Ukraine Law on Basic Principles of Cyber Security 2017
National cybersecurity framework: software asset inventory, component integrity, supply-chain verification, and vulnerability management.
National cybersecurity framework: software asset inventory, component integrity, supply-chain verification, and vulnerability management.
| Short name | UA Cyber |
| Region | Europe |
| Country or scope | Ukraine |
| Sector | Government |
| In your workspace | Off until you switch it on in Compliance › Manage. |
How Safeguard covers UA Cyber
- Scan requirements: 6, all decided by a scan.
- Controls: the scan requirements below.
- Automated tests: none map to it directly. You can link any automated test to its controls yourself (how).
- Policy templates: 22 from the standard set.
How each kind of coverage works, and what the readiness score counts: Compliance frameworks.
What a scan checks
Each scan of a product checks these 6 requirements against what the scan found, including the product's software inventory (SBOM).
| Requirement | What Safeguard checks | Decided by |
|---|---|---|
UA-CYB-CII-INV Critical Infrastructure Asset Knowledge | Owners and operators of critical infrastructure objects must implement cyber protection over their communication and technological systems, which presupposes an inventory of the software components those systems run (Law 2163-VIII critical-infrastructure protection duties) | Scan |
UA-CYB-INT Integrity of Technological Systems | Cyber protection must guard the integrity of information and of the systems processing it against unauthorized modification; verifiable integrity hashes on software components evidence this control (Law 2163-VIII cyber-protection requirements) | Scan |
UA-CYB-VULN Vulnerability Management Readiness | Operators must detect and respond to cyber threats and incidents affecting their systems, which requires knowing the exact version of each deployed component so vulnerabilities can be matched and remediated (Law 2163-VIII threat-response duties with CERT-UA coordination) | Scan |
UA-CYB-SUP Supply-Chain Trustworthiness | Protection of critical infrastructure extends to the trustworthiness of the technology it relies on, requiring visibility into the suppliers behind deployed software components (Law 2163-VIII critical-infrastructure security requirements) | Scan |
UA-CYB-ID Incident Reporting Identification | Reporting cyber incidents to CERT-UA and state authorities requires machine-usable identification of the affected software components (Law 2163-VIII incident-reporting framework) | Scan |
UA-CYB-AUD Auditable Security Documentation | Critical infrastructure objects are subject to independent information security audits and state review, supported by formally identified, timestamped and machine-readable records of system composition (Law 2163-VIII security-audit provisions) | Scan |
Policy templates
All 22 from the standard set, adapted to UA Cyber.
UK NCSC CAF
UK NCSC Cyber Assessment Framework - 4 objectives, 14 principles for essential services security.
Ukraine Law on Protection of Personal Data (2297-VI)
National data-protection law: technical safeguards, records of processing software, third-party/processor accountability, and integrity controls.