Edition: Decree No. 40 of the President of the Republic of Belarus of 14 February 2023 "On Cybersecurity" (in force from 16 February 2023); OAC Order No. 130 as amended by Order No. 98 of 27 May 2026.
This guide is not a legal opinion. The requirements are summarized closely to the official Russian text; the exact wording is in the official publications listed under "Sources". Whether a requirement applies to your organization and its systems is for your legal team and responsible officers to decide.
What the document is
Decree No. 40 sets up the national cybersecurity system. Its parts:
- the Operational and Analytical Center under the President of the Republic of Belarus (OAC), the regulator that defines the cybersecurity requirements;
- the National Cybersecurity Center, which receives information about cyber incidents;
- cybersecurity centers, which detect cyber incidents and report them to the National Center.
What the Decree does not contain
The Decree does not list technical measures such as passwords, updates, firewalling or logging. The OAC defines them (Decree, para. 3.1). So "how to comply with Decree No. 40 technically" in practice means "how to meet the OAC requirements":
- OAC Order No. 130 (Annex 4): cybersecurity requirements for information infrastructure. A paragraph-by-paragraph checklist is in the guide "How to meet OAC Order No. 130";
- OAC Order No. 66: technical and cryptographic protection of restricted information, including personal data, with requirements by information system class.
What the Decree requires from an organization directly
- Keep information about cyber incidents for at least one year. This applies to government bodies and other organizations for the information infrastructure they own (para. 3.12).
- Personal responsibility of the head. The head of the organization is personally responsible for its cybersecurity (para. 3.14).
- One-hour incident reporting for cybersecurity centers: they report detected cyber incidents to the National Cybersecurity Center within one hour of detection (para. 3.8).
Reporting deadlines at a glance
Different acts set the deadlines, each with its own recipient.
| Who | Reports what, to whom | Deadline | Basis |
|---|---|---|---|
| Cybersecurity center | Cyber incidents, to the National Cybersecurity Center | within 1 hour | Decree No. 40, para. 3.8 |
| Cybersecurity center | High- and medium-level cyber incidents and critical vulnerabilities, to the National Cybersecurity Center | within 1 hour | OAC Order No. 130, para. 6 of the Regulation on information exchange |
| Owner of an information system | Information security events, including breaches of confidentiality, integrity or availability, to the OAC | within 24 hours | OAC Order No. 66, para. 4.4 of the Regulation on reporting |
| Personal data operator | Breaches of personal data protection systems, to the authority for the protection of data subjects' rights | without delay, no later than 3 working days | Law No. 99-Z, Art. 16 |
Where to start: a practical checklist
- Assign responsibility. The head is personally responsible, so name who owns the cybersecurity of each system and who makes decisions during an incident.
- Decide which requirements apply to you. What information infrastructure you have, whether any systems hold restricted information or personal data, and which class they belong to.
- Keep events and incident records for at least a year. Check that server, network and security tool logs are actually collected and not overwritten earlier.
- Write down the reporting procedure. Who reports to whom and how fast, per the table above. One hour and 24 hours are short: prepare contacts and message templates in advance.
- Check the technical measures of OAC Order No. 130. Default credentials, lockout after failed logins, administrative access, software updates within a month, firewalling: see the Annex 4 checklist.
How Cyber-Cortex helps
Cyber-Cortex assesses your infrastructure and maps technical findings to Decree No. 40, OAC Orders No. 130 and No. 66 and Law No. 99-Z, with a quote and a link to the paragraph of the official publication. Findings indicate potential non-compliance; the conclusion is for your organization's responsible officer.