Ohio has new cybersecurity rules — ransomware payments must now be approved

Jurisdictions in Ohio must implement new cybersecurity standards to safeguard data, a move that comes as more local governments grapple with such threats.

And moving forward, governments must formally approve any ransomware payments.

The mandate was included in an amended version of House Bill 96, the state’s two-year budget. The requirements, which apply to cities, counties, libraries, and school districts, mirror language in measures that lawmakers considered, including House Bill 283.

“Under the new law, local governments must adopt a cybersecurity program that safeguards their data, information technology, and information technology resources to ensure availability, confidentiality, and integrity,” according to CyberOhio.

As part of their efforts, jurisdictions must identify the potential impacts of a cybersecurity breach. They must also establish policies to set up communication channels, analyze incidents, and act to contain cybersecurity events, as well as procedures for repairing infrastructure and maintaining security following an incident.

It’s not entirely clear how many local governments have cybersecurity policies in place.

“I think it’s a pretty mixed bag of subdivisions who have policies or who don’t, and probably several that are just hoping this never happens to them,” Ohio Senate Finance Committee Chair Jerry Cirino, R-Kirtland, told Cleveland.com.

A state auditor analysis found that between mid-2023 and mid-2024, at least 23 government offices experienced cyberattacks. In Licking County, for example, one attack resulted in the theft of more than $700,000.

“Political subdivisions in Ohio have recently been subject to increasing rates of cybersecurity incidents including numerous instances of spear phishing attacks that have cost taxpayers hundreds of thousands of dollars in damage, losses, and improper payments,” Ohio Reps. Adam Mathews, R-Lebanon, and Haraz N. Ghanbari, R-Perrysburg, said in prepared testimony to the Ohio House Technology and Innovation Committee, speaking to HB 283.

“As cyber criminals become increasingly sophisticated in their attempts to steal taxpayer dollars, local governments must have the resources in place to adequately respond and protect taxpayer resources,” the lawmakers said.

In passing the new requirement, state lawmakers eliminated the measure’s funding provisions. However, state officials, including those with CyberOhio, are prepared to help local governments comply with these new requirements.

“In a time when cybersecurity incidents are becoming more prevalent, cybersecurity is top of mind for county governments across the state,” Rachel Reedy, outreach and member engagement manager for the County Commissioners Association of Ohio, told members of the Ohio House Technology and Innovation Committee. Reedy was speaking specifically about HB 283.

Communities’ response to cyberattacks has varied. According to Cleveland.com, Cleveland did not pay a ransom. However, Columbus Mayor Andrew Ginther approved a $4 million ransom payment, which the Columbus City Council later approved.

Under the new guidelines, CyberOhio said that “governments experiencing a ransomware incident shall not pay or otherwise comply with a ransom demand, unless their legislative authority formally approves the payment or compliance with the ransom demand in a resolution or ordinance that specifically states why the payment or compliance with the ransom demand is in the best interest of the local government.”

The move should increase transparency.

“Any resolution or ordinance must explicitly state the reason the ransom payment is in the best interest of the political subdivision,” Mathews and Ghanbari said in their prepared testimony. “This requirement bolsters transparency and ensures constituents are both aware of the incident’s occurrence and have an opportunity to provide feedback on the best use of their taxpayer dollars.”