TITLE: Ukraine's State Service of Special Communications and Information Protection Issues New Cyber Incident Response Framework
BODY:
On 18 February 2026, the Administration of the State Service of Special Communications and Information Protection of Ukraine (SSSCIP) issued Order No. 143, establishing a new risk-oriented cyber incident and attack response framework. This regulation supersedes 2023 guidelines and aligns Ukraine's cybersecurity approach with European standards and international best practices.
The new framework shifts focus from reactive measures to proactive risk management by integrating cyber threats alongside established concepts of incidents and attacks. This enables the identification and neutralisation of hazards before they cause tangible damage to critical systems and networks. The response process is structured into four distinct phases: Preparation (asset inventory, vulnerability assessments, protection systems deployment, and staff training); Detection and Analysis (classification and prioritisation of events using a five-tier criticality scale from "White" to "Black" levels); Containment and Recovery (isolating affected network segments, eliminating threats, and restoring operations); and Post-Incident Activity (evaluating response effectiveness, producing final reports, and refining security policies through analysis of attackers' tactics, techniques, and procedures).
The Order formalises information sharing rules through the Traffic Light Protocol (TLP) and establishes a national cyber incident taxonomy, ensuring all cybersecurity actors maintain shared understanding of events. A unified reporting form for cyber incidents and threats provides response teams, including CERT-UA and sectoral CSIRTs, with necessary technical and organisational data. The SSSCIP prioritises timely submission of initial notifications regarding attacks and assistance needs, with in-depth technical specifics and indicators of compromise provided subsequently during active threat mitigation phases. Comprehensive checklists support each response stage.