Education and training in Critical Infrastructure Protection in Ukraine

20.07.2022
Vladlen Basystyi
Vladlen Basystyi
cybersecurity expert, senior project lead at CRDF Global

The Ukrainian state, private, research academia and scholars started actively developing and implementing Critical Infrastructure Protection (CIP) training programs in the Ukrainian educational system in 2015. Since that time, various courses, programs and modules for state and private university students based on the cybersecurity or physical security approaches for critical infrastructure facilities protection have been developed. All those curriculums are partially integrated in the higher education specialities, such as #125 “Cybersecurity”, #263 “Civil Protection”, #081 “Law”, #256 “National Security,” and #143 “Nuclear Energy1.

The Cybersecurity training programs have already been implemented in 59 Ukrainian universities through speciality # 125 “Cybersecurity”. This speciality was formed by combining three specialities of the old list – “Security of information and communication systems“, “Information Security Management“, and “Information Security Systems“. The standard of higher education for the first (Bachelor’s) level was approved on October 4, 2018. The universities had only two years to approve and implement the new programs. The Master’s degree standard was approved by the Ministry of Education and Science of Ukraine on March 18, 2021. The standard for the third (PhD) level is in the developing stage.

Ukraine also made progress on adding new 17 professions in the field of information security and cyber security to the occupational classification. As of October 25, 2021, there were only two of them in the classification: “Information Security Professional” and “Information Security Specialist”.

Nowadays, the State Service of Special Communication and Information Protection of Ukraine is actively developing the qualification requirements and standards for each profession according to the NIST standards2. With such new standards in Ukraine, it will be possible to move to the creation of a system of qualifications and certification of relevant professions and launch appropriate cybersecurity qualification centers where graduates of higher education institutions will be able to pass professional exams and obtain qualifications in a specific field of Cybersecurity.

There is also a tendency in the educational process to develop new curriculums and train future cybersecurity workforce at the universities based on the needs of CI sectors and private business of the regions in Ukraine. As an example, Vinnytsya Technical National University developed and introduced the “Cybersecurity of critical systems” program in #125 “Cybersecurity” speciality, specifically for the Energy sector of Vinnytsa region.

Comparing with the cybersecurity curriculums and programs, the CIP is still at the beginning stage of development in the formal higher education system of Ukraine. Currently, the “Critical infrastructure protection objects” course is being piloted through the Bachelor’s degree program of Specialty #263 “Civil protection“, and private academia curriculum also included the “Subjects of protection of critical infrastructure objects” course in Specialty 081 “Law” Bachelor Degree program as self-learning course for students.

The Bachelor’s degree CIP pilot formal training programs include the following areas:

  • Organizational and legal support of information protection at the critical infrastructure facilities;
  • Legal bases of organization and protection of critical infrastructure facilities;
  • Cybersecurity of critical infrastructure facilities;
  • Security systems for critical infrastructure facilities;
  • Automated video surveillance systems at critical infrastructure facilities;
  • Electronic protection of critical infrastructure facilities;
  • Inspection equipment at critical infrastructure facilities and others.

The rest unlicensed CIP programs3 proposed to university students, either as an optional training program or in separate modules or as qualification upgrading training courses for CIP professionals.

  Ukrainian universities and research institutions have established good relationships with EU and US universities and training centres. They actively participated in the international programs:

