ORIGINAL PAPER
Cybersecurity of the energy sector of Ukraine: administrative and legal mechanisms for protecting the state’s critical infrastructure
1
National Academy of Legal Sciences of Ukraine, Ukraine
2
Ukrainian State University of Railway Transport, Ukraine
3
Yaroslav Mudryi National Law University, Ukraine
Submission date: 2025-09-05
Final revision date: 2025-10-23
Acceptance date: 2025-11-03
Publication date: 2026-06-29
Polityka Energetyczna – Energy Policy Journal 2026;29(2):87-112
KEYWORDS
jurisprudenceglobal digitalizationoperational technologiesinternational standardsindustrial control systemsincident responseinternational cooperation
TOPICS
ABSTRACT
This research focuses on the analysis of administrative and legal systems providing cybersecurity within Ukraine’s energy sector amidst growing hybrid threats. Utilizing formal legal analysis, comparative methods, systems approaches, and examination of official reports, the study assesses the effectiveness of existing legislation and the roles of critical institutions such as the State Service for Special Communications and Information Protection (SSSCIP), the National Coordination Centre for Cybersecurity (NCSCC), and international cooperation frameworks. The findings indicate that, while Ukraine has made significant strides in developing a foundational legal and institutional framework aligned with European Union standards, several challenges hinder effective implementation. Key issues include insufficient sector-specific regulations, budgetary limitations, and a critical shortage of professionals with specialized training. The research highlights particular cybersecurity vulnerabilities, such as the protection of automated process control systems and the inconsistent levels of cyber preparedness across energy enterprises. Furthermore, the report underscores the need to enhance governmental oversight, establish clear technical standards that align with IEC 62443 and NIS 2, and expand training and support initiatives for operators of critical infrastructure. The recommendations aim to strengthen Ukraine’s energy sector’s cyber resilience, ensuring the stability and reliability of national infrastructure amidst rising cyber threats.
CONFLICT OF INTEREST
The Authors have no conflicts of interest to declare.
METADATA IN OTHER LANGUAGES:
Polish
Cyberbezpieczeństwo sektora energetycznego Ukrainy: mechanizmy administracyjne i prawne ochrony infrastruktury krytycznej państwa
orzecznictwo, globalna cyfryzacja, technologie operacyjne, standardy międzynarodowe, przemysłowe systemy sterowania, reagowanie na incydenty, współpraca międzynarodowa
Celem badania było zbadanie aktualnego stanu, skuteczności i wyzwań w funkcjonowaniu mechanizmów administracyjnych i prawnych zapewniających cyberbezpieczeństwo w sektorze energetycznym Ukrainy w warunkach wzmożonych zagrożeń. Metodologia pracy obejmowała zastosowanie metod teoretycznych, w szczególności formalnoprawnej analizy ustawodawstwa ukraińskiego i aktów międzynarodowych, metody prawnoporównawczej (porównanie z praktyką Unii Europejskiej, Stanów Zjednoczonych Ameryki i Izraela), analizy systemowej interakcji instytucjonalnych (Państwowa Służba Łączności Specjalnej i Ochrony Informacji Ukrainy, Narodowe Centrum Koordynacji Cyberbezpieczeństwa) oraz analizy oficjalnych raportów. Stwierdzono, że pomimo istnienia podstawowych ram regulacyjnych i instytucjonalnych, ich praktyczne wdrożenie napotkało znaczne trudności. Zidentyfikowano istotne luki we wdrażaniu wymogów cyberbezpieczeństwa przez operatorów obiektów energetycznych, niedostateczne uszczegółowienie regulacji dotyczących zautomatyzowanych systemów sterowania procesami i bezpieczeństwa przemysłowych systemów sterowania, problemy z efektywnością kontroli państwowej wynikające z ograniczonych zasobów oraz potrzebę dogłębnej wiedzy technicznej. Współpraca międzynarodowa i harmonizacja z normami europejskimi zostały uznane za istotne czynniki wzmacniające odporność, chociaż wdrożenie wymagało spójności. Wyniki badania i przedstawione rekomendacje (dotyczące opracowania standardów sektorowych, wzmocnienia nadzoru, wsparcia operatorów i rozwoju zasobów ludzkich) mogłyby zostać wykorzystane przez organy publiczne do ulepszenia przepisów i praktyki administracyjnej w celu zwiększenia cyberodporności krytycznej infrastruktury energetycznej.
