Prosecutor's office urges TID to adopt cybersecurity policy ahead of July audit checks

Christopher Betts, representing the Delaware County prosecutor's office, told the Transportation Improvement District board on May 13 that House Bill 96 amended Revised Code 9.64 and requires political subdivisions — including the TID — to have a cybersecurity policy or program.

"The statute became effective on September 30," Betts said. "The auditors are going to start looking for this ... for the other political subdivisions starting 07/01/2026." He recommended the board consider adopting a policy the county's IT lead, Steve Lewis, has drafted rather than creating a separate TID policy from scratch.

Board members questioned whether TIDs and similar special-purpose entities should draft their own policies or rely on the county's program. Pat Bellini framed the issue as a risk-transfer question: "Since we don't have any IT infrastructure and don't plan to, ... the idea of assuring us annually that they're complying with the code, which to me meets our obligation under the statute," he said.

Betts and staff agreed to circulate the county's draft policy in advance of the July meeting. The board directed staff and legal (Betts) to review Steve Lewis' policy and return with a recommendation to meet the auditors' expectations by or shortly after July 1. No formal adoption occurred at the May 13 meeting.

Why it matters: The discussion reflects a new statutory compliance requirement that will be part of future audits of local public bodies. The board's decision to consider the county draft rather than write a bespoke policy could reduce duplication of work but raises questions about how the TID will obtain assurances from county IT and contractors.

Next steps: Staff will obtain and distribute the county draft policy; Betts and staff will report back with a recommendation at the July 8 meeting.