This guide is not a legal opinion. The terms are explained in plain words; the legal definitions are in the acts themselves, linked under "Sources".
Regulators and the national cybersecurity system
OAC: the Operational and Analytical Center under the President of the Republic of Belarus. The regulator that defines the cybersecurity requirements (Decree No. 40, para. 3.1) and the requirements for technical and cryptographic protection of information (OAC Order No. 66).
Decree No. 40: Decree No. 40 of the President of the Republic of Belarus of 14 February 2023 "On Cybersecurity". It sets up the national cybersecurity system. See the Decree No. 40 guide.
National Cybersecurity Center: the part of the national system that receives information about cyber incidents from the cybersecurity centers.
Cybersecurity center: detects cyber incidents and reports them to the National Cybersecurity Center within one hour of detection (Decree No. 40, para. 3.8).
OAC Order No. 130: details Decree No. 40. Its Annex 4 holds the cybersecurity requirements for information infrastructure. In force as amended by Order No. 98 from 1 July 2026. See the Order No. 130 checklist.
OAC Order No. 66: the procedure for technical and cryptographic protection of information, including restricted information and personal data, with requirements by information system class.
Systems, events and incidents
Information infrastructure: the object whose assets are subject to Annex 4 of OAC Order No. 130: access credentials, authentication, software updates, firewalling, event collection.
Asset: what the object is made of: servers, network equipment, software, and the security tools used on it.
KVOI: a critically important informatization object. Our guides do not cover the KVOI requirements: check the official OAC acts.
Cybersecurity event: information the organization collects, processes and keeps for at least a year (Order No. 130, Annex 4, item 1, paragraph ten).
Information security event: a term of OAC Order No. 66. Owners of information systems report such events to the OAC, including breaches of confidentiality, integrity or availability, within 24 hours.
Cyber incident: what cybersecurity centers detect and report to the National Center. Organizations keep information about cyber incidents on their information infrastructure for at least a year (Decree No. 40, para. 3.12).
Critical vulnerability: like high- and medium-level cyber incidents, a cybersecurity center reports it to the National Center within one hour (para. 6 of the Regulation on information exchange, Order No. 130).
Information systems and their classes
Restricted information: information whose protection in information systems is governed by OAC Order No. 66.
Typical information system class: determines which measures of the Order No. 66 list are mandatory and which are recommended. The code is a digit and a suffix: 3-ин, 3-спец, 3-бг, 3-юл, 3-дсп, 4-* and others. The suffixes are explained in the Order.
Classes 3-*: for classes 3-ин, 3-спец, 3-бг, 3-юл and 3-дсп the mandatory measures include an isolated management network, firewalling of internal and external traffic, intrusion detection and prevention, centralized event collection and encryption in transit over public channels.
Classes 4-*: systems without a connection to public data channels. Some requirements (for example, information flow control) are recommended for them.
Mandatory and recommended requirement: how the Order No. 66 list marks each measure for each class. For example, multi-factor authentication (para. 5.6) is a recommended requirement.
Cryptography
Cryptographic protection tool: must meet the state standards linked to TR 2013/027/BY.
TR 2013/027/BY: a technical regulation of the Republic of Belarus; the requirements for cryptographic protection tools are based on the state standards linked to it.
Link and preliminary encryption: ways to keep information confidential and check its integrity in transit over public telecommunication networks; mandatory for classes 3-* (Order No. 66, para. 5.1).
Personal data
Law No. 99-Z: the Law of the Republic of Belarus "On Personal Data Protection".
Operator: an organization or person that processes personal data. It must take legal, organizational and technical measures to protect it (Art. 17).
Authorized person: processes personal data on the operator's behalf and must protect it too.
Authority: the authority for the protection of data subjects' rights. The operator notifies it of breaches of personal data protection systems without delay, no later than three working days (Art. 16).
Standards and frameworks
ISMS: information security management system, the subject of ISO/IEC 27001. How the standard relates to the Belarus requirements: see the ISO/IEC 27001 guide.
ISO/IEC 27001 Annex A: a list of 93 controls in four themes: organizational, people, physical, technological.
Statement of Applicability: the ISMS document where the organization states which Annex A controls it applies, which it excludes, and why.
NIST CSF 2.0: the NIST framework that groups outcomes into six functions: Govern, Identify, Protect, Detect, Respond, Recover.
CIS Controls: a prioritized set of technical safeguards from the Center for Internet Security.
SGRC: Security Governance, Risk and Compliance, a class of systems for managing information security, risk and compliance: asset and risk registers, compliance assessment, remediation tasks.
Technical terms
Default credentials: factory logins and passwords of equipment and software. They must be changed or blocked (Order No. 130, Annex 4, item 1, paragraph three).
Multi-factor authentication (MFA): signing in with several factors, for example a password and a one-time code.
Firewalling: filtering traffic by network and transport layer protocols at the network edge and between segments.
Intrusion detection and prevention: tools that inspect traffic to detect and block attacks (IDS/IPS).
Network segmentation: splitting the network into zones with controlled traffic between them; it limits an attacker's lateral movement.
CVE: the identifier of a publicly known vulnerability.
CVSS: a vulnerability severity scale from 0 to 10.
KEV: the CISA Known Exploited Vulnerabilities catalog: vulnerabilities that are actually exploited.
Potential non-compliance: what Cyber-Cortex calls a finding mapped to a requirement: a sign of a possible breach, not a legal conclusion. The decision is for the organization's responsible officer.