Westerville schools adopt NIST cybersecurity framework to meet Ohio HB 96 requirements

The Westerville City Schools Board on June 29 adopted the National Institute of Standards and Technology (NIST) Cybersecurity Framework v2.0 as the district's official cybersecurity program framework and authorized district staff to implement it in accordance with Ohio House Bill 96.

Mr. Siford, representing the district's information-technology team, told trustees the resolution reflects a year of cross-team work to bring Westerville City Schools into compliance with the state's requirements. "In front of you tonight is a resolution to adopt the NIST cybersecurity framework for Westerville City Schools," he said, summarizing that the documentation outlines six standards the district will be graded against.

Trustees asked clarifying questions during the presentation. One trustee asked, "What does NIST stand for?" The response from the meeting was: "National Institute of Standards and Technology." Another trustee described witnessing an account being automatically shut down earlier that day, underscoring the framework's operational effect: "I saw this in action real time today as I logged in when I was working remotely and my account got shut down super quick. I got flagged. So, thank you for being on top of it." The exchange highlighted both the rationale for formal adoption and the immediate, practical controls already being enforced.

The board voted to adopt the framework; roll-call votes in the transcript record trustees voting in favor. The adoption authorizes the IT department to proceed with the framework's implementation and to report progress back to the board as the district aligns policies and processes with the NIST standards.