Ohio Revised Code Chapter 1354 gives a business an affirmative defense to Ohio tort claims over a data breach if it maintains a written cybersecurity program that reasonably conforms to a listed framework such as the NIST Cybersecurity Framework, NIST 800-171, CIS Controls or ISO 27000, and updates within a year of revisions.
\nUnder Ohio Revised Code 1354.02, effective November 2, 2018, a covered entity seeking an affirmative defense must create, maintain and comply with a written cybersecurity program with administrative, technical and physical safeguards that reasonably conforms to an industry recognized cybersecurity framework. The program must be designed to protect the security and confidentiality of the information and to guard against unauthorized access likely to cause a material risk of identity theft or fraud.
\nScale and scope are judged by the entity’s size and complexity, the nature of its activities, the sensitivity of the information, the cost of available tools and its resources. An entity meeting these conditions is entitled to an affirmative defense to tort claims under Ohio law alleging that a failure to implement reasonable security controls resulted in a data breach.
\nSection 1354.03 lists the frameworks: the NIST Cybersecurity Framework, NIST SP 800-171, NIST SP 800-53 and 800-53A, the FedRAMP security assessment framework, the CIS Critical Security Controls, and the ISO/IEC 27000 family. Regulated entities may instead conform to HIPAA security rules, GLBA Title V or FISMA, and PCI DSS counts only alongside one of the listed frameworks. After a final revision to a framework, the program must reasonably conform within one year.
\nUse this for organizations with Ohio exposure. The defense applies to tort claims and does not replace breach-notice duties under R.C. 1349.19; whether a program qualifies is ultimately a legal question for counsel.
\nDSE recommends that Ohio-exposed organizations document which recognized framework their written security program follows and keep evidence of conformance current. Map existing policies and controls to the chosen framework, record why the program’s scale fits the business, and set a review date whenever the framework publishes a final revision so the one-year window is not missed.
\nEach year, have someone outside the IT team compare the written program with the framework mapping and a sample of control evidence, and record the result and open gaps. Check the framework publisher’s site for revisions and log the date the program was updated to match.
\nOhio Laws — Ohio Revised Code 1354.02, Safe harbor requirements. Ohio Revised Code 1354.03 — Reasonable conformance. Reviewed October 18, 2026.
", "content_text": "Ohio Revised Code Chapter 1354 gives a business an affirmative defense to Ohio tort claims over a data breach if it maintains a written cybersecurity program that reasonably conforms to a listed framework such as the NIST Cybersecurity Framework, NIST 800-171, CIS Controls or ISO 27000, and updates within a year of revisions.\nSource facts\nUnder Ohio Revised Code 1354.02, effective November 2, 2018, a covered entity seeking an affirmative defense must create, maintain and comply with a written cybersecurity program with administrative, technical and physical safeguards that reasonably conforms to an industry recognized cybersecurity framework. The program must be designed to protect the security and confidentiality of the information and to guard against unauthorized access likely to cause a material risk of identity theft or fraud.\nScale and scope are judged by the entity’s size and complexity, the nature of its activities, the sensitivity of the information, the cost of available tools and its resources. An entity meeting these conditions is entitled to an affirmative defense to tort claims under Ohio law alleging that a failure to implement reasonable security controls resulted in a data breach.\nSection 1354.03 lists the frameworks: the NIST Cybersecurity Framework, NIST SP 800-171, NIST SP 800-53 and 800-53A, the FedRAMP security assessment framework, the CIS Critical Security Controls, and the ISO/IEC 27000 family. Regulated entities may instead conform to HIPAA security rules, GLBA Title V or FISMA, and PCI DSS counts only alongside one of the listed frameworks. After a final revision to a framework, the program must reasonably conform within one year.\nApplicability\nUse this for organizations with Ohio exposure. The defense applies to tort claims and does not replace breach-notice duties under R.C. 1349.19; whether a program qualifies is ultimately a legal question for counsel.\nDSE recommendation\nDSE recommends that Ohio-exposed organizations document which recognized framework their written security program follows and keep evidence of conformance current. Map existing policies and controls to the chosen framework, record why the program’s scale fits the business, and set a review date whenever the framework publishes a final revision so the one-year window is not missed.\nVerification\nEach year, have someone outside the IT team compare the written program with the framework mapping and a sample of control evidence, and record the result and open gaps. Check the framework publisher’s site for revisions and log the date the program was updated to match.