- Home
- Ohio HB 96 Compliance
Ohio HB 96 & ORC 9.64
Ohio HB 96 cybersecurity compliance for political subdivisions
Gap assessment, the written program, board adoption language, the controls behind it, and audit-ready evidence. Built for townships, villages, school districts, libraries, and fire districts.
Where you stand
The deadlines have passed. The requirement has not
Counties and cities were due January 1, 2026. Townships, villages, school districts, libraries, and every other political subdivision were due July 1, 2026. ORC 9.64 has no enforcement patrol, which is why so many entities heard nothing. Compliance gets verified during your regular audit, and noncompliance becomes a formal finding in a public report.
- A written program adopted by your legislative authority, in your minutes.
- Five required areas addressed, plus training based on job duties.
- Incident reporting: 7 days to the state, 30 days to the Auditor.
- Ransom payments require a formal resolution before anything is paid.
What we deliver
The whole path, not just a document
We handle compliance and the security work behind it, so the program describes something real.
- ORC 9.64 Gap AssessmentWhere you are today against every requirement in the statute.
- Written Cybersecurity ProgramA program document scaled to your size and risk, with dated remediation targets.
- Board Adoption LanguageResolution or ordinance wording your legislative authority can act on.
- Incident Response PlanRoles, escalation, and the reporting contacts on one page.
- Job-Based Security TrainingTraining mapped to duties, not a single annual video.
- Control DeploymentMFA, endpoint detection, email security, and tested backups.
- Framework AlignmentCIS Controls IG1 or NIST, whichever fits your environment.
- Audit Evidence PackageMinutes, training records, and control evidence, organized in one place.
- Annual Program ReviewKeep the program current as staff, systems, and guidance change.
- Windows 10 Migration PlanningExtended Security Updates end October 13, 2026.
Read the full guide
What ORC 9.64 requires, in plain language
Our detailed guide covers who the law covers, the five required program areas, the three provisions almost everyone missed, what the Auditor of State will ask for, and a realistic 30 day catch-up plan.
Compliance sits on top of ordinary security work. If your day to day support is also thin, start with managed IT services and cybersecurity.
Questions
HB 96 questions from Ohio officials
What trustees, fiscal officers, clerks, and superintendents ask us.
Every Ohio political subdivision: counties, cities, townships, villages, public school districts, educational service centers, public libraries, and fire and EMS districts. If the Auditor of State audits you, assume you are covered.
There is no enforcement patrol. Compliance is checked during your regular audit, so the practical question is whether you have an adopted program in place before your auditors arrive. Getting documented and adopted now is a very different conversation than an empty folder.
No. We can build and operate the program, but your legislative authority has to formally adopt it, and the adoption needs to appear in your minutes. That part cannot be outsourced.
CIS Controls Implementation Group 1 for most small entities. It is 56 foundational safeguards designed for organizations with limited IT expertise and off-the-shelf technology.
No. Program records, framework documents, and incident reports are exempt, as are records identifying your security vendors, hardware, and software. You can document weaknesses honestly.
For a small entity, a realistic path is about 30 days: one week to inventory, one to draft against a framework, one to get it adopted at a meeting, and one to close the obvious gaps like MFA and tested backups.
Next step
Not sure whether your entity is compliant?
A free gap review takes about thirty minutes. We will tell you honestly what is missing and what your next audit will ask for. This is general information, not legal advice: your prosecuting attorney or counsel is the final word on your obligations.