{
 "note": "Unofficial English translation by NAVISTRI of the SSSCIP catalogue (order No. 75 of 30.01.2026) and the legal-compliance criteria (order No. 285 of 16.04.2026). The Ukrainian text is authoritative.",
 "functions": {"GV": "Govern", "ID": "Identify", "PR": "Protect", "DE": "Detect", "RS": "Respond", "RC": "Recover"},
 "categories": {
  "GV.OC": "Organisational context", "GV.RM": "Cybersecurity risk management strategy", "GV.RR": "Roles, responsibilities and authorities",
  "GV.PO": "Policy", "GV.OV": "Oversight", "GV.SC": "Supply chain risk management",
  "ID.AM": "Asset management", "ID.RA": "Cybersecurity risk assessment", "ID.IM": "Improvement",
  "PR.AA": "Identity management, authentication and access control", "PR.AT": "Awareness and training", "PR.DS": "Data security",
  "PR.PS": "Platform security", "PR.IR": "Technology infrastructure resilience",
  "DE.CM": "Continuous monitoring", "DE.AE": "Adverse event analysis",
  "RS.MA": "Incident management", "RS.AN": "Incident analysis", "RS.CO": "Incident response reporting and communication", "RS.MI": "Incident mitigation",
  "RC.RP": "Incident recovery plan execution", "RC.CO": "Incident recovery communication"
 },
 "measures": {
  "GV.OC-01": "Ensure the organisation's mission is understood and informs cybersecurity risk management.",
  "GV.OC-02": "Identify internal and external stakeholders and ensure their needs and expectations regarding risk management are understood and considered.",
  "GV.OC-03": "Identify, and ensure staff comply with, applicable legal, regulatory and contractual cybersecurity requirements and the organisation's own, including non-disclosure of confidential information and protection of rights and freedoms.",
  "GV.OC-04": "Identify and communicate to staff the organisation's key objectives, critical services and capabilities.",
  "GV.OC-05": "Identify the outcomes, capabilities and services the organisation depends on, and make staff aware of them.",
  "GV.RM-01": "Set cybersecurity risk management objectives and agree them with the organisation's stakeholders.",
  "GV.RM-02": "Define the cybersecurity risk appetite the organisation can accept, communicate it to all staff and stakeholders, and keep it up to date.",
  "GV.RM-03": "Include cybersecurity risk management activities and outcomes in the organisation's overall risk management processes.",
  "GV.RM-04": "Define and communicate strategic direction describing appropriate cybersecurity risk response options.",
  "GV.RM-05": "Define and communicate lines of communication across the organisation for cybersecurity risks, including risks from suppliers and other third parties.",
  "GV.RM-06": "Define and communicate a standardised method for calculating, documenting, categorising and prioritising cybersecurity risks.",
  "GV.RM-07": "Identify, characterise and discuss with staff strategic opportunities in cybersecurity risk management.",
  "GV.RR-01": "Designate a member of senior leadership who reports on and is accountable for cybersecurity risk and for a culture that is risk-aware, ethical and continually improving.",
  "GV.RR-02": "Establish, communicate, understand and enforce roles and authorities for risk management.",
  "GV.RR-03": "Allocate adequate resources in line with the cybersecurity risk strategy, roles, responsibilities and policies.",
  "GV.RR-04": "Include cybersecurity in human resources practices.",
  "GV.PO-01": "Establish and communicate a cybersecurity risk management policy based on the organisation's context, cybersecurity strategy and priorities.",
  "GV.PO-02": "Review, update and enforce the cybersecurity risk management policy periodically to reflect changes in requirements, threats, technology and mission.",
  "GV.OV-01": "Use the results of the cybersecurity risk management strategy to inform and adjust its direction.",
  "GV.OV-02": "Review and adjust the cybersecurity risk management strategy so that it covers the organisation's requirements and risks.",
  "GV.OV-03": "Evaluate cybersecurity risk management performance and review it for needed adjustments.",
  "GV.SC-01": "Establish a cybersecurity supply chain risk management programme, strategy, objectives, policies and processes, agreed with the organisation's stakeholders.",
  "GV.SC-02": "Establish, communicate and coordinate internally and externally the cybersecurity roles of suppliers, customers and partners.",
  "GV.SC-03": "Integrate cybersecurity supply chain risk management into cybersecurity risk management, risk assessment and improvement processes.",
  "GV.SC-04": "Identify suppliers and prioritise them by criticality.",
  "GV.SC-05": "Establish cybersecurity supply chain requirements and include them in contracts and other agreements with suppliers and relevant third parties.",
  "GV.SC-06": "Plan and perform due diligence on suppliers and other third parties to reduce cybersecurity risk before entering into formal relationships.",
