Careers

Diversity, Equity & Inclusion

Experience

Innovation

Interactive Maps

Locations

About

Pages

Meet our team of innovators
Ask us how we do it

Professionals

Insights

Services

Thompson Hine LLP, a full-service business law firm with approximately 400 lawyers in 8 offices, was ranked number 1 in the category “Most innovative North American law firms: New working models” by The Financial Times and was 1 of 7 firms shortlisted for The American Lawyer’s inaugural Legal Services Innovation Award. The firm has been recognized by the National Law Journal as a Legal Technology Trailblazer and featured by Bloomberg for its innovative service delivery models, which drive accuracy and predictability. The firm’s commitment to innovation is embodied in Thompson Hine SmartPaTHTM – a smarter way to work – predictable, efficient and aligned with client goals. For more information, please visit ThompsonHine.com and ThompsonHine.com/SmartPaTH.

Home | Thompson Hine LLP

Atlanta

Chicago

Cincinnati

Cleveland

Columbus

Dayton

Los Angeles

Minneapolis

New York

Washington, D.C.

The Ohio Legislature included provisions in a recently enacted <a href="https://www.legislature.ohio.gov/legislation/136/hb96/status" target="_blank" rel="noreferrer noopener">operating appropriations bill</a> (Ohio House Bill 96) that regulate how and when state agencies can make ransomware payments, including a new requirement related to consultation with and approval from legislative officials. The bill also sets forth new cybersecurity standards and cyber-related event reporting requirements for state agencies. It is important that Ohio state agencies subject to the provisions update their incident response plans to include a process for engaging with legislative officials, among other areas, and update their information security policies.

core/paragraph

Key Terms: Cybersecurity Incident and Ransomware Incident

core/heading

The new Ohio law defines a “cybersecurity incident” and a “ransomware incident” differently. The former is defined as any of the following:

A substantial loss of confidentiality, integrity, or availability of a covered entity’s information system or network

core/list-item

A serious impact on the safety and resiliency of a covered entity’s operational systems and processes

A disruption of a covered entity’s ability to engage in business or industrial operations or to deliver goods or services

The unauthorized access to an entity’s information system or network, or nonpublic information contained therein, that is facilitated through or is caused by a compromise of a cloud service provider, managed service provider, or other third-party data hosting provider, or a supply chain compromise

core/list

However, the term does not include a “mere threat” of a cyber disruption as extortion, any event perpetrated in good faith in response to a request by the system owner or operator, or lawfully authorized activity of certain federal, state, or local governments. In contrast to Ohio’s data breach notification law, the new ransomware requirement is not limited to whether sensitive personally identifiable information has been impacted.

In addition, the new law defines a “ransomware incident” as “a malicious cybersecurity incident in which a person or entity introduces software that gains unauthorized access to or encrypts, modifies, or otherwise renders unavailable a political subdivision’s information technology systems or data and thereafter the person or entity demands a ransom to prevent the publication of the data, restore access to the data, or otherwise remediate the impact of the software.”

Ohio’s new ransomware payment requirements are straightforward. Specifically, they prohibit a “political subdivision” from paying a or otherwise complying with a ransom demand in connection with a ransomware incident – unless its applicable “legislative authority formally approves the payment or compliance with the ransom demand in a resolution or ordinance that specifically states why the payment or compliance with the ransom demand is in the best interest of the political subdivision.”

Importantly, the new Ohio law does not currently cover private-sector entities, and only applies to a “political subdivision,” which is defined as “a county, township, municipal corporation, or other body corporate and politic responsible for governmental activities in a geographic area smaller than that of the state.” Interestingly, this definition does not expressly include the terms “school districts” or “transit authorities,” which are specifically enumerated in the definitions of “political subdivision” found in other portions of the Ohio Revised Code.

The entities subject to Ohio’s new ransomware payment requirements should immediately update their incident response plans (IRPs). In particular, while a state agency’s IRP should already include key external stakeholders, such as outside counsel, cyber insurance carriers, and digital forensic consultants, they now need to include points of contact within the agency’s corresponding legislative branch who can efficiently and effectively draft and seek to enact a resolution or ordinance formally approving the payment or compliance with the ransom demand. This could potentially be a single member of the legislature, a special committee, or the entire legislative branch of the political subdivision, and will likely vary depending on logistical issues and political relationships.

In addition, it will be important for Ohio state agencies to undertake table-top exercises that include all key stakeholders, including those in the legislative branch, so they are prepared to address a ransomware incident in real time, including the potential need to enact formal legislation supporting the ransom payment decision. The IRP needs to account for frequent changes to the key stakeholders due to personnel changes resulting from elections or other factors.

The Ohio law includes new reporting requirements that apply to both a cybersecurity incident and a ransomware incident. Following either type of incident, covered entities must notify both of the following:

The executive director of Ohio Homeland Security (OHS), a division of the Ohio Department of Public Safety, in a manner prescribed by OHS’s executive director, as soon as possible but not later than seven days after the political subdivision discovers the incident

The Ohio Auditor of State (AOS), in a manner prescribed by the AOS, as soon as possible but not later than 30 days after the political subdivision discovers the incident

The law also exempts certain records related to this reporting and cybersecurity programs in general (see next section) from Ohio’s public record disclosure laws. A covered entity’s IRP should also be updated to address these new reporting requirements.

Under the new Ohio law, “[t]he legislative authority of a political subdivision” must formally adopt “a cybersecurity program that safeguards [its] data, information technology, and information technology resources to ensure availability, confidentiality, and integrity.” The program must be consistent with generally accepted best practices for cybersecurity (e.g., NIST Cybersecurity Framework and Center for Internet Security Cybersecurity Best Practices). The program may include the following:

Identify and address the critical functions and cybersecurity risks of the political subdivision

Identify the potential impacts of a cybersecurity breach

Specify mechanisms to detect potential threats and cybersecurity events

Specify procedures for the political subdivision to establish communication channels, analyze incidents, and take actions to contain cybersecurity incidents

Establish procedures for repairing infrastructure impacted by a cybersecurity incident and maintaining security after the incident

Establish cybersecurity training requirements for all employees of the political subdivision, the frequency, duration, and detail of which shall correspond to the duties of each employee

According to guidance issued by <a href="https://cyber.ohio.gov/home" target="_blank" rel="noreferrer noopener">CyberOhio</a>, the “OCIC, O-PCI, and Cyber Reserves will be able to assist local governments in assessing cyber risk and begin to develop a cyber program.”

core/separator

<em>This advisory bulletin may be reproduced, in whole or in part, with the prior permission of Thompson Hine LLP and acknowledgment of its source and copyright. This publication is intended to inform clients about legal matters of current interest. It is not intended as legal advice. Readers should not act upon the information contained in it without professional counsel.</em>

<em>This document may be considered attorney advertising in some jurisdictions.</em>

https://admin.thompsonhine.com/wp-content/uploads/2025/07/Privacy-Cybersecurity-Update-Ohio-Enacts-Law-Regulating-Ransomware-Payments-and-Cybersecurity.pdf

Ohio Enacts Law Regulating Ransomware Payments and Cybersecurity

Services