Editions: ISO/IEC 27001:2022; OAC Order No. 130 as amended by Order No. 98 of 27 May 2026; OAC Order No. 66 as amended, including by Orders No. 259, No. 98 and No. 102.
This guide is not a legal opinion. ISO/IEC 27001 controls are matched to Belarus requirements by the meaning of their wording; a match does not make them equivalent. The exact wording is in the publications listed under "Sources". Whether a requirement applies to your organization and its systems is for your legal team and responsible officers to decide.
Two different documents
ISO/IEC 27001 is the international standard for an information security management system (ISMS). It is voluntary. It requires an organization to assess risks and choose controls to treat them; the control set is Annex A: 93 controls in four themes (organizational, people, physical, technological). Controls that do not apply are excluded with a justification in the Statement of Applicability.
Belarus requirements are mandatory. Decree No. 40 "On Cybersecurity" sets up the national cybersecurity system, and the OAC defines the technical measures (Decree, para. 3.1):
- OAC Order No. 130, Annex 4: requirements for information infrastructure (checklist);
- OAC Order No. 66: technical and cryptographic protection of restricted information, with requirements by information system class;
- Law No. 99-Z: personal data protection.
Key differences
| ISO/IEC 27001 | Belarus requirements | |
|---|---|---|
| Status | Voluntary standard | Mandatory acts |
| Choice of measures | Risk-based, exclusions justified in the Statement of Applicability | Lists of measures; Order No. 66 marks them mandatory or recommended per system class |
| Deadlines | Not fixed, set by the organization | Specific: software updates within a month, events kept at least a year, reporting within 1 hour or 24 hours |
| Cryptography | Rules of use set by the organization | Cryptographic tools per state standards linked to TR 2013/027/BY |
| Multi-factor authentication | One of the secure authentication technologies | A recommended requirement (Order No. 66, para. 5.6) |
The practical takeaway: the mandatory OAC requirements apply whether or not you hold an ISO/IEC 27001 certificate. A working ISMS does give you a ready base for them: an asset register, risk assessment, policies, logs and incident response procedures.
Control mapping
| Topic | ISO/IEC 27001:2022 control | Belarus requirement |
|---|---|---|
| Default credentials | A.5.17 Authentication information | Order No. 130, Annex 4, item 1, paragraph three; Order No. 66, para. 4.1 |
| Identification and authentication | A.5.17, A.8.5 Secure authentication | Order No. 130, item 1, paragraph four; Order No. 66, paras. 3.2, 3.7, 5.6 (recommended) |
| Administrative access | A.8.20 Networks security, A.8.22 Segregation of networks, A.8.9 Configuration management | Order No. 130, item 1, paragraphs five and six; Order No. 66, paras. 7.4, 7.9 |
| Perimeter, firewalling | A.8.20, A.8.22, A.8.3 Information access restriction | Order No. 130, item 1, paragraph nine; Order No. 66, paras. 7.12, 7.13, 7.16 |
| Segmentation, internal flows | A.8.22 | Order No. 66, paras. 7.11, 7.12 |
| Software updates | A.8.8 Management of technical vulnerabilities | Order No. 130, item 1, paragraph seven (within a month); Order No. 66, para. 7.8 |
| Security events | A.8.16 Monitoring activities | Order No. 130, item 1, paragraph ten (at least a year); Order No. 66, paras. 1.2, 1.3 |
| Encryption in transit | A.8.24 Use of cryptography | Order No. 66, para. 5.1 (classes 3-*) |
| Personal data | A.8.3 | Law No. 99-Z, Arts. 16 and 17 |
Where ISO does not cover the Belarus requirements
- Deadlines. The standard does not set a month for software updates or a year for keeping events: write them into your policies explicitly.
- Information system classes. Whether an Order No. 66 measure is mandatory depends on the system class (for example, classes 3-ин, 3-спец, 3-бг, 3-юл and 3-дсп must isolate the management network and firewall internal traffic). ISO has no such classification.
- Cryptography. Choosing algorithms "based on risk" is not enough: cryptographic tools must meet the state standards linked to TR 2013/027/BY.
- Reporting. The acts set recipients and deadlines: cybersecurity centers report to the National Cybersecurity Center within 1 hour; information system owners report to the OAC within 24 hours; personal data operators report to the authority no later than 3 working days. More in the Decree No. 40 guide.
How Cyber-Cortex helps
Cyber-Cortex maps every technical finding to ISO/IEC 27001, NIST CSF 2.0 and CIS Controls and to the paragraphs of the Belarus acts at the same time, with a quote and a link to the official publication. One assessment gives evidence for both the ISMS audit and the OAC requirements. Findings indicate potential non-compliance; the conclusion is for your organization's responsible officer.