  "GV.SC-07": "Understand, record, prioritise, assess, respond to and monitor the cybersecurity risks posed by a supplier, its products and services, and other third parties over the course of the relationship.",
  "GV.SC-08": "Include relevant suppliers and other third parties in incident planning, response and recovery activities.",
  "GV.SC-09": "Integrate supply chain security practices into cybersecurity and risk management programmes and monitor their performance across the technology product and service life cycle.",
  "GV.SC-10": "Include in cybersecurity supply chain risk management plans the steps to take after a partnership or service agreement concludes.",
  "ID.AM-01": "Maintain inventories of hardware managed by the organisation periodically.",
  "ID.AM-02": "Maintain inventories of software, services and systems managed by the organisation periodically.",
  "ID.AM-03": "Maintain representations of authorised network communication and of internal and external network data flows.",
  "ID.AM-04": "Maintain inventories of services provided by suppliers periodically.",
  "ID.AM-05": "Prioritise assets by classification, criticality, resources and impact on the mission.",
  "ID.AM-07": "Maintain inventories of data and corresponding metadata for designated data types.",
  "ID.AM-08": "Manage systems, hardware, software, services and data throughout their life cycles.",
  "ID.RA-01": "Identify, validate and record vulnerabilities in assets.",
  "ID.RA-02": "Receive cyber threat intelligence from the national incident information-sharing platform, the incident repository and other official sources.",
  "ID.RA-03": "Identify and record internal and external threats.",
  "ID.RA-04": "Identify and record the potential impacts and likelihoods of threats exploiting vulnerabilities.",
  "ID.RA-05": "Use threats, vulnerabilities, likelihoods and impacts to understand inherent risk and inform risk response prioritisation.",
  "ID.RA-06": "Choose, prioritise, plan, track and communicate risk responses.",
  "ID.RA-07": "Manage, assess for risk impact, record and track changes and exceptions to approved documentation.",
  "ID.RA-08": "Establish processes for receiving, analysing and responding to vulnerability disclosures.",
  "ID.RA-09": "Assess the authenticity and integrity of hardware and software before acquisition and use.",
  "ID.RA-10": "Assess critical suppliers before acquiring critical goods and services from them.",
  "ID.IM-01": "Identify improvements from cyber protection assessments.",
  "ID.IM-02": "Identify improvements from security tests and exercises, including those done with suppliers and relevant third parties.",
  "ID.IM-03": "Identify improvements to cybersecurity risk management while running operational processes, procedures and activities.",
  "ID.IM-04": "Establish, approve, communicate, review and improve the incident response plan (in line with the National Incident Response Plan, Cabinet of Ministers resolution No. 1533 of 26.11.2025), internal cybersecurity policies, the cyber protection plan and other governing documents.",
  "PR.AA-01": "Manage identities and credentials for authorised users, services and hardware across the organisation.",
  "PR.AA-02": "Proof identities and bind them to credentials based on the context of interactions.",
  "PR.AA-03": "Authenticate users, services and hardware.",
  "PR.AA-04": "Protect, convey and verify identity assertions.",
  "PR.AA-05": "Define access permissions, entitlements and authorisations in policy, following least privilege and separation of duties, and manage, enforce and review them.",
  "PR.AA-06": "Manage and monitor physical access to assets commensurate with risk.",
  "PR.AT-01": "Run regular cyber hygiene briefings and training so that staff have the knowledge and skills for general tasks with cybersecurity risk in mind.",
  "PR.AT-02": "Train staff in specialised cybersecurity and cyber protection roles so that they have the knowledge and skills for their assigned tasks.",
  "PR.DS-01": "Protect the confidentiality, integrity and availability of data at rest in the organisation's systems.",
  "PR.DS-02": "Protect the confidentiality, integrity and availability of data in transit.",
  "PR.DS-10": "Protect the confidentiality, integrity and availability of data in use: accessed, processed and regularly updated by the organisation's applications, users or devices.",
  "PR.DS-11": "Create, protect, maintain and test backups of data.",
  "PR.PS-01": "Establish and apply configuration management practices.",
  "PR.PS-02": "Maintain, replace and remove software commensurate with risk.",
  "PR.PS-03": "Maintain, replace and remove hardware commensurate with risk.",
  "PR.PS-04": "Generate log records and make them available for continuous monitoring.",
  "PR.PS-05": "Prevent installation and execution of unauthorised software.",
  "PR.PS-06": "Integrate secure software development practices and monitor their performance throughout the software development life cycle.",
