In May, I have already written about the projects of two notable in its importance and incompetence of projects of regulatory acts, which oblige all subjects of KII to translate all its KII objects on domestic software and iron. And the other day on the portal regulations.gov.ru, the updated text of the Government Decision Project "On Approval of Software Requirements, Telecommunication Equipment and Radio Electronic Products, used at the objects of critical information infrastructure, and the procedure for the transition to the predominant use of Russian software, telecommunications Equipment and radio electronic products. " Previously, in November, the draft Decree Decree was laid out. Let's see what has changed there?
If the thezisno, the picture turns out as follows:
- The transition to predominantly domestic software should occur until January 1, 2023, and on the domestic iron until January 1, 2024. Initially, the deadlines were established simply wild - 1st of January 2020 and 2021, respectively. According to the finalization of NAP projects, the deadlines were shifted at the 2024th and 2025 years, but in the final project, the deadlines were established in the form of 2023 and 2024, respectively. In my opinion, all the options are unreal, but apparently it is the last option and will fall into the signed decree of the president, which is not long to wait, if the providence does not intervene.
- All objects of KIA are falling under the requirements, regardless of their category of significance and even ordinary pawnshop or rural clinic will have to go on mostly domestic software and iron. Community attempts and sufficiently serious lobbyists explain to the authors. The absurdity of this requirement was not crowned with success - Minzirk (or those who stand behind them) said that otherwise all the subjects of KII would underestimate their importance, and even bypass the party categorization. So we are preparing for the widespread introduction of domestic software and equipment.
- The name of the new PP project is now concerned not only by software or equipment as before. Instead of the term "equipment" began to apply "Telecommunication equipment and radio-electronic products". Although the requirements themselves did not change from this - they used to cover telecom-iron and rap.
- Requirements concern not only new software and iron, but also already installed at KII facilities.
- Until July 1, 2021, it is necessary to approve the transition plan for mainly domestic software and iron. And before approving the plan, it is necessary to conduct an audit of used IT assets, to conduct their analysis and the fact of the presence in the registers of the domestic total and everything, after which, in the event of a charter in registers, to send a list of such and iron to approval in the Ministry of Medizifra (for software) and Ministry of Potorg (for iron). All about everything remained 5 with a little (!) Months. How to spend at least an audit available, I can not imagine.
- An interesting point to which you should pay attention and which I have already written somehow (here and here). It does not matter, in Russia is developed by or not. The main thing is that it was in the registry. And, for example, the protection means fall into the registry only after receiving the certificate of FSTEC or FSB, which leads to interesting conflicts that few people say. For example, I released some domestic vendor ITU or antivirus or a cryptographic gateway, and it cannot sell in KIA, since the product or its specific version is not included in the registry due to lack (it is clear that the temporary) regulator certificate. Paradox, but this is how it works. I know Case when the famous vendor refused to include in the Register of the Ministry of Internal Affairs precisely because of the lack of a certificate (although the previous version of the software in this registry was).
- And what about foreign software and iron? Is it really necessary to use it? No, everything is not so sad. There are clarifications of the Ministry of Fields, which say that it is possible to continue to use the inclusive in registers of software and equipment, but subject to the relevant justification that many have already learned to write more than five years ago, when importing the policy of imports in government agencies began. Now this practice will go to commercial enterprises.
Here is a picture of us now with import substitution in KII. There is a suspicion that the projects mentioned in the notice of the government decree and the decree of the president will no longer change and it is in this form that will be adopted in the near future. It is not necessary to conduct through deputies - it will not take much time. So we are preparing for a new reality. And if last year it was a remote job, then this is the ability to make an rationale to explain to the regulator why everything remains as it was before.
Source - Blog Alexei Lukatsky "Business without danger."
More interesting material on cisoclub.ru. Subscribe to us: Facebook | Vk | Twitter | Instagram | Telegram | Zen | Messenger | Icq new | YouTube | Pulse.