A new requirement has been established for public servants responsible for cybersecurity
In Uzbekistan, it has been established that cybersecurity specialists of state bodies and organizations with a state share of at least 50 percent must undergo advanced training at least once every two years. Starting November 1, 2026, a system for their education and retraining at the state university "Cyber University" has been introduced.
A new requirement has been established for state employees responsible for cybersecurity. This is provided for by Cabinet of Ministers Decision No. 594 of October 28, 2026, which approved the regulations on the procedure for training specialists.
Specialists holding foreign certificates in cybersecurity recognized in Uzbekistan will not be involved in professional development training during the validity period of their certificates. The list of such certificates and their validity periods will be approved by the Ministry of Digital Technologies.
According to the regulations, the duration of training courses is set as follows: professional development courses — 144 hours; retraining courses — at least 576 hours.
Courses may be organized with or without interruption from work, including in a remote format. Upon request of the ordering organization, professional development classes are also permitted to be conducted at the employees' workplace.
Training will be carried out on a fee-contract basis. Expenses will be covered by the sending organization or the off-budget funds of a higher-level body, as well as other sources not prohibited by legislation.
Those who complete the professional development course and successfully pass the final exam will be issued a certificate, while those who successfully complete the retraining course will be issued a diploma.
A trainee who fails the final professional development exam on the first attempt will be given a one-time retake opportunity no later than three months from the date the results are announced. Those who fail on the second attempt as well will be provided with an attendance reference instead of a certificate.
If the duties of such an employee remain unchanged, the organization must ensure their retraining within six months or send a relevant employee entrusted with cybersecurity duties to the course.
Trainees dissatisfied with the final exam results may submit an appeal within five working days from the time the results are announced.