Law director alerts council to new state cybersecurity requirements with Sept. 30 statute effective date

Tiffin's director of law, Zach Fowler, told City Council on Aug. 4 that the city must begin developing a cybersecurity program to comply with a new state statutory requirement and that the state auditor's deadlines fall later this year. Fowler said council members received materials summarizing the requirement and that the statute takes effect Sept. 30. He said the state auditor has set a compliance deadline at the end of the year and that the city will need to assemble a plan for council approval that includes threat identification, response plans and annual employee training. Why it matters: Cities must adopt cybersecurity policies and training programs to meet statutory requirements, and council-approved plans typically guide municipal IT governance and budgets. Fowler said he had only the webinar materials and encouraged council members to review those materials and contact his office with questions. "We will have to start to the process of developing a plan that council will have to approve," he said. Next steps: City staff will review the webinar materials and propose a draft cybersecurity program for council consideration before the auditor's year-end compliance deadline. Fowler advised that the Sept. 30 statutory effective date gives a near-term window for planning. (Ending) Council members had no additional items at the time; Fowler concluded his report and the council moved on to other business.