Zelenskyy Signed Law on Cybersecurity of State Resources: What Will Change

President Volodymyr Zelensky signed a draft law that will form the principles of cyber protection of state information resources. This is reported by UNN with reference to draft law №11290.

"Returned with the signature of the President of Ukraine," the draft law card says.

This Law shall enter into force on the day following the day of its publication

Details

In March, the Verkhovna Rada of Ukraine adopted in the second reading the Law of Ukraine "On Amendments to Certain Laws of Ukraine Regarding the Protection of Information and Cybersecurity of State Information Resources, Critical Information Infrastructure Objects".

The adopted law provides for a number of changes and innovations, including:

•  functioning of the national system for responding to cyber incidents, cyberattacks, cyber threats - the roles, tasks, service functions of response teams and the basic principles of interaction of all key subjects of the multi-level response network are defined;

• response in a crisis situation in cybersecurity - the principles for involving response mechanisms in a crisis situation are defined;

• functioning of the system for exchanging information on cyber incidents, cyberattacks, cyber threats - the obligations to report, interaction mechanisms, principles of protection and disclosure of information on cyber incidents are regulated;

• abandonment of the CCSSI and definition of the process of implementing risk management measures and ensuring that such measures are supported throughout the life cycle of systems based on security profiles;

• functioning of the cybersecurity status assessment system, including the audit method, without excessive control by the state;

•  introduction of full-time positions of cybersecurity managers and specialists in state bodies, as well as at critical infrastructure facilities.

Criticism of the draft law

Earlier, the document was criticized for the fact that the authorities allegedly plan to classify information about cyberattacks. In the first reading, the authors of the draft law really stipulated that access to information about cyberattacks and cyber incidents would be restricted. But by the second reading, this rule was removed - now only information about the nature and technical characteristics of the cyberattack will be restricted. One of the authors of the law, MP Oleksandr Fedienko comments that the information is not hidden, but, on the contrary, they are obliged to disclose it. 

Context

In December 2024, one of the largest external cyberattacks on state registers of Ukraine occurred, which led to a temporary suspension of the operation of several key systems.

In January 2025, the infrastructure of state registers after the largest Russian cyberattack was restored.