Ukraine Cybersecurity Strategy 2025
National framework addressing wartime cyber threats, critical infrastructure protection, and EU integration requirements.
| Jurisdiction | Ukraine |
|---|---|
| Category | Cybersecurity |
| Status | Active |
| Latest development |
Analysis
Key Requirements
- Establish a National Cybersecurity System: Ukraine must develop and maintain a comprehensive national cybersecurity system, emphasizing deterrence, cyber resilience, and coordinated interaction among government, private sector, and civil society actors. This includes the creation of cyber defense units and a national incident management system. President of Ukraine Decree on Cybersecurity Strategy National Security and Defense Council of Ukraine – Cybersecurity Strategy
- Critical Infrastructure Protection: Organizations operating critical infrastructure must implement risk-based cybersecurity measures, conduct regular vulnerability assessments, and ensure rapid response to cyber incidents. Cabinet of Ministers Action Plan 2025 Action Plan for 2025
- International Cooperation and EU Integration: Ukraine is required to align its cybersecurity framework with EU standards, participate in international cyber incident information sharing, and harmonize legal and technical standards with the EU. President of Ukraine Decree on Cybersecurity Strategy National Cyber Security Index – Ukraine
- Continuous Legal and Regulatory Updates: The strategy mandates ongoing legislative improvements, annual review of cybersecurity measures, and the adoption of new regulations to address emerging threats. Cabinet of Ministers Action Plan 2025 National Security and Defense Council of Ukraine – Cybersecurity Strategy
- Cybersecurity Workforce Development: The strategy requires the development of training and retraining programs for cybersecurity professionals, with state support for research and education in digital security. Cabinet of Ministers Action Plan 2025 President of Ukraine Decree on Cybersecurity Strategy
Compliance Challenges
- Resource Constraints: Many organizations, especially in the public sector, face limited budgets and lack skilled personnel to implement advanced cybersecurity controls. National Cyber Security Index – Ukraine National Cybersecurity Governance: UKRAINE (CCDCOE, 2024)
- Wartime Threat Environment: The ongoing conflict with Russia has led to a dramatic increase in sophisticated cyberattacks targeting government and critical infrastructure, overwhelming existing defenses. President of Ukraine Decree on Cybersecurity Strategy Cabinet of Ministers Action Plan 2025
- Fragmented Coordination: Ensuring effective cooperation between multiple government agencies, private sector entities, and international partners remains a challenge, particularly in incident response and information sharing. National Security and Defense Council of Ukraine – Cybersecurity Strategy National Cybersecurity Governance: UKRAINE (CCDCOE, 2024)
- Example: In 2022, the cyberattack on Ukraine’s energy grid highlighted gaps in incident response coordination and the need for improved public-private partnerships. National Cybersecurity Governance: UKRAINE (CCDCOE, 2024)
Implementation Best Practices
- Adopt a Risk-Based Approach: Conduct regular risk assessments, prioritize protection of critical assets, and implement layered security controls. Cabinet of Ministers Action Plan 2025 National Security and Defense Council of Ukraine – Cybersecurity Strategy
- Develop Incident Response Plans: Establish and regularly test incident response and business continuity plans, ensuring alignment with national protocols. President of Ukraine Decree on Cybersecurity Strategy National Cyber Security Index – Ukraine
- Invest in Workforce Training: Implement continuous training programs for IT and security staff, leveraging state-supported initiatives and international best practices. Cabinet of Ministers Action Plan 2025 National Cybersecurity Governance: UKRAINE (CCDCOE, 2024)
- Leverage International Frameworks and Tools: Utilize resources such as the NIST Cybersecurity Framework and ENISA Guidelines for structuring cybersecurity programs. National Cybersecurity Governance: UKRAINE (CCDCOE, 2024)
Recent Updates
- 2025 Action Plan Approved: On March 7, 2025, the Cabinet of Ministers approved the action plan for implementing the Cybersecurity Strategy, detailing specific tasks and allocating UAH 468.8 million for execution. Cabinet of Ministers Action Plan 2025 Action Plan for 2025
- Annual Review Requirement: The strategy mandates annual approval and review of cybersecurity measures, with updated indicators and compliance deadlines set each year. Cabinet of Ministers Action Plan 2025 President of Ukraine Decree on Cybersecurity Strategy
- Effective Dates: The current strategy and its action plans are effective through 2025, with annual updates and compliance deadlines specified in each year’s action plan. Action Plan for 2025
Related Regulations
- National Security Strategy of Ukraine: Provides the overarching framework for national security, including cybersecurity as a core component. National Security Strategy of Ukraine (2020)
- EU NIS Directive: Ukraine’s strategy is harmonized with the EU Network and Information Security Directive, supporting EU integration and cross-border cooperation. EU NIS Directive Official Text National Cyber Security Index – Ukraine
- Tallinn Manual: Provides international legal guidance on cyber operations, referenced in Ukraine’s approach to cyber defense and international law. Tallinn Manual (CCDCOE) National Cybersecurity Governance: UKRAINE (CCDCOE, 2024)
Industry Impact
