Edition: OAC Order No. 130 of 25 July 2023 as amended by OAC Order No. 98 of 27 May 2026 (in force from 1 July 2026).
This guide is not a legal opinion. The requirements are summarized closely to the official Russian text; the exact wording is in the official publications listed under "Sources". Whether a requirement applies to your organization and its systems is for your legal team and responsible officers to decide.
What the document is
Order No. 130 of the Operational and Analytical Center under the President of the Republic of Belarus (OAC), "On measures to implement Decree No. 40 of 14 February 2023", details Decree No. 40 "On Cybersecurity". The Decree itself does not list technical measures; the OAC defines them (Decree, para. 3.1).
For a technical review, the key part is Annex 4, "Cybersecurity requirements for information infrastructure". The organization chooses how to implement them (Annex 4, para. 2).
Annex 4 checklist
1. Default credentials — para. 1, third paragraph
Required. Default identification and authentication data (access credentials) for infrastructure assets and security tools must be changed, or their use blocked (unless the vendor restricts this). Passwords are renewed regularly and stored so that they are not freely accessible.
How to check.
- List the assets that have their own accounts: network gear, firewalls, printers, IP cameras, server management controllers (iLO, iDRAC, IPMI), storage.
- Confirm that factory accounts are renamed, disabled or have new passwords.
- Check where passwords are kept and who can reach them.
2. User identification and authentication — para. 1, fourth paragraph
Required. Access to assets and security tools only after successful identification and authentication, with logging, lockout after too many failed attempts, and timely removal or deactivation of unused accounts.
How to check.
- Is lockout after failed attempts enabled on servers, network gear and applications?
- Are login attempts logged?
- Is there a procedure to disable accounts of leavers and unused services?
About MFA. For information systems that process restricted information, the list in OAC Order No. 66 treats multi-factor and/or multi-step authentication (item 5.6) as recommended. Identification and authentication, logging and lockout after failed attempts are mandatory.
3. Least privilege and administrative access — para. 1, fifth and sixth paragraphs
Required. Access control follows the principle of least privilege, with logging and control of changes to access rights. Access to administration of assets and security tools is restricted, and every access attempt is logged.
How to check.
- Are administration interfaces reachable from the internet: RDP, SSH, network device web panels, hypervisor consoles?
- Who is in the administrator groups, and is the list reviewed?
- Is every attempt to access administration functions logged?
4. Software updates within one month — para. 1, seventh paragraph
Required. Software of infrastructure assets and the security tools used on them is updated to current versions within one month of an update's release. Exceptions: the vendor restricts updating, or updating would disrupt or stop the asset or tool.
How to check.
- Is there an inventory of software versions: OS, server software, firmware, security tools?
- Are release dates and installation deadlines tracked?
- Are exceptions documented: a vendor restriction or a risk of disruption?
5. Firewalling and intrusion detection — para. 1, ninth paragraph
Required. External communication goes through firewalling that filters traffic by network- and transport-layer protocols and is monitored by intrusion detection and prevention.
How to check.
- Which services are reachable from the internet, and does each need external access: databases, file services, management interfaces?
- Is traffic filtered at the perimeter by protocol and port?
- Is external traffic monitored by intrusion detection and prevention?
6. Security events: collect and keep for at least a year — para. 1, tenth paragraph
Required. Collect and process information about cybersecurity events and keep it for at least one year.
How to check.
- Which systems send logs: servers, network gear, security tools, key applications?
- How long are logs actually kept, and is there room for a year?
- Could you reconstruct an incident from the logs?
7. Other Annex 4 requirements
Annex 4 also covers other areas, including diagrams of the information infrastructure, time synchronization and malware protection. Check their wording against the official text.
Incident reporting deadlines
- Cybersecurity centers report detected cyber incidents to the National Cybersecurity Center within one hour of detection (Decree No. 40, para. 3.8). The Regulation on information exchange (Order No. 130, para. 6) applies this deadline to high- and medium-level incidents and to critical vulnerabilities.
- Government bodies and other organizations keep information about cyber incidents on their infrastructure for at least one year (Decree No. 40, para. 3.12).
- The head of the organization is personally responsible for its cybersecurity (Decree No. 40, para. 3.14).
How Cyber-Cortex helps
Cyber-Cortex assesses your infrastructure and maps technical findings to the paragraphs of Annex 4. For example:
| Finding | Requirement |
|---|---|
| Vendor default credentials | para. 1, third paragraph |
| Outdated software with available updates | para. 1, seventh paragraph |
| RDP or a management interface exposed to the internet | para. 1, fifth and sixth paragraphs |
| A database or unauthenticated service exposed to the internet | para. 1, ninth paragraph |
| Security events are not collected or kept | para. 1, tenth paragraph |
Each requirement links to the paragraph of the official publication and comes with a remediation step. Findings indicate potential non-compliance; the conclusion is for your organization's responsible officer.