Explanation
BACKGROUND
Ohio Revised Code Section 9.64 requires a political subdivision to adopt a cybersecurity program that safeguards the political subdivision’s data, information technology, and information technology resources and establishes requirements relating to cybersecurity preparedness and response.
The City of Columbus has established and maintains a Cybersecurity Program administered through the Department of Technology pursuant to the authority and responsibilities established under Columbus City Codes Section 225.011.
The purpose of this resolution is to formally adopt the City’s existing Cybersecurity Program as required by Ohio Revised Code Section 9.64. This resolution does not establish a new cybersecurity program, but rather provides the legislative adoption required by state law while affirming the Department of Technology’s continuing authority and responsibility to administer, maintain, and update the program in accordance with applicable law and City Code.
CONTRACT COMPLIANCE: Not Applicable
FISCAL IMPACT: There is no fiscal impact associated with the adoption of this resolution.
EMERGENCY DESIGNATION
Emergency action is requested so the resolution is in place to comply with time requirements of the applicable law and City Code at the earliest opportunity.
Title
To formally adopt the updated City of Columbus Cybersecurity Program pursuant to Ohio Revised Code Section 9.64; to affirm the Department of Technology’s continuing administration and implementation of the Cybersecurity Program pursuant to Columbus City Codes Section 225.011 and to declare an emergency. ($0.00)
Body
WHEREAS, Ohio Revised Code Section 9.64 requires political subdivisions to adopt cybersecurity programs designed to safeguard their data, information technology, and information technology resources; and
WHEREAS, Columbus City Codes Section 225.011 establishes the City’s Cybersecurity Program and assigns responsibilities for its administration and implementation through the Department of Technology; and
WHEREAS, the City of Columbus, through its Department of Technology, has established and currently administers a Cybersecurity Program designed to protect City information, technology resources, systems, and operations; and
WHEREAS, the City Council recognizes that the Cybersecurity Program is an existing administrative program and that formal Council action is appropriate to satisfy the legislative adoption requirement of Ohio Revised Code Section 9.64; and
WHEREAS, consistent with Ohio Revised Code Section 9.64, the City’s Cybersecurity Program may include, but is not limited to, appropriate administrative, technical, and physical safeguards; cybersecurity risk assessment and management practices; employee cybersecurity awareness and training; incident preparedness and response measures; and other measures intended to safeguard the City’s data, information technology, and information technology resources; and
WHEREAS, City Council has been briefed during an executive session regarding the City’s Cybersecurity Program and recognizes the importance of maintaining an effective and evolving cybersecurity program responsive to changes in technology, threats, risks, and applicable legal requirements; and
WHEREAS, an emergency exists in the usual daily operations of Department of Technology in that it is immediately necessary and appropriate for the Council of the City of Columbus to formally adopt the City’s Cybersecurity Program in accordance with Ohio Revised Code Section 9.64 which will preserve the public peace, property, health, welfare, and safety; and NOW, THEREFORE,
BE IT RESOLVED BY THE COUNCIL OF THE CITY OF COLUMBUS:
SECTION 1. That the Council of the City of Columbus hereby formally adopts the City of Columbus updated Cybersecurity Program pursuant to Ohio Revised Code Section 9.64.
SECTION 2. That the Department of Technology shall continue to administer, implement, maintain, and update the City’s Cybersecurity Program consistent with Columbus City Codes Section 225.011, Ohio Revised Code Section 9.64, and other applicable laws.
SECTION 3. That the Cybersecurity Program may include, but is not limited to, the cybersecurity safeguards, policies, practices, training, risk-management activities, incident preparedness and response measures, and other components appropriate to protect City data, information technology, and information technology resources.
SECTION 4. That nothing in this resolution shall be construed to require the public disclosure or incorporation into this resolution of information that is exempt from disclosure or otherwise protected under Ohio law, including cybersecurity or infrastructure records.
SECTION 5. That this resolution, for the reasons stated in the preamble, which are made a part of this resolution and fully incorporated for reference as if rewritten, is declared to be an emergency measure and shall take effect and be in force from and after this resolution’s adoption and approval by the Mayor or ten (10) days after its adoption if the Mayor neither approves nor vetoes this resolution.