This act introduces amendments to the procedure for protecting state information resources and restricted access information used by the Ministry of Defense and the Armed Forces of Ukraine. It clarifies the requirements for security control of information systems and tools, and also defines the criteria for the application of information protection means, including cryptographic ones, in systems deployed in the cloud outside of Ukraine.
Structurally, the act consists of a short preamble and two main changes made to постанову (Resolution) of the Cabinet of Ministers of Ukraine No. 719 dated June 18, 2024. The first change concerns the addition of a subparagraph to paragraph 3, which allows the use of certain systems and tools, provided that their security is controlled by the bodies of the Ministry of Defense responsible for cryptographic information protection. The second change adds paragraph 6, which defines the criteria for information protection means used in cloud systems outside of Ukraine, including requirements for expert opinions, compliance with international standards (ISO/IEC 15408, ISO/IEC 19790) and FIPS standards.
The most important provision of this act is the definition of criteria for the use of information protection means in cloud systems located outside of Ukraine. This allows for a more flexible approach to the selection of protection means, taking into account international standards and requirements, but subject to ensuring proper control over their use.
