This Order of the SSSCIP Administration No. 302 dated 24.04.2026 approves the new version of the Regulation on State Expertise in the Field of Cryptographic Information Protection (CIP). The document defines a clear mechanism for the organization and conduct of expertise for cryptographic protection tools, algorithms, and protocols used in Ukraine. It establishes rules of interaction between customers, expert organizations, and the SSSCIP Administration. The primary purpose of the act is to ensure the compliance of cryptographic tools with security requirements and the regulatory legal acts of Ukraine.
### Structure and Main Provisions
The Regulation consists of three sections and four annexes:
1. **General Provisions:** defines terminology, subjects of the expertise (customers, expert organizations, SSSCIP), and objects of study.
2. **Procedure for Conducting Expert Studies:** regulates the process of selecting an expert organization, identifying samples, developing programs and methodologies for studies, as well as documentation requirements.
3. **Procedure for Conducting Expertise:** describes the procedure for reviewing the results of studies by the Expert Commission, and the issuance, suspension, or cancellation of expert conclusions.
**Changes:** The new version details procedures for software identification via hash functions (specifically according to the DSTU 7564:2014 standard), clarifies requirements for the recognition of international certificates (ISO/IEC 15408, NIAPC), and implements mechanisms for control studies for the extension of the validity period of conclusions.
### Key Provisions for Practical Use
* **Gratuitousness:** The organization of state expertise by the SSSCIP Administration is carried out on a gratuitous (free of charge) basis.
* **Identification:** A key stage is the identification of samples and the integrity control of software via hashing, which allows for the scope of the conclusion to extend to copies of software tools.
* **Validity Periods:** Conclusions are issued for a term of up to 3 years (for single tools/batches) or up to 5 years (for serial tools, algorithms, and software).
* **Martial Law:** A provision is made for the possibility of extending the validity period of an expert conclusion by 6 months in the event that control studies cannot be conducted due to martial law conditions.
* **Grounds for Cancellation:** It is important to consider that a conclusion may be canceled in the event of the discovery of unauthorized changes to the object, the provision of inaccurate information, or the non-compliance of the tool with modern security requirements based on the results of control studies.
* **Appeal:** Decisions made within the framework of the expertise may be appealed in accordance with the Law of Ukraine “On Administrative Procedure”.
