I-TEAM: Local Governments Adapting to New Cybersecurity Rules

Ohio Updates Cybersecurity Standards for Local Governments

Ohio is making significant changes to its cybersecurity standards for local governments. These updates aim to protect residents' sensitive information and ensure the continued delivery of essential services. The new law, which was included in the state budget, requires local governments to implement stronger cybersecurity measures and report any cyber incidents promptly.

Starting Tuesday, if a local government experiences a cyber incident, it must notify the Ohio Department of Public Safety and the Ohio Auditor’s Office. This reporting requirement is designed to improve transparency and accountability. Additionally, there are new procedures for handling ransomware attacks. If a local government decides to pay a ransom, it must do so through a public resolution approved by the relevant governing body.

By January 1, counties and cities must have a comprehensive cybersecurity program in place, including employee training. Other local governments have until July 1 to meet these requirements. These deadlines emphasize the importance of proactive planning and preparedness in the face of evolving cyber threats.

Recent cyberattacks on local governments highlight the necessity of these changes. For example, West Chester Township and the City of Middletown both experienced cyber incidents last month, which disrupted city services. In late 2023, the City of Huber Heights declared a state of emergency after a ransomware attack.

News Center 7's John Bedell reached out to 13 local governments to understand how the new law will affect their operations. Many of them reported that they were already following similar practices, and the legislation primarily formalizes existing policies. Here are some of the responses:

• City of Huber Heights IT Department: They are in the process of formalizing their existing cybersecurity practices into a written policy. No major changes are expected.
• Greene County Administrator Brandon Huddleson: The county believes the law is a good idea and has updated its cybersecurity plan to include new reporting requirements and ransom payment procedures.
• City of Dayton: The city is committed to maintaining strong cybersecurity practices and is confident that its current program aligns with the state’s standards.
• City of Kettering: The city was well-positioned to comply with the new law, as it already had a comprehensive cybersecurity program in place. The main changes involve formal documentation.
• Clark County Administrator Jennifer Hutchinson: The county has long embraced the principles outlined in the law and views the legislation as a formalization of existing practices.
• City of Troy: The city has been substantially in compliance with the new standards for about two years and won’t need to make significant changes.
• City of Springfield Communications Director Karen Graves: The city already has many of the protections outlined in the law and is reviewing the legislation to ensure full compliance.
• City of Centerville: The city is formally documenting its cybersecurity plan and having City Council adopt it.
• Montgomery County Director of Information Technology Jim Brandenburg: The county already meets all the required cybersecurity standards and takes its responsibilities seriously.
• City of Fairborn Communications Manager Emily Gay: The city is updating its cybersecurity program to align with the new standards, focusing on procedural changes.
• City of Xenia: The city is committed to enhancing its security framework and is consolidating its practices into a broader policy.

These responses indicate that many local governments are already taking cybersecurity seriously and are adapting to the new requirements. The new law also strengthens defenses by exempting many cybersecurity records from public disclosure requirements, which helps prevent cyber threat actors from using public records requests to gather information about a city's technology and security systems.

As the new standards take effect, local governments across Ohio are working to ensure compliance and strengthen their cybersecurity measures. News Center 7 will continue to follow this story and provide updates on how these changes impact communities across the state.