Cyber-Cortex assesses your infrastructure and maps every finding to Belarus cybersecurity law (Decree No. 40, OAC Orders No. 130 and No. 66), ISO/IEC 27001, NIST CSF 2.0 and CIS Controls — with a plain explanation for the board and a remediation plan.
Example: a demo organization after its first assessment
From an infrastructure scan to the exact legal requirement and the standard control — in one flow.
Not another vulnerability scanner — Cyber-Cortex is a platform that speaks the language of auditors, regulators and the board.
Discover assets, services, ports, OS, certificates and exposed surfaces. Built-in nmap and nuclei plus native HTTP, TLS and DNS checks.
Every finding maps automatically to Belarus legislation, ISO 27001, NIST CSF 2.0 and CIS — with a plain-language explanation of why.
Executive KPIs, risk trend, compliance-by-framework (for the requirements the scanner checks), heatmaps and top violations — board-ready in one view.
Traceable requirement hierarchy from decree to paragraph to finding to remediation, with a searchable internal wiki.
A local AI assistant will answer from your legal and remediation corpus — without the internet, in the closed-perimeter edition.
Prioritized, effort-scored recommendations that close mapped violations across every framework at once.
Cyber-Cortex maps technical findings to specific paragraphs of the regulations. Requirement texts are quoted from official publications, each with a reference to its paragraph.
Logging security events, reporting cyber incidents, keeping incident information for at least one year.
As amended by Order No. 98, in force from 1 July 2026. Cybersecurity requirements for information infrastructure: access credentials, authentication, administration, firewalling, software updates within one month of release.
Technical and cryptographic protection of information systems that process restricted information, by system class.
The operator's duty to protect personal data.
Findings indicate potential non-compliance, not legal conclusions.
Cyber-Cortex maps findings to the cybersecurity and personal-data requirements of Kazakhstan and Uzbekistan. Requirements are quoted from the official legal databases (Russian texts): the «Әділет» legal information system (adilet.zan.kz) and Uzbekistan's National Database of Legislation (lex.uz). Each requirement cites its article or item and the edition of the act. Countries are switched on in the organization settings; by default only Belarus applies.
«Әділет» legal information system — adilet.zan.kz
Duty to ensure the cybersecurity of digital objects, access control and logging of access, fixing vulnerabilities, informing the National Cybersecurity Coordination Center of incidents, security certificates for .KZ and .ҚАЗ domains. Until 2026 the law was titled «On Informatization».
text checked October 22, 2026
Measures protecting personal data from unauthorized access, storage in Kazakhstan, notifying the authorized body of a security breach within one working day.
text checked October 22, 2026
For the entities listed in item 2: security event logs kept for at least three years, multi-factor authentication for class 1 and 2 objects, limits on default accounts in industrial control systems.
text checked October 22, 2026
Some requirements bind only state bodies, the quasi-public sector, owners of critical facilities and of systems integrated with state ones. The organization confirms applicability.
Kazakhstan guideNational Database of Legislation — lex.uz
Cybersecurity entities prevent unauthorized access, notify the authorized body of incidents and keep the data needed to analyse them; critical infrastructure entities run monitoring systems.
text checked October 22, 2026
Legal, organizational and technical measures protecting personal data: integrity and safekeeping, confidentiality, prevention of unlawful processing.
text checked October 22, 2026
General requirements for critical information infrastructure objects: identification and authentication, access management, timely software updates, integrity of transmitted data, monitoring.
text checked October 22, 2026
The General Requirements of PP-167 apply to critical information infrastructure entities. The organization confirms applicability.
Uzbekistan guideA finding mapped to a requirement indicates potential non-compliance and is not a legal opinion.
Banks, manufacturers, government bodies, hospitals, telecoms and retailers use one platform to prove conformity with national legislation and the global standards — ISO/IEC 27001, NIST CSF and CIS Controls. Use it in the cloud or on your own server; a closed-perimeter edition — no internet, with a local AI assistant — is in development.
Indicative pricing. Contact us for a quote.
Evaluation
Growing security teams
Regulated & CII operators
Decree No. 40 addresses government bodies and other organizations; OAC Order No. 130 sets the detailed requirements for information infrastructure. Cyber-Cortex shows which of those requirements findings in your infrastructure may not meet; whether they apply to your organization is for your legal team to decide.
No. Findings indicate potential non-compliance; each requirement links to the paragraph of the official publication so it can be verified.
Belarus legislation (Decree No. 40, OAC Orders No. 130 and No. 66, Law No. 99-Z), ISO/IEC 27001, NIST CSF 2.0 and CIS Controls — one finding maps to all of them at once.
Cyber-Cortex can be deployed on your own server. A fully closed-perimeter edition — with offline updates of vulnerability and legislation data and a local AI assistant with RAG — is in development.
Under OAC Order No. 66, multi-factor authentication (item 5.6) is recommended; identification and authentication, logging and lockout after failed attempts are mandatory. Cyber-Cortex flags missing MFA as a recommendation.
Within one month of an update's release (except where the vendor restricts updates or updating would disrupt the asset). Cyber-Cortex maps outdated versions to this requirement.
Request a demo — we reply within one business day.