Ukraine’s yearly cyber self-assessment, as an engine
Since 2026 every Ukrainian public body, local council and critical-infrastructure operator has to assess its own cyber protection once a year and send the report to the regulator. The method is spread across several PDF orders. I parsed them into data and wrote a scoring module with tests; the official report and plan now fill themselves in from the answers. The demo runs on a made-up village council, and nothing you enter leaves your browser.
Context for readers outside Ukraine
- The regulator is the State Service of Special Communications and Information Protection (SSSCIP, «Держспецзв’язку»). It writes the methods, keeps the list of people allowed to run assessments and receives the reports.
- Law No. 4336-IX of 27 March 2025 replaced the old certification of protection systems with security authorisation: each system is checked against a security profile (Cabinet resolution No. 712 of 18 June 2025). Resolution No. 1799 of 31 December 2025 added a yearly self-assessment of the current state of cyber protection. The report goes to SSSCIP within 30 days. Critical-infrastructure operators also need an external assessment at least every two years, and only people on SSSCIP’s list may run either kind. Banks and payment operators are out of scope because the National Bank regulates them.
- The framework is an adapted NIST CSF 2.0. SSSCIP order No. 75 of 30 January 2026 set a catalogue of 106 measures with the same structure and IDs as the NIST Cybersecurity Framework 2.0 (six functions, 22 categories, outcomes such as GV.OC-01), plus a few Ukrainian additions like the national incident response plan. Part of the catalogue is mandatory, and which part depends on the type of subject: 68 measures for the most critical infrastructure, 44 for the less critical, 23 for public bodies and councils that hold state information resources. Restricted information has its own set of 6, which adds one measure (DE.AE-06) to a council’s 23.
- The score comes from a formula in order No. 285 of 16 April 2026 (the report form was revised by No. 607 of 7 August 2026). Each measure is implemented (1), partially implemented (0.5), planned (0.2, only with an approved schedule or budget), not implemented (0) or not applicable. Mandatory measures count double. The functions have weights: legal compliance, Govern, Identify and Respond 0.12 each, Protect and Detect 0.23 each, Recover 0.06. If any function scores below 20%, the whole state is critical. The four state names follow the CSF tiers: Partial, Risk-informed, Repeatable, Adaptive.
- The same problem shows up wherever a regulator publishes a framework, a scoring method and report forms as documents and each service provider rebuilds them in spreadsheets: national NIS2 rules, sector rules, customer security questionnaires. Ukraine’s version is unusually exact, so it was a good place to try turning regulation into code.
Demo: a made-up village council
A typical small council: someone is responsible and some policies exist, but there is almost no monitoring or incident response. The type of subject decides which measures are mandatory and count double. Measure texts are an unofficial English translation; the verification questions stay in the Ukrainian original.
Type of subject
Answers
Overall state of cyber protection
Draft report
Sections II and III of the official report form (order No. 607) fill in from the same answers. Section I (systems, grounds, period, assessors) and the signatures stay with the provider.
Draft cyber protection plan
Section II of the plan form (order No. 75): every measure not yet fully implemented, mandatory ones first. Without a responsible person and a deadline, a measure cannot count as "planned" (0.2) next year.
How it was built
- Four official documents were parsed into JSON: 106 measures, 358 verification questions and 13 legal-compliance criteria, each row with its source document and page. The regulator’s site blocks scripts, so I downloaded the PDFs by hand.
- The mandatory-measure lists appear in two different documents (the base measures order and the plan form). I parsed both, and all four lists match. The catalogue has exactly 22 categories, as in CSF 2.0.
- The scoring module is plain JavaScript with no dependencies; this page runs the same code a later tool would. Its tests reproduce a council scored by hand. Where the method is silent, the chosen reading is written down below rather than buried in code.
- Report sections II and III and plan section II come out of the same answers. Still to do: the security profile for authorisation, several clients and years in one place, and a collector that turns Windows group policies and event logs into evidence.
- Getting from the PDFs to this page took about a day of work with AI. Keeping it right when the regulator changes the forms takes longer, and that is the part clients pay for: the report form changed four months after it was issued.
What the formula says that the documents don’t
A council that implements all 23 mandatory measures and nothing else scores critical. Detect has 11 measures and only one of them is mandatory for councils, so Detect scores 16.67%, and anything below 20% triggers the critical link. To get out of "critical" a council needs measures beyond the mandatory set, so they belong in the plan early. You can check it with the "only mandatory measures done" set in the demo above.
Readings where the method is silent
The tool prepares the documents; the assessment itself stays with a person on SSSCIP’s list, who signs the report (resolution No. 1799, item 15). Ukrainian service providers have their own page in Ukrainian.
Work with me
Have a compliance regime that lives in PDFs?
I turn regulations and their report forms into tested code that fills in the documents, and I keep it current when the regulator changes the forms. Send me the framework you work with.