What Is the NCCC and Why Does It Matter
The National Cyber Coordination Centre (NCCC) was established under the National Security and Defence Council (NSDC) of Ukraine as Ukraine's primary cybersecurity coordination authority. Unlike national cybersecurity agencies in many countries that operate primarily in an advisory capacity, the NCCC has binding regulatory authority over classified critical infrastructure operators — the power to set mandatory security requirements, conduct compliance audits, issue corrective orders, and take enforcement action.
The NCCC's significance has grown dramatically since February 2022. Wartime amendments to Ukraine's cybersecurity law expanded the NCCC's emergency powers, accelerated the classification process for critical infrastructure objects, and tightened incident reporting obligations. The NCCC now operates as both a regulatory authority and an operational coordination hub: it coordinates incident response across sectors, shares threat intelligence with classified operators, and issues rapid tactical guidance when active campaigns are detected against Ukrainian infrastructure. Operating under NCCC requirements is not a purely bureaucratic compliance exercise — the NCCC's intelligence-sharing and coordination functions provide genuine operational value to organisations that are properly registered and compliant.
For companies in or adjacent to Ukraine's defence technology ecosystem, NCCC compliance has direct commercial significance. Brave1 certification, military procurement eligibility, and supply-chain participation in defence programmes all require demonstrated compliance with NCCC cybersecurity standards. The convergence of regulatory obligation and commercial necessity makes NCCC readiness a business priority, not merely a legal one.
Scope: Who Is Subject to NCCC Requirements
Ukraine's Law on Critical Infrastructure Protection, as amended through 2024, establishes the framework for identifying and classifying critical infrastructure objects. The sectors covered by the NCCC's mandatory requirements include: energy (electricity generation, transmission, and distribution; oil and gas infrastructure; district heating); water (drinking water supply and treatment; wastewater treatment); transport (rail, road, air, maritime); telecommunications and digital infrastructure; financial services (banking; payment systems; exchanges); health (hospitals; medical laboratories; blood supply); defence industry (defence contractors and manufacturers; military logistics); public administration (central and regional government IT systems); and space infrastructure.
Classification is based on potential consequences of disruption — specifically, whether disruption would affect national security, the defence capability of the state, the health and safety of the population, the economic stability of the country, or the functioning of critical government services. The Cabinet of Ministers maintains the official register of classified critical infrastructure objects, and operators are formally notified of their classification. The three categories (Category 1 for national-level impact, Category 2 for regional/sectoral impact, Category 3 for localised impact) determine the intensity of mandatory requirements and oversight.
A critical nuance is that classification applies to specific infrastructure objects, not to organisations as a whole. A telecommunications company may have several objects in scope — a core switching facility classified as Category 1, regional distribution nodes as Category 2 — with different requirements applying to each. Managing compliance across multiple classified objects with different categories requires careful documentation and potentially different security programmes for each object.
NCCC requirements also apply to managed service providers and IT/OT service companies that manage or operate systems on behalf of classified critical infrastructure operators. If your organisation provides security operations, network management, SCADA monitoring, or systems integration services to a classified operator, your own systems and processes may be subject to NCCC oversight as a critical supplier.
Mandatory Security Measures
NCCC mandatory security measures are issued as binding regulations and updated periodically. The current framework, substantially revised in 2022-2023, organises mandatory controls into six domains.
Governance and risk management requires classified operators to maintain a documented cybersecurity programme approved at senior leadership level, conduct annual risk assessments against NCCC-prescribed methodology, maintain a current asset inventory covering all hardware, software, and communications systems within the classified object's scope, and designate a responsible cybersecurity officer with defined authority and reporting lines to management.
Network and system security mandates network segmentation isolating critical operational systems from internet-facing infrastructure, formal access control with the principle of least privilege enforced across all systems, multi-factor authentication for all privileged and remote access, encrypted communications for all remote management and administrative access, and documented firewall and network monitoring policies reviewed at least annually.
For operators of operational technology (OT) and industrial control systems — primarily energy, water, and transport operators — additional requirements apply: logical separation of IT and OT network segments enforced by technical controls (not merely policy), OT-specific monitoring with visibility into industrial protocol communications, a formal procedure for managing the introduction of removable media into OT environments, and documented procedures for emergency manual operation of critical systems in the event of a cyber-induced loss of digital control.
Incident detection and response requires 24/7 monitoring capability covering all systems within the classified object's scope, defined incident classification criteria and response procedures, documented escalation paths to the NCCC and sector regulator, and regular incident response exercises (minimum annual). The monitoring capability must be sufficient to detect a significant incident at any hour — not just during business hours — and response procedures must be activatable within the 4-hour initial notification window regardless of when detection occurs.
Vulnerability and patch management requires a formal programme covering identification of vulnerabilities in in-scope systems (both through vendor advisories and active scanning), risk-based prioritisation of remediation, and documented timelines for patching critical vulnerabilities. NCCC guidance specifies maximum remediation timelines for critical vulnerabilities — currently 30 days for critical CVEs in internet-facing systems and 90 days for internal systems. Annual penetration testing of in-scope systems is required for Category 1 and 2 objects.
Supply chain and third-party security requires operators to assess the cybersecurity posture of critical suppliers, include mandatory security provisions in supplier contracts, and establish procedures for responding to incidents originating from or affecting critical suppliers. For Category 1 objects, formal security assessments of critical suppliers are required before contracting and periodically thereafter.
