Effective November 2, 2018, companies that suffer a breach may
have certain defenses in Ohio if they have a written cybersecurity
program in place. Under this new law, companies can use
as an affirmative defense the existence of a cyber program in
rebuttal to an argument that they failed to implement reasonable
information security controls, and that failure resulted in a
breach. The definition of breach (and personal information that if
impacted gives rise to a duty to notify) is identical to Ohio's
existing breach notification law. The defense is available if the
company has a written program in place, and that program conforms
to "industry-recognized frameworks" like the National
Institute of Standards and Technology's Framework, ISO 27000,
FedRAMP, PCI Standards, the Security Rule of the Health Insurance
Portability and Accountability Act, or the Safeguards Rule of the
Gramm-Leach-Bliley Act. Anticipating that these frameworks may be
amended from time to time, the
