meta_id 3079552

On April 16, 2026, the State Service of Special Communication and Information Protection of Ukraine (Держспецзв'язку) approved Order No. 285, establishing unified methodological approaches for assessing cybersecurity status across government bodies and critical infrastructure operators. The order introduces a comprehensive framework comprising four key documents: methodological recommendations for self-assessment of cybersecurity status; methodological recommendations for external assessment of cybersecurity status; methodological recommendations for preparing assessment reports; and a standardised assessment report template. This initiative implements provisions from Ukraine's Law No. 4336-IX, which introduced the concept of cybersecurity status assessment, and Cabinet of Ministers Resolution No. 1799 (December 31, 2025), which established general procedures and approaches for such assessments. The new methodology employs a mathematical formula calculating cybersecurity status as a weighted average across six key functions: governance, identification, protection, detection, response, and recovery. Protection and detection functions receive the highest weightings, reflecting their priority for system resilience. The framework incorporates a critical vulnerability principle: if any single function scores below 20 percent compliance, the overall cybersecurity status is automatically classified as critical, preventing vulnerabilities from being masked by higher overall scores. A five-level maturity scale (0–4) assesses not only implementation of measures but also documentation quality and integration into operational processes. Assessment criteria evaluate staffing adequacy, personnel awareness, protection planning quality, and incident response readiness. All assessments must produce detailed reports containing summary indicators, recommendations, and supporting documentation. The standardised report format and completion instructions create uniform information presentation, simplifying the assessment process for government authorities and critical infrastructure operators seeking to evaluate and improve their cybersecurity posture.