Ukrainian cybersecurity law: a guide for business

In 2025 Ukraine’s cybersecurity legislation changed significantly: the Verkhovna Rada adopted Law No. 4336-IX, and the Cabinet of Ministers adopted a number of resolutions to implement it. Here is who the requirements apply to, what exactly has changed and what a company should do even if the law places no direct obligations on it.

This article is an overview for managers, not legal advice. Decide with your lawyer, based on the current versions of the documents, whether the requirements apply to your company.

The legislation in force

• Law of Ukraine “On the Basic Principles of Ensuring Cybersecurity of Ukraine” of 05.10.2017 No. 2163-VIII — the core law. It defines the national cybersecurity system and its main actors: the State Service of Special Communications (SSSCIP), the National Police, the Security Service, the Ministry of Defence and the General Staff, the intelligence agencies, the National Bank and the Ministry of Foreign Affairs.
• Law of Ukraine “On Critical Infrastructure” of 16.11.2021 No. 1882-IX — defines critical infrastructure facilities, how they are categorised and entered into the register.
• Law No. 4336-IX of 27.03.2025 — amendments to the laws on information protection and the cyber protection of state information resources and critical information infrastructure facilities. According to the review by the National Cybersecurity Coordination Center, the law was adopted to implement the norms of the European cybersecurity directives.
• Cabinet of Ministers resolutions of 2025 implementing the law — among them the National Cyber Incident Response Plan (No. 1533), amendments to the General Requirements for Cyber Protection of Critical Infrastructure Facilities (No. 1470) and the Procedure for Assessing the State of Cyber Protection (No. 1799).

Who the obligations apply to

The main requirements apply to three groups:

• state and local government bodies;
• owners and operators of critical infrastructure and critical information infrastructure facilities — a large share of which belong to businesses;
• owners of systems that process state information resources or restricted information.

The scale is considerable. According to the review, by the end of 2025 more than 4,600 facilities in 24 sectors had been entered into the Register of Critical Infrastructure Facilities, each with one of four criticality categories. The category determines the level of requirements.

The financial sector is regulated separately. The National Bank of Ukraine is the sectoral cybersecurity regulator for banks, non-bank financial institutions, payment system operators and technological operators of payment services. It sets its own cyber protection and information security audit requirements for them.

If your company has no facilities in the register, does not work with state information resources and is not regulated by the NBU, the obligations described below do not apply to it directly. That does not mean the changes don’t affect you — more on that below.

What changed in 2025

People responsible for cyber protection. State bodies set up cyber protection units and introduce the position of Chief Information Security Officer (CISO). Critical information infrastructure facilities appoint responsible persons and, where needed, set up a unit.

Incident reporting. The law put the national cyber incident response system on a legal footing: the national team CERT-UA plus sectoral and regional response teams. Private teams can join the system too. Owners and administrators of systems covered by the law must report cyber incidents to the relevant response team in the manner set by the authorised body.

Risk management instead of KSZI. The law abandoned “comprehensive information protection systems” (KSZI) in favour of risk management throughout the system life cycle: security profiles, security authorisation and, for some systems, certification against an information security standard. The state of cyber protection is assessed, among other methods, by audit.

Training. The law provides for systematic cyber protection training and cyber hygiene briefings.

Modern frameworks. Among the achievements of 2025, the review lists the implementation of the NIST Cybersecurity Framework 2.0 — an open framework for managing cyber risk.

Why it matters even if you are not critical infrastructure

• Supply chains. According to the review, in 2025 the most common initial access vector for destructive attacks was vulnerabilities in supply chains and compromised VPN accounts without multi-factor authentication. The review also stresses that supplier security requires reworking procurement and contracts. So expect critical infrastructure operators and state bodies to set requirements for software, cloud and IT service providers and to write them into contracts.
• Clients in the EU. The EU NIS2 Directive requires the entities it covers to address supply chain security, including their relationships with direct suppliers and service providers (Article 21). If you work with European clients, expect security questionnaires and contractual requirements.
• Your status can change. The register keeps growing: 2,046 new facilities were added in 2025. Facilities are identified by sectoral authorities, so a company can be given critical infrastructure status and the obligations that come with it.
• Attacks are not limited to the state. Among the targets of destructive attacks in 2025, the review names private companies in agriculture and logistics.

