Committee hears HB 283 requiring local governments to adopt cybersecurity programs and reporting rules

The House Technology and Innovation Committee on Oct. 11 held the first hearing for House Bill 283, a measure that would require Ohio political subdivisions to adopt cybersecurity programs, complete specified training and notify state authorities after an incident.

The bill’s sponsors, Representative Adam Matthews and Representative Brett Matthews, told the committee the measure was drafted with input from the auditor’s office and aims to ensure local governments “have the resources in place to adequately respond and protect our taxpayer resources.” Representative Adam Matthews said, “Political subdivisions in Ohio have recently been subject to increasing rates of cyber security incidents, including numerous incidents of spear spear phishing attacks that have cost taxpayers hundreds of thousands of dollars in damage, losses, and improper payments.”

HB 283 would require each political subdivision’s legislative authority to adopt a cybersecurity program that conforms to generally accepted best practices and may include elements such as identifying critical functions and cybersecurity risks, specifying mechanisms to detect potential risks, establishing procedures to repair infrastructure after an incident, and requiring cybersecurity training for all employees. Representative Brett Matthews told the committee the bill “requires political subdivisions following each cybersecurity incident to notify the executive director of the division of homeland…