Chapter 3301-3 | Data Acquisition Sites

Rule 3301-3-01 | Scope and definitions.

• Effective: October 8, 2026
• Promulgated Under: 119.03

(A) Pursuant to section 3301.075 of the Revised Code, all Ohio education computer network user entities and information technology centers will comply with all rules in this chapter.

(B) Terminology used in this chapter are defined as follows:

(1) "Accountability system for the Ohio education computer network" (OECN) means the collective grouping of instruments used by the department of education and workforce to determine the quality and adequacy of services provided by an information technology center. These instruments may include, but not be limited to, the following: any materials produced by other governmental agencies or trusted third parties at the request of the department or in the normal course of doing business; user satisfaction surveys; quality implementation metrics; service-level agreements and compliance therewith; site reviews; and continuous improvement plans.

(2) "ADM" means total average daily membership by school building and district as certified by the department from data collected from districts during the designated EMIS counting period, as published in the school district payment report of either the second report in March or the second report in July, whichever is most recent, or any report designated by the department as a replacement for the school district payment report.

(3) "Biometrics" means to verify the identity of and establish a user's permission to access a network, computer system, or software application by means of unique physical characteristics such as fingerprints, palm prints, or retina scans.

(4) "Business continuity plan" and "disaster recovery plan" may be used interchangeablyto mean a document defining actions that will be taken to restore or replicate operations in the event of an unplanned and extended service outage.

(5) "Continuous improvement plan" means an annual report produced by an information technology center that describes actions to improve the quality of services, customer satisfaction, or operation efficiencies of the information technology center.

(6) "Corrective action plan" means a plan developed by an information technology center, in cooperation with the department, outlining a course of action intended to return the information technology center to full compliance with rule 3301-3-05 of the Administrative Code.

(7) "Core services" are the minimum set of state-subsidized information technology services that each information technology center will offer to its user entities as determined by the department. This minimum set of information technology services will be determined through policies issued and guidelines periodically communicated by the department. These services may include, but are not limited to, any of the following:

(a) Fiscal services, including accounting (cash basis with generally accepted accounting practice extensions), payroll/personnel, and fixed asset accounting;

(b) Student records management, including provisions for student scheduling, grade reporting, attendance tracking, and tracking of special education needs;

(c) State-mandated data reporting, including access to the appropriate department databases and software applications;

(d) Library automation, curricular resources, and educational technology services to support academic content standards and effective instruction;

(e) Internet access and networking services, including email and the support of data exchange within an information technology center's user entities and across different information technology centers and their user entities.

(8) "Council of governments" (COG) means a regional organization of public governmental entities established pursuant to Chapter 167. of the Revised Code.

(9) "Data release policy" means a formal policy adopted by an information technology center to describe the process, permissions, and controls used to determine how data held in trust by the information technology center may be shared with other parties upon request.

(10) "Data retention policy" means a formal policy adopted by an information technology center to describe the methods and timeline for preserving and/or appropriately disposing of a user entity's historical data.

(11) "Department" means the department of education and workforce.

(12) "District" means any city, county, exempted village, local, joint vocational, or cooperative education school district as classified pursuant to section 3311.01 of the Revised Code or any public community school as classified pursuant to section 3314.01 of the Revised Code.

(13) "Electronic format" means a method of organizing data elements that enables data generated by one computer system to be read and used by another computer system without further human adjustment or modification of the transfer medium.

(14) "Electronic networking" means a data communication configuration in which two or more devices are connected to enable information transfer. Such a configuration permits the electronic linkage of computer systems over a large geographic area.

(15) "End user" means any employee of a user entity who interacts with an information technology center and is a direct recipient and benefactor of the core services.

(16) "Fiscal agent" means a board of education or governing board of a school district, educational service center, or council of government that has been designated by a computer consortium's governing body to function as the custodian of funds for that consortium organization pursuant to section 3313.92 of the Revised Code, or a treasurer licensed in accordance with section 3301.074 of the Revised Code and employed by an information technology center organized as a council of governments pursuant to Chapter 167, of the Revised Code.

