Law / United States / 
Ohio
Political Subdivision Cybersecurity, program and ransom demand approval
Political Subdivision Cybersecurity Program, Ohio Rev. Code s. 9.64(B) and (C)
In force since .
A sector security regimes rule binding government bodies.
- Instrument type
- an act of a legislature
- Obligation class
- Security, Governance
As of .
What it requires
- This binds a political subdivision, meaning a county, township, municipal corporation or other body corporate and politic responsible for governmental activities in a geographic area smaller than the state (section 9.64(A)(2)).
- After a ransomware incident, do not pay or otherwise comply with a ransom demand unless the legislative authority formally approves it in a resolution or ordinance that specifically states why paying or complying is in the political subdivision's best interest (section 9.64(B)).
- Have the legislative authority adopt a cybersecurity program that safeguards the political subdivision's data, information technology and information technology resources to ensure availability, confidentiality and integrity, consistent with generally accepted best practices such as the NIST cybersecurity framework and the CIS cybersecurity best practices (section 9.64(C)).
These lines are LexLint's reading of the law's text, as of .
What this law does
Section 9.64 of the Revised Code was enacted by House Bill 96 of the 136th General Assembly and is effective . A political subdivision is a county, township, municipal corporation, or other body corporate and politic responsible for governmental activities in a geographic area smaller than that of the state.
A political subdivision experiencing a ransomware incident must not pay or otherwise comply with a ransom demand unless its legislative authority formally approves the payment or compliance in a resolution or ordinance that states why it is in the best interest of the political subdivision.
The legislative authority of a political subdivision must adopt a cybersecurity program that safeguards the political subdivision's data, information technology, and information technology resources to ensure availability, confidentiality, and integrity. The program must be consistent with generally accepted best practices for cybersecurity, such as the national institute of standards and technology cybersecurity framework and the center for internet security cybersecurity best practices.
A ransomware incident is a malicious cybersecurity incident in which a person or entity introduces software that gains unauthorized access to or encrypts, modifies, or otherwise renders unavailable a political subdivision's information technology systems or data and thereafter demands a ransom.