HB96 compliance programs for Ohio schools, townships, and municipalities
Turnkey cybersecurity programs that satisfy ORC § 9.64 — built for your entity size, ready for the Auditor of State.
Deadline Alert
The deadline is approaching — and most entities haven’t started.
Counties and cities had a January 1, 2026 compliance deadline under Ohio House Bill 96 — and many are already past due. If your county or city still doesn’t have a formal cybersecurity program in place, you are operating outside the law and increasing your audit risk with every passing day.
All other political subdivisions — school districts, townships, villages, libraries, and special districts — face a July 1, 2026 deadline. That may sound like it’s months away, but building a compliant cybersecurity program takes time: understanding the requirements, conducting a risk assessment, writing the policies, getting board approval, and training your staff. Most entities need 4–8 weeks at minimum.
Many entities haven’t started because they don’t have IT staff, don’t know what the law actually requires, or assumed their managed service provider was handling it. HB96 compliance is not optional — it is a legal mandate under ORC § 9.64. The Auditor of State is watching. Non-compliance creates legal liability, audit findings, and puts public data at risk.
The good news: Ridgepoint’s turnkey compliance programs are designed specifically for this. We build everything you need, deliver it in plain English, and make it ready for board adoption and Auditor of State review — whether you have a full IT department or no technical staff at all.
Requirements
What HB96 requires.
- Written cybersecurity program aligned with NIST CSF or CIS Controls
- Documented risk assessment
- Written incident response plan with state reporting procedures (7 days to DPS, 30 days to Auditor of State)
- Ransomware response policy
- Board/council resolution formally adopting the program
- Annual security awareness training for staff
Who Must Comply
Who must comply by July 1, 2026.
School Districts
All public school districts in Ohio
Townships
All townships statewide
Villages
All incorporated villages
Libraries
Public library systems
Special Districts
And other political subdivisions
Note: Counties and cities had a January 1, 2026 deadline and should already be in compliance. If you are a county or city that hasn’t started, contact us immediately.
Our Program
Ridgepoint’s turnkey compliance program.
Investment
$5,000 – $15,000
Fixed price, scaled to entity size
Timeline
4 – 8 weeks
From engagement to final deliverables
What you receive:
- Complete written cybersecurity program aligned with NIST CSF or CIS Controls
- Documented risk assessment identifying critical functions and potential impacts
- Written incident response plan with state reporting procedures
- Ransomware response policy with board resolution template
- Security awareness training outline ready for staff delivery
- Board/council resolution template for formal program adoption
- Auditor of State readiness checklist
Everything is written in plain English, structured for board adoption, and designed to withstand an Auditor of State review.
Ongoing Security
Beyond compliance: ongoing security.
The compliance program gets you across the finish line. But cybersecurity is ongoing — threats evolve, staff changes, technology updates. A written program that sits in a drawer doesn’t protect anyone. The entities that are truly secure are the ones that treat their cybersecurity program as a living document, reviewed and updated on a regular basis.
Ridgepoint offers ongoing support through vCISO retainers, annual security awareness training (required by HB96), tabletop exercises, and annual program reviews. Whether you need a fractional security leader to guide your program year-round or just an annual refresher to keep your documentation current and your staff trained, we can help. Our security awareness training programs are designed specifically for government and education environments — practical, engaging, and built to satisfy the annual training requirement under HB96.
FAQ
Common questions from Ohio municipalities and schools.
The July 1 deadline is approaching. Don’t wait until the Auditor calls.
We work with school districts, townships, villages, and libraries throughout Ohio to deliver HB96 compliance programs — on time, on budget, and audit-ready.
Start Your HB96 Compliance Program