REFERENCES (83)
1.
Agyemang et al. 2025 – Agyemang, R., Furnell, S. and Muller, T. 2025. A profile-based cyber security readiness assessment framework at country level. [In:] N. Clarke and S. Furnell (Eds.), Proceedings of the 18th IFIP WG 11.12 International Symposium “Human Aspects of Information Security and Assurance”, pp. 93–106, Cham: Springer, https://doi.org/10.1007/978-3-....
2.
Alghassab, M. 2022. Analyzing the impact of cybersecurity on monitoring and control systems in the energy sector. Energies 15(1), https://doi.org/10.3390/en1501....
3.
Ampratwum et al. 2023 – Ampratwum, G., Tam, V.W.Y. and Osei-Kyei, R. 2023. Critical analysis of risks factors in using public-private partnership in building critical infrastructure resilience: A systematic review. Construction Innovation 23(2), pp. 360–382, https://doi.org/10.1108/CI-10-....
4.
Anguelov, K. and Kavaldzhieva, K. 2021. Methodology for determining the socio-economic factors in the performance of Cost-Benefit Analysis for the production of electricity from biomass. [In:] 2021 17th Conference on Electrical Machines, Drives and Power Systems, ELMA 2021 – Proceedings. Sofia: Institute of Electrical and Electronics Engineers, https://doi.org/10.1109/ELMA52....
5.
Annual analytical review (October 2023–September 2024) 2024. [Online:] https://www.rnbo.gov.ua/files/... [Accessed: 2026-01-15].
6.
Assante, M. 2016. Confirmation of a coordinated attack on the Ukrainian power grid. [Online:] https://www.readkong.com/page/... [Accessed: 2026-01-15].
7.
Biluk et al. 2020 – Biluk, I., Shareyko, D., Fomenko, A., Havrylov, S., Savchenko, O. and Hruban, V. 2020. Adaptive Control in Complete Electric Drives. [In:] Proceedings of the 25th IEEE International Conference on Problems of Automated Electric Drive. Theory and Practice, PAEP 2020, Kremenchuk: Institute of Electrical and Electronics Engineers, https://doi.org/10.1109/PAEP49....
8.
Boiko et al. 2023 – Boiko, S., Kasatkina, І. and Danilin, О. 2023. Aspects of reconfiguration of electrical supply systems when implementing distributed generation sources in the terms of distribution networks of enterprises. Journal of Kryvyi Rih National University 21(1), pp. 169–174, https://doi.org/10.31721/2306-....
9.
Brunet-Jailly, E. 2022. Cross-border cooperation: A global overview. Alternatives 47(1), pp. 3–17, https://doi.org/10.1177/030437....
10.
Carrapico, H. and Farrand, B. 2024. Cybersecurity trends in the European Union: Regulatory mercantilism and the digitalisation of geopolitics. Journal of Common Market Studies 62(S1), pp. 147–158, https://doi.org/10.1111/jcms.1....
11.
Casino et al. 2022 – Casino, F., Pina, C., López-Aguilar, P., Batista, E., Solanas, A. and Patsakis, C. 2022. SoK: Cross-border criminal investigations and digital evidence. Journal of Cybersecurity 8(1), https://doi.org/10.1093/cybsec....
12.
Code of Ukraine “On Administrative Offences” 1984. [Online:] https://zakon.rada.gov.ua/laws... [Accessed: 2026-01-15].
13.
Convention on Cybercrime (ETS No. 185) 2001. [Online:] https://www.coe.int/en/web/con... [Accessed: 2026-01-15].
14.
Criminal Code of Ukraine 2001. [Online:] https://zakon.rada.gov.ua/laws... [Accessed: 2026-01-15].
16.
Dai et al. 2025 – Dai, Z.C., Tan, M., Yang, Y., Liu, X., Wang, R. and Su, Y.X. 2025. Massive Coordination of Distributed Energy Resources in VPP: A Mean Field RL-Based Bi-Level Optimization Approach. IEEE Transactions on Cybernetics, https://doi.org/10.1109/TCYB.2....
17.
