Resolution Adopting a Cybersecurity Policy Per Ohio Revised Code §9.64

Resolution: 2025 – 001

WHEREAS, the State of Ohio has implemented Ohio Revised Code §9.64, enacted in HB 96 (136th General Assembly), requiring all local governments and jurisdictions to establish a cybersecurity policy to be effective as of September 30, 2025; and

WHEREAS, the purpose of this requirement is to strengthen protections of public data, information systems and technology resources from cybersecurity threats and risks;

WHEREAS, the Scioto County Public Library recognizes the importance of safeguarding sensitive and confidential information entrusted to the Board of Trustees and staff of the Library; and

WHEREAS, a draft Cybersecurity Policy has been prepared and reviewed by staff and is recommended for adoption as a framework for compliance with Ohio Revised Code §9.64 and HB 96; and

WHEREAS, the policy provides guidance on access control, system security, data protection, incident response, training and vendor management, while requiring consultation with IT professionals and legal counsel for implementation and customization;

NOW, THEREFORE, BE IT RESOLVED:

1. The attached Cybersecurity Policy is hereby adopted as the official policy of the Scioto County Public Library.
2. The policy shall take effect on September 30, 2025, and implementation of technical and training requirements no later than June 30, 2026, as provided by the Ohio Auditor of State.
3. The Scioto County Public Library shall distribute the adopted policy to all departments, employees, and relevant contractors, and to ensure compliance in partnership with IT providers and legal counsel.

Cybersecurity Policy Draft

Scioto County Public Library (SCPL) is committed to safeguarding all data, systems, and resources. This policy establishes a cybersecurity program that ensures the availability, confidentiality, and integrity of SCPL information.

1. Cybersecurity Program Components

• Inventory and control of business assets and data
• Risk assessments and vulnerability management of data and systems
• Cyber hygiene assessments and system log review
• Access controls and user authentication including MFA and rule of least privilege
• Data encryption for sensitive information
• Incident response and business continuity planning
• Antivirus/Malware and Firewall protective measures
• Network infrastructure design and management

2. Annual Cybersecurity Training

All staff members will receive annual cybersecurity training corresponding to the duties of each employee. Training will cover at a minimum:

• Phishing and social engineering
• Password security and multi-factor authentication
• Proper use of IT resources
• Reporting procedures for suspicious activity

3. Cybersecurity Incident Reporting

In the event of a cybersecurity breach or ransomware attack, the incident must be reported promptly to the appropriate internal authorities and, as required, to external regulatory bodies. The incident response team will follow established protocols to:

• Contain the breach
• Investigate the cause
• Notify affected parties
• Implement corrective actions

4. Ransomware Incident Protocols

Our organization prohibits payment or compliance in response to ransomware attacks, unless a resolution by the SCPL Board of Trustees specifies:

• All conditions of SCPL Policy are met
• The payment is necessary to prevent imminent harm to public safety
• Why the payment or compliance is in the best interest of the library

5. Incident Response Planning and Testing

Our organization has established an incident response protocol to ensure a swift and effective response to cybersecurity incidents. This plan includes:

• Defined roles and responsibilities for the incident response team
• Procedures for identifying, containing, and mitigating incidents
• Communication protocols for internal and external stakeholders
• Post-incident analysis and lessons learned
• The incident response plan will be reviewed and tested at least once per year through simulated cyberattack drills or tabletop exercises.

6. Continuous Improvement

The cybersecurity program will be reviewed and updated annually to ensure it remains effective and aligned with evolving threats and regulatory requirements.

7. Public Records Exemption

Cybersecurity program documents, incidents reports, and security procurement records are not public records:

• Any records, documents, or reports related to the cybersecurity program and framework, and the reports of a cybersecurity incident or ransomware incident, are not public records under section 149.43 of the Ohio Revised Code.
• A record identifying cybersecurity-related software, hardware, goods, and services, that are being considered for procurement, have been procured, or are being used by SCPL, including the vendor name, product name, project name, or project description, is a security record under section 149.433 of the Ohio Revised Code.

Incident Response Plan (IRP)

1. Purpose

Our organization has established an incident response protocol to ensure a swift and effective response to cybersecurity incidents. This plan is designed to minimize damage, reduce recovery time, and prevent future incidents.

2. Roles and Responsibilities

• Team Lead – Oversees the incident response process and makes strategic decisions.
• IT Security Manager – Coordinates technical response, including containment and mitigation.
• Communications Lead – Manages internal and external communication related to the incident.
• Legal Counsel – Provides legal guidance, especially regarding data breach notification laws and compliance.
• Human Resources (HR) – Handles internal employee communication and support, especially in cases involving employee-related incidents.
• Administrative Lead – Provides high-level oversight and ensures alignment with organizational goals and policies.

3. Incident Identification and Containment

• Identification: All staff are trained to recognize and report potential cybersecurity incidents (e.g., ransomware, phishing, data breaches).
• Containment: The IT Security Manager will oversee isolation of affected systems to prevent further spread of the incident. This may include disconnecting systems from the network or disabling compromised accounts.
• Mitigation: Steps will be taken to resolve the threat and restore systems to a secure state.

