Ohio Law Incentivizes Businesses for Implementing Cybersecurity Programs

Ohio organizations that reasonably conform to established cybersecurity programs may be incentivized.

• By Sydny Shepard
• Sep 21, 2018

Ohio Gov. John Kasich has signed Senate Bill 220, also known as the Ohio Data Protection Act, making it the first law in the national which incentivizes businesses to implement certain cybersecurity controls by providing them with an affirmative defense.

Under the Act, eligible organizations may rely on their conformance to certain cybersecurity frameworks as an affirmative defense against tort claims in data breach litigation, according to Columbus Business First. The act is intended to provide organizations with a legal incentive to implement written cybersecurity programs.

In order to qualify, Ohio organizations much implement a written cybersecurity program designed to protect the security and confidentiality of personal information, protect against anticipated threats or hazards to the security and integrity of personal information and protect against unauthorized access to and acquisition of personal information that is likely to result in a material risk of identity theft or fraud.

Additionally, the organization must "reasonably conform" to one of the following cybersecurity frameworks:

• National Institute of Standards and Technology's (NIST) Cybersecurity Framework
• NIST special publication 800-171, or 800-53 and 800-53a
• Federal Risk and Authorization Management Program's Security Assessment Framework
• Center for Internet Security's Critical Security Controls for Effective Cyber Defense
• International Organization for Standardization (ISO)/International Electrotechnical Commission’s (IEC) 27000 Family – Information Security Management Systems Standards.