Ohio’s cybersecurity safe harbor: a written program that conforms to a recognized framework earns an affirmative defense

Ohio Revised Code Chapter 1354 gives a business an affirmative defense to Ohio tort claims over a data breach if it maintains a written cybersecurity program that reasonably conforms to a listed framework such as the NIST Cybersecurity Framework, NIST 800-171, CIS Controls or ISO 27000, and updates within a year of revisions.

Source facts

Under Ohio Revised Code 1354.02, effective November 2, 2018, a covered entity seeking an affirmative defense must create, maintain and comply with a written cybersecurity program with administrative, technical and physical safeguards that reasonably conforms to an industry recognized cybersecurity framework. The program must be designed to protect the security and confidentiality of the information and to guard against unauthorized access likely to cause a material risk of identity theft or fraud.

Scale and scope are judged by the entity’s size and complexity, the nature of its activities, the sensitivity of the information, the cost of available tools and its resources. An entity meeting these conditions is entitled to an affirmative defense to tort claims under Ohio law alleging that a failure to implement reasonable security controls resulted in a data breach.

Section 1354.03 lists the frameworks: the NIST Cybersecurity Framework, NIST SP 800-171, NIST SP 800-53 and 800-53A, the FedRAMP security assessment framework, the CIS Critical Security Controls, and the ISO/IEC 27000 family. Regulated entities may instead conform to HIPAA security rules, GLBA Title V or FISMA, and PCI DSS counts only alongside one of the listed frameworks. After a final revision to a framework, the program must reasonably conform within one year.

Applicability

Use this for organizations with Ohio exposure. The defense applies to tort claims and does not replace breach-notice duties under R.C. 1349.19; whether a program qualifies is ultimately a legal question for counsel.

DSE recommendation

DSE recommends that Ohio-exposed organizations document which recognized framework their written security program follows and keep evidence of conformance current. Map existing policies and controls to the chosen framework, record why the program’s scale fits the business, and set a review date whenever the framework publishes a final revision so the one-year window is not missed.

Verification

Each year, have someone outside the IT team compare the written program with the framework mapping and a sample of control evidence, and record the result and open gaps. Check the framework publisher’s site for revisions and log the date the program was updated to match.

Official references

Ohio Laws — Ohio Revised Code 1354.02, Safe harbor requirements. Ohio Revised Code 1354.03 — Reasonable conformance. Reviewed October 18, 2026.