Ways to improve legal regulation of critical infrastructure information networks protection

The study aimed to identify ways to improve the legal regulation of the protection of information networks of Ukraine’s critical infrastructure, taking into account contemporary challenges in cybersecurity and international standards. The research employed a comparative analysis of the legislation of Ukraine, the EU, the USA, and the United Kingdom governing cybersecurity in critical infrastructure. Additionally, it assesses the effectiveness of existing legal and regulatory frameworks in the context of modern threats, particularly armed conflict. The analysis revealed the fragmented nature of the current legislation, the lack of an effective coordination mechanism among state authorities, and insufficient legal instruments for regulating liability for cybercrimes targeting critical infrastructure. It was established that Ukraine’s regulatory framework only partially complies with international standards, complicating its harmonisation with EU requirements. The insufficient integration of the public and private sectors in the field of cybersecurity is also a significant factor limiting the effectiveness of protecting strategic digital assets. To enhance the efficiency of legal regulation, comprehensive harmonisation of Ukraine’s legislation with EU norms is necessary, particularly with the NIS 2 Directive, which establishes unified requirements for the protection of critical infrastructure. The introduction of mandatory certification of cybersecurity measures and the expansion of criminal liability for cyberattacks on critical infrastructure, including sanctions for legal entities, are advisable. A crucial direction is the legislative establishment of a unified national cyber threat monitoring system and the improvement of mechanisms for public-private partnerships. The proposed changes will contribute to strengthening the cyber resilience of Ukraine’s critical infrastructure, ensuring its compliance with international standards, and facilitating its integration into the global cybersecurity system