NBU Regulation 95
National Bank of Ukraine Cybersecurity Regulation No. 95 — National Bank of Ukraine
Also known as: Постанова НБУ №95, НБУ 95, Постанова НБУ №178, Положення НБУ про кібербезпеку, НБУ відкрите банківництво
Official site Official change log Subscribe to NBU Regulation 95 (RSS)
At a glance
- Current version
- NBU Resolution No. 95 of 28 September 2017 (basic text)
- Published 28 September 2017. source
- Status
- In force
- Next deadline
- None announced
- Who must comply
- Banks of Ukraine; Section III (cryptographic protection in the National Bank's information systems) also applies to non-bank institutions participating in those systems (point 5). source
- How it is assessed
- Each bank implements an ISMS through a governance body that includes senior management and reviews its information security policy at least once a year. source
- Written by
- A resolution of the Board of the National Bank of Ukraine; the National Bank may inspect how a bank has implemented its information security management system (point 13). source
- Enforced by
- The National Bank may inspect a bank's ISMS and the completeness of its security measures. source
- Last change
NBU regulations on cybersecurity for banks, anchored in Resolution No. 95; its Section III on cryptographic protection also reaches non-bank institutions that take part in the National Bank's information systems.
Recent changes
-
Medium
NBU amends Instruction on the procedure for regulating the activities of banks in Ukraine
The National Bank of Ukraine has approved amendments to the Instruction on the procedure for regulating the activities of banks in Ukraine. This update to the …
-
Medium
NBU changes Methodology for calculating prudential ratios for regulating banks' activities in Ukraine
The National Bank of Ukraine has made changes to the Methodology for calculating prudential ratios for regulating banks' activities in Ukraine. This methodology regulates the calculation …
-
Medium
NBU amends the Tariffs for organizational services and other services and operations
The National Bank of Ukraine introduces amendments to the Tariffs for organizational services and other services (operations) provided by the NBU. The changes affect the amount …
-
Medium
NBU expands requirements for prudential information disclosure by banks
The National Bank of Ukraine reviews and expands the regulatory framework for prudential information disclosure. The changes cover not only individual resolutions but a range of …
-
Medium
Clarification of the name of NBU Board Resolution № 11 dated 15 February 2018
The National Bank of Ukraine website has clarified the name of the Board Resolution of the National Bank of Ukraine dated 15 February 2018 № 11. …
-
Medium
NBU approves amendments to the Regulation on the procedure for determining the regulatory capital size by…
The National Bank of Ukraine approved amendments to the Regulation on the procedure for determining the regulatory capital size by banks of Ukraine. The document replaces …
-
Medium
NBU introduces change to National Bank Board decision dated January 3, 2017 No. 2-рш
The National Bank of Ukraine has made changes to the decision of the Board of the National Bank of Ukraine dated January 3, 2017 No. 2-рш. …
Key dates
No upcoming datesVersion history
-
NBU Resolution No. 95 of 28 September 2017 (basic text) Major versionCurrent
The Board approved the Regulation on organising information security measures in the banking system; it took effect on 1 March 2018, and Section V on 1 September 2019. source
Who it applies to
The Regulation sets mandatory minimum information security and cyber protection requirements for banks.
- What it sets
- Mandatory minimum requirements for organising information security and cyber protection, information security management principles, and requirements for bank systems that interact with the National Bank's systems (point 2). source
- ISMS scope
- The minimum scope of a bank's information security management system is all of its critical business processes (point 12). source
- Standard named
- The Regulation requires an ISMS under DSTU ISO/IEC 27001:2015 and Annex A controls applied per DSTU ISO/IEC 27002:2015 (points 8 and 11). source
- That edition withdrawn
- The national standards catalogue lists DSTU ISO/IEC 27001:2015 as withdrawn from 22 August 2023, replaced by DSTU ISO/IEC 27001:2023. source
How compliance is assessed
Each bank implements an ISMS through a governance body that includes senior management and reviews its information security policy at least once a year.
- ISMS governing body
- A bank forms a collective ISMS governing body that includes the chair of the management board or the deputy responsible for information security (points 14 and 15). source
- Policy review
- The information security policy is kept current and reviewed at least once a year (point 18). source
- Incident management
- A bank implements an information security incident management process and approves documents describing the response (point 130). source
Enforcement and penalties
The National Bank may inspect a bank's ISMS and the completeness of its security measures.
- NBU inspection
- The National Bank may check the state of a bank's ISMS implementation and the completeness of the security measures set by the Regulation (point 13). source
Documents
Verified against official sources on 18 October 2026. We monitor the official sources for this framework. Watching since 11 September 2026. Subscribe to NBU Regulation 95 (RSS)