Compliance with NBU Resolution No. 143: Cybersecurity Audit and Consulting

Cyber audit in accordance with NBU Resolution No. 143

Non-bank financial service providers are required to align their information security and cybersecurity systems with the requirements of Resolution No. 143 of the Board of the National Bank of Ukraine. Failure to comply with these requirements creates significant regulatory, operational and reputational risks, and increases the likelihood of observations during regulatory inspections.


BDO in Ukraine provides professional audit and consulting services to financial service providers regarding compliance with NBU Resolution No. 143 and helps strengthen the overall resilience of organisations against cybersecurity threats.


Who is subject to NBU Resolution No. 143

The Resolution requirements apply to non-bank financial service providers, including:

  • insurance companies
  • credit unions
  • financial companies
  • pawnshops.


Infographic listing financial institutions covered by NBU Resolution No. 143, including insurance companies, credit unions, finance companies and pawnshops, with a focus on regulatory requirements, risk management and compliance with the standards of the National Bank of UkraineThe Resolution requires entities to bring their operations into compliance with the new information security and cybersecurity requirements within 12 months of its effective date.


Cybersecurity compliance audit under NBU Resolution No. 143 dated 9 December 2025

We conduct an independent assessment of your organisation’s compliance with Resolution No. 143, including:

  • organisational model of information security management
  • management of cyber risks and information security risks
  • access control, authentication and account management
  • event logging and monitoring
  • network protection and segmentation
  • management of information security incidents and cyber incidents
  • compliance with requirements for software and hardware.


Audit results under Resolution No. 143

The audit results in a structured report that includes a gap analysis, recommendations and a clear understanding of regulatory risk levels. Each provision of Resolution No. 143 is assessed as “Compliant”, “Partially Compliant”, or “Non-Compliant”. In instances of partial or full non-compliance, practical recommendations are provided to address the identified gaps.  


Recommendations and roadmap for enhancing cybersecurity 

Based on audit results, BDO in Ukraine provides:

  • practical recommendations prioritised by risk
  • assistance in developing an implementation plan for cybersecurity measures
  • consideration of the scale, complexity of IT infrastructure and client business model
  • alignment with leading international practices and information security standards (ISO/IEC 27001, 27002, CIS 18 Critical Security Controls).


Cybersecurity documentation consulting

BDO in Ukraine provides advice and support to clients in developing and updating internal documents required under Resolution No. 143, including:

  • information security and cybersecurity policies and regulations
  • methodologies for managing cyber risks
  • access rights management rules
  • incident response plans for cybersecurity and information security incidents
  • business continuity requirements.


The documentation is prepared in accordance with NBU regulatory requirements and practical applicability in daily operations.


Why BDO in Ukraine is your cybersecurity partner

  • deep expertise in financial regulation and IT audit
  • experience working with financial service providers in Ukraine
  • integration of regulatory, technological and risk-based approaches
  • focus not only on compliance but also on real improvement of business cyber resilience.


We help financial service providers confidently meet the requirements of Resolution No. 143, reduce information security risks and prepare for regulatory inspections.

Key Contact

Andrii Borenkov

Andrii Borenkov, CFA

Partner, Head of Advisory
View bio

FAQ (Frequently Asked Questions)

NBU Resolution No. 143 — the regulatory act of the National Bank of Ukraine that establishes mandatory requirements for information security and cybersecurity for non-bank financial service providers.

IT audit — an independent and objective assessment of IT systems, processes and controls to determine their effectiveness, reliability, security and compliance with business and regulatory requirements.

Information security audit — a comprehensive review of organisational and technical measures to protect information, IT infrastructure and digital assets.

Cybersecurity audit — an assessment of an organisation’s ability to prevent, detect and respond to cyber threats, including analysis of cyber risks and existing protection measures.

Regulatory compliance — adherence to laws, regulations and regulatory documents, including requirements of the National Bank of Ukraine.

Gap analysis — a comparative assessment of the current state of IT controls and information security systems against standards or regulatory requirements to identify non-compliance.

Cyber risks — risks of financial, operational, or reputational losses arising from cyberattacks, information security incidents, or deficiencies in IT controls.

IT controls — policies, procedures and technical measures ensuring the security, integrity, availability and reliability of IT systems and data.

Access management — processes and mechanisms for granting, modifying and revoking user access rights to information systems according to roles and responsibilities.

Incident management — established procedures for detecting, analysing, responding to and mitigating the consequences of information security and cyber incidents.

Business continuity — the ability of an organisation to maintain critical processes and services during disruptions, crises, or cyber incidents.

ISO/IEC 27001 — the international standard defining requirements for an information security management system, used as a benchmark in audits and consulting.

CISA (Certified Information Systems Auditor) — the international professional certification confirming the qualification of specialists in IT audit and IT risk management.

Related Publications