Uzbekistan Cybersecurity Strategy 2026–2030
A presidential decree that sets national cyber priorities for five years, creates new cybersecurity units in state bodies, and puts a coordination council under the Security Council. This page rewrites its main points in plain English.
Goals
The strategy states one aim: set the priority directions for cybersecurity over the next five years, protecting citizens, society and the state.
Objectives
- Strengthen national cyber resilience and protect critical information infrastructure.
- Reduce cyber risk across government, business and public sectors.
- Fight cybercrime actively.
- Advance digital innovation and technological independence.
- Cooperate internationally and take part in global cyber governance.
Operational tasks
- Build national cyber response centers and early threat detection.
- Develop digital identity and authentication infrastructure.
- Improve data protection law and standards.
- Improve digital forensics.
- Join international cyber investigations.
Eight priority areas
Select a row to see what the strategy says it will do.
Deadlines in the decree
Dates are taken from the decree's numbered points. Status is calculated from today's date and only tells you whether a deadline is still ahead. It does not say whether the work was done.
Who does what
Leaders of state bodies are personally responsible for meeting the deadlines (point 3).
New units
- Ministry of Justice, Ministry of Energy and the Tax Committee each set up a Cybersecurity Provision Department with at least 4 positions, by 1 Apr 2026.
- Eleven named state bodies set up cybersecurity units within their existing budgets.
Oversight
- A National Coordination Council on Cybersecurity sits under the chair of the Security Council.
- The Presidential Security Council coordinates and monitors implementation.
- The Prime Minister and the Security Council Secretary oversee compliance.
Market and testing
- State bodies may buy cybersecurity services from registered outsourcing providers.
- The State Security Service drafts the registration procedure.
- Independent security testing is approved, based on advanced foreign practice.
Funding
- Budget resources are directed to cybersecurity from 1 Apr 2026.
- Extra-budgetary funds cover licensing, training and connection to security networks.
- Foreign investment and grants support certified protection tools.
Market research: how lucrative is cybersecurity?
Demand, market size and pay in three views. Figures come from public reports and salary sites, gathered in October 2026.
- Demand has moved from headcount to skills. In the 2025 ISC2 study (over 16,000 respondents), 95% report at least one skills gap. The most needed skills are AI security (41%) and cloud security (36%).
- Budgets are tight. In the same study 36% report budget cuts and 24% report layoffs, while 33% say they cannot afford enough staff. Employers want proven skill, so entry-level roles are competitive.
- Market size estimates differ by firm: about $219B in 2026, rising to $699B by 2034 at 13.8% a year (Fortune Business Insights). Forecasts for 2030 range from $352B to $501B. Read these as a range.
- United States: 514,359 cybersecurity openings in 12 months and 74 workers per 100 openings (CyberSeek). The US Bureau of Labor Statistics projects 29% job growth for 2024 to 2034, as reported by StationX.
- Where the money is: North America holds 43% of the market, Europe 25.6% and Asia-Pacific 20.7% (2025).
- Asia-Pacific holds over 70% of the global workforce gap but only about a fifth of the market's spend, so demand is high while pay depends strongly on the type of employer.
- Fastest growing markets: Australia at 18.4% a year and India at 16% a year (market research firms' forecasts).
- India pay per year in lakh rupees (LPA): fresher 4 to 6, mid-level 7 to 20, senior 20 to 35, top-tier and multinational 35 to 48 or more. Median total pay is about 14.5 LPA. IT services firms pay 5 to 10 LPA, while multinationals and global capability centres pay far more (Futurense, citing PayScale and Levels.fyi).
- Not found: reliable current salary data for Singapore, Japan and Korea. Check a local salary survey before comparing.
- Threat volume is high and rising. UZ-CERT reports 60,000 cyber threats and 119 incidents in 2024 and expects more in 2025. In Q1 2024 alone, 3,290,860 attacks were recorded in the national internet segment.
- The most targeted sectors are banking and finance, manufacturing, energy and ICT. These are the same sectors PF-38 prioritises.
- PF-38 creates hiring triggers: new cybersecurity units in three bodies plus eleven named state bodies, a registry of outsourcing providers, an electronic testing platform, a cyberlaboratory and national cyber-literacy programs. The text I read gives no budget figures.
- Supply is growing: more than 510,000 young people earned international IT certificates in 2025 (IT Park). Pay grows quickly with experience (see the chart below).
| Role | United States | United Kingdom | Germany |
|---|---|---|---|
| SOC analyst | $55–85k entry, $110–140k senior | £25–37k entry, £55–80k senior | €48–65k junior, €85–105k senior |
| Penetration tester | $70–100k entry, $150–210k senior | £30–45k entry, £65–100k senior | €75–100k mid, €100–135k senior |
| GRC analyst | $60–85k entry, $120–170k senior | £28–40k entry, £55–85k senior | €75–100k mid, €100–130k senior |
| Cloud security engineer | $85–115k entry, $160–220k senior | £35–52k entry, £70–110k senior | €85–115k mid, €115–145k senior |
| CISO | $190–300k+ | £100–160k+ | €140–260k |
US and UK figures: TryHackMe salary guide, March 2026. Germany: Optima Europe salary guide 2026. Bonuses can add 10 to 30% at mid and senior levels.
How lucrative is it?
World: security spending keeps growing and demand is strong, but hiring budgets are tight and employers now hire for specific skills such as cloud, AI and detection. A first job takes proof of skill, not only a certificate.
Asia: the biggest gap and the fastest-growing markets. Pay ranges from modest at IT services firms to high at multinationals.
Uzbekistan: pay starts at $700–1,500 a month, rises to $1,500–2,000, and reaches $2,500 or more for senior specialists. PF-38 adds new employers.
The biggest upside: a mid-level specialist earns about $18,000–24,000 a year locally. A mid-level SOC analyst in Germany earns €65–85k and one in the US $85–115k. Reaching those salaries means working for foreign or export-oriented employers, which takes strong English, public proof of skill and a legal way to be hired. It is possible and not guaranteed.
- StationX: skills gap statistics (summary of ISC2 2024, CyberSeek, BLS)
- SecurityInfoWatch: ISC2 2025 workforce study
- StationX: market size statistics (Gartner, Fortune Business Insights, MarketsandMarkets and others)
- TryHackMe: cyber security salaries in 2026
- Optima Europe: Germany salary guide 2026
- Futurense: cybersecurity analyst salary in India
- Dunyo.info, citing the BBC: Uzbekistan's IT market
- UZ-CERT: forecast of major cyber threats for 2025 and Global Cybersecurity Index result
- Kun.uz: cyberattacks in Q1 2024
- Open the official text on lex.uz
Learning roadmap for students
PF-38 sets up SOCs, forensic labs, vulnerability testing, certified outsourcing providers, critical-infrastructure standards and national training programs. Each of those needs people. This roadmap goes level by level, from zero to advanced. Do the levels in order, then pick a track.
Career tracks and where PF-38 creates demand
After Level 2 you choose a track. Each one maps to a part of the strategy. Employers and certifications change, so treat the certificate names as examples and check current requirements before you pay for an exam.
A 24-month plan
Roughly 10 hours a week. Faster if you study full time, slower if you work or study elsewhere. No roadmap guarantees a job, but visible proof of skill is what gets interviews.