Ohio Mandates Local Governments to Implement Cybersecurity Programs

Key Takeaways

Ohio mandates local governments to create cybersecurity programs and report attacks to the state within seven days.
Authorities must obtain legislative approval before paying ransoms for cyberattacks.
The legislation, effective Sept. 30, lacks state funding for implementation but offers free training through CyberOhio.

Ohio Implements Cybersecurity Law

Ohio has enacted a new law requiring local governments, school districts, and water authorities to develop comprehensive cybersecurity programs aimed at preventing, detecting, and responding to cyberattacks. Each locality is now obligated to report any cyber incident to the state’s Department of Public Safety within seven days of the breach.

Additionally, the legislation restricts local governments from paying ransoms in the event of cyberattacks unless they receive prior approval from their legislative authority. They must also publicly justify why compliance with the ransom demands is in the best interest of the government. The law will take effect on September 30, but it does not come with any state funding to support local implementation of these measures.

The need for increased cybersecurity measures has been highlighted by alarming statistics from the Federal Bureau of Investigation, which reported over 859,000 complaints of suspected cyber crimes in the U.S. last year. Although this figure represents a slight decrease of 2.4% from the previous year, the financial losses from these crimes soared to $16 billion, marking a 33% increase year-on-year.

Cyberattacks are becoming increasingly sophisticated, especially with the rise of generative AI technology, making local governments more attractive targets—often with limited resources and outdated systems. Phillip Harmon, a cybersecurity expert, noted scenarios ranging from minor email hacks to severe ransomware assaults that can disrupt operations, sometimes affecting essential services such as 911 dispatch.

Last year, a ransomware attack in Columbus, Ohio, compromised the personal data of approximately 500,000 residents. In another incident, a cyberattack on a health system in Ohio resulted in a total tech failure. In response to rising security threats, Columbus has committed $23 million towards improving its IT infrastructure for cyber defenses.

While local governments nationwide are striving to strengthen their cybersecurity frameworks, many face significant budget limitations. An executive order issued by the Trump administration earlier emphasized that state and local authorities should bear greater responsibility for combating cyber threats.

Despite the lack of supplementary state funding for cybersecurity programs, Ohio is providing free annual training through the CyberOhio initiative. The agency emphasizes this training as a critical element in reducing cyber risks for local governments.

The content above is a summary. For more details, see the source article.