Danchuk, V. and Danchuk, M. 2024. Integration of blockchain technologies into cybersecurity systems for critical infrastructure facilities: Prospects and challenges. Bulletin of Cherkasy State Technological University 29(4), pp. 43–52, https://doi.org/10.62660/bcstu....
18.
Decree of the President of Ukraine No. 242/2016 “On the National Coordination Centre for Cybersecurity” 2021. [Online:] https://zakon.rada.gov.ua/laws... [Accessed: 2026-01-15].
19.
Decree of the President of Ukraine No. 447/2021 “On the Decision of the National Security and Defence Council of Ukraine of 14 May 2021 ‘On the Cybersecurity Strategy of Ukraine’” 2021. [Online:] https://www.president.gov.ua/d... [Accessed: 2026-01-15].
20.
Directive (EU) No. 2022/2555 of the European Parliament and of the Council “On Measures for a High Common Level of Cybersecurity Across the Union” 2022. [Online:] http://data.europa.eu/eli/dir/... [Accessed: 2026-01-15].
21.
Dong et al. 2022 – Dong, S., Cao, J., Flynn, D. and Fan, Z. 2022. Cybersecurity in smart local energy systems: Requirements, challenges, and standards. Energy Informatics 5, 9, https://doi.org/10.1186/s42162....
23.
EU supports cybersecurity in Ukraine with over 10 million euro 2022. [Online:] https://www.eeas.europa.eu/del... [Accessed: 2026-01-15].
25.
European Resource Adequacy Assessment 2022 Edition 2022. [Online:] https://www.entsoe.eu/outlooks... [Accessed: 2026-01-15].
26.
Firoozjaei et al. 2022 – Firoozjaei, M.D., Mahmoudyar, N., Baseri, Y. and Ghorbani, A.A. 2022. An evaluation framework for industrial control system cyber incidents. International Journal of Critical Infrastructure Protection 36, https://doi.org/10.1016/j.ijci....
27.
Fornusek, M. 2024. SBU has repelled almost 10,000 cyberattacks since 2022. [Online:] https://kyivindependent.com/sb... [Accessed: 2026-01-15].
28.
Hrynchyshyna, V. 2024. Information technology in the context of international relations: Cybersecurity as one of the challenges of the modern digital age. Kyiv: National University of “Kyiv-Mohyla Academy”.
29.
Işık et al. 2025a – Işık, C., Ongan, S., Islam, H., Yan, J., Alvarado, R. and Ahmad, M. 2025. The nexus of economic growth, energy prices, climate policy uncertainty (CPU), and digitalization on ESG performance in the USA. Climate Services 38, https://doi.org/10.1016/j.clis....
30.
Işık et al. 2025b – Işık, C., Yan, J. and Ongan, S. 2025. Energy intensity, supply chain digitization, technological progress bias in China’s industrial sectors. Energy Economics 145, https://doi.org/10.1016/j.enec....
31.
Khan, S. and Madnick, S. 2021. Cybersafety: A system-theoretic approach to identify cyber-vulnerabilities and mitigation requirements in industrial control systems. IEEE Transactions on Dependable and Secure Computing 19(5), pp. 3312–3328, https://doi.org/10.1109/TDSC.2....
32.
Korosteleva, J. 2022. The implications of Russia’s invasion of Ukraine for the EU energy market and businesses. British Journal of Management 33(4), pp. 1678–1682, https://doi.org/10.1111/1467-8....
33.
Kravchuk et al. 2024 – Kravchuk, M., Kravchuk, V., Hrubinko, A., Podkovenko, T. and Ukhach, V. 2024. Cyber security in Ukraine: Theoretical view and legal regulation. Law, Policy and Security 2(2), pp. 28–38, https://doi.org/10.62566/lps/2....
34.
Krechko, O. and Mikhaylov, A. 2025. Global electricity generation from renewable sources using fuzzy sets and spatial analysis: revolution in solar and wind energy in BRICS countries. Quality and Quantity 59(2), pp. 1553–1571, https://doi.org/10.1007/s11135....
35.
Krimmer et al. 2021 – Krimmer, R., Dedovic, S., Schmidt, C. and Corici, A.A. 2021. Developing cross-border e-Governance: Exploring interoperability and cross-border integration. [In:] N. Edelmann et al. (Eds.), Proceedings of the 13th IFIP WG 8.5 International Conference “Electronic Participation”, pp. 107–124, Cham: Springer, https://doi.org/10.1007/978-3-....
