Communications operators painted the rules for identifying their facilities of kia
Minzifra developed a decree on the sectoral features of the assignment of communication objects to critical information infrastructure (KII). According to the document, communication operators themselves will identify and determine such objects depending on the scale of the possible consequences in the event of a computer incident. The execution of new functions will require operators an additional 6 billion rubles of expenses for six years.
The telecom operators themselves will determine the objects of critical information infrastructure (KII) at communication facilities, follows from the draft resolution published on May 16 on the regulation.gov portal. To identify KII objects and assign them the categories of significance will be special commissions that will be composed of company employees. The companies also have the right not to identify such objects.
Among other things, the company will transfer information about the software and PAK, which are used at KII facilities, as well as means of ensuring the safety of objects. Each of the objects can be classified as a category depending on the scale of the possible consequences in the event of a computer incident. Requirements may enter into force on September 1, 2025.
Object of kia – This is an information system, an automated control system or a telecommunication network that ensures the implementation of important processes necessary for their operation. In early April, President Vladimir Putin signed a law that extends the obligation to transfer significant KII facilities to Russian software to commercial companies.
The consolidated report to the draft resolution says that the expenses of telecom operators for the implementation of its provisions will amount to more than 6 billion rubles. For six years. The Kommersant source on the telecom market evaluates the costs of companies at additional « hundreds of millions of rubles per operator per year. » The document also states that now there is no normative consolidation of the features of the category of KII objects in the field of communication, and “there are only general provisions”, in accordance with which the operators determine them.
The opinions of operators of communication about the new regulation were divided. The Megafon assures that the innovations will not affect their work, because as a subject of Kia they already fulfill the requirements. “The state improves the protection of critical infrastructure. The new requirements in detail reflect the sectoral specifics in the category, ”they say in Megafon.
However, in T2 they explain that the proposed edits make a “fundamental change to the algorithm for determining the objects of CIA”. According to the company representative, the existing order allows you to categorize and ensure the safety of KII « at the proper level. » “It involves the consideration of the critical processes of the organization from determining unacceptable events, but in the new version it is proposed to simply choose the objects of kia from the list of typical objects.” At the same time, the list of kia can be significantly expanded, explain in the company, which can complicate the implementation of safety requirements. The new approach will require serious costs for categorizing and ensuring the safety of “new” KII facilities are included in T2. In Vimpelkom, MTS, Rostelecom, they refused to comment.
The interlocutor “Kommersant”, familiar with the discussion of the document, says that now the business “minimally” determines the KII, since he “does not have a desire to fall under additional responsibility and the requirement for domesticity software”. “The problem is that the concepts in the legislation are determined quite blurred and it is not always clear whether any system should be attributed to the CII,” adds Igor Alekseev, managing director for working with Positive Technologies.
The mincifers do not believe that communication operators may abuse the provisions of the resolution and not determine the part of their infrastructure as Kii, they told Kommersant in the ministry. At the same time, it is believed that the indicated assessment of the expenses of operators is designed for six years and for all existing operators and “each operator will have a not too significant amount”.
