Versions: Decree No. 40 of 14 February 2023; OAC Order No. 130 as amended by Order No. 98 (in force since 1 July 2026); OAC Order No. 66 as amended, including by Orders No. 259, No. 98 and No. 102; Law No. 99-Z.
This guide is not a legal opinion. The requirements are summarized closely to the official Russian text; the exact wording is in the official publications listed under "Sources". The process recommendations are practice, not requirements of the acts. Whether a requirement applies to your organization is for your legal team and responsible officers to decide.
What is required
| Act | Requirement |
|---|---|
| Order No. 130, Annex 4, item 1, paragraph ten | Collection and processing of cybersecurity event records is organized, and the records are kept for at least one year |
| Decree No. 40, para. 3.12 | State bodies and other organizations keep information on cyber incidents on their information infrastructure objects for at least one year |
| Order No. 66, para. 1.2 of the list | For systems processing restricted information: collecting and keeping security event records for at least one year is mandatory |
| Order No. 66, para. 1.3 of the list | For classes 3-ин, 3-спец, 3-бг, 3-юл and 3-дсп: centralized collection and storage of events |
The organization chooses how to implement the Annex 4 requirements (Annex 4, item 2). Annex 4 also covers time synchronization; without it, events from different systems are hard to correlate. Check the exact wording against the official text.
Class codes are kept in Cyrillic, as in the Order.
Why logs matter: reporting deadlines
Event logs are not only a retention requirement. Without them you cannot notice an incident or meet the deadlines:
| Who | To whom | Deadline | Basis |
|---|---|---|---|
| Cybersecurity center | National Cybersecurity Center: high- and medium-level cyber incidents and critical vulnerabilities | within 1 hour | Order No. 130, item 6 of the Regulation on information exchange; Decree No. 40, para. 3.8 |
| Information system owner | OAC: information security events | within 24 hours of detection | Order No. 66, para. 4.4 of the Regulation on submitting information |
| Personal data operator | Authority for the protection of data subjects' rights: breaches of personal data protection systems | without delay, no later than 3 working days | Law No. 99-Z, Art. 16 |
More on deadlines in the Decree No. 40 guide.
Three things that are easy to miss
- A year means actual retention, not a default setting. Logs are often overwritten by size or deleted after 30 to 90 days. Check how much data is really in the archive.
- Security tools are event sources too. Firewalls, intrusion detection, antivirus and VPN logs matter for an investigation as much as server logs.
- Central collection is mandatory for classes 3-*. Logs kept separately on each server do not meet para. 1.3.
How to build the process
Practice that helps meet the requirements and show it to an auditor. These steps are not requirements of the acts.
| Step | What to do | Evidence it leaves |
|---|---|---|
| 1. Sources | List of systems and security tools whose events are collected | Register of log sources |
| 2. Events | What to record: logins and failed logins, admin actions, permission changes, security tool alerts | List of recorded events |
| 3. Time | One time source for all systems | Synchronization settings |
| 4. Collection | Ship events to central storage (mandatory for classes 3-*) | Collection diagram |
| 5. Retention | At least a year, logs protected from modification and deletion | Retention policy, check of actual retention |
| 6. Review | Who reviews events and how often, alert rules | Monitoring procedure, review records |
| 7. Response | Reporting procedure that fits the deadlines (1 hour, 24 hours, 3 working days) | Incident response procedure |
Where a scanner helps
Log retention is a process: an external scan neither confirms nor refutes it, and an honest scanner report should say "not checked". But a scanner helps indirectly: exposed administrative services and services without authentication are exactly where logging of access attempts matters most (Order No. 130, item 1, paragraphs five and six).
More in SGRC or vulnerability scanner.
ISO/IEC 27001
The closest control is A.8.16 Monitoring activities. The standard sets no retention period, so "at least one year" has to be written into your own policies. See ISO/IEC 27001 and the Belarus requirements.
How Cyber-Cortex helps
Cyber-Cortex maps findings to the paragraphs of Decree No. 40, OAC Orders No. 130 and No. 66 and Law No. 99-Z, and to ISO/IEC 27001, NIST CSF 2.0 and CIS Controls, with an explanation of why and a remediation recommendation. Findings indicate potential non-compliance; the conclusion is for your organization's responsible officer.
The full Annex 4 checklist is in the Order No. 130 guide. Terms are explained in the glossary.