On 2 October 2026, Ukraine's State Service of Special Communications and Information Protection (SSSCIP) and Estonia's e-Governance Academy (eGA) held the country's first CISO Forum in Kyiv. The EU Delegation's account says the event was supported by the EU-funded EU4CyberUA project, which runs from 2026 to 2029 with a €10 million budget. Ukraine wrote the chief information security officer role into law in 2025. The forum's job was to turn that legal role into working practice.
The strongest case for the mandate
A statutory CISO is a serious answer to a real problem. Wartime Ukraine has plenty of technical talent but patchy accountability. When nobody in an organisation owns cyber risk, incidents become IT tickets rather than management decisions. SSSCIP's own readout of the forum describes the shift as moving from responding to individual technical threats to managing cyber risk across the organisation. That means clear lines of responsibility and cyber risk built into management decisions. Deputy Chairman Volodymyr Trofymenko said CISOs need "the necessary competence and sufficient authority", and that the forum should become an annual fixture. The 2025 law also moves Ukraine toward EU practice. A law-firm summary says it entered into force on 20 April 2025, aims to align with the NIS 2 Directive, and is expected to need more than 30 implementing acts. A single accountable officer is a sensible foundation for all of that.
Where the pressure actually lands
The incident data suggests the mandate will not be tested at the centre. According to Dev.ua's reporting on CERT-UA's figures, the team processed 5,927 incidents in 2025. That is 37.4% more than the 4,315 in 2024. Local authorities were the largest target group, with 2,115 incidents or 35.7% of the total, up from 31.8% the year before. Central government organisations accounted for 1,170 incidents, a falling share. CERT-UA cautions that its statistics cover only events it detected and processed, not all attacks.
This matters for how the new CISO role is designed. A national ministry can hire a credible CISO and fund a security operations centre. A small municipality or regional military administration usually cannot. It faces the same adversary with a fraction of the staff and budget.
The forum's second day, billed as CSIRT Day, took up exactly this gap. According to the EU Delegation, it covered "the development of regional cybersecurity centres, their cooperation with CERT-UA, and the involvement of regional teams in delivering services at the national level." That is the right pivot. It treats regional capacity as shared infrastructure rather than expecting every local body to build its own defences.
Why talent, not paperwork, is the constraint
The pro-innovation risk in any CISO mandate is that compliance becomes the goal. If the law is read as "appoint someone with the title", organisations will tick the box and nothing will improve. The EU and eGA material points to the better path: build the people pipeline first. The eGA project launch notice lists a National CISO Training Centre among EU4CyberUA's components. It also lists modernised Security Operations Centres, protection of critical infrastructure and government information systems, and cooperation with ENISA and CERT-EU.
The pipeline already has a bottleneck. The EU Delegation notes that CISO Campus, the existing training body, will need "additional expertise, people and resources" to grow. SSSCIP says the same: further development will require expanded capacity to train CISOs in Ukraine. Its CEO, Ieva Ilves, reported strong demand for professional training, according to Brussels Times. Demand outrunning supply is a sign of progress. It also means a mandate can arrive faster than qualified people.
What proportionate implementation looks like
Three design choices would keep the framework pro-resilience rather than pro-paperwork.
- Scale obligations to risk. The incident data shows many small public bodies under heavy attack. They should be able to meet CISO duties through shared or regionally pooled roles, not by each hiring a full-time officer they cannot afford or find.
- Measure outcomes, not appointments. Detection time, incident reporting to CERT-UA and recovery speed say far more than a count of named CISOs. The forum's emphasis on a systematic approach to risk fits this view.
- Keep the community open. Trofymenko stressed ongoing dialogue between those who set the rules and those who implement them. An annual forum helps only if practitioners' feedback actually changes implementing acts. With more than 30 still to come, there is room to do that.
What to watch
Two caveats apply. First, the forum itself was a convening, not a policy change. Neither SSSCIP nor the EU Delegation published attendance figures or new rules from it. Second, EU4CyberUA is only months old, having launched in Kyiv on 10 June 2026, so there are no results to evaluate yet. The real tests will be whether regional cybersecurity centres get stable funding, whether CISO Campus scales, and whether the implementing acts stay proportionate to the risk each organisation actually faces.
Ukraine has a decade of operational experience that few countries can match. Its CISO framework will succeed if it channels that experience into the places under the most pressure, which on the 2025 data are local governments, not the capital's ministries.