DSSZZI KSZI Requirements

Nothing changed in the last 90 days. Sign in to read further back.

1. 2025-04-20 Law No. 4336-IX enters into force, introducing security authorization for public-sector systems

1. 2025-04-20
   Law No. 80/94-VR (edition of 20 April 2025, Law No. 4336-IX) AmendmentCurrent text

   Law No. 4336-IX restated Article 8: public-sector systems with state information resources must be security-authorized or hold an information security standard certificate. source

   More

   • Article 1 now defines security authorization and an authorized system.
   • Article 8 was restated: state information resources and restricted information in systems of public bodies and state enterprises must be processed in security-authorized systems or under a certificate of conformity to an information security standard.
   • Article 13(1-1): comprehensive information protection systems and information security management systems with confirmed conformity created before Law No. 4336-IX took effect keep operating without re-confirmation.
2. 2024-06-28
   Edition of 28 June 2024 (Law No. 3783-IX) Amendment

   Amended by Law No. 3783-IX of 5 June 2024 on military registration and acquiring war veteran status under martial law. source

3. 2024-04-04
   Edition of 4 April 2024 (Law No. 3549-IX) Amendment

   Amended by Law No. 3549-IX of 16 January 2024 on processing data in state registers for military registration under martial law. source

4. 2006-01-01
   Edition of 1 January 2006 (Law No. 2594-IV) Major version

   Law No. 2594-IV of 31 May 2005 set out the law in a new wording, in force from 1 January 2006 (Article 13(1)). source

5. 1994-07-05
   Law No. 80/94-VR (as adopted) Major version

   Adopted on 5 July 1994 and put into effect by Resolution No. 81/94-VR. source

Every system owner is responsible for protecting its information; systems of public bodies and state enterprises with state information resources face authorization or certification.

Owner's responsibility

Responsibility for protecting information in a system rests with its owner or administrator; owners of systems with state information resources set up a cyber protection unit or appoint responsible persons (Article 9). source

Public-sector systems

State information resources and restricted information in systems of public authorities, state bodies, state enterprises and local self-government must be processed in authorized systems or under an information security standard certificate (Article 8). source

Location limits

No element of such a system may be located on temporarily occupied territory or in an aggressor state or a state in a customs or military union with it (Article 8). source

Financial sector

The National Bank sets the conditions for processing and protecting information in systems for payment, banking and other financial services it regulates (Article 8). source

The owner declares security authorization against security profiles by an authorization letter to the SSSCIP, renewed by planned authorization within a year.

Declarative authorization

The authorization procedure follows a notification (declarative) principle: the owner decides on authorization taking into account the baseline, target and, where present, sectoral security profiles (Article 8). source

Authorization letter

Authorization is based on a letter filed with the SSSCIP Administration, which adds the system to the list of authorized systems within ten working days (point 9 of the authorization procedure, Resolution No. 712). source

Planned authorization

Planned authorization takes place no later than one calendar year after the previous authorization (point 7 of the authorization procedure). source

Certificate route

A certificate of conformity to an information security standard is issued by a conformity assessment body accredited by Ukraine's national accreditation body or a recognised foreign one (Article 8). source

Legacy KSZI

Comprehensive information protection systems with confirmed conformity created before Law No. 4336-IX took effect are used under their original conditions without re-authorization (Article 13(1-1)). source

Liability is set by other laws; officials who file an authorization letter answer for the accuracy of the information in it.

Liability

Persons guilty of violating legislation on information protection in systems bear liability under law (Article 11). source

Authorization letter

Officials of the owner that filed the authorization letter are liable under law for the accuracy of its information and for the measures chosen under the security profiles (point 9 of the authorization procedure). source

1. Law text Закон України «Про захист інформації в інформаційно-комунікаційних системах» № 80/94-ВР
2. Law text Постанова КМУ від 18.06.2025 № 712 — Security authorization procedure and security profiles procedure

1. Mintsyfra Security Profiles

   The baseline, sectoral and target security profiles that a system is authorized against under this law.

2. UA Cybersecurity Law

   The cybersecurity law covering critical infrastructure operators, amended by the same Law No. 4336-IX.

Verified against official sources on 18 October 2026. We monitor the official sources for this framework. Watching since 7 September 2026. Subscribe to DSSZZI KSZI Requirements (RSS)