Gahanna moves to adopt cybersecurity program required by Ohio law

The City of Gahanna presented a draft cybersecurity program for council adoption on Dec. 8 to meet a new state mandate.

Director of Administrative Services said House Bill 96 established section 9.64 of the Ohio Revised Code, which requires political subdivisions to adopt a formal cybersecurity program that protects confidentiality, integrity and availability of municipal information systems. "Attached to the agenda, you have the cybersecurity program that complies with section 9.64 and the guidance provided by the state," the director said.

The program establishes governance, security controls, incident response procedures and continuous improvement standards for the city’s digital environment and asks the mayor to designate a person responsible for overseeing the program. Staff reported Director of IT Renee Carter and her team have been working on the program prior to the law and are setting internal deadlines and reporting processes. The director noted auditors will review compliance with section 9.64 as part of the routine audit cycle.

Councilmembers asked about internal timelines and reporting frequency; staff said those items will be assigned to Director Carter and presented for approval. The administration expects the legislative body to adopt the program by Dec. 31 as required and intends to demonstrate good‑faith efforts toward compliance as the IT team implements required controls.

Next steps: council placed the item on consent for the next meeting; staff will finalize internal deadlines, designated responsible person and audit metrics for subsequent council review.