  • In 1998, the Training Centre for Physical Protection, Accounting and Control of Nuclear Material, named after George Kuzmycz was launched at the National Academy Sciences of Ukraine, Institute for Nuclear Research. The training centre’s establishment was possible with the financial and technical assistance of US Department of Energy. Since the foundation, various training courses on Physical Protection and Nuclear Material Control and Accounting (MPC&A) were developed and introduced as upgrading qualification courses for MPC&A specialists. As a result of the Training Center activity, the Bachelor’s and Master’s degrees program “Physical protection and accounting and control of nuclear materials” was added to the speciality #143 “Nuclear Energy” in the number of Ukrainian universities.
  • In 2016, Ukrainian researchers and scholars from the Eastern Ukrainian National University named after Volodymyr Dal and Kherson National Technical University, designed a pilot version of the Master Program “Risk Analysis of SoS Security and Resilience” within the framework TEMPUS Project “Modernization of Postgraduate Studies on Security and Resilience for Human and Industry Related Domains” co-founded by the Tempus Programme of Europe. The programme’s main goal was to create a knowledge base for multidisciplinary research on critical infrastructure risk management and develop a security curriculum for suitable and recognized industry and academic experts. It was expected that this programme would allow the training of highly qualified specialists and arm them with up-to-date tools and techniques enabling security risk assessment, risk management, and response to new challenges of cyber society. As a result of the Pilot program, there was developed a separate “Cyber Security of Critical Infrastructures” training course. The university included it in the Master’s degree speciality #125 “Cybersecurity” program.
  • The “Protection and Resilience of critical infrastructure” and “Energy security” modules are included in the Strategic Leadership Program: National Security course of Master of Public Administration degree in Defense and Security sector at Kyiv Mohyla Business School. The program was developed and implemented in partnership with the National Security and Defense Council of Ukraine and the Office of the President of Ukraine with the support of international partners – US, Canadian, British, NATO and Ukrainian missions.

On the below example, you can see the list of Ukrainian universities and training center who started introducing the CIP training programs in their formal and informal educational process for developing future CIP workforce in Ukraine.

Name of Education InstitutionsSpecialtyTypeTraining program name
National Aviation university#263 “Civil protectionBachelor degreeCritical infrastructure protection objects
Interregional Academy of Personnel Management#081 “LawBachelor degree (self-learning course)Subjects of protection of critical infrastructure objects
National Academy of the Security Service of Ukraine, Educational and Scientific Institute of State Security#256 “National Security” Ensuring state security in the information sphereNot certified program (optional training program)Counterintelligence protection of Cybersecurity of the state and critical infrastructure objects
National Academy of the Security Service of Ukraine, Educational and Scientific Institute of State Security#256 “National Security” Cyber protection, ensuring state security in the information sphereNot certified program (optional training program)    Counterintelligence protection of Cybersecurity of the state and critical infrastructure objects
National Technical University of Ukraine “Igor Sikorsky Kyiv Polytechnic Institute”#143 “Nuclear EnergyMaster degreePhysical protection and accounting and control of nuclear materials
Vinnytsya Technical National university#125 “CybersecurityBachelor and Master degreeCybersecurity of critical systems
Eastern Ukrainian National university named after Volodymyr  Dal#125 “Cybersecurity”  Bachelor degreeCybersecurity of critical infrastructures
Kyiv-Mohyla Academy Business School Master of Public Administation degree in Defense and Security sectorStrategic Leadership Program: National Security course, Modules: Protection and Resilience of critical infrastructure; Energy security.
Training Center for Physical Protection, Accounting and Control of Nuclear Material named after George Kuzmic (GKTC) at the National Academy of Sciences of Ukraine, Institute for Nuclear Research Upgrading of the qualification training program of MPC&A specialists of nuclear facilities  Physical Protection (14 courses are included in the training program) Nuclear Material Control and Accounting (14 courses are included in the training program)

Modern CIP training of higher education seekers is aimed at continuous professional and personal development with the possibility of further integration into the civil, security and research areas and of course to be able to apply the gained knowledge in the professional CIP market.  If we speak about CIP training for security sector, the main stakeholders of educational services in Ukraine are Security Service of Ukraine; Security and Defense Sector Agencies; Public Authorities. The competencies of such specialists include counterintelligence, protection of national statehood, the fight against terrorism and counterintelligence protection of critical infrastructure, etc.

If we consider „Civil Protection“ speciality competencies, the main task of civil protection specialists is to organize the protection of critical infrastructure and territory, ensuring readiness for effective measures to protect the population in emergencies of man-made and natural nature.

