Both Ohio House Bill 96 cybersecurity deadlines are now behind us. Counties and cities had to adopt a formal cybersecurity program by January 1, 2026. School districts, townships, villages, libraries and every other political subdivision had until July 1, 2026.

If your board or council has already adopted a program, congratulations. The harder part starts now: keeping that program alive, documented and audit-ready through 2027. If you have not adopted one yet, you are out of compliance today, and the Auditor of State is already checking during regular audits.

This guide from Modern Office Methods, OptimizedIT and Obviam covers what the law requires, what you should already have done, how to catch up quickly, and how to fund it when no one set aside a budget line for cybersecurity.

What Ohio House Bill 96 requires

HB 96, Ohio’s FY 2026–2027 operating budget, created Ohio Revised Code 9.64. It applies to every political subdivision in the state, including counties, cities, villages, townships, school districts and other local government entities. It took effect September 30, 2025, and puts three obligations on every one of them.

  1. Adopt a formal cybersecurity program. Your legislative authority (the board of education, council, trustees or commissioners) must adopt a program that protects the availability, confidentiality and integrity of your data and IT resources. It must align with generally accepted best practices such as the NIST Cybersecurity Framework or the CIS Critical Security Controls. The law says the program may address:
  • Identifying critical functions and cybersecurity risks
  • Identifying the potential impact of a breach
  • Mechanisms to detect threats and cybersecurity events
  • Procedures for communication, incident analysis and containment
  • Procedures to repair infrastructure and maintain security after an incident
  • Cybersecurity training for all employees, matched in frequency, length and detail to each person’s duties
  1. Report incidents on a deadline. After discovering a cybersecurity or ransomware incident, you must notify the Ohio Cyber Integration Center (OCIC) at Ohio Homeland Security within 7 days and the Auditor of State within 30 days. The Auditor’s guidance says this includes payment or payroll redirect fraud, spear phishing and other social engineering. When in doubt, report.
  2. Get approval before paying a ransom. You cannot pay a ransom unless your legislative authority passes a resolution or ordinance stating why the payment is in the entity’s best interest. The Auditor treats a payment made without that resolution as an illegal expenditure.

A helpful protection: your cybersecurity program and incident reports are not public records under ORC 149.43. Records naming your security vendors, products and projects are treated as security records under ORC 149.433. You can document your program in detail without publishing a roadmap for attackers.

For school districts only: HB 96 also created ORC 3301.24, which required districts, community schools and STEM schools to adopt an artificial intelligence use policy by July 1, 2026. Many districts are reviewing it alongside their cybersecurity program, since the two overlap on data privacy and acceptable use.

Key HB 96 dates

Every HB 96 cybersecurity deadline has now passed, so compliance is checked during your regular audit.

Date What happened Who it applies to
Ongoing (2026 and 2027 audits) Auditor of State checks compliance during regular audits, against the program your entity adopted All political subdivisions
July 1, 2026 Cybersecurity program adoption deadline School districts, townships, villages, libraries and all other political subdivisions
January 1, 2026 Cybersecurity program adoption deadline Counties and cities
September 30, 2025 Law takes effect: 7-day and 30-day incident reporting and ransom approval rules begin All political subdivisions
June 30, 2025 Governor DeWine signs HB 96 All political subdivisions

What should already be in place

By now, every Ohio school district and local government should be able to hand an auditor this checklist with evidence behind each item.

  • ☐ A board-adopted program. A written cybersecurity program approved by resolution or ordinance, with the meeting minutes to prove it.
  • ☐ A named framework. The program states which framework it follows (NIST CSF 2.0 or CIS Controls) and is sized to your entity. The Auditor audits against the program you chose, so promise only what you will actually do.
  • ☐ Assigned ownership. A named person or role responsible for the program, plus your IT provider’s responsibilities spelled out.
  • ☐ A risk and asset inventory. Your critical functions, systems, data and connected devices, including multifunction printers, copiers and scanners that store and transmit documents.
  • ☐ An incident response plan. Who declares an incident, who calls OCIC within 7 days, who notifies the Auditor within 30 days, and who talks to the public.
  • ☐ A ransom decision process. A drafted resolution template and emergency-meeting procedure so your board can act fast if it ever has to.
  • ☐ Employee training underway. Every employee enrolled in role-based training, with completion records. State-provided annual training and the Ohio Persistent Cyber Improvement (O-PCI) program both satisfy the law.
  • ☐ Recovery procedures. Tested backups and steps to restore systems and keep them secure after an incident.
  • ☐ Incident log. A record of any incident reported since September 30, 2025, with dates and confirmations.

