ORC 9.64 — Ohio political subdivisions
The written cybersecurity program Ohio public entities must adopt — delivered by the same engineering rota that runs the helpdesk.
ORC 9.64 requires Ohio political subdivisions to adopt and maintain a written cybersecurity program, designate a coordinator, train staff, and report annually. The Auditor of State may audit the program under ORC 117.43. CIT runs the program on the same per-endpoint contract as the rest of the IT stack — one rota, one set of numbers.
Written cybersecurity program
Adopt and maintain a written cybersecurity program that addresses the subdivision's systems and data. CIT drafts the program and keeps it current against the Ohio DAS model program.
Cybersecurity coordinator
Designate a coordinator responsible for the program. CIT's Security Engineer serves as coordinator or supports the in-house designee.
Training
Provide cybersecurity training to employees with access to systems. CIT delivers annual training with completion records retained for audit.
Incident response plan
Maintain a written incident response plan and exercise it. CIT's plan is tested annually and tied to the SIEM alerting pipeline.
Annual report
Report annually to the legislative authority on the program's status. CIT prepares the report from the same ticket and SIEM exports that feed the SLA report.
Audit readiness
The program is auditable under ORC 117.43 by the Auditor of State. CIT maintains the evidence trail — logs, training records, risk assessments — in one place.
The subdivision gets the same eight operational layers as a private SMB — helpdesk, monitoring, EDR, patch, SIEM, network, building, and MDM — with the compliance program layered on top. One contract, one rota, one annual report that an auditor can read.
Talk to an engineer about your programNot legal advice — pair this guide with counsel familiar with the rule and Ohio breach-notification statutes.