Cybersecurity of the energy sector of Ukraine: administrative and legal mechanisms for protecting the state’s critical infrastructure

Abstract

This research focuses on the analysis of administrative and legal systems providing cybersecurity within Ukraine’s energy sector amidst growing hybrid threats. Utilizing formal legal analysis, comparative methods, systems approaches, and examination of official reports, the study assesses the effectiveness of existing legislation and the roles of critical institutions such as the State Service for Special Communications and Information Protection (SSSCIP), the National Coordination Centre for Cybersecurity (NCSCC), and international cooperation frameworks. The findings indicate that, while Ukraine has made significant strides in developing a foundational legal and institutional framework aligned with European Union standards, several challenges hinder effective implementation. Key issues include insufficient sector-specific regulations, budgetary limitations, and a critical shortage of professionals with specialized training. The research highlights particular cybersecurity vulnerabilities, such as the protection of automated process control systems and the inconsistent levels of cyber preparedness across energy enterprises. Furthermore, the report underscores the need to enhance governmental oversight, establish clear technical standards that align with IEC 62443 and NIS 2, and expand training and support initiatives for operators of critical infrastructure. The recommendations aim to strengthen Ukraine’s energy sector’s cyber resilience, ensuring the stability and reliability of national infrastructure amidst rising cyber threats.