4. Communication Protocols

• Internal Communication: The Communications Lead will notify all relevant parties through email, internal messaging systems, etc.
• External Communication: If required by law or policy, Legal Counsel will oversee communication with external parties, including affected individuals, regulatory bodies, and law enforcement.
• Mandatory Reporting Compliance with ORC Section 9.64: Within 7 days, report incidents to The Ohio Department of Public Safety/Ohio Homeland Security Ohio Cyber Integration Center. Within 30 days, report incidents to the Ohio Auditor of State.

5. Post-Incident Analysis and Lessons Learned

• After the incident is resolved, the Team Lead will oversee a post-incident analysis to determine the root cause, assess impact, and evaluate effectiveness of the response.
• A lessons learned report will be created and shared with the team. Recommendations for improving this plan and overall cybersecurity measures will be included in the report.

6. Plan Review and Testing

• This plan will be reviewed and updated at least once per year.
• Simulated cyberattack drills or tabletop exercises will be conducted annually to test the plan and ensure preparedness.
• These exercises will help identify gaps in the plan and ensure that all personnel are prepared to respond effectively in real-world scenarios.

Notary Services Policy

Scioto County Public Library offers free, limited Notary Public services for the benefit of the residents of our community. These services are provided in accordance with Ohio Revised Code Chapter 147 and the rules of the Ohio Secretary of State. Notary services are a convenience offered by the Library and are not a substitute for legal counsel. Library staff who are commissioned notaries are prohibited from providing legal advice or preparing documents.

Notary services are normally available weekdays between the hours of 10:00am and 5:00pm, though hours may vary by library branch location. Patrons are strongly encouraged to call ahead to confirm that a notary will be available and that the document can be notarized. Restrictions may apply regarding specific types of documents.

The Library’s free notary service is intended for simple documents that do not require specialized expertise. Documents must be complete, with no blank spaces other than signature lines, before being presented. The Library Notary may not notarize any signature if the document contains blank spaces. Patrons must sign documents in the presence of the notary. All signers must appear in person, with valid identification.

The Notary must have satisfactory evidence that the person executing the document(s) is the person described in the instrument. The person who will sign the document must provide the Notary with at least one valid and satisfactory form of identification. The Notary will decline to notarize the signature on a document if the signer cannot provide valid and satisfactory identification. Acceptable forms of identification are:

• A current passport from any country, written in English;
• A valid driver’s license from any state of the United States;
• A valid non-driver’s photo identification card from any state of the United States; or
• A United States Military identification card.

Certain public documents cannot be copied and notarized. Some examples of these are: birth certificates, death certificates and marriage certificates.

Notary service is not available for the following:

• Deeds
• Wills
• Living wills
• Living trusts
• Codicils
• Depositions
• Power of Attorney
• Car Titles
• Mortgage or real estate closing documents

The Library will not provide witnesses and witnesses may not be solicited from customers using the library. If a witness is required, the patron must provide their own witness. The witness must also provide valid photo identification if they are signing the document.

Notaries will not provide service if a patron, document, or circumstance of the request for notary service raise any issue of authenticity, ambiguity, doubt, or uncertainty. Each Library Notary retains the right, at their sole discretion, to decline to perform any notarial act if they are not comfortable proceeding, cannot verify identity or intent, or believe the act may create legal risk or violate notarial standards. Such refusal may occur for any reason permitted by law, and the Library will support the notary’s decision. Notaries will maintain an individual journal of each notarial act performed during library work hours.

Notary services must be performed in the Library. The Notary Public will not travel to provide notary services.

Scioto County Public Library will pay for or reimburse employees the cost to become a public notary or renew an existing notary commission with proper receipts and documentation. Please contact the Fiscal Officer prior to filling out a new or renewal application if you intend on SCPL reimbursing notary expenses.

Payment Re-Direct and Business Email Compromise Prevention Policy and Procedure

Purpose

The purpose of this policy is to protect the Scioto County Public Library from financial loss due to fraudulent payment “re-direct” or business email compromise (BEC) schemes. These types of cybercrimes involve criminals impersonating trusted vendors, employees, or partners to fraudulently redirect payments or update banking information.

Policy

The Scioto County Public Library will follow the guidance outlined in Auditor of State Bulletin 2024-003 and take all necessary precautions to prevent payment re-direct and BEC fraud. No changes to payment, banking, or contact information for vendors, employees, or other payees will be processed without proper verification and authorization as outlined in this policy. Failure to adhere to these procedures may result in disciplinary action and, under Ohio law, personal liability if negligence contributes to a financial loss.

Procedures

1) General Verification Requirements

• a) Staff must exercise extreme caution when receiving requests to change banking, payment, or contact information.
• b) Requests made by email, fax, or text message may not be processed until verified through independent contact using information from a trusted source such as a previous invoice, official website, or in-person communication.
• c) In-person or telephone verification is required before approving any change request.

2) Employee Payroll Changes

• a) Employees requesting payroll direct deposit or banking information changes must complete and sign the Library’s Employee Direct Deposit Enrollment Form in person.
• b) The Fiscal Officer or designee will verify the employee’s identity before any changes are made.
• c) Electronic or emailed requests for payroll banking changes will not be accepted.