\nOfficial references\nOhio Laws — Ohio Revised Code 1354.02, Safe harbor requirements. Ohio Revised Code 1354.03 — Reasonable conformance. Reviewed October 18, 2026.", "content_markdown": "Ohio Revised Code Chapter 1354 gives a business an affirmative defense to Ohio tort claims over a data breach if it maintains a written cybersecurity program that reasonably conforms to a listed framework such as the NIST Cybersecurity Framework, NIST 800-171, CIS Controls or ISO 27000, and updates within a year of revisions.\n\n## Source facts\n\nUnder [Ohio Revised Code 1354.02](https://codes.ohio.gov/ohio-revised-code/section-1354.02), effective November 2, 2018, a covered entity seeking an affirmative defense must create, maintain and comply with a written cybersecurity program with administrative, technical and physical safeguards that reasonably conforms to an industry recognized cybersecurity framework. The program must be designed to protect the security and confidentiality of the information and to guard against unauthorized access likely to cause a material risk of identity theft or fraud.\n\nScale and scope are judged by the entity’s size and complexity, the nature of its activities, the sensitivity of the information, the cost of available tools and its resources. An entity meeting these conditions is entitled to an affirmative defense to tort claims under Ohio law alleging that a failure to implement reasonable security controls resulted in a data breach.\n\n[Section 1354.03](https://codes.ohio.gov/ohio-revised-code/section-1354.03) lists the frameworks: the NIST Cybersecurity Framework, NIST SP 800-171, NIST SP 800-53 and 800-53A, the FedRAMP security assessment framework, the CIS Critical Security Controls, and the ISO/IEC 27000 family. Regulated entities may instead conform to HIPAA security rules, GLBA Title V or FISMA, and PCI DSS counts only alongside one of the listed frameworks. After a final revision to a framework, the program must reasonably conform within one year.\n\n## Applicability\n\nUse this for organizations with Ohio exposure. The defense applies to tort claims and does not replace breach-notice duties under R.C. 1349.19; whether a program qualifies is ultimately a legal question for counsel.\n\n## DSE recommendation\n\nDSE recommends that Ohio-exposed organizations document which recognized framework their written security program follows and keep evidence of conformance current. Map existing policies and controls to the chosen framework, record why the program’s scale fits the business, and set a review date whenever the framework publishes a final revision so the one-year window is not missed.\n\n## Verification\n\nEach year, have someone outside the IT team compare the written program with the framework mapping and a sample of control evidence, and record the result and open gaps. Check the framework publisher’s site for revisions and log the date the program was updated to match.\n\n## Official references\n\n[Ohio Laws — Ohio Revised Code 1354.02, Safe harbor requirements](https://codes.ohio.gov/ohio-revised-code/section-1354.02). [Ohio Revised Code 1354.03 — Reasonable conformance](https://codes.ohio.gov/ohio-revised-code/section-1354.03). Reviewed October 18, 2026." }, "json_ld": { "@context": "https://schema.org", "@graph": [ { "@type": "Organization", "@id": "https://dsesecurity.com/#organization", "name": "Detection Systems & Engineering", "alternateName": "DSE Security", "url": "https://dsesecurity.com/", "logo": { "@type": "ImageObject", "url": "https://update.dsesecurity.com/assets/dse-logo-20260812.png?v=1.8.20" } }, { "@type": "Organization", "@id": "https://update.dsesecurity.com/#editorial-team", "name": "DSE Security Editorial Team", "url": "https://update.dsesecurity.com/", "parentOrganization": { "@id": "https://dsesecurity.com/#organization" } }, { "@type": "WebSite", "@id": "https://update.dsesecurity.com/#website", "name": "DSE Updates", "alternateName": "DSE Security Knowledge Hub", "url": "https://update.dsesecurity.com/", "inLanguage": "en-US", "publisher": { "@id": "https://dsesecurity.com/#organization" }, "potentialAction": { "@type": "SearchAction", "target": { "@type": "EntryPoint", "urlTemplate": "https://update.dsesecurity.com/?q={search_term_string}" }, "query-input": "required name=search_term_string" } }, { "@type": "WebPage", "@id": "https://update.dsesecurity.com/updates/ohio-data-protection-act-1354-cybersecurity-program-safe-harbor/", "url": "https://update.dsesecurity.com/updates/ohio-data-protection-act-1354-cybersecurity-program-safe-harbor/", "isPartOf": { "@id": "https://update.dsesecurity.com/#website" }, "lastReviewed": "2026-10-18" }, { "@type": "BreadcrumbList", "@id": "https://update.dsesecurity.com/updates/ohio-data-protection-act-1354-cybersecurity-program-safe-harbor/#breadcrumbs", "itemListElement": [ { "@type": "ListItem", "position": 1, "name": "DSE Updates", "item": "https://update.dsesecurity.com/" }, { "@type": "ListItem", "position": 2, "name": "Ohio’s cybersecurity safe harbor: a written program that conforms to a recognized framework earns an affirmative defense", "item": "https://update.dsesecurity.com/updates/ohio-data-protection-act-1354-cybersecurity-program-safe-harbor/" } ] }, { "@type": [ "Article", "TechArticle" ], "@id": "https://update.dsesecurity.com/updates/ohio-data-protection-act-1354-cybersecurity-program-safe-harbor/#article", "identifier": "https://update.dsesecurity.com/updates/ohio-data-protection-act-1354-cybersecurity-program-safe-harbor/", "url": "https://update.dsesecurity.com/updates/ohio-data-protection-act-1354-cybersecurity-program-safe-harbor/", "headline": "Ohio’s