(17) "Governing body" means the collective group of user entity representatives with authority to determine the operational management of the information technology center as established by the information technology center governance document.

(18) "Governance document" means the formal document approved by the user entities of an information technology center to delineate the organizational structure and operational rules of the information technology center and outline the responsibilities assigned to key management roles.

(19) "Incident response plan" means a document defining actions that will be taken to detect, identify, mitigate, and report a security breach or data loss.

(20) "Information technology" means that whole body of methods and materials, including the use of computer systems and related electronic devices, that is utilized to process information.

(21) "Information technology center" (ITC) means an entity that has been authorized pursuant to section 3301.075 of the Revised Code and authorized by the department to provide core services to user entities.

(22) "Multifactor authentication" means a multi-step process used to verify the identity of a user and establish the user's permission to access a network, computer system, or software application.

(23) "Ohio education computer network" (OECN) means that collective group of information technology centers authorized pursuant to section 3301.075 of the Revised Code, and their participating school districts and community schools. Such centers, in conjunction with the department, comprise a statewide delivery system to provide comprehensive, cost-efficient information technology services for participating Ohio school districts and community schools.

(24) "Quality implementation metrics" are the data reported to the department that reflect information technology center actual performance relative to the quality implementation standards.

(25) "Quality implementation standards" are the benchmarks set by the department for successful delivery of core services.

(26) "Security token" means an electronic device carried by an individual for use in multifactor authentication.

(27) "Site permit" or "permit" means a document issued by the department recognizing and authorizing an entity organized pursuant to rule 3301-3-02 of the Administrative Code to operate as an information technology center.

(28) "Site review" means an on-site peer review conducted by the department or its designee as a means to assess the effectiveness of the delivery of core services and the general user entity satisfaction of an information technology center.

(29) "User entity" means any organization authorized by the department to utilize the services of an information technology center. Such a user entity will have voting representation in the information technology center. The user entity may be any district or community school as defined in paragraph (B)(12) of this rule or any other public entity as determined by the department.

Last updated September 28, 2026 at 11:24 AM

Supplemental Information

Authorized By: 3301.07, 3301.075
Amplifies: 3301.075
Five Year Review Date: 10/8/2031

Rule 3301-3-02 | Eligibility to establish an information technology center.

• Effective: October 8, 2026
• Promulgated Under: 119.03

(A) As provided under section 3301.075 of the Revised Code, an information technology center is established by user entities, and is deemed eligible pursuant to this rule.

(B) A user entity meets the definition in paragraph (B)(29) of rule 3301-3-01 of the Administrative Code and uses or expresses the intent to use services provided by an information technology center.

(C) Information technology center permit eligibility.

(1) User entities desiring to establish an information technology center that meets the classification described in paragraph (A) of this rule will apply to the department for the appropriate site permit and provide each of the following:

(a) An organizational governance document ratified by the governing body of each proposed participating user entity of the information technology center that will be reviewed by legal counsel for compliance with Chapter 167. of the Revised Code or section 3313.92 of the Revised Code;

(b) Document a minimum of twenty user entities that will consume services of this information technology center and, pursuant to the definition of ADM in paragraph (B)(2) of rule 3301-3-01 of the Administrative Code, a minimum aggregate ADM of twenty-five thousand students of user entities contracted to receive core services;

(c) Provide a schedule consistent with rule 3301-3-06 of the Administrative Code demonstrating a minimum of staffing, training, resources, and procedural operations to deliver core services;

(d) Formally demonstrate and substantiate to the department the need for an additional information technology center and how, if approved, this center would enhance the overall capabilities of the Ohio education computer network;

(e) Be fully considered for approval by the department.

