Mintsyfra Security Profiles

No changes recorded yet — we are watching, and nothing has been published.

1. 2026-01-01 Resolution No. 627 on the experimental project declaring conformity of comprehensive information protection systems built on security profiles loses force
2. 2025-06-19 The security profiles and security authorization procedures (Resolution No. 712) take effect

1. 2026-04-21
   CMU Resolution No. 712 (edition of 21 April 2026, Resolution No. 493) AmendmentCurrent text

   Resolution No. 493 of 10 April 2026 amended the transitional rule on completing comprehensive information protection systems begun before Resolution No. 712 (point 2, paragraph three). source

2. 2026-02-13
   Edition of 13 February 2026 (Resolution No. 177) Amendment

   Resolution No. 177 of 11 February 2026 amended the same transitional rule (point 2, paragraph three). source

3. 2025-09-19
   Edition of 19 September 2025 (Resolution No. 1166) Amendment

   Resolution No. 1166 of 17 September 2025 restated the transitional rule (point 2, paragraph three). source

4. 2025-06-18
   CMU Resolution No. 712 (as adopted) Major version

   The Cabinet approved the security authorization procedure and the procedure for developing and approving security profiles; the resolution entered into force on 19 June 2025. source

Profiles define the protection measures for public-sector systems that must be security-authorized; a system is authorized only once its target profile is approved.

Baseline profile

Minimum security requirements set by the type of information processed (open or restricted) and by the system's function; the SSSCIP publishes those containing open information on its website and reviews them every two years (point 3). source

Sectoral profile

Built on the baseline profile for a sector or field, agreed with the SSSCIP and approved by the sector authority; updated within three months of a baseline profile change (point 4). source

Target profile

Developed for each system subject to authorization from the baseline profile, any sectoral profile, national standards and a risk assessment; reviewed on the basis of annual risk analysis (point 5). source

Systems covered

Systems processing state information resources or restricted information, and critical information infrastructure objects, owned by public authorities, state bodies, state enterprises and local self-government (authorization procedure, point 1). source

Compliance with the target profile is assessed, then the owner files an authorization letter; planned authorization follows within a year and unplanned within six months of a profile change.

Assessment first

Initial authorization requires positive results of an assessment of compliance with the target profile (authorization procedure, point 8). source

Planned authorization

Planned authorization takes place no later than one calendar year after the previous authorization (authorization procedure, point 7). source

After profile changes

Unplanned authorization is carried out within six months of a change to the baseline, sectoral or target profile, unless other acts provide otherwise (authorization procedure, point 7). source

The SSSCIP can return an authorization letter for rework, and officials answer for the accuracy of the letter and the measures chosen under the profiles.

Letter returned

The SSSCIP returns a letter within ten working days if the information is incomplete or inaccurate or the wrong baseline or sectoral profile was chosen (authorization procedure, point 9). source

Officials' liability

Officials of the owner are liable under law for the accuracy of the authorization letter and for the measures chosen under the security profiles (authorization procedure, point 9). source

1. Law text Постанова КМУ від 18.06.2025 № 712 «Деякі питання захисту інформаційних, електронних комунікаційних, інформаційно-комунікаційних, технологічних систем»
2. Law text Закон України «Про захист інформації в інформаційно-комунікаційних системах» (Article 8)

1. DSSZZI KSZI Requirements

   The law that requires security authorization of public-sector systems and on which these procedures are based.

2. CMU Resolution 518

   The general cyber protection requirements for critical infrastructure operators, built on an SSSCIP catalogue of measures rather than security profiles.

Verified against official sources on 18 October 2026. We monitor the official sources for this framework. Watching since 7 September 2026. Subscribe to Mintsyfra Security Profiles (RSS)