A year ago, Ukraine started a deep reform of state data protection and dropped outdated approaches from the early 2000s. At a press conference at Ukrinform, SSSCIP representatives summed up the first year of Law No. 4336-IX: more than 100 information and communication systems have already passed authorization under the new rules.

What changed after Law No. 4336-IX: from bureaucracy to NIST standards

The main achievement of the reform is the move from the bulky CISS system to a flexible risk-based approach.

  • International experience. The law builds on the NIST security standards (USA).
  • Simpler authorization. Instead of piles of paper, the system owner sends an authorization letter, and SSSCIP reviews it within 10 days.
  • Flexibility. System owners choose technical protection standards themselves within the set security profiles: from confidential to top secret information.
  • Unification. The law unifies requirements for cryptographic and technical protection, which speeds up the deployment of new encryptors.

What it means for system owners

The new model gives more freedom but also more responsibility. The system owner is responsible for choosing protection measures, putting them in place and regularly assessing the state of cyber defense. In addition, the assessment covers six functions, and SSSCIP checks compliance under a new state control methodology.

Read also: SSSCIP introduces a new state cybersecurity control methodology; The government orders all authorities to create cybersecurity teams; Cybersecurity bill No. 8087 returned for a repeated second reading.

S-byte: your guide to Law No. 4336-IX and new security standards

The move to the new protection model may seem complex. However, the S-byte team takes care of the technical and legal issues:

  • ISS building. We design information security systems under the new rules, taking into account your organization and its security profile.
  • Information security audit. We assess the current state of the system and prepare it for authorization, so you get a positive SSSCIP decision without delays.
  • State TPI expertise. We support system assessment and the verification of equipment from leading brands, including Cisco and Trend Micro.
  • ISO 27001 and risk management. We help you adopt global security management practices that match the NIST approach.

S-byte turns complex legal requirements into clear and reliable protection of your data. Contact us, and we will help you pass authorization under the new rules.