NIS2 obligations in Ukraine

Competent authority & CSIRT Legal ref: Art. 8, 9 The Law of Ukraine “On the Basic Principles of Ensuring Cyber Security of Ukraine”

• The State Service of Special Communications and Information Protection of Ukraine (SSSCIP) is the authorised body responsible for ensuring the functioning of the national system for responding to cyberincidents, cyberattacks, and cyberthreats. ecs-org.eu · 28 Oct 2026 · secondary source
• National Police of Ukraine. ecs-org.eu · 28 Oct 2026 · secondary source
• Security Service of Ukraine (SSU). ecs-org.eu · 28 Oct 2026 · secondary source
• Ministry of Defence of Ukraine and General Staff of the Armed Forces of Ukraine . ecs-org.eu · 28 Oct 2026 · secondary source
• Intelligence Agencies of Ukraine. ecs-org.eu · 28 Oct 2026 · secondary source
• National Bank of Ukraine. ecs-org.eu · 28 Oct 2026 · secondary source
• Ministry of Foreign Affairs of Ukraine. ecs-org.eu · 28 Oct 2026 · secondary source
• The National Team for Responding to Cyberincidents, Cyberattacks, Cyberthreats (CERT-UA) performs the functions of: ecs-org.eu · 28 Oct 2026 · secondary source
• The national contact point in accordance with the NIS2 Directive. ecs-org.eu · 28 Oct 2026 · secondary source
• The national CSIRT (operates under SSSCIP). ecs-org.eu · 28 Oct 2026 · secondary source
• Coordinator for the purpose of coordinated vulnerability disclosure. ecs-org.eu · 28 Oct 2026 · secondary source
• Sectoral CSIRTs: ecs-org.eu · 28 Oct 2026 · secondary source
• CSIRT-NBU: сybersecurity center of the National Bank of Ukraine;. ecs-org.eu · 28 Oct 2026 · secondary source
• CSIRT-SSU: сybersecurity situation center of the Security Service of Ukraine. ecs-org.eu · 28 Oct 2026 · secondary source
• MIL.CERT-UA: cyberdefense center of the Ministry of Defence of Ukraine. ecs-org.eu · 28 Oct 2026 · secondary source
• National Cyber Crisis Management Authority: The National Coordination Center for Cybersecurity (NCSCC) as an executive body of the National Security and Defense Council of Ukraine (NSDC) carries out general coordination of entities within the national system for responding to cyberincidents, cyberattacks, and cyberthreats. To ensure coordinated, prompt, and effective response to a crisis caused by a cyberincident, cyberattack, or cyberthreat, a standing Joint Response Group for cyberincidents, cyberattacks, and cyberthreats operates under NCSCC. ecs-org.eu · 28 Oct 2026 · secondary source

Who's in scope (national deviations) Legal ref: The Law of Ukraine 2163-VIII, The Law of Ukraine ”On Critical Infrastructure”, Decree of the Cabinet of Ministers of Ukraine of October 9, 2020 № 1109

• Cybersecurity requirements apply to all entities designated as cybersecurity actors, regardless of their size. A mechanism and criteria have been established for classifying objects as critical infrastructure, along with a list of sectors (subsectors), core services of the state’s critical infrastructure, and the procedure for assigning critical infrastructure objects to one of the criticality categories. Under Ukrainian legislation, operators of critical infrastructure are, in essence, equated with essential and important entities as defined in the NIS2 Directive. Ukraine has identified 24 critical infrastructure sectors and 17 vital functions and/or services, the disruption of which results in adverse consequences for Ukraine’s national security. The criticality categories of a critical infrastructure object are: Category I, II, III, and IV. ecs-org.eu · 28 Oct 2026 · secondary source

Registration

Not yet published / needs verification We have not found a published, sourced national rule for this yet.