- Critical Infrastructure Sectors: Energy, finance, and telecommunications must implement advanced security controls and participate in national incident reporting and response mechanisms, increasing operational costs but improving resilience. National Cyber Security Index – Ukraine National Cybersecurity Governance: UKRAINE (CCDCOE, 2024)
- Private Sector and SMEs: Businesses are required to adopt minimum cybersecurity standards and may face increased compliance costs, but benefit from improved threat intelligence sharing and state-supported training. President of Ukraine Decree on Cybersecurity Strategy Cabinet of Ministers Action Plan 2025
- International Partnerships: Enhanced cooperation with EU and NATO partners increases access to resources and expertise, but also requires alignment with evolving international standards. National Security and Defense Council of Ukraine – Cybersecurity Strategy National Cyber Security Index – Ukraine
Sources
- President of Ukraine Decree on Cybersecurity Strategy
- National Security and Defense Council of Ukraine – Cybersecurity Strategy
- Cabinet of Ministers Action Plan 2025
- Action Plan for 2025
- National Cybersecurity Governance: UKRAINE (CCDCOE, 2024)
- National Cyber Security Index – Ukraine
- EU NIS Directive Official Text
- Tallinn Manual (CCDCOE)
- NIST Cybersecurity Framework
- ENISA Guidelines
Recent developments
- — Analysis outlines how Ukraine strengthened its **cybersecurity framework for 2025** by updating the Organizational and Technical Model of Cybersecurity in line with NIST CSF 2.0, enhancing risk management, threat detection, and incident response for state bodies and critical infrastructure as part of the 2021–2025 Cybersecurity Strategy.[5] (source)
- — Industrial Cyber reports on a CDAC study showing about **US$2.29 billion** in committed and delivered cyber defense assistance to Ukraine (2022–2025), highlighting a layered ecosystem of foreign government support that directly underpins implementation of Ukraine’s Cybersecurity Strategy and its 2025 objectives.[4] (source)
- — Coverage of President Zelenskyy signing Law No. 4336-IX on information protection and cybersecurity of state information resources and critical infrastructure, a sweeping legal update that tightens requirements for state networks and CIF and operationalizes key elements of Ukraine’s broader digital and Cybersecurity Strategy.[9] (source)
- — The State Service of Special Communications announces Cabinet approval of the **2025 action plan** for implementing the Cybersecurity Strategy, detailing tasks on regulation, national system development, international cooperation, risk-based protection of critical infrastructure, and workforce training, with UAH 468.8 million allocated in the 2025 state budget.[3] (source)
- — Dev.ua notes that slightly less than **UAH 0.5 billion** has been reserved in the 2025 budget for measures under the Cybersecurity Strategy (final plan of the 2021–2025 cycle), signaling strong fiscal commitment to cyber resilience and closing out the current strategic period with prioritized funding for critical tasks.[8] (source)
- — Ukrainian media report that the government approved the **2025 measures plan** for Cybersecurity Strategy implementation, emphasizing regulatory support, organizational-technological development of the national cybersecurity system, enhanced cooperation with international partners, and expanded training systems for cybersecurity professionals.[7] (source)
- — CSIS analysis discusses Ukraine’s move to establish a dedicated **Cyber Force** (bill passed first reading in parliament) to unify offensive and defensive military cyber capabilities, align with NATO standards, and create a cyber reserve—an institutional evolution that complements and extends the goals of the 2021–2025 Cybersecurity Strategy.[6] (source)
- — Further commentary in the same CSIS piece notes planned creation of Cyber and Space Forces by end-2025 and a target of 60% operational readiness by 2026, indicating that Ukraine’s strategic cyber posture is shifting from civilian-led resilience under the Cybersecurity Strategy toward integrated military cyber operations.[6] (source)
- — Industry analysis highlights updated guidelines for **critical infrastructure facilities (CIF)** protection plans issued by the State Service for Special Communications and the SBU, requiring risk assessment, dependency mapping, adaptation to new threats (including war-related), and dual approval—tightening operational requirements for CIF operators under the Strategy framework.[5] (source)
- — The CDAC report, as summarized by Industrial Cyber, notes growing emphasis on **training and domestic cyber capabilities** in Ukraine’s assistance requests, reflecting industry and donor recognition that long-term resilience and effective execution of the Cybersecurity Strategy depend on skilled personnel and sustainable capacity rather than only hardware support.[4] (source)
Related regulations
- NYDFS Cybersecurity Regulation — New York, Active, effective 2025-11-01
- Law on Cybersecurity of Vietnam — Vietnam, Active
- Austria NIS2 Act — Austria, Upcoming
- Luxembourg NIS2 Transposition — Luxembourg, Active
- EU Cyber Resilience Act (CRA) — European Union, Phased, effective 2027-12-11
- EU Cyber Resilience Act - Vulnerability and Incident Reporting (11 Sep 2026) — European Union, Active, effective 2026-09-11
- Netherlands NIS2 Transposition (Cyberbeveiligingswet) — Netherlands, Active, effective 2026-08-15
- Belgium NIS2 Transposition — Belgium, Active, effective 2024-10-18
Put it into practice
- Generate the policy: NIST CSF policy generator (generatepolicy.com)
- Buy the policy pack: Enterprise Security Bundle (cyberpolicy.shop)
- Build it yourself: Compliance Program Starter (ciso.diy)
Browse all regulations · Compliance deadlines · Latest updates