The civic record
Read. Follow. Verify.Ohio SB 203 requires local governments to adopt cybersecurity programs and restricts ransom payments
Last action · May 28, 2025: Referred to Financial Institutions, Insurance and TechnologySponsor: Tim Schaffer
Track this bill to get notified when it advances a stage. One tap to stop, anytime.
What This Bill Would Do
Ohio s must adopt a cybersecurity program aligned with recognized frameworks and restrict ransom payments during s unless formally approved by their legislative authority. The measure also mandates strict incident reporting timelines to state agencies and exempts cybersecurity program records from laws.
Local government agencies face new compliance mandates, mandatory employee training standards, and strict post-incident reporting deadlines to the Ohio Department of Public Safety and Auditor of State, altering how municipalities and counties manage digital infrastructure and respond to digital extortion.
Who It Would Affect
Groups the bill's text would affect if enacted, as described in the record. Being affected is not a position for or against it.
Political subdivisions
Must adopt NIST-aligned cybersecurity programs, restrict ransom payments, conduct employee training, and comply with mandatory state incident reporting deadlines.
Political subdivision employees
Must complete annual cybersecurity training appropriate to their duties.
Division of Homeland Security
Receives mandatory notifications of cybersecurity and ransomware incidents from political subdivisions within seven days.
Auditor of State
Receives mandatory notifications of cybersecurity and ransomware incidents from political subdivisions within thirty days.
Key Facts
You don't have to trust us. Each fact below is taken straight from the official document - click any one to see the exact passage, highlighted in the original.
Frequently Asked Questions
Can a local government pay a ransom during a cyberattack without prior approval?
What training satisfies the employee cybersecurity training requirements?
Are local government cybersecurity plans available to the public via public records requests?
What else do you want to know?
News Coverage
Follow the record
Votes, people, money & the original sourceWhere This Stands
Currently in committee. The next step in the legislative lifecycle is Floor Vote.
Procedural history
2 actions- May 28, 2025SenateCommitteeReferred to Financial Institutions, Insurance and Technology
- May 14, 2025SenateIntroducedIntroduced
Version history
Only one version on file - nothing to compare yet. As later stages (committee substitute, engrossed, enrolled) are captured, the redline appears here.
View official text →Lobbying Activity
No state lobbying filings in our records match this bill. Federal lobbying reports (LDA) cover Congress, so they are not listed on state bills.
Full breakdown
Who this bill affects and the strongest case for and against it, written only from the bill’s own text.
Sponsors
Discoveries
Patterns POLISCOPE noticed across the record. These are observations to investigate, not conclusions.
Mandatory Ransomware Approval and Reporting
Shifts local cybersecurity handling from optional guidelines to mandatory legislative approval for ransom payments and strict notification timelines to state agencies.
Connected Entities
Sources
www.legislature.ohio.gov
Analysis Score
0–100- Significance75How much this matters to a regular citizen
- Controversy15Intensity of disagreement among stakeholders
- Entertainment5Compellingness for a non-policy-wonk reader
- Buzz35Current news / social attention level
Publisher tools