The Ministry of Energy of Ukraine coordinates the development of cybersecurity and the implementation of cyber protection measures in Ukraine’s fuel and energy sector.
By Order of the Ministry of Energy dated December 15, 2022, No. 417, registered with the Ministry of Justice of Ukraine on February 8, 2023, under No. 249/39305, the Cybersecurity Requirements for the Fuel and Energy Sector of Critical Infrastructure were approved. The requirements were developed taking into account the Framework for Improving Critical Infrastructure Cybersecurity issued by the U.S. National Institute of Standards and Technology. The positive outcomes of implementing these requirements include the creation of a legal and regulatory framework for the practical implementation of cyber protection measures that enhance the cyber resilience of critical infrastructure facilities, as well as a significant reduction in the likelihood of cybersecurity crises.
An Energy Sector Cyber Threat Information Exchange Platform (MISP) has been established, enabling response and rapid information sharing on cyber incidents, cyberattacks, and cyber threats between key cybersecurity stakeholders and enterprises of Ukraine’s fuel and energy sector, as well as operators of fuel and energy critical infrastructure.
As part of the implementation of the Smart Grid Deployment Concept in Ukraine until 2035, approved by the Cabinet of Ministers of Ukraine Resolution No. 908-r dated October 14, 2022, the Ministry of Energy issued Order No. 285 dated August 5, 2024, registered with the Ministry of Justice of Ukraine on August 21, 2024, under No. 1278/42623, approving the Methodology for Assessing the Cybersecurity Status of Power Grids and Power Grid Cybersecurity Practices. The methodology defines the Cybersecurity Capability Maturity Model (C2M2) developed by the U.S. Department of Energy, as well as indicators and indexes for evaluating power grid cybersecurity. The corresponding self-assessment allows operators of critical infrastructure to improve cybersecurity programs, strengthen the cyber resilience of power grids, and increase their protection.
By Order of the Ministry of Energy dated September 10, 2024, No. 338, registered with the Ministry of Justice of Ukraine on September 24, 2024, under No. 1438/42783, the Procedure for Conducting a Cybersecurity Review of the Fuel and Energy Critical Infrastructure Sector was approved. Based on the 2025 Review, the Ministry of Energy prepared an assessment of the cybersecurity status of the fuel and energy critical infrastructure sector, described identified actual and potential cyber threats, and developed proposals for measures to ensure cyber resilience, as well as for improving Ukraine’s cybersecurity legislation.
To ensure timely cyber protection measures for critical information systems in the energy sector, the Ministry of Energy continuously updates the List of Fuel and Energy Sector Critical Information Infrastructure Facilities.
The Ministry of Energy has also developed Methodological Recommendations for Improving the Cyber Hygiene of Civil Servants of the Ministry and employees of operators of the fuel and energy critical infrastructure sector.
The Ministry implements measures to improve the skills of energy sector cybersecurity specialists. In 2023, it conducted sectoral training with a Table Top Exercise (TTX) simulating a Ransomware cyberattack, held a cybersecurity round table for the fuel and energy sector, and organized a strategic session that brought together critical infrastructure cybersecurity specialists. In 2024, it conducted open command-and-staff cybersecurity exercises for energy companies and training for critical infrastructure operators. In 2025, training was provided to 4,000 energy sector employees and Ministry civil servants on the Basics of Cyber Hygiene course.
The Ministry of Energy also works in the field of cyber diplomacy. Experts from the United States, European Union countries, and NATO are involved in implementing cyber protection measures for Ukraine’s energy infrastructure.
