Summary

• CERT-EU and Ukraine's State Service of Special Communications and Information Protection signed an administrative arrangement during the fifth EU–Ukraine Cyber Dialogue.
• The agreement aims to initiate operational exchanges between CERT-EU and CERT-UA to improve cyber incident prevention, detection and response.
• The dialogue also addressed NIS2 alignment, the Cyber Resilience Act, telecommunications security and wider cyber defence cooperation.

The EU and Ukraine have agreed to strengthen operational cybersecurity cooperation through an administrative arrangement intended to initiate closer information exchange between CERT-EU and Ukraine’s national computer emergency response team, CERT-UA.

The arrangement was signed by representatives of CERT-EU and Ukraine’s State Service of Special Communications and Information Protection during the fifth EU–Ukraine Cyber Dialogue in Brussels on 9 October. Announcing the outcome on 13 October, the European Commission said the agreement was designed to improve the capabilities of both sides to prevent, detect and mitigate cyber incidents affecting the organisations they protect.

Although the two teams already operate within an established network of European and international cybersecurity relationships, the new arrangement provides a more formal basis for developing exchanges between the EU institutions’ incident response service and its Ukrainian counterpart. The Commission has not published the agreement’s technical procedures, implementation timetable or any performance measures against which its subsequent operation will be assessed.

The initiative is taking place while Ukraine continues to defend government and critical infrastructure systems against cyber threats associated with Russia’s invasion. The dialogue also forms part of Ukraine’s wider engagement with European institutions as it works towards alignment with EU laws and regulatory practices.

Turning shared intelligence into usable warnings

CERT-EU provides cybersecurity support to EU institutions, bodies, offices and agencies, including threat analysis, vulnerability coordination and incident response. CERT-UA performs a corresponding national function in Ukraine, helping organisations identify malicious activity and respond to compromises affecting their systems.

Because malicious infrastructure and software vulnerabilities can affect organisations across borders, information discovered during an incident in one jurisdiction may be useful to defenders elsewhere. A malicious domain identified during an attack on a Ukrainian organisation, for example, could help European security teams recognise related activity, provided the information can be shared promptly and contains sufficient context.

Operational exchanges can include indicators of compromise, descriptions of attack techniques, reports about exploited vulnerabilities and information about how malicious activity has developed. Different types of information require different handling, particularly where details could expose an investigation, sensitive infrastructure or the methods used by security teams to detect an attacker.

Collecting intelligence is also distinct from making it useful. A suspicious network address may be relevant to a particular campaign but unsuitable for broad blocking if it belongs to legitimate shared infrastructure. Recipients therefore need to understand the reliability, context and limitations of the information before using it to make operational decisions.

Where both organisations can identify related incidents, cooperation may help establish whether activity is isolated or part of a wider campaign. It could also reduce duplication when separate security teams investigate similar techniques, although the agreement does not establish that joint investigations or automated sharing systems have already begun.

The public announcement confirms an intention to initiate information exchange rather than a new technical platform. It does not specify the formats to be used, the classification of intelligence that may be shared or whether participating teams will introduce additional automated processes.

Regulatory alignment remains a separate undertaking

The Cyber Dialogue also examined Ukraine’s progress towards European cybersecurity requirements, including the NIS2 Directive and the Cyber Resilience Act. These measures govern different aspects of cybersecurity, with NIS2 addressing organisational risk management and supervision across covered sectors, while the Cyber Resilience Act establishes security requirements for products with digital elements.

Adapting national legislation and supervisory arrangements to these frameworks requires different work from exchanging technical threat intelligence. Laws establish obligations and enforcement structures, whereas operational cooperation depends on trusted relationships, suitable information handling arrangements and the ability to act on warnings.

The participants additionally discussed implementation of the EU’s 5G Cybersecurity Toolbox in Ukraine. Telecommunications infrastructure supports numerous commercial and public services, making equipment assurance, supplier dependencies and network management relevant to broader national resilience.

Ukraine’s telecommunications operators must also contend with physical disruption to infrastructure during the war. Cybersecurity measures cannot remove that physical risk, but network resilience planning can address how operators maintain services and recover from different types of interruption.

Alongside those technical and regulatory discussions, the dialogue covered cyber crisis management, the EU Cyber Diplomacy Toolbox, sanctions, cybercrime investigations and the role of public and private organisations. Representatives of the European Commission, European External Action Service, ENISA, Europol and other bodies took part alongside Ukrainian government, defence and security officials.

The breadth of participation reflects the different responsibilities involved in cyber incidents, but it does not mean that every organisation attending the dialogue has joined the new information-sharing arrangement. The Commission specifically identifies CERT-EU and Ukraine’s state communications authority as its signatories.

Practical cooperation still depends on implementation

Information exchange between incident response teams can support organisations beyond the immediate participants when warnings reach national authorities, sectoral responders or affected technology providers through established channels. The extent of that benefit depends on how promptly reliable information is distributed and whether recipients can use it in their own environments.

Commercial organisations may operate across several jurisdictions or depend on software and services also used by public authorities. Earlier knowledge of a vulnerability or attack method can give security teams additional time to investigate exposure, although the usefulness of a warning also depends on whether a suitable mitigation exists.

The agreement does not create a new reporting obligation for European businesses, and it has not been described as providing direct access to CERT-UA’s incident data. Existing national and European reporting arrangements continue to govern how organisations notify relevant authorities about incidents.

Further cooperation may also encounter practical limits where information is classified, protected by national security requirements or connected to an active criminal investigation. Even well-established relationships cannot guarantee that every relevant detail will be available to all partners, while incident response actions remain subject to the authority of the organisation responsible for the affected systems.

For Ukraine, the relationship provides an additional formal channel for sharing operational experience with EU institutions. For CERT-EU, it could improve understanding of threats encountered by an established partner facing sustained hostile activity, provided the arrangement develops into regular exchanges supported by usable technical information.

The European Commission has committed both sides to seeking concrete operational results without announcing specific targets. Evidence of implementation will therefore come from subsequent cooperation, rather than the signature alone, as the participating organisations develop the procedures and relationships needed to make the arrangement effective.