Amidst the constantly growing cyber threats facing Ukrainian organizations, ensuring the evidentiary integrity and legal force of automated business processes and electronic documents after a cyberattack is critical. This is not merely a data recovery issue, but a complex architectural and operational challenge that requires balancing the speed and efficiency of automation with the need for forensic readiness and legal admissibility of results in court.
An operational failure in this context involves the inability to prove the legitimacy of business operations or the legal force of documents following a cyber incident. This can lead to significant financial losses, regulatory fines, loss of trust from clients and partners, and the inability to defend interests in litigation. Therefore, designing and implementing an architecture that guarantees evidentiary value becomes an integral part of a cyber-resilience strategy.
The Necessity of Evidentiary Integrity in the Face of Cyber Threats
Ukraine's modern digital economy is built on automated business processes that generate massive volumes of electronic documents and data. After a cyberattack, there is an urgent need not only to restore system functionality but also to confirm that all operations, transactions, and documents created or modified during this period are authentic, immutable, and legally binding. Traditional backup and recovery approaches may not always provide sufficient evidence of data integrity and provenance, especially if the backups themselves were compromised or their integrity called into question.
This requires CIOs, CTOs, CISOs, and IT operations managers to rethink their system architecture by integrating mechanisms capable of ensuring data immutability and evidentiary value throughout the business process lifecycle. The goal is to ensure that even after the most complex compromise, events can be clearly reconstructed, the authenticity of electronic documents confirmed, and they can be presented as irrefutable evidence in court.
The Legal Framework of Ukraine: Foundation for Evidentiary Electronic Data
Ukrainian legislation provides a clear framework for the use of electronic documents and their evidentiary weight. The Law of Ukraine "On Electronic Trust Services" is key in this context. It defines a qualified electronic signature (QES) as an advanced electronic signature created using a qualified electronic signature device and based on a qualified public key certificate. A QES has the same legal force as a handwritten signature and carries a presumption of equivalence. This means that documents signed with a QES enjoy a high level of trust and are protected from accidental or intentional modification.
Procedural codes of Ukraine (Commercial, Civil, Administrative) regulate the submission and evaluation of electronic evidence in court. Electronic evidence is information in electronic (digital) form containing data on circumstances relevant to the case, including electronic documents, websites, messages, metadata, and databases. It is important that a court may disregard a copy of an electronic document if the original is not submitted and the correspondence of the copy to the original is questioned. The original electronic document must allow for proof of its integrity and authenticity. For submitting procedural documents in electronic form to court, the "Electronic Court" subsystem of the Unified Judicial Information and Telecommunication System is used, where documents are secured with a QES. The Supreme Court also notes that the absence of a QES does not always render electronic evidence unreliable, but its evidentiary weight may vary depending on the specific case.
Architectural Strategies for Ensuring Integrity and Legal Force
To ensure the evidentiary integrity and legal force of automated business processes after a cyberattack, comprehensive architectural solutions must be implemented.
- Immutable Logging: Implementing immutable log systems that record all actions, changes, and transactions in automated business processes. These logs must be protected from any modification after creation. This provides a complete history of events, which is critical for forensic examination and restoring integrity. The National Bank of Ukraine, for example, requires the implementation of an effective access management system, including event logging.
- Qualified Electronic Signature (QES): Mass application of QES for signing all legally significant electronic documents generated by automated processes. This applies not only to external documents but also to internal ones that may become the subject of litigation. QES guarantees document integrity and signer identification, which serves as irrefutable evidence in court.
- Blockchain Technologies: Considering the integration of blockchain solutions to confirm the integrity of critical data and documents. Blockchain ensures record immutability and transparency, as any attempt to alter data will result in a mismatch of hash values, making tampering obvious. This can be particularly useful for fixing key stages of business processes or creating "fingerprints" of important documents.
- Document Management Systems (DMS) with Evidentiary Base: Implementing DMS that automatically form an "evidentiary package" for each document. This package should include the original file, electronic signatures, metadata with details, receipts, and a full history of all operations performed on the document. Such systems store the original and its printouts separately, clearly distinguishing between them.
NBU Regulatory Requirements: A Benchmark for the Financial Sector
The National Bank of Ukraine plays a leading role in setting cybersecurity and information security standards for the financial sector, which can serve as a benchmark for other industries. NBU Board Resolution No. 99 of August 25, 2025, regulates the use of cloud technologies, emphasizing cybersecurity, data protection, and business continuity. It requires financial institutions to assess risks and ensure compliance when using cloud services.
NBU Board Resolution No. 143 of December 9, 2025, establishes new requirements for information security and cyber defense for non-banking financial institutions. It covers cyber risk management, information security incidents, and requirements for internal documents regulating access rights management to information systems. Particularly important are the requirements for implementing an effective access management system that includes authentication, segregation of duties, and mandatory event logging. These norms underscore the need for a proactive approach to ensuring data integrity and evidentiary value.
Checklist for Assessing Readiness for Evidentiary Value After a Cyberattack
To assess the architecture of automated business processes for evidentiary readiness after a cyberattack, the following checklist is recommended:
- Have immutable logging systems been implemented for all critical business processes and IT systems?
- Is the use of qualified electronic signatures (QES) ensured for all legally significant electronic documents generated by automated processes?
- Are blockchain technologies being considered or already implemented to confirm the integrity of key data or to fix stages of business processes?
- Are there clear electronic data and document retention policies that ensure their availability for forensic examination within the required timeframe?
- Do architectural solutions and operational procedures comply with the requirements of the National Bank of Ukraine (specifically Resolutions No. 99 and No. 143) and other relevant Ukrainian legal acts?
- Are there mechanisms for fast and reliable reconciliation of data and business processes after an incident to restore evidentiary integrity?
- Are regular audits and system tests conducted for forensic readiness and the ability to provide legally admissible evidence?
- Are procedures developed and documented for the collection, preservation, and submission of electronic evidence in court, taking into account the requirements of procedural codes?
