AppSec and DevSecOps in Central Asia: Demand Drivers, Requirements and Trends by Country

The main driver of demand for AppSec and DevSecOps in Central Asia is not a trend but regulation of the financial sector and personal data. Banks in Kazakhstan and Uzbekistan already operate under recent regulatory requirements, Kyrgyzstan is reshaping its rules around the Digital Code, and Tajikistan and Turkmenistan remain more "closed" markets with their own specifics. Below is an overview by country, with the acts we were able to confirm.

What drives AppSec demand in the region

• Regulatory requirements for banks. In Kazakhstan, the former National Bank Resolution No. 48 has been replaced by 2026 acts of the Agency of the Republic of Kazakhstan for Regulation and Development of the Financial Market (ARDFM). In Uzbekistan, Central Bank Regulation No. 19/1 has been in force since November 2025.
• Personal data. Personal data laws exist in every country in the region, and localization and cross-border transfer rules shape the choice of infrastructure and tools.
• Digitalization and payments. Growth of mobile applications, APIs and integrations with state platforms expands the attack surface.
• Software supply chain. Dependencies from public repositories and contractors are a topic regulators are already including in their requirements. See SBOM.
• Professional community. Demand has emerged for practical training and knowledge exchange.

Kazakhstan

The most regulated market in the region. For banks, ARDFM Resolution No. 53 dated 3 April 2026 on bank IS requirements and Resolution No. 81 dated 20 April 2026 on minimum IS requirements in the financial market (in force since 12 July 2026) apply. The former National Bank rules required static code analysis and analysis of third-party components for remote service software. Personal data is governed by Law No. 94-V dated 21 May 2013, as amended in 2026, and the Digital Code entered into force in July 2026. For the public sector and systems integrated with it, the Unified Requirements in the Field of ICT and Information Security apply (Government Resolution No. 832 dated 20 December 2016). For details, see Kazakhstan bank IS requirements and personal data in Kazakhstan.

Uzbekistan

CBU Regulation No. 19/1 (in force since 20 November 2025) contains one of the most detailed provisions in the region on the software lifecycle: security requirements at every stage, vulnerability testing before launch, and DevOps platforms in a closed environment with automatic code analysis. The personal data law No. ZRU-547, after the amendments of 26 March 2026, has retained mandatory localization for biometric, genetic and telecom operator user data. There is also a cybersecurity law (2022). For details, see IS requirements in Uzbekistan.

Kyrgyzstan

Banks follow the 2021 NBKR Regulation (Resolution No. 2021-П-20/72-8-(НПА)), which has requirements for the software lifecycle, vulnerability management and outsourcing. The Law "On Cybersecurity" was signed in 2024, and personal data has been governed by the Digital Code since February 2026. For details, see IS requirements in Kyrgyzstan.

Tajikistan

The basic act is the Law "On Personal Data Protection" dated 3 August 2018 No. 1537. According to a CABAR.asia review (2024), the authorized body is the Communication Service under the Government, collection and processing of data requires a certificate from this body, and the law has no liability mechanism for violations. The review does not describe general localization requirements, and the table of contents of the law includes Article 14 on accumulation and storage of data and Article 18 on cross-border transfer, whose text we could not verify. We did not find any National Bank IS regulations that we could confirm, so for banks in the region we recommend requesting requirements directly from the regulator and partners.

Turkmenistan

The Law "On Information on Private Life and Its Protection" was signed on 20 March 2017 and has been in force since 1 July 2017. Article 12 requires personal data to be stored in a database located on the territory of Turkmenistan; Article 17 allows transfer abroad if the recipient country ensures protection, or with the data subject's consent and other specified grounds. According to Turkmenportal, in January 2024 the Central Bank approved a procedure for implementing cybersecurity and IS requirements in the banking system: cyber protection of banks, measures against unauthorized access and malware, identification of critical information infrastructure, and regular cyber risk assessment.

Trends

1. From one-off penetration tests to a process. Regulators increasingly talk about the software lifecycle rather than one-time checks. The path is described in DevSecOps: where to start.
2. On-premise and control over code. Requirements for a closed environment and data localization are increasing interest in solutions that run inside the company.
3. Personal responsibility of management. In Kazakhstan, according to the commentary on Resolution No. 81, responsibility for IS rests with the head of the financial organization.
4. SCA and SBOM. Control of third-party components is moving from a "good practice" to an expected artifact.
5. Secrets and privileged access. These issues are covered by authentication requirements. See secrets management.

Community: AppSecFest in Almaty

Practical exchange of experience on AppSec and DevSecOps in the region takes place at the AppSecFest conference in Almaty, organized by AST Cyber Lab. According to the conference page, 3,173 people have attended over the years and 83 speakers have presented; the fourth conference took place in 2026 at Al-Farabi Hall. For teams that are only building their process, it is an opportunity to see how colleagues from banks and fintech solve these tasks. The program and recordings are available on the conference page.

Countries at a glance

• Kazakhstan: ARDFM industry requirements for banks (No. 53, No. 81), Law No. 94-V and the Digital Code; localization of storage in a database or digital object on the territory of the country; the most dense regulation of the financial sector among the markets we confirmed.
• Uzbekistan: CBU Regulation No. 19/1 with rules on the software lifecycle and SIEM; localization only for biometric, genetic and telecom service user data; a separate cybersecurity law.
• Kyrgyzstan: NBKR Regulation of 2021, a 2024 cybersecurity law, and the Digital Code instead of a personal data law; we have not confirmed a general localization requirement.
• Tajikistan: a 2018 personal data law, with the Communication Service as the authorized body; we did not find detailed industry IS acts for banks.
• Turkmenistan: a 2017 law requiring data to be stored in a database on the territory of the country; a Central Bank procedure on cyber protection of banks (January 2024).

How to choose tools for the region

A practical set of criteria for teams working in several countries:

• Flexible deployment. The ability to install the product on-premise or in a private cloud in the required jurisdiction.
• Languages and stack. Support for the languages and frameworks you use, including mobile applications. Verify this in a pilot on your own code.
• Reporting for regulators. Export of results in a format understandable to your IS team and auditor.
• Local support. Language, time zone and procurement method.
• Integration into the process. A tool that is not built into CI/CD quickly becomes an "extra report".

How to start if you work in several countries

Take the strictest of the applicable regimes as your baseline and add national specifics on top of it. If you have bank clients in Kazakhstan and Uzbekistan, a secure development process with automatic code analysis, dependency control and audit-ready reports will cover a significant share of the common requirements. Separately, map the national rules on storing personal data and sort your systems by jurisdiction. Then determine which environments (development, testing, production) must stay inside the country and which can be run centrally. You can discuss an implementation map for your countries on the DevSecOps page.

Frequently asked questions

This article is for information purposes only and does not constitute legal advice. The regulatory framework changes; check current versions of the acts before making decisions.

Sources

• ARDFM Resolution No. 53 dated 3 April 2026
• CBU of Uzbekistan Regulation No. 19/1 (lex.uz)
• NBKR: Regulation on IS in commercial banks
• CABAR.asia: personal data protection in Tajikistan
• Law of Turkmenistan "On Information on Private Life and Its Protection"
• Turkmenportal: Central Bank of Turkmenistan approved cybersecurity requirements for banks
• Law of the Republic of Tajikistan "On Personal Data Protection"