CYBERSECURITY OF CRITICAL INFRASTRUCTURE UNDER MARTIAL LAW CONDITIONS

Abstract

The article examines the legal and organizational foundations for ensuring cybersecurity of critical infrastructure objects under martial law conditions in Ukraine. The provisions of the Law of Ukraine "On the Basic Principles of Ensuring Cybersecurity of Ukraine" of October 5, 2017, in particular the norms of Articles 6 and 8 regarding cyber defense of critical infrastructure and the structure of the national cybersecurity system, are analyzed in their interrelation with the Law of Ukraine "On Critical Infrastructure" of November 16, 2021, and the martial law regime introduced by the Decree of the President of Ukraine of February 24, 2022. The practice of cyberattacks on critical infrastructure objects of Ukraine during the full-scale armed aggression of the Russian Federation is examined and the main threat vectors in cyberspace are identified, including coordinated cyberattacks on energy and communications infrastructure. The powers of the national cybersecurity system subjects are considered, in particular the State Service of Special Communications and Information Protection of Ukraine and the governmental computer emergency response team CERT-UA, and their activities during wartime are analyzed. The Cybersecurity Strategy of Ukraine for 2021–2025 is analyzed and the degree of its adaptability to armed conflict conditions is determined. The necessity of improving sectoral cybersecurity requirements for critical infrastructure objects taking into account the experience of countering cyber threats during martial law and relevant European Union standards, in particular Directive NIS 2, is substantiated. Proposals for strengthening the liability of critical infrastructure operators and developing public-private partnerships in the field of cyber defense are formulated.