Ships a mobile app, in Ohio

Ohio Rev. Code sections 1354.01 to 1354.05 (enacted by Senate Bill 220, 132nd General Assembly, effective November 2, 2018; section 1354.01 last amended by House Bill 66, 132nd General Assembly, effective April 5, 2019) · Read the law's page

• This is an optional safe harbor, not a mandatory duty: this chapter requires no business to create a cybersecurity program (other Ohio laws, such as Chapter 3965 for insurance licensees, do bind particular sectors), and this chapter reaches only a covered entity, any business that accesses, maintains, communicates, or processes personal information (as defined by Ohio Revised Code 1349.19) or restricted information in or through a system, network, or service located inside or outside Ohio, that chooses to seek the affirmative defense described below.
• To seek that defense, create, maintain, and comply with a written cybersecurity program with administrative, technical, and physical safeguards, covering personal information alone or personal information together with restricted information, and scale the program to the covered entity's size and complexity, the nature and scope of its activities, the sensitivity of the information protected, the cost and availability of security tools, and the resources available to it.
• Make the program reasonably conform to the current version of the NIST Cybersecurity Framework, NIST Special Publication 800-171, NIST Special Publications 800-53 and 800-53A, the FedRAMP security assessment framework, the CIS Critical Security Controls, or the ISO/IEC 27000 family, alone or in combination, or, if already regulated under it, reasonably conform to the entirety of the HIPAA security rule, Gramm-Leach-Bliley Act Title V, the Federal Information Security Modernization Act, or HITECH, or comply with the PCI Data Security Standard together with one of the first group's frameworks.
• To keep the program's reasonable conformance current, adopt a revised version of a chosen framework in the first group, or of the PCI standard, no later than one year after the publication date stated in the revision, and an amended version of the HIPAA security rule, Gramm-Leach-Bliley Act Title V, the Federal Information Security Modernization Act or HITECH no later than one year after the effective date of the amended framework.
• A covered entity that does this earns an affirmative defense to a tort claim under Ohio law alleging that its failure to implement reasonable information security controls caused a data breach concerning the information its program covers; the chapter creates no cause of action of its own, and nothing in it may be read to create a private right of action, including a class action.

Ohio Admin. Policy IT-09, procurement clauses, under Ohio Rev. Code Sec. 125.18(B)(3) · Read the law's page

• If you build contracted, in-kind or other third-party web content or mobile application solutions for such an agency, make them comply with the accessibility standards of 28 CFR Part 35, Subpart H, and WCAG 2.1 Level AA (IT-09, Outsourced Web Content and Mobile Application Development).
• If you sell such an agency commercial off-the-shelf web content or mobile application software, software as a service included, certify that it complies with WCAG 2.1 Level AA (IT-09, Commercial-Off-the-Shelf Software Purchases).
• This reaches a supplier to a state agency, board or commission under the authority of the Governor: one that builds web content or mobile application solutions for it under a contract, in-kind or other third-party arrangement, or one that sells it commercial off-the-shelf web or mobile software, software as a service included; the policy places the duty to impose these conditions on the agency, which section 125.18(B)(3) of the Revised Code directs to comply (IT-09, Outsourced Web Content and Mobile Application Development; Commercial-Off-the-Shelf Software Purchases).