Is a lender, in Ukraine

Закон України "Про основні засади забезпечення кібербезпеки України" № 2163-VIII від 05.10.2017 (редакція від 03.04.2025, підстава - 4070-IX), ст. 6(4) · Read the law's page

• Ensure the cyber-defense of the communication and technological systems of your critical infrastructure object, and protect its technological information, in accordance with legislative requirements.
• Organize an independent information-security audit of your critical infrastructure object, to the requirements the Cabinet of Ministers of Ukraine sets, or, where you are a bank, another financial-services-market participant the National Bank of Ukraine regulates and supervises, a payment-system operator or participant, or a payment-services technology operator, to the requirements the National Bank of Ukraine sets instead.
• This binds an owner or manager of an enterprise, institution or organization that Ukraine's critical-infrastructure designation process (Law No. 1882-IX "On Critical Infrastructure") has classified as a critical infrastructure object; that Law's own sector list (its Article 9(4)) includes, among seventeen sectors, governance and essential public administrative services, energy, water, food, healthcare, the pharmaceutical industry, vaccine manufacturing and biolab operation, information services, electronic communications, financial services, transport, defense and state security, law enforcement, civil protection, space activity, the chemical industry, and research activity.
• No fine or criminal penalty currently attaches to a breach of this duty by name: Article 12 only cross-references whatever civil, administrative or criminal liability already exists elsewhere in Ukrainian law for the underlying conduct.

Закон України "Про основні засади забезпечення кібербезпеки України" № 2163-VIII від 05.10.2017 (редакція від 03.04.2025, підстава - 4070-IX), ст. 6(4)-(5), ст. 9(2) · Read the law's page

• This binds the same critical-infrastructure-object owner or manager described on this jurisdiction's companion cyber-defense-and-audit row.
• Inform CERT-UA immediately (невідкладно, without delay; the statute states no fixed hour clock) of a cybersecurity incident affecting your critical infrastructure object's communication or technological systems.
• Where the incident information you exchange with CERT-UA or another party contains personal data, handle that exchange under the requirements of the Law on the Protection of Personal Data.
• No fine or criminal penalty currently attaches to a breach of this notification duty by name: Article 12 only cross-references whatever civil, administrative or criminal liability already exists elsewhere in Ukrainian law for the underlying conduct.