cybersecurity safe harbor: a written program that conforms to a recognized framework earns an affirmative defense", "description": "Ohio Revised Code Chapter 1354 gives a business an affirmative defense to Ohio tort claims over a data breach if it maintains a written cybersecurity…", "abstract": "Ohio Revised Code Chapter 1354 gives a business an affirmative defense to Ohio tort claims over a data breach if it maintains a written cybersecurity program that reasonably conforms to a listed framework such as the NIST Cybersecurity Framework, NIST 800-171, CIS Controls or ISO 27000, and updates within a year of revisions.", "articleBody": "Ohio Revised Code Chapter 1354 gives a business an affirmative defense to Ohio tort claims over a data breach if it maintains a written cybersecurity program that reasonably conforms to a listed framework such as the NIST Cybersecurity Framework, NIST 800-171, CIS Controls or ISO 27000, and updates within a year of revisions.\nSource facts\nUnder Ohio Revised Code 1354.02, effective November 2, 2018, a covered entity seeking an affirmative defense must create, maintain and comply with a written cybersecurity program with administrative, technical and physical safeguards that reasonably conforms to an industry recognized cybersecurity framework. The program must be designed to protect the security and confidentiality of the information and to guard against unauthorized access likely to cause a material risk of identity theft or fraud.\nScale and scope are judged by the entity’s size and complexity, the nature of its activities, the sensitivity of the information, the cost of available tools and its resources. An entity meeting these conditions is entitled to an affirmative defense to tort claims under Ohio law alleging that a failure to implement reasonable security controls resulted in a data breach.\nSection 1354.03 lists the frameworks: the NIST Cybersecurity Framework, NIST SP 800-171, NIST SP 800-53 and 800-53A, the FedRAMP security assessment framework, the CIS Critical Security Controls, and the ISO/IEC 27000 family. Regulated entities may instead conform to HIPAA security rules, GLBA Title V or FISMA, and PCI DSS counts only alongside one of the listed frameworks. After a final revision to a framework, the program must reasonably conform within one year.\nApplicability\nUse this for organizations with Ohio exposure. The defense applies to tort claims and does not replace breach-notice duties under R.C. 1349.19; whether a program qualifies is ultimately a legal question for counsel.\nDSE recommendation\nDSE recommends that Ohio-exposed organizations document which recognized framework their written security program follows and keep evidence of conformance current. Map existing policies and controls to the chosen framework, record why the program’s scale fits the business, and set a review date whenever the framework publishes a final revision so the one-year window is not missed.\nVerification\nEach year, have someone outside the IT team compare the written program with the framework mapping and a sample of control evidence, and record the result and open gaps. Check the framework publisher’s site for revisions and log the date the program was updated to match.\nOfficial references\nOhio Laws — Ohio Revised Code 1354.02, Safe harbor requirements. Ohio Revised Code 1354.03 — Reasonable conformance. Reviewed October 18, 2026.", "datePublished": "2026-10-18T21:00:42+00:00", "dateModified": "2026-10-18T22:22:07+00:00", "mainEntityOfPage": { "@id": "https://update.dsesecurity.com/updates/ohio-data-protection-act-1354-cybersecurity-program-safe-harbor/" }, "inLanguage": "en-US", "isAccessibleForFree": true, "author": { "@type": "Organization", "name": "DSE Security Editorial Team", "url": "https://update.dsesecurity.com/#editorial-team" }, "publisher": { "@id": "https://dsesecurity.com/#organization" }, "image": { "@type": "ImageObject", "@id": "https://update.dsesecurity.com/updates/ohio-data-protection-act-1354-cybersecurity-program-safe-harbor/#primaryimage", "url": "https://update.dsesecurity.com/assets/editorial/cyber-defense-social-v2.jpg?v=1.8.20", "contentUrl": "https://update.dsesecurity.com/assets/editorial/cyber-defense-social-v2.jpg?v=1.8.20", "width": 1200, "height": 630, "caption": "Ohio’s cybersecurity safe harbor: a written program that conforms to a recognized framework earns an affirmative defense" }, "articleSection": [ "Business Continuity", "Cybersecurity" ], "keywords": [ "Business Continuity", "Cybersecurity", "Explainer", "Advisory priority" ], "genre": "Explainer", "about": [ { "@type": "Thing", "name": "Business Continuity", "url": "https://update.dsesecurity.com/topic/business-continuity/" }, { "@type": "Thing", "name": "Cybersecurity", "url": "https://update.dsesecurity.com/topic/cybersecurity/" } ], "wordCount": 413, "timeRequired": "PT2M", "publishingPrinciples": "https://update.dsesecurity.com/updates/dse-updates-editorial-methodology/", "usageInfo": "https://update.dsesecurity.com/usage/", "copyrightHolder": { "@id": "https://dsesecurity.com/#organization" }, "copyrightNotice": "Copyright © 2026 Detection Systems & Engineering. All rights reserved.", "citation": { "@type": "CreativeWork", "name": "Ohio Laws — Ohio Revised Code 1354.02, Safe harbor requirements", "url": "https://codes.ohio.gov/ohio-revised-code/section-1354.02" } } ] } }