The State Service of Special Communications approved the Cybersecurity Risk Assessment Methodology
The State Service of Special Communications has announced the approval of its Cybersecurity Risk Assessment Methodology. This methodology establishes a unified approach for identifying and assessing cybersecurity risks across government authorities, critical infrastructure operators, and owners (managers) of critical information infrastructure facilities.
The relevant order, issued by the Administration of the State Service of Special Communications on 2 June 2026, reference No. 402, was registered with the Ministry of Justice of Ukraine on 18 June 2026, under reference No. 880/46274.
The methodology was developed in accordance with the General Requirements for Cyber Protection of Critical Infrastructure Facilities, as approved by Cabinet of Ministers of Ukraine Resolution No. 518 dated 19 June 2019. It also adheres to the Minimum Requirements for the Protection of Information, Electronic Communications, Information and Communication, and Technological Systems, approved by Cabinet of Ministers of Ukraine Resolution No. 373 dated 29 March 2006.
The document outlines unified approaches to:
-
identifying and classifying critical assets;
-
detecting current cyber threats and vulnerabilities;
-
conducting qualitative and quantitative cybersecurity risk assessments;
-
determining risk levels using a risk matrix;
-
planning risk treatment measures and preparing relevant reports.
A distinctive feature of the methodology is its combination of qualitative and quantitative approaches to risk assessment. The document incorporates modern mathematical analysis methods, including the Bayesian method, which facilitates the refinement of risk assessments based on new information regarding cyber incidents, cyber threats, and changes in system protection status.
The methodology further defines the procedure for compiling lists of cybersecurity risks, preparing risk treatment plans, and conducting regular reviews of assessment results. Risk assessments are mandated at least annually, and whenever significant changes occur in systems or information processing procedures.
"The introduction of this Methodology will promote a risk-oriented approach to cybersecurity, enhance the resilience of information systems used by government bodies and critical infrastructure operators, and align national cybersecurity risk management practices with international standards and recommendations," the agency stated.
Subscribe to our Telegram channel t.me/sudua, follow SUD.UA on Google News , and join us on VIBER, WhatsApp, Facebook and on Instagram to stay informed about the important events.