(2) Two or more information technology centers desiring to combine operations with the intent of establishing a new information technology center will do each of the following:

(a) Demonstrate the action to combine operations has been approved by the governing bodies of each participating information technology center;

(b) Each hold a valid site permit as described in rule 3301-3-03 of the Administrative Code;

(c) Comply with guidelines as established by the department, apply for a new site permit, and be fully considered for approval by the department;

(d) Complete a site review within two fiscal years following the date the information technology centers are combined, which, subject to the completion of a corrective action plan or satisfying any additional follow-up actions requested by the department resulting from the site review, will establish the time until the next site review as specified in paragraph (E) of rule 3301-3-03 of the Administrative Code;

(e) Comply with paragraph (C)(1) of this rule, endeavor to conclude business as separate operations, and surrender all existing site permits at such time as pre-existing contractual obligations of each participating information technology center are fully resolved.

Last updated October 8, 2026 at 7:55 AM

Supplemental Information

Authorized By: 3301.07, 3301.075
Amplifies: 3301.075
Five Year Review Date: 10/8/2031
Prior Effective Dates: 5/1/1979, 9/23/2005

Rule 3301-3-03 | Information technology center site permit validity, renewal, and revocation.

• Effective: October 8, 2026
• Promulgated Under: 119.03

(A) To retain or renew a site permit, an information technology center with an existing site permit will do each of the following:

(1) For information technology centers in existence as of January 1, 2023, maintain a minimum base of twelve user entities that are provided with core services or have a minimum aggregate ADM of twenty-thousand students. For any entity not classified as an information technology center as of January 1, 2023, maintain a minimum base of twenty user entities that are provided with core services and have a minimum aggregate ADM of twenty-five-thousand students. The count of user entities and ADM is pursuant to the respective definitions in rule 3301-3-01 of the Administrative Code.

(2) Fully comply with responsibilities and performance as defined in rule 3301-3-06 of the Administrative Code;

(3) Fulfill the accountability and reporting processes and guidelines as established by the department, including use of accountability system components as defined in paragraph (B)(1) of rule 3301-3-01 of the Administrative Code.

(4) The site permit will be renewed upon completion of a site review and demonstration of compliance with rule 3301-3-06 of the Administrative Code.

(B) Information technology centers desiring to renew a site permit will apply to the department and do both of the following:

(1) Maintain the eligibility as described in paragraph (A) of this rule;

(2) Submit for review by the oversight committee described in paragraph (E) of rule 3301-3-05 of the Administrative Code.

(C) An information technology center not compliant with paragraph (A) of this rule may petition the department for renewal upon submitting a corrective action plan describing how it will achieve compliance within a timeframe mutually determined by the information technology center and the department, but otherwise not to exceed three years. A petition to correct the same issue may be exercised only once within two consecutive renewal applications.

(D) An information technology center desiring to acquire the assets, liabilities, user entities, and business operations of another information technology center will do each of the following:

(1) Demonstrate the action to combine operations has been approved by the governing bodies of each participating information technology center;

(2) Hold valid site permits as described in paragraph (A) of this rule;

(3) Fulfill guidelines as established by the department and be considered for approval by the department;

(4) Complete a site review within two fiscal years following the acquisition, which, subject to the completion of a corrective action plan or any additional follow-up actions requested by the department resulting from the site review, will establish the time until the next site review as specified in paragraph (E) of this rule;

(5) Comply with all aspects of paragraph (A) of this rule, endeavor to conclude business as separate operations, and surrender the existing site permit of the acquired information technology center at such time as pre-existing contractual obligations of the acquired information technology center are fully resolved.

(E) Any site permit issued by the department under this rule will remain valid starting on the first day of the fiscal year following the last site review and for a period of five years, unless any of the following apply:

(1) The permit is surrendered by the permit holder;

(2) The permit is revoked by the department pursuant to the provisions of Chapter 119. of the Revised Code for failure to comply with the rules of this chapter;

(3) The permit validity timeline is adjusted in response to paragraph (F) of this rule.

(F) The department may exercise discretion to waive or defer all or portions of this rule in response to a situation deemed beyond the control of the department or the information technology centers, including but not limited to, a declaration of public emergency, calamity, disaster, or limitations of funding or other resource constraints.

