Ohio's House Bill 96 requires every political subdivision, meaning cities, counties, townships, and school districts, to adopt a formal, documented cybersecurity program aligned to a recognized framework such as NIST CSF or the CIS Controls. It also sets 7-day and 30-day incident reporting, and it restricts ransomware payments without a public vote.
Key dates
Incident reporting has been required since September 30, 2025. Counties and cities had to adopt a program by January 1, 2026, and school districts and other subdivisions had to adopt one by July 1, 2026.
Both adoption deadlines fall in 2026. If your subdivision hasn't yet adopted a documented, framework-aligned program, the reporting rules apply either way. I'd treat this as the priority now: adopt a program and document it before an audit or an incident exposes the gap.
How Tech Dynamix helps you meet HB 96
Here is where we help, and where I would start:
- Framework-aligned cyber program: policies and controls mapped to NIST CSF or CIS, sized for your staff and budget
- Threat detection and response: around-the-clock monitoring, EDR and SIEM tuning, playbooks, and tabletop exercises, so your team knows what to do on the first day of an incident
- Incident reporting and governance: the 7-day and 30-day workflows put into practice, with the documentation and approvals a ransomware decision would need
- Annual security awareness training: role-based training so staff recognize a phishing attempt and know how to report it
- Resilient infrastructure: network hardening, MFA, secure backups, and recovery plans that get you back online without paying a ransom
We are based in Northeast Ohio, and we work with municipalities and K-12 districts to build practical roadmaps and put controls in place. In my experience, a subdivision that starts now spends less than one that starts after an incident.
I'd much prefer to help you adopt a program now than meet your team for the first time during an incident. Contact us to schedule an HB 96 readiness assessment and a plan matched to your subdivision.