But all metioned programs, courses and specialities do not cover the full spector of training of CIP professionals needed for Ukraine at current time.  The reason of this issue that CIP is still not identified as a separate profession or field of knowledge in the formal education in Ukraine. The obstacle is for introducing this critical for Ukraine specialty is that the International Standard Classification of Education does not distinguish the field of Critical Infrastructure Protection as a particular field of knowledge or profession. The introduction of the CIP profession as a separate one at present Ukrainian legal realia would contradict the Law of Ukraine “On Higher Education” and Ukraine’s international obligations. That is why Ukrainian universities have been covering this gap by introducing this field of knowledge and its content through the interdisciplinary educational programs at law enforcement, defence, and civil academies. At the same time, this legal burden and the absence of CIP as a separate standard in the classification makes it difficult for Ukrainian universities’ instructors to receive their CIP program approval from the Ministry of Education and Science of Ukraine (MESU) and be certified as CIP university instructors after piloting their current Bachelor’s degree programs. 

To solve this problem, the Service of Critical Infrastructure Protection at the National Security and Defense Council of Ukraine (SCIP/NSDC), together with the MESU and international partner – CRDF Global in Ukraine, drafted the Concept of development of a system of training specialists in critical infrastructure protection. The development of the Concept became especially relevant in connection with the adoption of the Law of Ukraine “On Critical Infrastructure” dated November 16, 2021. This law is the foundation for the development of the country’s critical infrastructure protection system and contains provisions that, in particular, provide for the development of training programs for higher education seekers, further training, work and training programs for employees in the field of critical infrastructure protection.

The Concept aims to create a national system of training, retraining and advanced training of CIP professionals to meet the country’s needs in professionals and improve awareness, including educational activities, of all segments of the population and its readiness to meet security challenges.

Before the start of the Russian – Ukrainian war on February 24, 2022, the Concept had been approved by the Cabinet of Ministries of Ukraine and sent to the Ministry of Education of Ukraine and Ministry of Economy of Ukraine for final review and consideration. The Concept is expected to be implemented during 2022 to – 2031 years.

According to the Concept, the implementation plan for this initiative consists of 2 stages:

  • Stage I (2022 to – 2026): development of qualification requirements for staff occupied in CIP, implementation of short-term pilot programs of professional development of staff, the definition of requirements for educational programs (including interdisciplinary) to develop competencies of graduates capable of working in CIP for the implementation of the “pilot project” (with the consent of higher education institutions);
  • Stage II (2026 to – 2031): ensuring the selection of persons and their preparation for the acquisition of relevant competencies in the field of CIP, as well as, after the pilot project, creating, if necessary, a new speciality “Critical Infrastructure Protection and its Resilience”, creating a national qualification centre in the field of CIP and the network of educational centres; the beginning of the implementation of specialized academic programs of formal higher education.

The influence of international assistance on the development of CIP academia curriculums and training programs.

It should be noted that the significant influence on the development of the national CIP training programs and curriculums at the Ukrainian academia, research institutions and training centres was made by the support of international donors, embassies, and international programs from the United States (US), United Kingdom (UK), European Union (EU), Organization for Security and Co-operation in Europe (OSCE) and the North Atlantic Treaty Organization (NATO).  

During the last decade, a lot of international onsite and online workshops/seminars, table-top exercises (TTX), training courses, international speakers visit, international experience exchange site visits and scientific-practical conferences were jointly conducted by international organizations and experts for Ukrainian governmental institutions, academia, and private business.