Last updated October 8, 2026 at 7:55 AM

Supplemental Information

Authorized By: 3301.07, 3301.075
Amplifies: 3301.075
Five Year Review Date: 10/8/2031
Prior Effective Dates: 5/1/1979, 6/19/1987, 11/4/2021, 6/7/2024

Rule 3301-3-05 | Responsibilities of the department.

• Effective: October 8, 2026
• Promulgated Under: 119.03

The department will do each of the following:

(A) Work with information technology centers to develop, articulate, implement and manage an integrated, efficient, and secure system of information technology services and support for educational entities; and data exchange;

(B) Work with information technology centers to define and communicate core services and quality implementation standards for those services;

(C) Work with information technology centers to ensure the deployment of an accountability system to promote the quality delivery of core services and uniform reporting of quality implementation standards by information technology centers, including the use of any accountability system components as described in paragraph (B)(1) of rule 3301-3-01 of the Administrative Code;

(D) Oversee a system of site-permit application, issuance, renewal, and revocation.The department will issue the site permit of each information technology center submitted for renewal upon completion of a site review, demonstration of compliance, including compliance with rule 3301-3-07 of the Administrative Code, and submission of a corrective action plan if the information technology center is not in compliance.

(E) Designate a committee comprised of the information technology center representatives to provide advice and guidance regarding core services, administration, operational procedures, funding, and future direction of the Ohio education computer network (OECN);

(F) As authorized by the Ohio general assembly, provide funding to subsidize the delivery of core services by information technology centers to their user entities;

(G) Provide for a system to enable information technology centers to document user entities receiving core services in order to facilitate the calculation and distribution of subsidy funding and to demonstrate compliance with the paragraph (C) of rule 3301-3-02 or paragraph (A) of rule 3301-3-03 of the Administrative Code.

Last updated October 8, 2026 at 7:55 AM

Supplemental Information

Authorized By: 3301.07, 3301.075
Amplifies: 3301.075
Five Year Review Date: 10/8/2031
Prior Effective Dates: 6/19/1987, 7/1/1995

Rule 3301-3-06 | Responsibilities of information technology centers.

• Effective: October 8, 2026
• Promulgated Under: 119.03

An information technology center will do all of the following:

(A) Promote a cooperative and integrated system of information technology for its user entities as well as among other information technology centers;

(B) Promote and administer the efficient and cost-effective implementation of information technology that supports information technology strategies of the department and all user entities;

(C) Coordinate innovative uses of information technology that support the goals of the department, information technology center, and all user entities;

(D) Provide for electronic networking capabilities between and among user entities and the information technology center, support connectivity to the department or its designee, and maintain a system of electronic contact information as specified by the department;

(E) Ensure that all data acquired on behalf of user entities are held in trust for those entities. Any transfer or release of any user entity's data will not occur until prior authorization is received from that specific entity. Upon receipt of district authorization, an information technology center will transfer or return district data without delay or impediment;

(F) Offer core services to all user entities, provide districts with the opportunity to obtain services on an individual-service basis and assist districts in obtaining services from one or more information technology centers of their choosing;

(G) Post on its public website a list of all the services that it provides and the corresponding cost for each of those services.

Last updated October 8, 2026 at 7:55 AM

Supplemental Information

Authorized By: 3301.07, 3301.075
Amplifies: 3301.075
Five Year Review Date: 10/8/2031
Prior Effective Dates: 4/1/1972

Rule 3301-3-07 | Performance standards.

• Effective: October 8, 2026
• Promulgated Under: 119.03

Information technology centers will meet each of the following :

(A) Governance - agreement/constitution

(1) The agreement between user entities establishing an information technology center, and any modification to the agreement, will be ratified by all user entities, comply with section 3313.92 or Chapter 167. of the Revised Code, reviewed by legal counsel for compliance with section 3313.92 or Chapter 167. of the Revised Code, and be communicated to the department.

(2) The agreement will include such provisions for a governing assembly as a board of directors or an executive committee.

(3) The agreement will include provisions for a systematic approach to encourage participation that is representative of all end users and governance that is representative of all user entities.

