Law / United States / 
Ohio
Political Subdivision Cybersecurity, incident notice to homeland security and the auditor of state
Political Subdivision Cybersecurity Incident Report, Ohio Rev. Code s. 9.64(D)
In force since .
A vulnerability and incident reporting rule binding government bodies.
- Instrument type
- an act of a legislature
- Obligation class
- Reporting
As of .
What it requires
- This binds a political subdivision, meaning a county, township, municipal corporation or other body corporate and politic responsible for governmental activities in a geographic area smaller than the state (section 9.64(A)(2)).
- After each cybersecurity incident or ransomware incident, have the legislative authority notify the executive director of the division of homeland security within the department of public safety, in the manner the executive director prescribes, as soon as possible and no later than seven days after the political subdivision discovers the incident (section 9.64(D)(1)).
- Also notify the auditor of state, in the manner the auditor of state prescribes, as soon as possible and no later than thirty days after the political subdivision discovers the incident (section 9.64(D)(2)).
These lines are LexLint's reading of the law's text, as of .
What this law does
The legislative authority of a political subdivision, following each cybersecurity incident or ransomware incident, must notify the executive director of the division of homeland security within the department of public safety as soon as possible but not later than seven days after the political subdivision discovers the incident.
It must also notify the auditor of state, in the manner the auditor of state prescribes, as soon as possible but not later than thirty days after the political subdivision discovers the incident. A cybersecurity incident includes a substantial loss of confidentiality, integrity, or availability of a covered entity's information system or network. Reports of a cybersecurity incident or ransomware incident under the notice duty are not public records under section 149.43 of the Revised Code.