UA Cybersecurity Law

1. 2026-10-13 Medium
   NBU approves amendments to the Rules for Bank Operations in connection with the introduction of martial law…

   The National Bank of Ukraine approved amendments to the Rules for Bank Operations related to the introduction of martial law in the country. The document defines …

   Amendment Action required

2. 2026-08-16 Low
   Cabinet of Ministers changes approach to ensuring continuity of state information resources

   The government adopted Resolution No. 1009, which changes the logic of ensuring resilience of state information systems and strengthens requirements for backup and protection of state …

   New document Effective 2026-08-06

That is the last 90 days. Sign in to read further back.

1. 2025-10-19 Article 5-1 takes effect: state authorities set up cyber protection units and appoint heads of cyber protection; owners of critical information infrastructure appoint a responsible person
2. 2025-04-20 Law No. 4336-IX enters into force, rewriting the cybersecurity law
3. 2018-05-09 The Law on the Basic Principles of Cybersecurity of Ukraine enters into force

1. 2025-10-19
   Law No. 2163-VIII (edition of 19 October 2025, Law No. 4336-IX) AmendmentCurrent text

   Article 5-1 on cyber protection units and heads of cyber protection, added by Law No. 4336-IX, entered into force six months after that law was published. source

2. 2025-04-20
   Edition of 20 April 2025 (Law No. 4336-IX) Amendment

   Amended by Law No. 4336-IX of 27 March 2025 on protecting information and cyber protection of state information resources and critical information infrastructure objects. source

   More

   • Article 6 was restated: officials of critical infrastructure operators and of owners of critical information infrastructure must meet cyber protection requirements and report cyber incidents, cyberattacks and cyber threats.
   • A new Article 9-1 set up a national system for exchanging information on cyber incidents, with mandatory reporting to the relevant CSIRT; owners of critical information infrastructure must report all significant cyber incidents.
   • A new Article 4(4) bars software and network equipment on an open list of prohibited products from systems processing state information resources and from critical information infrastructure.
   • A new Article 15(4) gave the SSSCIP state control of compliance with cyber protection legislation.
3. 2025-04-03
   Edition of 3 April 2025 (Law No. 4070-IX) Amendment

   Amended by Law No. 4070-IX of 20 November 2024 on the National System of Confidential Communication and the National Electronic Communication Network. source

4. 2024-06-28
   Edition of 28 June 2024 (Law No. 3783-IX) Amendment

   Amended by Law No. 3783-IX of 5 June 2024 on military registration and acquiring war veteran status under martial law. source

5. 2024-04-04
   Edition of 4 April 2024 (Law No. 3549-IX) Amendment

   Amended by Law No. 3549-IX of 16 January 2024 on processing and using data in state registers for military registration and acquiring war veteran status under martial law. source

The duties fall on critical infrastructure operators, owners of critical information infrastructure and public bodies running systems with state information resources.

Objects of cyber protection

Systems of any ownership that process national information resources or serve public authorities, critical information infrastructure objects, and systems used for e-government, electronic public services, e-commerce and electronic document flow (Article 4(2)). source

Critical infrastructure

Officials of critical infrastructure operators and of owners or administrators of critical information infrastructure objects must ensure compliance with cyber protection requirements and report incidents (Article 6(1)). source

Financial sector

The register of critical information infrastructure in the banking system and on non-bank financial markets the National Bank supervises, and for payment system operators, is kept by the National Bank of Ukraine (Article 4(3)). source

Cyber protection state assessments are voluntary or mandatory where legislation requires; named cyber protection heads oversee compliance and significant incidents are reported to a CSIRT.

Cyber protection assessment

Assessment of the cyber protection state of critical infrastructure and critical information infrastructure objects is carried out voluntarily or, in cases set by legislation, mandatorily, taking into account SSSCIP methodological recommendations (Article 6(2)). source

Head of cyber protection

State authorities owning systems with state information resources, official information or state secrets set up cyber protection units and appoint heads of cyber protection (in local self-government bodies, persons performing their functions); owners of critical information infrastructure appoint a person performing that role (Article 5-1). source

Incident reporting

Owners of critical information infrastructure report all significant cyber incidents to the relevant CSIRT, and owners of systems with state information resources report all cyber incidents, in the order and time limits set by the SSSCIP (Article 9-1(3)-(4)). source

The SSSCIP exercises state control; officials who fail to make mandatory incident reports bear administrative liability under law.

State control

The SSSCIP exercises state control over compliance with cyber protection legislation in a procedure set by the Cabinet of Ministers (Article 15(4)). source

Reporting failures

Officials of critical infrastructure operators, owners of critical information infrastructure and owners of systems with state information resources bear administrative liability under law for failing to make mandatory incident reports, or making them late (Article 9-1(6)). source

1. Law text Закон України «Про основні засади забезпечення кібербезпеки України» № 2163-VIII
2. Law text Закон України № 4336-IX від 27.03.2025 (amending act on cyber protection of state information resources and critical information infrastructure)
3. Law text Постанова КМУ № 518 — General requirements for cyber protection of critical infrastructure

1. CMU Resolution 518

   The Cabinet resolution setting the general cyber protection requirements that critical infrastructure operators must meet under this law.

2. DSSZZI KSZI Requirements

   The Law on the Protection of Information in Information and Communication Systems, which sets security authorization for public-sector systems.

3. NIS2

   The EU directive on network and information security, which this law names as a reference for Ukraine's cybersecurity strategy (Article 5(2)).

Verified against official sources on 18 October 2026. We monitor the official sources for this framework. Watching since 7 September 2026. Subscribe to UA Cybersecurity Law (RSS)