1. Written program
Not a forgotten PDF. A program your organization has formally adopted and can still find.
In plain English
HB96 is the policy conversation many Ohio leaders use when they say “cyber is no longer optional.” The day-to-day rules public organizations work with are largely under ORC § 9.64: have a real cybersecurity program, keep it current, and know how to report incidents on time.
Who this is for
Administrators, fiscal officers, IT and security staff, board and council members, school and library leaders, park districts, public authorities, and anyone who has to answer: “Are we prepared?”
What good looks like
2. Real-world fit
It matches how you actually run finance, utilities, schools, public safety, or public services.
3. People know their roles
Who gets called, who decides, and who talks to the state if systems go down.
4. Training happens
Staff who handle email, payments, and records get practical cyber awareness—not a one-time checkbox.
5. Vendors are visible
You know which companies run critical systems and what proof they provide.
6. You can recover
Backups and restore plans are tested, not just “configured somewhere.”
The clocks that matter after an incident
| Who | Typical timing theme | Why it matters |
|---|---|---|
| Ohio Cyber Integration Center (OCIC) | About 7 days after discovery | State cyber notification path |
| Ohio Auditor of State | About 30 days after discovery | Separate reporting path—do not assume one filing covers both |
| Your insurer / key vendors | Per contract | Late notice can create extra problems |
Details: Incident readiness guide and ORC § 9.64 summary.
How FalconForgeAI helps you
We help local leaders turn “we think we’re okay” into a clear, reviewable picture.
- Intake workshop — We help you gather the documents and system lists you already have.
- Program picture — We line your materials up against ORC § 9.64 and HB96 themes leaders care about.
- Gap list you can run — Missing items, outdated items, and vendor-owned items—ranked by importance.
- Board-ready language — Short narratives your administrators can share without overclaiming.
- Incident prep support — Roles, contact trees, and dual reporting tracks prepared before a crisis.
We help you see and organize the story. Your leaders still decide. We do not file OCIC or Auditor reports, certify compliance, or give legal advice.
Next step
If your program lives in email threads and shared drives, we can help you make it clear enough for leadership review.