Stow-Munroe Falls board adopts cybersecurity policy to meet state mandate

The Stow-Munroe Falls City School District Board of Education adopted a new cybersecurity policy on Monday to comply with state requirements set out in House Bill 96 and related Ohio law.

Dr. Gold, presenting the policy (Policy 75 40.01), told the board the measure was drawn from House Bill 96 and is intended to give the district a formal cybersecurity program, including definitions for "cybersecurity" and "ransomware," response procedures and oversight responsibilities. "This house bill was required that all school districts ... adopt this particular program and it must be adopted by 09/30/2025," Dr. Gold said.

The board discussed whether the policy must be fast-tracked rather than undergoing three customary readings. Dr. Gold said the district received notice in August 2025 and that the state's timeline required expedited action. He described an implementation schedule: an initial assessment and staff awareness/training beginning in December, further technical assessment and vendor work by March, and an annual risk report and full program baseline to be in place by July 1, 2026. "This gives us an opportunity to do a full implementation," Dr. Gold said.

Board members pressed for details about costs and who would oversee the program. Dr. Gold said immediate additional expenses were not expected because the district currently works with a regional technology partner (Neonet) and that the board would receive confidential updates without exposing sensitive security details. He said oversight responsibilities in the policy are assigned broadly to the superintendent, treasurer, director of operations and the district technology lead so administrative guidelines can specify operational roles.

The board voted by roll call to adopt the policy as presented. The recorded roll-call responses read as unanimous 'Aye' at the time the vote was taken. Dr. Gold also told the board three other policies would proceed through the regular three-reading process: a revised participation policy for community/STEM students in extracurriculars, a promotion/placement/retention policy, and rescission of an electronic data-processing disaster-recovery policy that overlaps with the new cybersecurity policy.

The adoption places the district on a state-mandated timeline: district officials said they were working to align training and reporting to meet the statutory and administrative deadlines for implementation.