  • 5 practical onsite Workshops “Critical Infrastructure/Key Resource Protection», US Embassy to Ukraine, Resident Training Advisor (RTA) office, US Federal Law Enforcement Training Center, the Department of Homeland Security (FLETC/DHS), 2010 to-2011;
  • US National Sports Safety and Security Conference, National Center for Spectators Sport Safety and Security (NCS4), FLETC/DHS, State Border Guards Service of Ukraine (SBGU), Security Service of Ukraine (SSU), Ministry of Emergency Service of Ukraine (MESU), 02-04 August, 2011;
  • Working consultations and sites visits in Atlanta, Georgia state in the USA,, US Safety and Security Experts who worked at the 1996 Olympic Games, FLETC/DHS, SBGSU, SSU, MESU, 04-06 August, 2011;
  • International seminar “Critical Infrastructure Protection. Experience of European countries“, Security Service of Ukraine, Organization for Security and Co-operation in Europe (OSCE), 11-13 October, 2016;
  • Round table “Critical Infrastructure Protection: Problems and Prospects for Implementation in Ukraine“, National Institute for Strategic Studies of Ukraine, 17 July, 2012;
  • Round table on “Organizational aspects of building a critical infrastructure protection system in Ukraine“, NISS, NATO Liaison Office in Ukraine, 25 February, 2016;
  • Seminar “Establishing a system of personnel training in Ukraine in the field of CIP”, National Institute for Strategic Studies of Ukraine (NISS), NATO Professional Development Program (NATO PDP) in Ukraine, 09 November, 2016;
  • Workshop “The main approaches to planning of actions in the event of a crisis on objects of critical energy infrastructure” NISS, 13 April, 2017;
  • Expert meeting “Best practice of public relations in the event of serious incidents on critical infrastructure objects” NISS, 11 May, 2017;
  • The First International Scientific-Practical conference “Critical Infrastructure of Ukraine as an Object of Criminal Legal Protection and Preventive Activities. The Role and Place of Special Services in the State System of Critical Infrastructure Protection, Legal Aspects and Main Tasks“, OSCE, Security Service of Ukraine, Vasyl Stefanyk Precarpathian National University, 08-10 June, 2017;
  • Workshop “Critical National Infrastructure”, NISS, UK Cabinet Office Emergency Planning College, 19–23 June 2017;
  • Workshop “Critical National Infrastructure: Energy Sector”. NISS, UK Cabinet Office Emergency Planning College, 04–07 September, 2017;
  • Table Top Exercise  “Coherent Resilience 2017”, NISS, the NATO Energy Security Centre of Excellence and Ministry of energy and coal industry of Ukraine, US Naval Postgraduate School,  16-20 October, 2017;
  • International Round Table “The Role and Place of Special Services in Critical Infrastructure Protection“, the Security Service of Ukraine, OSCE, 29 November, 2017;
  • The Second International Scientific-Practical conference “Formation and prospects of development of the state system of critical infrastructure protection in Ukraine. Criminological assessment of risks and threats“, OSCE, Security Service of Ukraine, Vasyl Stefanyk Precarpathian National University 26-28 April, 2018;
  • Round table “Certification of critical infrastructure: the formation of information analysis system“, NISS, State Archives Service of Ukraine, 22 March, 2018;
  • Crisis Management Course, NATO-Ukraine Training Program, NATO Liaison Office in Ukraine, National Academy of the National Guards of Ukraine, NISS, 29-31 May, 2018;
  • International Round Table “Protecting Critical Infrastructure and Enhancing Chemical Safety and Security in the East of Ukraine”, site visit to Ukraine of the formerDeputy Assistant Secretary for Infrastructure Protection, U.S. Department of Homeland Security Mr. David Wulf, OSCE Project Coordinator office in Ukraine 16 August, 2018;
  • Table Top Exercise  “Coherent Resilience 2018”, UK Embassy to Ukraine,  the National Academy of Internal Affairs of Ukraine (NAIA), 08-11 October, 2018;
  • International seminar “Critical Infrastructure Protection. Experience of European countries”, OSCE, NISS, Ministry of transportation of Ukraine, 07-08 November, 2018;
  • Ninth module of “Critical Infrastructure Protection” within the framework of the “100 Champions” project, NATO PDP, the NAIA of Ukraine, 12-13 November, 2018;
  • Interagency Experts Working Group on Combating the Proliferation of Weapons of Mass Destruction, Terrorism and Critical Infrastructure Protection  on “Problems of building public-private partnerships in critical infrastructure protection“, NISS, 18 April, 2019;
  • Public discussion on draft law “Critical Infrastructure and its Protection” NGO “International Anti-Terrorist Unity”; NGO “Social Justice”; All-Ukrainian Association of Employers in the field of security activities “Federation of Security Professionals”, 17 May, 2019;
  • The Third Annual International Scientific-Practical conference “Formation and prospects for the development of the state system and the establishment of critical infrastructure in Ukraine”, OSCE, Security Service of Ukraine, Vasyl Stefanyk Precarpathian National University, 12-14 September, 2019;
  • Virtual roundtable “Higher Education in Cyber ​​Security in Ukraine“, the United States Agency for International Development (USAID), USAID project “Cyber ​​Security of Critical Infrastructure of Ukraine“, Kharkiv National University of Radio Electronics, 19 November, 2020;
  • Online roundtable discussion on “Creating a regulatory framework for security and resilience of criticalinfrastructure: preliminary results and priorities for further work“, NATO Mission in Ukraine, NISS,  25 February, 2021;
  • National Cyber Security Cluster “Critical Infrastructure Protection”, CRDF Global in Ukraine, SCIP/NSDC of Ukraine, 27 May, 2021;
  • Online seminar “Critical Infrastructure Protection”, NextPeak, CRDF Global in Ukraine, SCIP/NSDC of Ukraine, 02-03 June, 2021;
  • The Table Top Exercise “Coherent Resilience 2020”, NATO, defense and law enforcement governmental agencies of Ukraine, 13 -17 September 2021;
  • The Fourth Annual International Scientific and Practical Conference “Formation and Prospects for the Development of the State System for Critical Infrastructure Protection in Ukraine“, OSCE, the SSU and SCIP/NSDC of Ukraine, 28-30 October 2021;
  • Online workshop “Critical Infrastructure Protection”, US Nouset National Security Group LCC, CRDF Global in Ukraine, SCIP/NSDC of Ukraine, 02-04 November 2021;
  • Working meeting “Critical Infrastructure System Protection in Ukraine”, SCIP/NSDC, International Relations Division and the Stakeholder Engagement Division of the U.S. Cybersecurity and Infrastructure Security Agency (CISA), CRDF Global in Ukraine, 19 November 2021;
  • Webinar “Exploring Ukraine’s Critical Infrastructure Protection Development”, CRDF Global in Ukraine, SCIP/NSDC, 09 December 2021.