36.
Krykun, V.V. 2022. Corruption risks of the Law of Ukraine “On critical infrastructure”. Scientific Bulletin of Dnipropetrovsk State University ‘Actual Problems of Domestic Jurisprudence’ 6, pp. 141–146, https://doi.org/10.32782/39221....
37.
Kuniev, Y.D. and Krutas, V.O. 2021. Administrative regulation of offences in the information sphere. [In:] Proceedings of the XI International Scientific and Practical Conference “Modern Law in the Era of Social Change”, pp. 181–183. Kyiv: National Aviation University.
38.
Kuznietsova et al. 2022 – Kuznietsova, O., Yastremska, L., Korniyenko, I. and Baranovskyy, M. 2022. Environmental orientation of energy policy of the EU and Ukraine. Technologies and Engineering 23(4), pp. 17–34, https://doi.org/10.30857/2786-....
39.
Law of Ukraine No. 1366-IX “On Amendments to the Code of Ukraine on Administrative Offences and the Criminal Code of Ukraine on Strengthening Liability for Violation of Fire and Technological Safety Requirements” 2021. [Online:] https://zakon.rada.gov.ua/laws... [Accessed: 2026-01-15].
40.
Law of Ukraine No. 1882-IX “On Critical Infrastructure” 2021. [Online:] https://zakon.rada.gov.ua/laws... [Accessed: 2026-01-15].
41.
Law of Ukraine No. 2019-VIII “On Electricity Market” 2017. [Online:] https://zakon.rada.gov.ua/laws... [Accessed: 2026-01-15].
42.
Law of Ukraine No. 2163-VIII “On the Basic Principles of Cybersecurity in Ukraine” 2017. [Online:] https://zakon.rada.gov.ua/laws... [Accessed: 2026-01-15].
43.
Law of Ukraine No. 2229-XII “On Security Service of Ukraine” 1992. [Online:] https://zakon.rada.gov.ua/laws... [Accessed: 2026-01-15].
44.
Law of Ukraine No. 222-VIII “On Licensing of Economic Activity Types” 2015. [Online:] https://zakon.rada.gov.ua/laws... [Accessed: 2026-01-15].
45.
Law of Ukraine No. 2297-VI “On Protection of Personal Data” 2010. [Online:] https://zakon.rada.gov.ua/laws... [Accessed: 2026-01-15].
46.
Law of Ukraine No. 3855-XII “On State Secret” 1994. [Online:] https://zakon.rada.gov.ua/laws... [Accessed: 2026-01-15].
47.
Law of Ukraine No. 80/94-VR “On Protection of Information in Automated Systems” 1994. [Online:] https://zakon.rada.gov.ua/laws... [Accessed: 2026-01-15].
48.
Lella et al. 2023 – Lella, I., Tsekmezoglou, E., Theocharidou, M., Magonara, E., Malatras, A., Svetozarov Naydenov, R. and Ciobanu, C. 2023. ENISA Threat Landscape. https://doi.org/10.2824/782573.
49.
Li, X. and Tian, G. 2024. Analyzing Internet Finance Model Using Big Data Financial Intermediation. Journal of Engineering Project and Production Management 14(1), https://doi.org/10.32738/JEPPM....
50.
Liebetrau, T. 2024. Problematising EU cybersecurity: Exploring how the single market functions as a security practice. Journal of Common Market Studies 62(3), pp. 705–724, https://doi.org/10.1111/jcms.1....
51.
Malatji et al. 2022 – Malatji, M., Marnewick, A.L. and Von Solms, S. 2022. Cybersecurity capabilities for critical infrastructure resilience. Information and Computer Security 30(2), pp. 255–279, https://doi.org/10.1108/ICS-06....
52.
Markopoulou et al. 2019 – Markopoulou, D., Papakonstantinou, V. and de Hert, P. 2019. The new EU cybersecurity framework: The NIS Directive, ENISA’s role and the General Data Protection Regulation. Computer Law & Security Review 35(6), https://doi.org/10.1016/j.clsr....
53.
Odebade, A.T. and Benkhelifa, E. 2023. A comparative study of national cyber security strategies of ten nations. arXiv 2303. https://doi.org/10.48550/arXiv....
54.