  "PR.IR-01": "Protect networks and environments from unauthorised logical access and use.",
  "PR.IR-02": "Protect technology assets from environmental threats.",
  "PR.IR-03": "Implement mechanisms to achieve resilience requirements in normal and adverse situations.",
  "PR.IR-04": "Maintain adequate resource capacity to ensure availability.",
  "DE.CM-01": "Monitor networks and network services continuously to find potentially adverse events.",
  "DE.CM-02": "Monitor the physical environment continuously to find potentially adverse events.",
  "DE.CM-03": "Monitor staff activity and technology usage continuously to find potentially adverse events.",
  "DE.CM-06": "Monitor external service provider activities and services continuously to find potentially adverse events.",
  "DE.CM-09": "Monitor computing hardware and software, runtime environments and their data continuously to find potentially adverse events.",
  "DE.AE-02": "Analyse potentially adverse events periodically to better understand associated activities.",
  "DE.AE-03": "Correlate information from multiple sources periodically.",
  "DE.AE-04": "Understand the estimated impact and scope of adverse events.",
  "DE.AE-06": "Pass information on adverse events to authorised entities for use with the appropriate tools.",
  "DE.AE-07": "Collect, detect and analyse cyber threat intelligence and other contextual information.",
  "DE.AE-08": "Declare incidents and attacks properly, against defined criteria.",
  "RS.MA-01": "Execute the incident response plan in coordination with relevant third parties once an incident is declared.",
  "RS.MA-02": "Triage and validate incident reports.",
  "RS.MA-03": "Categorise and prioritise incidents.",
  "RS.MA-04": "Escalate or elevate incidents as needed.",
  "RS.MA-05": "Apply criteria for initiating incident recovery.",
  "RS.AN-03": "Analyse what took place during an incident and its root causes.",
  "RS.AN-06": "Record actions taken during an investigation and preserve the records' integrity and provenance.",
  "RS.AN-07": "Collect incident data and metadata and preserve their integrity and provenance.",
  "RS.AN-08": "Estimate and validate the magnitude of an incident or attack.",
  "RS.CO-02": "Notify internal and external stakeholders of incidents, attacks and threats.",
  "RS.CO-03": "Share information with designated internal and external stakeholders.",
  "RS.MI-01": "Contain incidents.",
  "RS.MI-02": "Eradicate incidents.",
  "RC.RP-01": "Execute the recovery portion of the incident response plan once initiated from the incident response process.",
  "RC.RP-02": "Select, scope, prioritise and perform recovery actions.",
  "RC.RP-03": "Verify the integrity of backups and other restoration assets before using them for restoration.",
  "RC.RP-04": "Consider critical mission functions to establish post-incident operational norms.",
  "RC.RP-05": "Verify the integrity of restored assets, restore systems and services, and confirm normal operating status.",
  "RC.RP-06": "Declare the end of incident recovery, based on criteria, and complete incident-related documentation.",
  "RC.CO-03": "Communicate recovery activities and progress in restoring operational capabilities to designated internal and external stakeholders.",
  "RC.CO-04": "Inform the public about incident recovery using approved methods and messaging, under the public notification procedure of Cabinet of Ministers resolution No. 1533 of 26.11.2025."
 },
 "legal_groups": {"1": "Organisation and staffing", "2": "Staff awareness", "3": "Cyber protection plan", "4": "Incident response", "5": "System protection", "6": "Information sharing"},
 "legal": {
  "1.1": "Is a head of cyber protection, or a person performing that role, appointed?",
  "1.2": "Is a separate cyber protection unit set up and working?",
  "1.3": "Is the cyber protection unit fully staffed (100%) under its approved structure?",
  "2.1": "Did all staff who were due take cyber hygiene training during the reporting period? (give the share who did)",
  "2.2": "Did every staff category scheduled for cyber protection training complete it? (give the share who did)",
  "3.1": "Is there a cyber protection plan?",
  "3.2": "Is the cyber protection plan reviewed every year?",
  "4.1": "Is there working cooperation with incident response teams (CSIRTs)?",
  "4.2": "Are incident response policies and procedures written and kept up to date?",
  "5.1": "Is internet access provided through the State Cyber Protection Centre's secure government access system, a provider with secure access nodes, or the subject's own security-authorised secure access system?",
  "5.2": "Are the subject's systems connected to the response tools of the national response system?",
  "6.1": "Has the subject joined the national platform for sharing information on incidents, attacks and threats?",
  "6.2": "Is there an information-sharing email address on the subject's own domain with an associated OpenPGP key?"
 }
}