Clerks, IT leads and managers of small local governments
Free checklist for a town, county or district cybersecurity program and incident plan, with state reporting deadlines and no-cost federal services.
ePlan fills in
How it works
What you get
The check is free. The paperwork after it is drafted at the Emergency operations plan door.
Modeled on: NIST Cybersecurity Framework 2.0 and your state's law (Ohio Rev. Code 9.64 as the worked example)
From public data
is the longest an Ohio town, county or other political subdivision can wait after discovering a cyber or ransomware incident before notifying the state; the state auditor gets 30 days
Source: Ohio Rev. Code 9.64(D)
Draft an emergency operations plan and continuity plan for a small county, town, district or tribe, in FEMA's CPG 101 structure. Free to read.
Questions
In some states. Ohio requires each political subdivision's legislative authority to adopt one consistent with best practices such as the NIST Cybersecurity Framework and CIS, covering items like critical functions and risks, breach impacts, detection, incident handling, repair and employee training.
In Ohio, the legislative authority notifies the state homeland security division within seven days of discovering a cyber or ransomware incident, and the auditor of state within 30 days. Program records and incident reports aren't public records.
Yes. CISA's Cyber Hygiene services, including scanning for vulnerabilities exposed to the internet, are available at no cost to state, local, tribal and territorial governments as well as critical infrastructure organizations.
Related doors
Which jurisdiction is the plan for?
Where is your farm in Pennsylvania?
Which water system needs the plan?
Where is the project in Massachusetts?
Which land, and how many acres?
What is the project, and where?
Answer it and ePlan opens the Emergency operations plan door with your answer filled in.