On sharing information on cyber threats 2022. [Online:] https://cert.gov.ua/article/39... [Accessed: 2026-01-15].
55.
Onykiienko, Yu. and Mazin, M. 2025. Application of wavelet transformations on microcontrollers for monitoring and optimising energy systems in industrial conditions. Journal of Kryvyi Rih National University 23(1), pp. 56–67, https://doi.org/10.31721/2306-....
56.
Order of the Administration of the State Service for Special Communications and Information Protection of Ukraine No. 93 “On Approval of the Regulation on State Expertise in the Field of Technical Information Protection” 2007. [Online:] https://zakon.rada.gov.ua/laws... [Accessed: 2026-01-15].
57.
Order of the Administration of the State Service of Special Communications and Information Protection of Ukraine No. 1009 “On Approval of the Annual Plan for Implementation of State Supervision (Control) Measures in the Field of Compliance with Legislative Requirements for the Provision of Services in the Field of Technical Information Protection and Cryptographic Information Protection (Except for Electronic Trust Services) by the Administration of the State Service of Special Communications and Information Protection of Ukraine for 2024” 2023. [Online:] https://cip.gov.ua/ua/news/nak... [Accessed: 2026-01-15].
58.
Order of the Cabinet of Ministers of Ukraine No. 1351-p “On Approval of the Strategy for Digital Development of Innovation Activities of Ukraine for the Period Up to 2030 and Approval of the Operational Action Plan for Its Implementation in 2025–2027” 2024. [Online:] https://zakon.rada.gov.ua/laws... [Accessed: 2026-01-15].
59.
Osička, J. and Černoch, F. 2022. European energy politics after Ukraine: The road ahead. Energy Research & Social Science 91, https://doi.org/10.1016/j.erss....
60.
Parkes et al. 2024 – Parkes, J., Chan, D., Chan, S.Y. and Enobun, W. 2024. ISC census and annual report. [Online:] https://www.isc.co.uk/media/uu... [Accessed: 2026-01-15].
61.
Pollini et al. 2022 – Pollini, A., Callari, T.C., Tedeschi, A., Ruscio, D., Save, L., Chiarugi, F. and Guerri, D. 2022. Leveraging human factors in cybersecurity: An integrated methodological approach. Cognition, Technology & Work 24, pp. 371–390, https://doi.org/10.1007/s10111....
62.
Rajkumar et al. 2023 – Rajkumar, V.S., Ştefanov, A., Presekal, A., Palensky, P. and Torres, J.L.R. 2023. Cyber attacks on power grids: Causes and propagation of cascading failures. IEEE Access 11, pp. 103154–103176, https://doi.org/10.1109/ACCESS....
63.
Regulation (EU) No. 2019/943 of the European Parliament and of the Council “On the Internal Market for Electricity” 2019. [Online:] http://data.europa.eu/eli/reg/... [Accessed: 2026-01-15].
64.
Relations with Ukraine 2025. [Online:] https://www.nato.int/cps/uk/na... [Accessed: 2026-01-15].
65.
Resolution of the Board of the National Bank of Ukraine No. 178 “On Approval of the Regulation on Organisation of Cyber Defence in the Banking System of Ukraine and Amendments to the Regulation on Determination of Critical Infrastructure Objects in the Banking System of Ukraine” 2022. [Online:] https://zakon.rada.gov.ua/laws... [Accessed: 2026-01-15].
66.
Resolution of the Cabinet of Ministers of Ukraine No. 444 “On Approval of the Procedure for Training the Population to Act in Emergency Situations” 2013. [Online:] https://zakon.rada.gov.ua/laws... [Accessed: 2026-01-15].
67.
Safeguarding cyberspace together: SSSCIP, NCCC, and ENISA sign working arrangement 2023. [Online:] https://cip.gov.ua/en/news/raz... [Accessed: 2026-01-15].
68.
Savchuk, S.O. 2024. Challenges and opportunities of integration of Ukraine in the EU cyber security system. Economics, Management and Administration 108(2), pp. 198–203, https://doi.org/10.26642/ema-2....
69.
Semenenko et al. 2024 – Semenenko, O., Onofriichuk, V., Tolok, P., Rieznik, V. and Momot, D. 2024. Analysis of Ukraine’s external military-economic relations during the war with Russia. Scientific Bulletin of Mukachevo State University. Series “Economics” 11(1), pp. 71–82, https://doi.org/10.52566/msu-e....
