Understanding Your New Cybersecurity Responsibilities

1. Establish a Formal Cybersecurity Program

Every township or small city is now expected to create and maintain a structured cybersecurity program. Every township or small city is now expected to create and maintain a structured cybersecurity program.

​

What this means:

• You’ll need a defined approach to managing cybersecurity risk.

• Your IT environment should follow recognized best practices (password controls, device protections, logging, monitoring, etc.).

• The program can be scaled to your size — it doesn’t require a large IT department, just structure and consistency.

2. Conduct Risk Assessment and Strengthen Network Sceurity

HB 96 requires local governments to understand where they are vulnerable and to take steps to minimize those risks. Risk assessments help identify the systems, data, and processes that could be most affected by an attack.

​

What this means:

• Regular reviews of your technology setup.

• Prioritization of improvements like multifactor authentication, backups, and secure configurations.

• Better protection for citizen data and municipal operations.

3. Create an Incident Response and Recovery Plan​

Cities and townships must have documented procedures for handling cyber incidents and recovering afterward. This ensures a fast, organized response during an attack.

​

What this means:

• A clear plan for who does what during a cyber incident.

• Steps for restoring services and notifying state authorities.

• Increased resilience and reduced downtime.

​

4. Mandatory Cybersecurity Training for Employees

Employees often represent the biggest risk — not out of neglect, but because cyberthreats are constantly evolving. HB 96 requires role‑based training to ensure staff understand how to stay safe online.

​​

What this means:

• Staff in multiple departments—including finance, public safety, and administration—will receive cybersecurity training.

• Training reduces phishing risks, accidental data exposure, and system misuse.

​

5. Reporting Requirements for Cyber Incidents

Local governments must report cybersecurity incidents to the appropriate state authorities in a timely manner. This helps the state coordinate support and track widespread threats.

​​

What this means:

• If a breach, malware event, or ransomware attack occurs, your township or city must notify the state.

• Reporting timelines are strict, encouraging quick response and transparency.

​

6. Restrictions on Ransom Payments

HB 96 restricts local governments from paying a ransom unless it has been formally approved by the governing body. This helps ensure thoughtful decision‑making during high‑pressure incidents.

​

What this means:

• Your leadership team must meet and approve any ransom payments.

• Encourages evaluation of alternatives and best practices before making major decisions.