Training and education are fundamental to the success of a national critical infrastructure security and resilience program development in Ukraine and must continue reaching government officials, infrastructure owners and operators, first responders, and the public, where appropriate. Training should be available in many different forms to ensure the broadest reach based on US, UK, NATO and EU best practices.

Creating a culture of continuous improvement in infrastructure security and resilience requires increasing the exposure to fundamental concepts in certain college or university curricula as well. The purpose of academic programs may be to: train students on the use of assessment techniques; make engineers more aware of ways to protect infrastructure elements, reduce their vulnerabilities, or make them more resilient by design; inform planners on the importance of advance planning, information sharing, and partnerships; help emergency managers understand the potential impacts of cascading failures; among other factors.

Building national CIP training system and curriculums will require a lot of time and work to be done in Ukraine jointly with international experts and leading international educational/research institutions in training of a national team of instructors, developing national CIP curriculums, E-learning programs, on-job trainings, job aids, etc, and do a lot of piloting projects with academia and CIP community before their integration in the educational process.

  • List of approved standards in higher education of Ukraine (in Ukrainian);
  • National Initiative for Cybersecurity Education (NICE) Cybersecurity Workforce Framework;
  • University training programs/curriculums that still are not approved (did not receive accreditation) by the Ministry of Education and Science of Ukraine.

Other articles