ШЛЯХИ РЕАЛІЗАЦІЇ ДЕРЖАВНОЇ СТРАТЕГІЇ ІНФОРМАЦІЙНОЇ БЕЗПЕКИ: ІНСТИТУЦІЙНІ, НОРМАТИВНІ ТА ТЕХНОЛОГІЧНІ РІШЕННЯ

The article addresses the gap between the content of state strategies in the field of information security and the state of their actual implementation. It is shown that this gap is not an incidental consequence of resource constraints but a structural one: a strategy formulates goals in terms of a desired state, whereas implementation is recorded in terms of measures carried out, and there is no transition between these two descriptive languages. Drawing on official data concerning the implementation of Ukraine's Cybersecurity Strategy, according to which the aggregate indicator rose from 32 per cent in 2022 to 86 per cent in 2025 while individual directions remained at 23 per cent, it is substantiated that a high aggregate figure conceals the unevenness that actually determines the level of protection. It is proposed to consider the pathways of strategy implementation in three interrelated dimensions: institutional, regulatory and technological. For each dimension, a characteristic type of gap between intent and execution is identified, together with the instrument capable of closing it. It is argued that the key condition for effectiveness is the transition from reporting on measures to measuring capabilities, for which the construction of operational plans with indicators, embedded in the draft of the new Information Security Strategy, can be used. Foreign experience in evaluating the implementation of national strategies is systematised, in particular the findings concerning the absence of cost estimates and outcome-oriented performance measures, and those of its elements suitable for domestic conditions are identified. A model of three-tier linkage between documents is proposed, in which a strategic goal, an operational measure and a technological capability are connected by a shared indicator.