--- title: Ukraine's yearly cyber self-assessment, as an engine lang: en site: NAVISTRI --- # Ukraine's yearly cyber self-assessment, as an engine Since 2026 every Ukrainian public body, local council and critical-infrastructure operator has to assess its own cyber protection once a year and send the report to the regulator. The method is spread across several PDF orders. I parsed them into data and wrote a scoring module with tests; the official report and plan now fill themselves in from the answers. The demo runs on a made-up village council; nothing you enter leaves the browser. ## Context for readers outside Ukraine - The regulator is the State Service of Special Communications and Information Protection (SSSCIP). It writes the methods, lists who may run assessments and receives the reports. - Law No. 4336-IX (27 March 2025) replaced certification of protection systems with security authorisation against security profiles (resolution No. 712, 18 June 2025). Resolution No. 1799 (31 December 2025) added a yearly self-assessment of the current state of cyber protection, reported to SSSCIP within 30 days. Critical-infrastructure operators also need an external assessment at least every two years, and only listed people may assess. Banks and payment operators are out of scope. - The framework is an adapted NIST CSF 2.0: SSSCIP order No. 75 (30 January 2026) has 106 measures in six functions and 22 categories, with CSF IDs such as GV.OC-01. Mandatory subsets: 68 for the most critical infrastructure, 44 for the less critical, 23 for public bodies and councils with state information resources, and 6 for restricted information (it adds DE.AE-06 to a council's 23). - The score comes from a formula in order No. 285 (16 April 2026; the report form was revised by No. 607 on 7 August 2026). Statuses are 1, 0.5, 0.2, 0 or not applicable, and mandatory measures count double. Function weights: law, Govern, Identify and Respond 0.12; Protect and Detect 0.23; Recover 0.06. Any function below 20% makes the whole state critical. The state names follow the CSF tiers. - The same problem shows up wherever a regulator publishes a framework, a scoring method and report forms as documents and each provider rebuilds them in spreadsheets (national NIS2 rules, sector rules, customer questionnaires). Ukraine's version is unusually exact. ## Demo: a made-up village council Someone is responsible and some policies exist; monitoring and incident response barely do. The type of subject decides the mandatory measures. Measure texts: unofficial English translation ([en.json](/data/en.json)); questions in the Ukrainian original ([criteria.json](/data/criteria.json)). Data: [catalog.json](/data/catalog.json), [legal.json](/data/legal.json). Scoring: [/engine/score.mjs](/engine/score.mjs). ## Draft report and plan Report sections II and III (order No. 607) and plan section II (order No. 75) fill in from the same answers. Section I and the signatures stay with the provider. ## How it was built - Four official PDFs were parsed into JSON with the document and page on every row: 106 measures, 358 questions, 13 legal criteria. The regulator's site blocks scripts, so I downloaded the PDFs by hand. - The mandatory-measure lists, parsed from two different documents, match exactly; the catalogue has 22 categories, as in CSF 2.0. - The scoring module is plain JavaScript; its tests reproduce a council scored by hand. Readings where the method is silent are written down below. - It took about a day of work with AI. Keeping it right when the regulator changes the forms takes longer, and clients pay for that part: the report form changed four months after it was issued. ## What the formula says that the documents don't A council that implements all 23 mandatory measures and nothing else scores critical: Detect has 11 measures, one of them mandatory for councils, so Detect scores 16.67%, below the 20% critical link. ## Readings where the method is silent 1. All 106 measures apply until marked not applicable. 2. Mandatory measures count 2, others 1; mandatory sets of several subject types combine. 3. Not applicable is not allowed for mandatory measures. 4. An unanswered measure counts as not implemented. 5. The 13 legal criteria use the same statuses, weight 1. 6. Scores are rounded to hundredths: up to 20% is critical, up to 50% low, up to 80% reduced, above that satisfactory. 7. Any function below 20% makes the overall state critical. 8. A function with no applicable measures has no score; its weight is redistributed. The tool prepares documents; a person on SSSCIP's list still runs the assessment and signs the report. Ukrainian page: [/](/). ## Work with me Have a compliance regime that lives in PDFs? I turn regulations and their report forms into tested code that fills in the documents, and I keep it current when the forms change: [max@sushch.uk](mailto:max@sushch.uk). A NAVISTRI demo, not legal advice. By [Maksym Sushchuk](https://sushch.uk/).