NIS2 baseline (Art. 3(4), Art. 27): Member States draw up a list of essential and important entities; entities provide name, contact details, IP ranges, sector and Member States served. EUR-Lex

Incident reporting Legal ref: Art. 9/1 The Law of Ukraine “On the Basic Principles of Cyber Security of Ukraine”, Decree of the Cabinet of Ministers of Ukraine of November 26, 2025 № 1533, Decree of the Cabinet of Ministers of Ukraine of 19 June, 2019 № 518

• Cybersecurity actors are required to notify competent authorities (in particular, CERT-UA, the national CSIRT) of significant incidents that may affect the security of information resources. The owner and/or head of a critical infrastructure object is responsible for organizing the immediate notification of CERT-UA (and, if applicable, the regional/sectoral CSIRT), as well as the functional unit for counterintelligence protection of state interests in the field of information security of the Central Directorate of the Security Service of Ukraine (SSU Cybersecurity Situation Center) or the relevant unit of the regional SSU body, regarding cyber incidents and cyberattacks related to their critical infrastructure object. Entities of the national system for responding to cyber incidents, cyberattacks, and cyber threats are obligated to immediately inform NCSCC of all significant cyber incidents and cyberattacks. Ukrainian legislation requires the mandatory exchange of information among state authorities, including SSSCIP/CERT-UA, NCSCC, SSU, the National Police of Ukraine, and other competent bodies. Information sharing between cybersecurity actors is conducted via dedicated platforms, including MISP-UA, MISP CERT-UA, and MISP-NBU. Categories (levels) of cyber incident/cyberattack criticality: level 0, non-critical (white); level 1, low (green); level 2, medium (yellow); level 3, high (orange); level 4, critical (red); level 5, extreme (black). ecs-org.eu · 28 Oct 2026 · secondary source

NIS2 baseline (Art. 23): early warning within 24 hours, incident notification within 72 hours, final report within one month (progress report if still ongoing). EUR-Lex

Management liability & training

Not yet published / needs verification We have not found a published, sourced national rule for this yet.

NIS2 baseline (Art. 20): management bodies must approve and oversee cybersecurity risk-management measures, can be held liable for infringements, and must follow training. EUR-Lex

Penalties Legal ref: Art. 9¹ The Law of Ukraine “On the Basic Principles of Ensuring Cyber Security of Ukraine”

• No fines are currently applied. However, the legislation of Ukraine in the field of cybersecurity, in particular Article 12 of the Law of Ukraine “On the Basic Principles of Ensuring Cybersecurity of Ukraine” and Article 11 of the Law of Ukraine “On Information Protection in Information and Communication Systems”, sets out general provisions regarding administrative penalties for violations in the field of cybersecurity. Additionally, Part 6 of Article 9¹ of the Law of Ukraine “On the Basic Principles of Ensuring Cyber Security of Ukraine” establishes administrative liability for failure to fulfill, or failure to fulfill within the prescribed time frame, the obligation to report mandatory notifications regarding cyber incidents or cyberattacks. ecs-org.eu · 28 Oct 2026 · secondary source
• Planned for 2026-2027: Development of a draft Law of Ukraine on Amendments to the Codex of Ukraine on Administrative Offenses to increase liability for violations of legislative requirements in the field of cybersecurity ecs-org.eu · 28 Oct 2026 · secondary source

NIS2 baseline (Art. 34): maximum fines of at least EUR 10m or 2% of worldwide turnover (essential) and EUR 7m or 1.4% (important), whichever is higher. EUR-Lex

Security measures, standards & deadlines Legal ref: Art. 8, The Law of Ukraine “On the Basic Principles of Cyber Security of Ukraine”) Order of the Administration of the State Special Communications Service of Ukraine dated January 30, 2026 No. 75 “

• As part of the implementation of the organisational and technical cybersecurity model of the national cybersecurity system, SSSCIP has integrated the NIST Cybersecurity Framework (CSF) 2.0, which establishes baseline cybersecurity measures and provides methodological guidelines for their implementation. The SSSCIP has also adopted a series of orders aimed at enhancing the cybersecurity of critical information infrastructure, in line with international standards. In addition, Ukraine has adopted a number of national standards aligned with international ISO standards, including: ISO/IEC 27001, ISO/IEC 27005, ISO/IEC 27019, ISO/IEC 27032, and ISO/IEC 27035. ecs-org.eu · 28 Oct 2026 · secondary source

Supervisory guidance

Not yet published / needs verification No regulator guidance links recorded yet. Official text: The Law of Ukraine 4336-IX · The Law of Ukraine 2163-VIII

What changed recently

1. 20 Apr 2025
   National NIS2 law enters into force (per tracker) ecs-org.eu needs verification