Haven’t adopted a program yet? A 30-day catch-up plan

If your entity missed its deadline, adopt a right-sized program at your next board or council meeting, then build it out. Missing the deadline can become a formal audit finding, and an incident without a plan creates far bigger exposure.

  1. Week 1: Assign an owner and pick a framework. Name a program lead and choose NIST CSF 2.0 or the CIS Controls. Smaller entities often start with CIS Implementation Group 1, the basic safeguards every organization should have.
  2. Week 1: Set up incident reporting now. This duty has applied since September 30, 2025, program or not. Put the OCIC and Auditor of State contacts in writing and tell staff who to call.
  3. Week 2: Run a quick assessment. Inventory systems, data, user accounts and devices, including the print fleet. Note gaps in multi-factor authentication, patching, backups and endpoint protection.
  4. Week 3: Draft the program. Start from a template rather than a blank page. The Ohio Cyber Reserve offers a ready-made security program, and your IT partner can tailor it to what you actually run.
  5. Week 3: Enroll staff in training. Register for O-PCI or state-provided training so every employee has a completion record.
  6. Week 4: Adopt it. Bring the program to your board or council for a vote. Some entities have used emergency legislation to move quickly. Keep the minutes.
  7. After adoption: Close the gaps on a timeline. Prioritize multi-factor authentication, tested offline backups and endpoint protection first. Document each fix so your next audit shows progress.

How to maintain compliance into 2027

Adopting a program was the one-time step; staying compliant means running it on a calendar and keeping the evidence. Auditors will look for proof that you are doing what your program says, so build these habits now.

How often What to do Evidence to keep
Continuously Monitor for threats, patch systems, enforce multi-factor authentication Monitoring alerts, patch reports, MFA enrollment
Monthly Review user accounts and remove access for departed staff Access review log
Quarterly Test backup restores, run phishing simulations, review vendor access Restore test results, simulation reports
Twice a year Update the asset inventory, including printers, copiers and new devices Dated inventory
Annually Complete role-based employee training Training completion records
Annually Run a tabletop exercise on a ransomware or payroll-fraud scenario Exercise notes and after-action items
Annually Reassess risk against your framework and have the board review the program Assessment report, board minutes
After any incident Report to OCIC (7 days) and the Auditor (30 days), then update the plan Report confirmations, lessons learned

A few habits make the 2027 audit easier:

  • Time the annual review before budget season. A spring review gives your board the gaps and costs before the FY 2028 budget is set.
  • Keep one compliance folder. Store minutes, policies, training records and test results in one place, since these records are exempt from public records requests.
  • Watch for updates. The Auditor of State’s 2026 Ohio Compliance Supplement (pages 78–81) describes what auditors look for in cybersecurity programs. Check each year’s edition for changes.
  • Remember that compliance is not security. The law sets a floor. Threats change faster than statutes, so review the program whenever your systems or risks change.

No dedicated funding? How to pay for HB 96 compliance

HB 96 did not include any state funding for local cybersecurity programs, so most entities are paying for compliance out of existing budgets. The good news is that a compliant program does not have to start with a large purchase. Start with what is free, then spend where the risk is highest.

Use the free state resources first

  • Ohio Persistent Cyber Improvement (O-PCI). Delivered at no cost by the Ohio Cyber Range Institute at the University of Cincinnati. It includes staff training, NIST-based assessments, tabletop exercises and ongoing mentorship, and its training satisfies the HB 96 requirement.
  • Ohio Cyber Reserve. Offers a ready-made security program to start from, plus rapid response and technical help after an incident.
  • CyberOhio’s HB 96 resource hub. Webinars, guidance and an Aggregate Purchasing Resource Guide for buying security tools at group pricing.
  • Free frameworks. NIST CSF 2.0 and the CIS Controls are free to download and scale to small entities.