(4) The agreement will define the responsibilities of each component of the organizational structure.

(5) The information technology center's governing authority rests with the board of directors or the governing assembly rather than the fiscal agent.

(6) The agreement will set forth the process of change and define how organizational changes are to occur, including, amending the agreement, changing the fiscal agent, adding and withdrawing membership, and changing officers.

(7) The information technology center's governance document will contain language that holds harmless the fiscal agent for any liabilities, obligations, claims, damages, penalties, causes of action, costs or expenses relating to the operation and activities of the information technology center. Amounts to be paid in settlement of any such claims or damages, including attorneys' fees and costs and expenses, will be apportioned among all districts participating in the information technology center to the extent permitted by law.

The provisions of paragraph (A)(7) of this rule would not be applicable to cases of misfeasance, malfeasance, nonfeasance, or other illegal or inappropriate activities directly attributed to the actions of the fiscal agent.

(8) All governance policies and procedures, as well as daily site operations, will be in accordance with the information technology center's current by-laws, agreement(s), or both.

(9) All information technology centers will maintain fully executed contractual agreements with their user entities. The contractual agreement between the information technology center and its user entities will specify at a minimum the quality implementation standards, as defined by the department, for all core services, as well as any additional fees to supplement state subsidy for the core services.

(B) Fiscal operations standards

(1) Local fiscal operations

(a) The information technology center will demonstrate the appropriate appointment and utilization of a fiscal agent.

(i) An information technology center organized under section 3313.92 of the Revised Code will designate one user entity participating in the consortium agreement to act as fiscal agent.

(ii) An information technology center organized as a council of governments in accordance with Chapter 167. of the Revised Code may employ its own treasurer to assume all financial responsibilities or may elect to designate one user entity participating in the council to act as fiscal agent.

(iii) The fiscal agent treasurer or the treasurer employed by a council of governments is responsible for all financial transactions associated with the information technology center.

(iv) The fiscal agent treasurer or the treasurer employed by a council of governments will be licensed in accordance with section 3301.074 of the Revised Code.

(b) Financial accounting records of information technology center activities will be separately maintained and be auditable.

(i) Information technology centers will perform all financial transactions and accounting procedures in compliance with applicable laws of the state of Ohio and standards established by the auditor of state.

(ii) Information technology centers will establish, define, and adhere to procedures for receipting expenditures and accounting and equipment acquisition, inventory, and disposition.

(c) The appropriate governing bodies of the information technology center will approve all fee assessments, contracts, employee compensation and benefits, as well as initial and modified appropriations, as evidenced by official meeting minutes.

(d) The board of directors or the governing assembly will be provided access to the following:

(i) Detailed fiscal reports for each regular board of directors or governing assembly meeting.

(ii) Other reports upon request.

(2) Financial condition

(a) Amortization periods for the retirement of indebtedness will not exceed the recommended schedules for depreciation as established by the internal revenue service.

(b) The information technology center will establish a schedule of fees for services that, in combination with state subsidy funding, cash reserves, and other sources of revenue, will generate operating funds sufficient to meet anticipated expenditures.

(C) Operating standards

(1) Organization

(a) The information technology center will hold a valid permit and maintain compliance with the criteria established for that permit as identified in rule 3301-3-03 of the Administrative Code.

(b) The information technology center will comply with section 3301.075 of the Revised Code and with the OECN line item appropriation language contained in the state budget as currently enacted.

(c) The information technology center as organized in accordance with either Chapter 167. or section 3313.92 of the Revised Code will provide a current copy of its organizational agreement(s) for review during the site review specified in paragraph (A)(2) of rule 3301-3-04 of the Administrative Code and upon request by the department and/or the public.

(2) Core services

(a) Core services will be delivered based upon the quality implementation standards communicated by the department.

(b) All software and hardware used by information technology center will enable efficient and effective end-user access to the core services.

(c) Equipment for computer systems or support services may be shared among and between multiple information technology centers in order to increase operational efficiencies, lower operating costs, and/or to improve service reliability.

