CMU Resolution 518

No changes recorded yet — we are watching, and nothing has been published.

1. 2025-11-20 Restated General Requirements under Resolution No. 1470 take effect

1. 2025-11-20
   CMU Resolution No. 518 (edition of 20 November 2025, Resolution No. 1470) RevisionCurrent

   Resolution No. 1470 of 13 November 2025 restated the General Requirements around a catalogue of cyber protection measures, risk management and an annual cyber protection plan. source

   More

   • All baseline cyber protection measures defined by the SSSCIP are mandatory (point 3).
   • The cyber protection plan is approved and reviewed every year; its measures must be consistent with the object's protection plan against the national-level "cyberattack/cyber incident" design threat, agreed under the security passport procedure of Resolution No. 818 of 4 August 2023 (point 4).
   • The annex to the General Requirements was deleted.
2. 2022-09-07
   Edition of 7 September 2022 (Resolution No. 991) Amendment

   Amended by Resolution No. 991 of 2 September 2022 on amending certain Cabinet resolutions on electronic communications. source

3. 2019-06-19
   CMU Resolution No. 518 (as adopted) Major version

   The Cabinet approved the General Requirements for cyber protection of critical infrastructure objects; the resolution entered into force on 26 June 2019. source

The requirements bind critical infrastructure operators and owners of critical information infrastructure, except entities under National Bank regulation.

Who is bound

Mandatory for critical infrastructure operators and owners or administrators of critical information infrastructure objects (point 1). source

Financial sector excluded

Not applicable to the National Bank, banks, other financial market participants regulated by the National Bank, payment system operators, their participants and technological operators of payment services (point 1). source

Sector requirements

Sectoral critical infrastructure authorities may develop sector requirements on this basis, agreed with the SSSCIP (point 11). source

Operators apply the SSSCIP baseline measures, run continuous risk management, keep a cyber protection plan reviewed every year and assess their cyber protection state.

Baseline measures

Cyber protection is ensured through measures chosen with risk management results; all baseline measures are mandatory (point 3). source

Annual plan

Operators approve a cyber protection plan, review it every year and update it as needed, describing the current and/or target cyber protection state (point 4). source

State assessment

Operators ensure assessment of the cyber protection state under the procedure set under Article 5(3) of the cybersecurity law (point 5). source

Risk management

Risk management is continuous and uses national and international cybersecurity management standards; the risk assessment method is approved by the SSSCIP (point 6). source

The SSSCIP exercises state control over compliance with cyber protection legislation.

State control

The SSSCIP exercises state control over compliance with cyber protection legislation in a procedure set by the Cabinet of Ministers (Law No. 2163-VIII, Article 15(4)). source

1. Law text Постанова КМУ від 19.06.2019 № 518 «Про затвердження Загальних вимог з кіберзахисту об'єктів критичної інфраструктури»
2. Law text Постанова КМУ від 13.11.2025 № 1470 (amending resolution)

1. UA Cybersecurity Law

   The cybersecurity law under which the Cabinet approves these general requirements.

2. NBU Regulation 143

   The National Bank's own regime for non-bank financial service providers, which this resolution excludes.

3. NIS2

   The EU directive's risk-management measures for essential and important entities, set at EU level rather than by a national cabinet resolution.

Verified against official sources on 18 October 2026. We monitor the official sources for this framework. Watching since 7 September 2026. Subscribe to CMU Resolution 518 (RSS)