Versions per the «Әділет» legal information system as of 22 October 2026: Law No. 418-V, as amended, most recently by Law No. 326-VIII of 24 June 2026; Law No. 94-V, articles 12, 22 and 25 as worded by Law No. 326-VIII; the Unified Requirements (Decree No. 832), as amended, most recently by Decree No. 119 of 25 February 2026.
This guide is not a legal opinion. The requirements are summarized closely to the official Russian text; the exact wording is in the publications listed under "Sources". Whether your organization belongs to the public sector, owns critical facilities or processes personal data is for your legal team and responsible officers to decide.
In short
- Law No. 418-V was titled «On Informatization» until 2026. Law No. 256-VIII of 9 January 2026 renamed it «On Cybersecurity» and restructured it. Informatization in general is now governed by the Digital Code (No. 255-VIII).
- Owners and holders of digital objects must ensure their cybersecurity (arts. 16, 17). The detailed measures are addressed to "digital government" objects and critical digital objects (art. 54).
- The Unified Requirements (Decree No. 832) do not bind everyone. Item 2 lists who they bind: state bodies, the quasi-public sector, owners of systems integrated with state ones, and owners of critical facilities.
- A personal-data security breach is reported to the authorized body within one working day (Law No. 94-V, art. 25).
Law No. 418-V «On Cybersecurity»
- Access control. Among technical protection measures the law names the use of access control systems and of logging of access to digital objects (art. 55(3)).
- "Digital government" objects and critical digital objects (art. 54(2)). Their owners must prevent unauthorized access, detect it in time if it was not prevented, and eliminate incidents and vulnerabilities. The law sets no deadline for fixing them.
- Incidents. The same owners inform the National Cybersecurity Coordination Center of an incident without delay, then send data on the measures taken (art. 54(2)(7)). Owners of critical digital objects report incidents they detect themselves in the manner and time set by the monitoring rules (art. 18).
- .KZ and .ҚАЗ domains. Internet resources in these domains transmit data using security certificates (art. 56-1(2)).
Unified Requirements (Decree No. 832)
They apply to the entities listed in item 2. Among the requirements:
| Requirement | Item |
|---|---|
| Security event logs: analysis, time synchronization, protection from tampering; kept for at least three years, at least two months readily available | 38 |
| Multi-factor authentication for access to class 1 and class 2 information objects | 47 |
| Workstations of state bodies and local executive bodies: remote-management tools from outside the internal network are ruled out | 20(3) |
| Industrial control systems of critical facilities: identification and authentication of all users and devices, limits on default accounts and shared passwords | 165 |
| Internet resources: registration certificates to verify the domain name and cryptographically protect the session | 66 |
For class 3 objects and organizations outside item 2, item 47 does not prescribe multi-factor authentication.
Law No. 94-V «On Personal Data and Their Protection»
- Protection measures (art. 22). The owner, the operator and any third party must prevent unauthorized access to personal data, detect it in time and minimize its consequences.
- Storage in Kazakhstan (art. 12(2)). Personal data are stored in a database or digital object located in the Republic of Kazakhstan.
- Breach notification (art. 25(2)(8)). Notify the authorized body within one working day of detection. The notice gives the contact details of the person responsible for organizing personal-data processing, if there is one.
Notification deadlines
| Who | To whom | Deadline | Basis |
|---|---|---|---|
| Owner or operator of personal data | The authorized body | Within one working day of detecting the breach | Law No. 94-V, art. 25 |
| Owners of "digital government" objects and critical digital objects | National Cybersecurity Coordination Center | Without delay | Law No. 418-V, art. 54 |
| Owners of critical digital objects | The Coordination Center and the cybersecurity operations center | As set by the monitoring rules | Law No. 418-V, art. 18 |
What a scan can check
A scan of your own infrastructure shows:
- RDP, management interfaces, SMB, databases and unauthenticated services reachable from the internet. This is potential non-compliance with the access-control duty (Law No. 418-V, arts. 55, 54) and, if the database holds personal data, with Law No. 94-V, art. 22.
- Default credentials. For industrial control systems of critical facilities, item 165 of the Unified Requirements.
- No multi-factor authentication. Mandatory only for class 1 and 2 objects of entities bound by the Unified Requirements (item 47); a recommendation elsewhere.
- Outdated software: eliminating vulnerabilities (art. 54).
- Expired or self-signed certificates, deprecated TLS. For .KZ and .ҚАЗ domains, art. 56-1. The acts set no explicit TLS version.
- Insufficient event logging: item 38. Without logs, the notification deadlines cannot be met either.
A scan cannot show where personal data are stored (art. 12), which class an object has, or whether the organization falls under item 2. Documents confirm that.
How Cyber-Cortex helps
Cyber-Cortex maps findings to these requirements and shows the basis: the article or item, the edition of the act and a link to adilet.zan.kz. Kazakhstan's legislation is switched on in the organization settings; by default only Belarus applies. A mapping indicates potential non-compliance; applicability and the conclusion are for the organization's responsible officer.
What a scanner can and cannot see is covered in SGRC or vulnerability scanner.