cybersecurity incident to under ORC 9.64?
Can a city or township still pay a ransom?
Is adopting a cybersecurity policy enough?
Does Buckeye write our cybersecurity program?
Related
Related reading
Telecom for Ohio cities, townships and counties
How we help city buildings, inside your purchasing rules.
Read → SecuritySecurity assessment
An outside look at where you stand.
Read → ComplianceDoes 911 know which building you're in?
Kari's Law and dispatchable location, in plain English, for phone systems that span more than one site.
Read → CompensationHow we get paid
Carrier residual, disclosed. Same price as going direct.
Read →Send us your list of buildings. We'll map the network side.
Every circuit, line and contract on one page, with the backup paths you can get at each address.
Book a call