Incident Reporting Obligations
The NCCC's incident reporting regime is among the most demanding in Europe, a product of the operational experience of defending critical infrastructure under active attack conditions. The 4-hour initial notification requirement reflects the NCCC's need for near-real-time situational awareness to coordinate national-level response to campaigns targeting multiple operators simultaneously.
The initial 4-hour notification must be made through the NCCC's official reporting channel — a secure digital portal with backup telephone contacts for situations where the portal is unavailable. The notification requires: identification of the classified object affected, the time of detection, a preliminary description of the incident, an assessment of whether operational capability has been affected, and contact details for the senior officer responsible for the response. The 4-hour window begins when the incident is detected — which means detection capability must be robust enough to identify significant incidents in real time, not through next-day log review.
The 72-hour full report requires substantially more detail: a technical description of the affected systems and the nature of the attack; a timeline from initial intrusion (estimated if not yet known) through detection and response; an assessment of data accessed, exfiltrated, or destroyed; response actions taken and their effectiveness; current operational status; root cause assessment (preliminary or final); planned remediation measures with timelines; and any cross-sector impact. For incidents involving data exfiltration or compromise of classified information, additional reporting obligations under Ukraine's state secrets law may apply concurrently.
The NCCC also operates a voluntary incident information-sharing programme separate from the mandatory reporting regime. Operators who share detailed technical indicators of compromise (IOCs) and attack methodologies receive in return NCCC-curated threat intelligence relevant to their sector. Participation in this programme has become an informal expectation for Category 1 operators and is strongly recommended for all classified objects.
Alignment with Brave1 and NATO Standards
For defence technology companies and defence contractors, NCCC compliance intersects with a broader set of requirements emerging from Ukraine's military and NATO-integration frameworks.
Brave1, the Ukrainian defence technology cluster established under the Ministry of Digital Transformation, applies cybersecurity requirements for participating companies calibrated against NCCC standards and broadly consistent with NATO's Cybersecurity Maturity Model Certification (CMMC). Companies seeking Brave1 accreditation must demonstrate the core elements of NCCC compliance: documented security programme, incident response capability, regular penetration testing, and staff security training. Where a company is also a classified critical infrastructure operator — for example, a defence manufacturer with Category 2 classified production infrastructure — Brave1 requirements are effectively a subset of what NCCC compliance already demands.
Ukraine's NATO integration pathway includes alignment with NATO cybersecurity standards for national infrastructure and defence sector entities. The specific framework being applied is NATO's MISP-aligned information-sharing standard for critical infrastructure protection and, for defence-sector entities, the NATO Industrial Security Policy. Both are consistent with NCCC mandatory requirements; organisations with current NCCC compliance programmes are well-positioned for the additional requirements of NATO-aligned certification.
Mapping AmonSul Services to NCCC Controls
AmonSul's services are designed around the NCCC's mandatory framework, and our engagement outputs — assessment reports, penetration test findings, incident documentation — are structured to satisfy NCCC compliance documentation requirements directly.
MDR → Incident detection and response (24/7 monitoring requirement) + Vulnerability management (continuous monitoring). AmonSul's MDR service provides the 24/7 monitoring capability that the NCCC's incident detection requirement demands. Detection logic built from VATRA's live actor database means the monitoring programme can identify campaigns targeting Ukrainian critical infrastructure before they reach the severity threshold that triggers mandatory reporting — the most operationally valuable outcome. The service produces the timestamped detection records and classification documentation that are the foundation of compliant 4-hour notifications.
Incident Response retainer → Incident response (response capability requirement) + Reporting support. AmonSul's IR retainer ensures that response capability can be activated within hours of detection. Pre-engagement documentation and agreed escalation procedures mean that when a significant incident occurs, the reporting process begins with knowledgeable support rather than under emergency pressure. Our analysts are familiar with NCCC format requirements and reporting protocols, and have supported clients through the full notification cycle.
Penetration Testing → Vulnerability management (annual penetration test requirement for Cat 1/2). AmonSul's penetration testing service for critical infrastructure clients is scoped against the NCCC's annual testing requirement for Category 1 and 2 objects. Reports are structured with the NCCC documentation standard in mind — MITRE ATT&CK mapping, risk rating, remediation guidance with timelines — so findings can be incorporated directly into the compliance documentation package.
VATRA → Threat intelligence requirement + Risk assessment input. VATRA provides the threat-landscape context required for a credible NCCC risk assessment: live profiles of Sandworm, Gamaredon, and other actors actively targeting Ukrainian critical infrastructure, with current infrastructure and TTP data derived from operational contact with those adversaries. The NCCC's risk assessment methodology requires organisations to document the threat actors relevant to their sector — VATRA's sector-specific briefings produce exactly that documentation.
Digital Forensics → Incident investigation (root-cause requirement) + Evidence for NCCC reporting. When a significant incident occurs, AmonSul's forensic capability produces the technical documentation the NCCC's 72-hour report requires: attack timeline, affected systems analysis, root-cause assessment, and indicators of compromise. Chain-of-custody documentation is maintained throughout, which is also necessary if the incident has implications under Ukraine's state secrets legislation or results in insurance or legal proceedings.