(d) Contractual agreements will be executed with user entities across all core service areas specifying the areas of service (e.g. software management, data management, training, problem resolution, documentation, communication and quality of service), responsibilities of the information technology center and the user entity for each area of service, and quality implementation standards for each area of service.

(e) Specific guidelines applying to internet access and networking services

(i) The speed and reliability of the network will be commensurate with department standards and provide for optimal performance for end users.

(ii) Standards established by the department for connectivity will be maintained by the information technology center.

(iii) The information technology center is responsible for any repairs or maintenance to the network and equipment for accessing the internet.

(iv) The information technology center will coordinate and manage an integrated services network that may include, but not be limited to, voice, video, and data services. Any educational entity desiring to be connected will have the option of access and the primary internet service provider(s) will involve the network and provider(s) selected by the department.

(3) Reports

(a) The information technology center will file with the department a continuous improvement plan that meets department guidelines and timeframes as set by the department. The report will include tthe information technology center's planned versus actual delivery of core services based upon quality implementation standards. The report will inform the department-managed accountability system for the OECN. The information technology center will respond in writing to the department and/or make operational adjustments as directed by the department if deficiencies are noted in the department's review of the continuous improvement plan.

(b) The information technology center will implement an automated help-desk system with quality implementation standards defined by the department in partnership with the OECN. The system will, at a minimum, facilitate communication and problem resolution among user entities and escalation to appropriate information technology center staff across the OECN, as well as with the department. The system will enable the reporting of quality implementation metrics for the core services to the department and provide data for the department-managed accountability system for the OECN.

(c) Detailed financial records of the information technology center for the current and previous fiscal year transactions will be made available to the department during the site review conducted pursuant to rule 3301-3-04 of the Administrative Code. Financial records will also be made available to the department within sixty days of the end of the fiscal year in an electronic format as specified by the department.

(4) Business continuity, security, data release, and other safeguards

(a) The information technology center will follow the political subdivision cybersecurity inpursuant to section 9.64 of the Revised Code.

(b) The information technology center will develop, document, implement, and, at a minimum, annually test business strategies, including one or more of disaster recovery, business continuity, incident response, or other emergency preparedness plans.

(c) The information technology center will establish and implement processes for protecting systems and user data, including but not limited to each of the following:

(i) Secure systems in a monitored and controlled access environment;

(ii) Restrict access to systems, and especially systems with sensitive information, to only those whose job access is necessary;

(iii) Review system access accounts at least annually to confirm access remains necessary;

(iv) Maintain standards for user authentication, including but not limited to password length, password complexity, password lifetime, or use of multifactor authentication, security tokens, or biometrics.

(d) The information technology center staff will be bonded, at a level determined by the information technology center's governing body, for the faithful performance of their duties.

(e) The information technology center will have insurance coverage for all fixed assets.

(f) A data-retention policy will be written, implemented, and communicated to all user entities, that specifies how data are stored and restored and the method for disposal of data.

(g) The computer system will be reviewed at regular intervals to ensure sufficient system performance and data security.

(h) The information technology center will not modify in any respect software or associated data structures provided by the department without the prior written approval from the director of education and workforce or the director's designee.

(i) A written data release policy will be implemented and communicated by the information technology center. The policy will describe the process for requesting a release, return, or transfer of data. A release, return, or transfer of data will occur no later than ten business days following the district's request, unless otherwise specified and agreed upon by both the district and the information technology center.

(5) Information technology center personnel

(a) Staffing levels are to be sufficient to meet the service needs of the user as measured by end-user and staff satisfaction. Personnel assignments will ensure that user support needs are met and that all core services are successfully delivered.

(b) All staff will have training and/or experience necessary to perform the duties contained in their job descriptions and tasks assigned.

Last updated September 28, 2026 at 5:40 PM

Supplemental Information

Authorized By: 3301.07, 3301.075
Amplifies: 3301.075
Five Year Review Date: 10/8/2031
Prior Effective Dates: 4/1/1972, 5/1/1979, 9/23/2005