Editions: Decree No. 40 of 14 February 2023; OAC Order No. 130 as amended by Order No. 98 (in force from 1 July 2026); OAC Order No. 66 as amended, including by Orders No. 259, No. 98 and No. 102; Law No. 99-Z.
This guide is not a legal opinion. The requirements are summarized closely to the official Russian text; the exact wording is in the official publications listed under "Sources". Which acts apply to your organization and its systems in Belarus is for your legal team to decide, ideally with local counsel.
Who this is for
CISOs and compliance leads responsible for security of a Belarus branch, subsidiary or system who know ISO/IEC 27001 and NIST CSF but not the Belarus rulebook. The goal: in ten minutes, know which documents matter, what they actually require, and where to start.
The regulatory map
| Layer | Document | What it covers |
|---|---|---|
| Framework | Decree No. 40 "On Cybersecurity" | National cybersecurity system, roles, incident record retention, accountability of the head |
| Technical measures | OAC Order No. 130, Annex 4 | Requirements for information infrastructure |
| Information systems | OAC Order No. 66 | Technical and cryptographic protection of restricted information, measures by system class |
| Personal data | Law No. 99-Z | Operator duties, protection measures, breach notification |
Who is who
- OAC (the Operational and Analytical Center under the President of the Republic of Belarus) is the regulator. It defines the cybersecurity requirements (Decree No. 40, para. 3.1) and the procedure for technical and cryptographic protection of information.
- The National Cybersecurity Center receives information about cyber incidents.
- Cybersecurity centers detect cyber incidents and report them to the National Center within one hour (Decree No. 40, para. 3.8).
What is actually required
Unlike ISO/IEC 27001, where you choose controls based on risk, the Belarus acts set specific measures and deadlines.
| Requirement | Basis | Closest equivalent |
|---|---|---|
| Default credentials changed or blocked | Order No. 130, Annex 4, item 1, paragraph three | ISO A.5.17 |
| Authentication, lockout after failed logins, removal of unused accounts | Order No. 130, item 1, paragraph four | ISO A.5.17, A.8.5 |
| Least privilege; restricted and logged administrative access | Order No. 130, item 1, paragraphs five and six | ISO A.8.20, A.8.22 |
| Software updates within one month of release | Order No. 130, item 1, paragraph seven | ISO A.8.8 |
| Firewalling and intrusion detection for external traffic | Order No. 130, item 1, paragraph nine | ISO A.8.20 |
| Collect cybersecurity events and keep them at least a year | Order No. 130, item 1, paragraph ten | ISO A.8.16 |
| Keep cyber incident records at least a year | Decree No. 40, para. 3.12 | — |
| The head of the organization is personally responsible | Decree No. 40, para. 3.14 | — |
The full mapping is in the ISO/IEC 27001 guide.
What surprises international teams
- Fixed deadlines. A month to patch and a year of event logs are requirements, not targets. Document the exceptions (the vendor restricts the update, or it would break the asset).
- Information system classes. Under Order No. 66, whether a measure is mandatory depends on the system class. For classes 3-ин, 3-спец, 3-бг, 3-юл and 3-дсп the mandatory measures include an isolated management network, firewalling of internal and external traffic and centralized event collection.
- Cryptography. Cryptographic protection tools must meet the state standards linked to TR 2013/027/BY. For classes 3-*, encryption in transit over public networks is mandatory. Your corporate encryption standard may not match these requirements, so check early.
- MFA. In the Order No. 66 list, multi-factor authentication (para. 5.6) is a recommended, not mandatory, requirement. Identification and authentication, logging and lockout after failed logins are mandatory.
Reporting deadlines
| Who | To whom | Deadline | Basis |
|---|---|---|---|
| Cybersecurity center | National Cybersecurity Center | within 1 hour | Decree No. 40, para. 3.8; Order No. 130, para. 6 of the Regulation |
| Owner of an information system | OAC | within 24 hours | Order No. 66, para. 4.4 of the Regulation |
| Personal data operator | Authority for the protection of data subjects' rights | without delay, no later than 3 working days | Law No. 99-Z, Art. 16 |
If your global incident response plan is built around 72 hours, the Belarus deadlines are shorter: the local team must know the recipients and have message templates ready in advance.
A 90-day plan
- Days 1–30: applicability. With counsel, establish which information infrastructure and information systems you run in Belarus, whether they process restricted information or personal data, and which class each system belongs to. Name the responsible people.
- Days 31–60: technical check. Work through the Annex 4 checklist: default credentials, lockout, admin access, patch timelines, firewalling, logs. Confirm logs are actually kept for a year.
- Days 61–90: processes and documents. Add the Belarus deadlines to the incident response plan, check cryptography against TR 2013/027/BY, and reflect the Belarus requirements in your ISMS Statement of Applicability.
How Cyber-Cortex helps
Cyber-Cortex assesses your infrastructure and maps every finding to the paragraphs of the Belarus acts and to ISO/IEC 27001, NIST CSF 2.0 and CIS Controls at the same time, with a quote from the official text and a remediation plan. The interface is in English and Russian, so the local team and the global CISO look at the same findings. Findings indicate potential non-compliance; the conclusion is for your organization's responsible officer.
Terms are explained in the glossary.