3) Vendor Payment or Banking Changes

• a) Vendors must provide new banking details on company letterhead signed by an authorized representative.
• b) The Fiscal Officer or designee must verify the request by contacting the vendor using a previously verified phone number (not one provided in the request).
• c) A second staff member should confirm the change before processing.
• d) Documentation of verification (including date, time, and person contacted) must be retained.

4) Warning Signs of Fraud – All staff should be alert to the following indicators of possible fraud:

• a) Slight variations in vendor or employee email addresses.
• b) Urgent or last-minute payment requests.
• c) Misspelled words, poor grammar, or unusual tone.
• d) Unexpected changes in payment methods or contact information.
• e) Suspicious requests must be reported immediately to the Fiscal Officer.

5) Incident Response – If a fraud attempt or suspected compromise occurs:

• a) Immediately notify the Fiscal Officer and Library Director.
• b) Contact the Auditor of State’s Office at: 866-Fraud-OH (866-372-8364) or at fraudohio@ohioauditor.gov.
• c) Preserve all related records and communications.
• d) If funds have been transferred, immediately contact the Library’s financial institution to initiate recovery procedures and follow incident reporting protocol outlined in the cybersecurity policy.

Effective Date: November 20, 2025
Approved By: Scioto County Public Library Board of Trustees on November 20, 2025
Reference: Auditor of State Bulletin 2024-003 – Payment Re-Direct and Business Email Compromise Schemes

Sales Tax Exemption and Reimbursement Policy

I. Purpose

The purpose of this policy is to establish consistent procedures for the reimbursement of sales tax and the proper use of the Scioto County Public Library’s (SCPL) tax-exempt status. This policy ensures compliance with Ohio law and the guidance issued by the Ohio Auditor of State in Bulletin 2025-013, while promoting fiscal responsibility and safeguarding public funds.

II. Policy Statement

As a political subdivision of the State of Ohio, the Scioto County Public Library is exempt from the payment of Ohio sales tax on purchases made directly by and charged to the Library. However, this exemption does not extend to employees making purchases using personal funds or accounts. Employees who make authorized purchases on behalf of the Library using personal credit cards or checking accounts must pay applicable sales tax at the time of purchase. The Library may reimburse employees for both the purchase price and sales tax, provided the expenditure meets the criteria set forth in this policy.

III. Requirements and Restrictions

1. Authorized Purpose: All expenditures must serve a proper public purpose and comply with the Library’s purchasing and reimbursement procedures. Purchases for the Library made with employee’s personal funds must be authorized in writing by the Fiscal Officer and Director prior to the purchase. Authorization exceptions may be made after the purchase for emergency situations.
2. Tax-Exempt Certificate Access: Only employees authorized by the Fiscal Officer may use or access the Library’s tax-exempt certificate. The tax-exempt certificate shall be used only for purchases made directly by and charged to the Scioto County Public Library.
3. Prohibition on Use of Tax-Exempt Certificate for Personal Purchases: Employees are prohibited from using or presenting the Library’s tax-exempt certificate when making purchases with a personal credit card or checking account, even when the purchase is for Library business.
4. Sales Tax Reimbursement: Employees who make authorized purchases using personal funds must pay the sales tax at the point of sale. The Library may reimburse the employee for the full purchase amount, including sales tax, if the expenditure is approved and properly documented. Reimbursement requests must include an itemized receipt showing payment, including any sales tax charged.
5. Direct Library Purchases (Tax-Exempt Transactions): Purchases made directly by the Library (e.g., using the Library’s credit card, purchase order, or account) are not subject to sales tax. Invoices and receipts must clearly indicate that the sale was made to the “Scioto County Public Library.”
6. Recovery of Sales Tax Paid in Error: If sales tax is charged on a purchase made directly by the Library, the Fiscal Officer shall take steps to recover the amount from the vendor or through the Ohio Department of Taxation’s “Sales/Use Tax Application for Refund (STAR)” process.

IV. Reimbursement Threshold

As a best practice to minimize unnecessary sales tax payments, the Library establishes a $500 maximum threshold for reimbursable purchases made using an employee’s personal credit card or checking account. Purchases exceeding $500 (including sales tax) must be made using the Library’s credit card, purchase order, or account to utilize the tax exemption. Exceptions may be approved by the Fiscal Officer in limited, documented circumstances (e.g., emergencies).

V. Documentation and Audit Compliance

Reimbursement requests must include:

• Original itemized receipts or invoices
• Proof of payment (credit card slip, bank statement, etc.)
• Description of the public purpose for the expenditure

The Fiscal Officer shall maintain records of all reimbursements and purchases in accordance with Library retention schedules and audit requirements.

Failure to comply with this policy may result in denial of reimbursement and or disciplinary action.

Effective Date: November 20, 2025
Approved By: Scioto County Public Library Board of Trustees on November 20, 2025
Reference: Auditor of State Bulletin 2025-013 – Reimbursement of Sales Tax by Tax-Exempt Public Offices
Authority: Ohio Revised Code § 5739.02(B)(1), (B)(12)