Video 0:43
Video
Columbus Council to adopt cybersecurity program and renew $775,000 monitoring contract
Read the full articleColumbus City Council is scheduled to formally adopt an updated cybersecurity program under Ohio law and waive competitive bidding on a $775,000 contract renewal with CDW Government LLC. Council also weighs emergency authorization to purchase SolarWinds software products.
How we know this
The sources and records behind this story, with the facts they support.
Columbus City Council · 2026-10-19
Supporting evidence (4)
The published agenda schedules REGULAR MEETING NO. 45 OF COLUMBUS CITY COUNCIL, OCTOBER 19, 2026 at 5:00 P.M. IN COUNCIL CHAMBERS.
Read supporting passage
REGULAR MEETING NO. 45 OF COLUMBUS CITY COUNCIL, OCTOBER 19, 2026 at 5:00 P.M. IN COUNCIL CHAMBERS.
On the agenda, Resolution 0200X-2026 acts to formally adopt the updated City of Columbus Cybersecurity Program pursuant to Ohio Revised Code Section 9.64; to affirm the Department of Technology’s continuing administration and implementation of the Cybersecurity Program pursuant to Columbus City Codes Section 225.011 and to declare an emergency ($0.00).
Read supporting passage
0200X-2026 · To formally adopt the updated City of Columbus Cybersecurity Program pursuant to Ohio Revised Code Section 9.64; to affirm the Department of Technology’s continuing administration and implementation of the Cybersecurity Program pursuant to Columbus City Codes Section 225.011 and to declare an emergency. ($0.00)
On the same docket, Ordinance 2676-2026 authorizes a contract with CDW Government LLC for the renewal of the cybersecurity monitoring software, waiving competitive bidding provisions of the Columbus City Code and authorizing the expenditure of $775,345.17 from the Information Services Operating Fund as an emergency.
Read supporting passage
2676-2026 · To authorize the Director of the Department of Technology to enter into contract with CDW Government LLC for the renewal of the cybersecurity monitoring software; to waive the competitive bidding provisions of the Columbus City Code; to authorize the expenditure of $775,345.17 from the Department of Technology, Information Services Division, Information Services Operating Fund; and to declare an emergency. ($775,345.17)
In a companion measure, Ordinance 2444-2026 authorizes a contract with CDW Government, LLC for the purchase of SolarWinds software products utilizing the State Term Contract, waiving competitive bidding provisions and authorizing the expenditure of $145,103.28 from the Information Services Operating Fund as an emergency.
Read supporting passage
2444-2026 · To authorize the Department of Technology to enter into contract with CDW Government, LLC for the purchase of SolarWinds software products utilizing the State Term Contract; to waive the competitive bidding provisions of the Columbus City Codes; and to authorize the expenditure of $145,103.28 from the Department of Technology, Information Services Operating Fund; and to declare an emergency. ($145,103.28)
https://codes.ohio.gov/ohio-revised-code/section-9.64
Supporting evidence (7)
The governing statute was Enacted by House Bill 96 - 136th General Assembly, effective September 30, 2025.
Read supporting passage
September 30, 2025 – Enacted by House Bill 96 - 136th General Assembly
Under the statute, the legislative authority of a political subdivision shall adopt a cybersecurity program that safeguards the political subdivision's data, information technology, and information technology resources to ensure availability, confidentiality, and integrity, consistent with generally accepted best practices such as the national institute of standards and technology cybersecurity framework and center for internet security cybersecurity best practices.
Read supporting passage
The legislative authority of a political subdivision shall adopt a cybersecurity program that safeguards the political subdivision's data, information technology, and information technology resources to ensure availability, confidentiality, and integrity. The program shall be consistent with generally accepted best practices for cybersecurity, such as the national institute of standards and technology cybersecurity framework, and the center for internet security cybersecurity best practices
In addition, the statute requires local governments to establish cybersecurity training requirements for all employees of the political subdivision, with training provided by the state or the Ohio persistent cyber initiative program of the Ohio cyber range institute satisfying the requirements.
Read supporting passage
Establish cybersecurity training requirements for all employees of the political subdivision; the frequency, duration, and detail of which shall correspond to the duties of each employee. Annual cybersecurity training provided by the state, and training provided for local governments by the Ohio persistent cyber initiative program of the Ohio cyber range institute, satisfy the requirements of this division.
Under state law, a political subdivision experiencing a ransomware incident shall not pay or otherwise comply with a ransom demand unless the political subdivision's legislative authority formally approves the payment or compliance with the ransom demand in a resolution or ordinance that specifically states why the payment or compliance with the ransom demand is in the best interest of the political subdivision.
Read supporting passage
A political subdivision experiencing a ransomware incident shall not pay or otherwise comply with a ransom demand unless the political subdivision's legislative authority formally approves the payment or compliance with the ransom demand in a resolution or ordinance that specifically states why the payment or compliance with the ransom demand is in the best interest of the political subdivision.
Under the law, the legislative authority of a political subdivision, following each cybersecurity incident or ransomware incident, shall notify the executive director of the division of homeland security within the department of public safety not later than seven days after discovery, and notify the auditor of state not later than thirty days after discovery.
Read supporting passage
The legislative authority of a political subdivision, following each cybersecurity incident or ransomware incident, shall notify both of the following: (1) The executive director of the division of homeland security within the department of public safety, in a manner prescribed by the executive director, as soon as possible but not later than seven days after the political subdivision discovers the incident; (2) The auditor of state, in a manner prescribed by the auditor of state, as soon as possible but not later than thirty days after the political subdivision discovers the incident.
Under state statute, any records, documents, or reports related to the cybersecurity program and framework in division (C) of this section, and the reports of a cybersecurity incident or ransomware incident under division (D) of this section, are not public records under section 149.43 of the Revised Code.
Read supporting passage
Any records, documents, or reports related to the cybersecurity program and framework in division (C) of this section, and the reports of a cybersecurity incident or ransomware incident under division (D) of this section, are not public records under section 149.43 of the Revised Code.
The statute establishes that a record identifying cybersecurity-related software, hardware, goods, and services, that are being considered for procurement, have been procured, or are being used by a political subdivision, including the vendor name, product name, project name, or project description, is a security record under section 149.433 of the Revised Code.
Read supporting passage
A record identifying cybersecurity-related software, hardware, goods, and services, that are being considered for procurement, have been procured, or are being used by a political subdivision, including the vendor name, product name, project name, or project description, is a security record under section 149.433 of the Revised Code.
Columbus Council Weighs $19.2M Refinancing for Zero Trust IT Debt
Supporting evidence (1)
Previously, Columbus Council Weighs $19.2M Refinancing for Zero Trust IT Debt.
Read supporting passage
Columbus Council Weighs $19.2M Refinancing for Zero Trust IT Debt
Supporting evidence (1)
In that earlier refinancing measure, council considered legislation to authorize the issuance of limited tax bond anticipation notes in an amount not to exceed $19,165,000.00 for the purpose of refunding outstanding bond anticipation notes, to authorize the expenditure of $23,894,400.00 from the Info Services Operating Fund and the Info Services Debt Retirement Fund, and to declare an emergency.
Read supporting passage
To authorize the issuance of limited tax bond anticipation notes in an amount not to exceed $19,165,000.00 for the purpose of refunding outstanding bond anticipation notes; to authorize the appropriation of $19,165.000.00 in the Info Services Debt Retirement Fund; to authorize the expenditure of $23,894,400.00 from the Info Services Operating Fund and the Info Services Debt Retirement Fund; and to declare an emergency. ($23,894,400.00)