Skip to main content

HB 96


HB 96
Mandatory Reporting Requirements

Step 1: Within 7 Days of Discovery

  •     Notify: Ohio Cyber Integration Center (OCIC), part of the Ohio Department of Public Safety.
  •     How: Submit your report via the OCIC’s 24/7 portal: Submit Here

Step 2: Within 30 Days of Discovery

  •     Notify: Ohio Auditor of State.
  •     How: Complete the Cybersecurity Reporting Form: Complete Here


What Is Considered a Cybersecurity Incident?
Per the Ohio Auditor of State, a cybersecurity incident includes:

  •     A substantial loss of confidentiality, integrity, or availability of your systems or data.
  •     A serious impact on the safety or resiliency of operational systems.
  •     A disruption to your ability to deliver services or conduct operations (e.g., payment redirect, payroll redirect, spear phishing).
  •     Unauthorized access to systems or nonpublic data caused by: 
    •  A compromise of a cloud or managed service provider.
    •  A supply chain compromise.

 

Cybersecurity Policies and Training
Beginning December 17th 2025, Mayfield City Schools adopted Board Policy 8305 - Information Security to strengthen data protection and security practices. In alignment with Ohio HB 96 this policy includes the following courses:

  •     Training M-099: Cybersecurity Training for Administrators is required for all new administrative hires and will be completed        annually by administrators.
  •     Training M-049: Cybersecurity Awareness is assigned to all new hires and will be completed annually by all other staff.

MFCSD enabled 2 factor authentication on all staff accounts beginning in 2022.