Where to start: a practical plan

1. Determine your status. Do you have facilities in the critical infrastructure register, are you regulated by the NBU, do you process state information resources, what cyber protection requirements are already in your client contracts?
2. Appoint an owner. Even if the law does not require it, cyber protection needs an owner with authority and a budget.
3. Assess your current state against NIST CSF 2.0. The framework has six functions: Govern, Identify, Protect, Detect, Respond and Recover. Go through each and record the gaps.
4. Set up incident detection. Collect and analyse event logs from network equipment, servers, endpoints and cloud services — without them you can neither notice an incident nor document it.
5. Prepare a response plan. Who decides, how affected systems are isolated, whom to notify and when — including CERT-UA and the cyber police.
6. Close the basic risks. Multi-factor authentication for VPN and email, timely updates, backups that cannot be encrypted or deleted from the main network.
7. Train your people. Regular cyber hygiene briefings for all employees.
8. Check your contractors. Define cyber protection requirements for your suppliers and write them into contracts.

Checklist

• You know whether the company has facilities in the critical infrastructure register and whether the NBU regulates it
• Cyber protection requirements from client contracts, including EU clients, are collected
• An owner for cyber protection is appointed
• The current state is assessed against NIST CSF 2.0, with a list of gaps
• Event logs are collected and analysed
• There is an incident response plan with a notification procedure
• Multi-factor authentication for VPN, email and administrators
• Backups are protected from encryption and deletion, restores are tested
• Employees receive cyber hygiene briefings
• Cyber protection requirements for contractors are written into contracts

How Bereg-IT can help

Start with a consultation or an audit: we assess the risks, data protection and compliance with the requirements that apply to your company and prepare a prioritised roadmap. We help implement protection — from network security and NGFW to vulnerability management. And SOC as a Service takes over the collection and analysis of security events, investigation, notification and regular reporting — important for companies with regulatory requirements for logging and incident response.

The first consultation is free. Send a request and an information security specialist will get in touch.

Sources

1. Law of Ukraine “On the Basic Principles of Ensuring Cybersecurity of Ukraine” of 05.10.2017 No. 2163-VIII: https://zakon.rada.gov.ua/laws/show/2163-19
2. Law of Ukraine “On Critical Infrastructure” of 16.11.2021 No. 1882-IX: https://zakon.rada.gov.ua/laws/show/1882-20
3. Law of Ukraine of 27.03.2025 No. 4336-IX on amendments to certain laws of Ukraine on information protection and cyber protection of state information resources and critical information infrastructure facilities: https://zakon.rada.gov.ua/laws/show/4336-20
4. Verkhovna Rada of Ukraine, news on the adoption of bill No. 11290 (27.03.2025): https://www.rada.gov.ua/news/razom/260570.html
5. National Cybersecurity Coordination Center at the NSDC of Ukraine, Review of the National Cybersecurity System of Ukraine 2025 (in Ukrainian) — 2025 resolutions, obligations of critical information infrastructure owners, register data, attack vectors: https://www.rnbo.gov.ua/files/2026/NATIONAL_CYBER_SCC/kiber_2025.pdf
6. NIST, The NIST Cybersecurity Framework (CSF) 2.0, CSWP 29 (26.02.2024): https://nvlpubs.nist.gov/nistpubs/CSWP/NIST.CSWP.29.pdf
7. Directive (EU) 2022/2555 (NIS2), Article 21 — cybersecurity risk-management measures, including supply chain security: https://eur-lex.europa.eu/eli/dir/2022/2555/oj