64, following review in executive session of a program proposed by the Cyber Security Officer and IT Department. The program is to align with NIST and CIS best practices and cover risk identification, threat detection, incident response, recovery, and employee cybersecurity training, including an Incident Response Plan and a ransomware payment decision process. The resolution commits the Board and IT Department to annually review and update the program to address evolving threats, and to ensure third‑party providers meet security standards.While no specific procurement is mentioned, this move signals ongoing and likely increasing needs for cybersecurity tools, monitoring, incident response, training platforms, and third‑party security assessments. Vendors in security software, managed security services, awareness training, and compliance consulting can engage with RTA’s IT leadership as they operationalize and enhance this program over time.

Program records are exempt from Ohio public records law per ORC 9.64 and 149.43; ransomware payments, if ever contemplated, require separate Board resolution.