For foreign vendors

Certification at the Cybersecurity Center

To sell cybersecurity products to government agencies and critical information infrastructure (CII) facilities in Uzbekistan, the product must be certified. We guide the vendor through the entire process, from preparing documents and source code to obtaining the certificate.

IT-HUNTER's core focus

Does your product need certification?Discuss certification

Does your product need certification?

Answer four questions and we'll show what the current Regulation requires.

1Who will use the product in Uzbekistan?
2What kind of product is it?
3Does the product process confidential information?
4How will you supply the product?

Procedure and timing

Deadlines for the certification body's stages are set by the Regulation. The testing period is determined by the test methodology and the contract.

  1. 1Preparing the product and documentsdepends on readinessVendorIT-HUNTER
  2. 2Application submissionafter a formal checkIT-HUNTER
  3. 3Decision on the application2 business daysCertification body
  4. 4Contract and paymentdepends on scopeVendorCertification body
  5. 5Sample selection2 business daysCertification body
  6. 6Testingper methodologyCertification bodyIT-HUNTER
  7. 7Resolving nonconformitiesup to 1 monthVendorIT-HUNTER
  8. 8Certificate issuance3 business daysCertification body

Document checklist

Mark what you already have ready. We'll prepare the rest together.

0/11 ready

Four certification schemes

1

Type sample

A specific version is tested. A certificate with a checksum has no expiry date.

For supplying a specific product version
2

Product batch

A specific batch is certified based on its shipping documents.

For a one-off delivery
3

Serial production

A production audit and surveillance at least once a year. The certificate is valid for 3 years.

For regular releases and updates
4

For high-level CII

Used primarily for tools deployed at high-level CII facilities.

For critical facilities

How we take a vendor through certification

  1. Preliminary assessment

    We review the product, determine whether it falls under mandatory certification, choose the scheme and assess readiness.

  2. Gap analysis and remediation

    We check the product and documentation against the requirements, identify nonconformities before submission and help resolve them.

  3. Document package

    We prepare the application, program description, user and administrator guides and supporting documents in Russian and Uzbek.

  4. Source code and installation files

    We help prepare the source code and installation packages for handover to the testing laboratory in the required form.

  5. Submission and communication

    We act as your representative in Uzbekistan: we file the application and handle correspondence and contract negotiation with the certification body.

  6. Testing support

    We attend the tests, respond promptly to experts' questions and arrange for findings to be resolved within the set deadline.

  7. Certificate and market entry

    Once the certificate is issued, we help with supply to public sector and CII customers, deployment and support.

Foreign vendors

  • Manufacturers of DLP, antivirus, firewalls, SIEM and other security tools
  • Companies entering Uzbekistan's public sector market
  • Vendors without their own office in Tashkent

Distributors and integrators

  • Those supplying foreign solutions to government agencies and CII facilities
  • Those who need a certified product to take part in tenders
  • Those who want to reduce the time and risk of repeat testing

What you need to know about certification

Only verified facts from regulations and the certification body's own materials.

Mandatory for the public sector and CII

Cybersecurity products for government information systems and critical information infrastructure (CII) facilities are subject to mandatory certification.

Source: Regulation on the certification procedure, cl. 2

Current procedure in force since 18.11.2024

The procedure was approved by order No. 114 of the Chairman of the State Security Service dated 15.10.2024 and registered by the Ministry of Justice on 14.11.2024 under No. 3574, pursuant to the Law "On Cybersecurity".

Source: lex.uz

Accredited body

Certification is carried out by the ICT and information security certification body at the Cybersecurity Center, accreditation certificate No. O'ZAK.MS.0004.

Source: csec.uz, services

What gets certified

Software products, software of ICT and information security hardware-software systems, information security tools, DLP, antivirus software and firewalls.

Source: csec.uz, services

The applicant need not be the manufacturer

An application can be filed by the manufacturer, its authorized representative, a seller, an importer or a user of the product.

Source: Regulation, cl. 1

Source code for confidential data

For products that process confidential information, the full source code must be submitted. Built-in cryptographic protection must be certified in advance.

Source: Regulation, cl. 7; Instructions for applicants

Four certification schemes

Type sample, batch, serial production with inspection control, and a scheme used mainly for high-level CII facilities.

Source: Regulation

Validity period

A certificate for a specific version with a checksum has no expiry; for serial production it is valid for 3 years.

Source: Regulation, cl. 33

Procedure timelines

Decision on the application: 2 business days; sample selection: 2 business days; certificate issuance: 3 business days. The testing period is set by the test methodology and the contract.

Source: Regulation, cl. 8, 11, 32

Frequently asked vendor questions

Do we need a company or office in Uzbekistan?

The Regulation allows the applicant to be not only the manufacturer but also its authorized representative, seller or importer. IT-HUNTER can act as your representative in Uzbekistan.

Do we have to hand over the source code?

For tools that process confidential information, yes: the full source code is handed over to the testing laboratory after the contract is signed. We help prepare it in the required form.

How much does certification cost?

There is no fixed price list: the certification body calculates the cost based on the scope of work, for example the number of source code files or firewall ports. Payment does not depend on the test results.

How long is a certificate valid?

A certificate for a specific version with a checksum has no expiry date. For serial production, it is valid for 3 years with surveillance.

Are foreign certificates recognized?

The Regulation provides for recognition of foreign certificates in the manner established by law. The specific mechanism is not set out in the Regulation, so we assess this option separately for each product.

Can we attend the tests?

Yes, the applicant's specialists may attend the tests. We arrange their participation and respond promptly to the experts' questions.

Why it's faster with IT-HUNTER

To sell cybersecurity products to government agencies and critical information infrastructure (CII) facilities in Uzbekistan, the product must be certified. We guide the vendor through the entire process, from preparing documents and source code to obtaining the certificate.

Discuss certification
  • We know the certification body's requirements and the experts' typical findings
  • Our own cyber range: we check product behavior in isolated infrastructure before submission
  • Our own team of developers and software security specialists
  • Documents and communication in Russian, Uzbek and English

The decision to issue a certificate is made by the certification body based on test results. IT-HUNTER is not a certification body: we prepare the product and documents and support the procedure. Information on this page is based on publicly available regulations and csec.uz materials as of November 2026.