70.
Singh, C. 2023. The European approach to cybersecurity in 2023: A review of the changes brought in by the network and information security 2 (NIS2) Directive 2022/2555. International Company and Commercial Law Review 5, pp. 251–261.
71.
Striolo, A. and Huang, S. 2022. Upcoming transformations in integrated energy/chemicals sectors: Some challenges and several opportunities. The Journal of Physical Chemistry C 126(51), pp. 21527–21541, https://doi.org/10.1021/acs.jp....
72.
Sulich et al. 2021 – Sulich, A., Rutkowska, M., Krawczyk-Jezierska, A., Jezierski, J. and Zema, T. 2021. Cybersecurity and sustainable development. Procedia Computer Science 192, pp. 20–28, https://doi.org/10.1016/j.proc....
73.
Tanasiichuk et al. 2024 – Tanasiichuk, A., Tyukhtenko, N., Zaburmekha, Y., Sokoliuk, S., Prokopchuk, O., Krupskyi, A. and Tsurkanov, M. 2024. Sustainable Development Strategy of Enterprises in International Markets: Opportunities and Challenges. European Journal of Sustainable Development 13(3), pp. 311–328, https://doi.org/10.14207/ejsd.....
74.
The European Union supports Ukraine’s digital transformation: Results of EU4DigitalUA’s work 2024. [Online:] https://www.eeas.europa.eu/del... [Accessed: 2026-01-15].
75.
The vulnerability detection and cyber incidents/cyber attacks response system helped to detect and process 1,042 cyber incidents in 2024, 2025. [Online:] https://scpc.gov.ua/en/article... [Accessed: 2026-01-15].
76.
Tsybka, A.A. 2025. Administrative and legal measures to address threats to energy security in the electricity and nuclear energy sectors. Kyiv Law Journal 4, pp. 101–109, https://doi.org/10.32782/klj/2....
77.
Ukraine–U.S. cooperation in cybersecurity area reaches a new level 2022. [Online:] https://cip.gov.ua/en/news/ukr... [Accessed: 2026-01-15].
78.
Umair, M. and Guliyeva, S. 2025. Optimizing welfare and market power: Energy storage strategies in renewable-integrated power markets. Journal of Energy Storage 118, https://doi.org/10.1016/j.est.....
79.
Weber, C. 2023. Achievements and challenges in European energy markets. Journal of Modern Power Systems and Clean Energy 11(3), pp. 698–704, https://doi.org/10.35833/MPCE.....
80.
Yasenenko, V. 2025. Cyber defence automation: Can AI outperform hackers? Technologies and Engineering 26(3), pp. 89–99, https://doi.org/10.30857/2786-....
81.
Yevdokymov, S. 2025. Mathematical modelling and neural networks in the context of railway cybersecurity. Information Technologies and Computer Engineering 22(2), pp. 107–117, https://doi.org/10.31649/vitce....
82.
Zaikina, H.M. 2024. Some issues of administrative and legal support of cybersecurity: The experience of the USA and the EU. In: Proceedings of the XII International Scientific and Practical Conference “Human, Society, Communication Technologies”, pp. 131–133, Kharkiv: Ukrainian State University of Railway Transport.
83.
Zografopoulos et al. 2023 – Zografopoulos, I., Hatziargyriou, N.D. and Konstantinou, C. 2023. Distributed energy resources cybersecurity outlook: Vulnerabilities, attacks, impacts, and mitigations. IEEE Systems Journal 17(4), pp. 6695–6709, https://doi.org/10.1109/JSYST.....
| eISSN: | 2720-569X |
| ISSN: | 1429-6675 |
© 2006-2026 Journal hosting platform by Bentus
We process personal data collected when visiting the website. The function of obtaining information about users and their behavior is carried out by voluntarily entered information in forms and saving cookies in end devices. Data, including cookies, are used to provide services, improve the user experience and to analyze the traffic in accordance with the Privacy policy. Data are also collected and processed by Google Analytics tool (more).
You can change cookies settings in your browser. Restricted use of cookies in the browser configuration may affect some functionalities of the website.
You can change cookies settings in your browser. Restricted use of cookies in the browser configuration may affect some functionalities of the website.
