Get Full Government Meeting Transcripts, Videos, & Alerts Forever!
Get email alerts on the Cybersecurity topic
No spam. Unsubscribe anytime.
Upper Arlington council adopts cybersecurity program, asks for ransomware criteria and training details
Summary
Council adopted Resolution No. 12-2025 to formalize the citycybersecurity program required by Ohio House Bill 96, after IT officials described NIST-based controls, staff training and annual audits; council asked for clearer criteria on approving ransomware payments and for confirmation of insurance coverage.
Upper Arlingtoncouncil on Oct. 13 adopted Resolution No. 12-2025 formally approving the city's cybersecurity program and designating its administrator, fulfilling requirements established by Ohio House Bill 96.
Jeff Kiesen, the city's IT director, told council the program was developed with the Ohio Cyber Reserve and uses the NIST control set to measure and address gaps. "We started this process in 2023," Kiesen said, describing annual audits and ongoing work to close identified gaps. He said the city already runs mandatory staff training, an email-security (phishing) program that targets training by behavior, and periodic in-person awareness sessions.
Council members asked for more detail about training effectiveness and about what the law requires when an agency faces a ransomware demand. President Augustine Jeter noted the resolution's provision that ransomware payments come to council for approval. Kiesen said the city has immutable backups and believes it could generally recover from many incidents but that a cost-benefit judgment can be complex: "When you look at the cost to recover from a particular ransomware incident, it can be very large," he said.
Council also discussed cyber insurance. Kiesen said coverage is provided as a rider in the city's larger insurance package and that the policy includes baseline IT requirements the city must meet. The finance director and other staff said auditors will be reviewing cybersecurity controls as part of the annual financial audit going forward.
The motion to adopt Resolution No. 12-2025 was moved and seconded; President Jeter called the question and the council adopted the resolution by voice vote. The resolution directs the city to maintain NIST-based controls, run required staff training, and continue annual audits with the Ohio Cyber Reserve.
What comes next: council members requested follow-up materials on the training programincluding how effectiveness is measuredand draft criteria staff would use to bring a ransomware payment to the public body for deliberation.