Watch for grant rounds

The CyberOhio Local Government Grant Program, funded by the federal State and Local Cybersecurity Grant Program, has offered Cybersecurity Software and Services grants (up to $20,000 per entity in an earlier round, with a 20% local match) and .gov domain migration grants. Rounds open and close, so check cyber.ohio.gov regularly and have your assessment ready to support an application.

Stretch the budget you already have

  • Turn on what you already own. Many Microsoft 365 and Google Workspace plans include multi-factor authentication, email filtering and logging that are switched off.
  • Phase the work. Adopt the program now and schedule improvements over two or three budget cycles. A documented roadmap shows auditors good-faith progress.
  • Fold security into existing contracts. A copier or print fleet refresh can bring secure devices, encrypted drives and user authentication without a separate line item. Managed IT agreements can include monitoring, patching and backups for a predictable monthly cost.
  • Buy cooperatively. Use state term schedules, cooperative purchasing contracts or your regional ITC or ESC to reach pricing and shared services that a single district or township could not get alone.
  • Use cyber insurance as leverage. Insurers increasingly require MFA, backups and endpoint protection. Meeting those requirements can protect coverage and premiums, which helps justify the spend.
  • Consolidate tools. Overlapping point solutions cost more than one managed platform. Cutting duplicates often frees money for gaps.

How Modern Office Methods, OptimizedIT and Obviam help

We help Ohio schools and local governments turn HB 96 from a binder on a shelf into a program that runs, all from one local partner.

  • HB 96 readiness assessment. We map your environment to NIST CSF or the CIS Controls, identify gaps and give you a prioritized, budget-aware roadmap your board can adopt.
  • Program documentation. We help draft or refresh your cybersecurity program, incident response plan and ransom decision process, written to match what you actually run so it holds up in an audit.
  • Managed IT through OptimizedIT. Patching, monitoring, backup and recovery testing, and access reviews on a predictable monthly agreement, with the reports auditors ask for.
  • Cybersecurity through Obviam. Threat detection and response, security awareness training and phishing simulations, and tabletop exercises that test your 7-day and 30-day reporting steps.
  • Secure print fleet. Copiers and multifunction printers are networked computers that store sensitive documents. We include them in your inventory and secure them with authentication, encryption and firmware management.
  • Funding help. We help you sequence the work across budget cycles, use free state programs first, and prepare the assessment documentation that grant applications require.

Ready to check where you stand? Start with our no-cost Technology Synergy Assessment. It reviews your print, IT and cybersecurity environment, and our team will follow up with your HB 96 next steps.

Frequently asked questions about Ohio HB 96

Does Ohio HB 96 apply to school districts?
Yes. ORC 9.64 applies to every political subdivision, including public school districts. Districts had to adopt a board-approved cybersecurity program by July 1, 2026.

What happens if we missed the HB 96 deadline?
The Auditor of State checks compliance during regular audits, and a missing program can result in a formal audit finding. Adopt a right-sized program as soon as possible and document your improvement plan.

How fast do we have to report a cyber incident in Ohio?
Notify the Ohio Cyber Integration Center within 7 days of discovery and the Auditor of State within 30 days. That includes payroll redirect fraud and phishing-based incidents.

Can an Ohio township, city or school pay a ransomware demand?
Only if its legislative authority first passes a resolution or ordinance explaining why payment is in the entity’s best interest. Otherwise the payment is an illegal expenditure.

Which framework should our HB 96 program follow?
The law points to the NIST Cybersecurity Framework and CIS best practices. Smaller entities often start with CIS Controls Implementation Group 1, while larger ones may prefer NIST CSF 2.0.

Is our cybersecurity program a public record?
No. Program documents and incident reports are exempt from public records law, and records identifying security vendors and products are protected security records.

Is there funding for HB 96 compliance?
HB 96 itself included no funding. Free help is available through O-PCI and the Ohio Cyber Reserve, and CyberOhio periodically offers grants funded by the federal State and Local Cybersecurity Grant Program.

Does HB 96 training have to be annual?
The law requires training for all employees matched to their duties. Annual state-provided training or O-PCI training satisfies the requirement, and annual training is the practical standard.

Sources

This article is for general information and is not legal advice. Consult your legal counsel and the Auditor of State for guidance specific to your entity.