Overview of requirements and measures to ensure the security of critical information infrastructure facilities.

Yuri Podgorbunsky, Security Vision

Conducting cyberattacks on systems and networks of critical information infrastructure (hereinafter referred to as CII) can paralyze the operation of key sectors of the economy, thereby causing significant damage to the state, society, or citizens..

The FSTEC of Russia pays special attention to ensuring the security of CII facilities, and failure to comply with information security requirements may result in penalties, including criminal liability.

Thus, ensuring the security of CII is a crucial task aimed at preserving the confidentiality, integrity, and availability of information, ensuring the continuity of operation of critical CII facilities, and minimizing the consequences of possible computer incidents.

The urgency of ensuring the security of CII is due to the need to increase the resilience of systems to modern cyber threats and the formation of effective mechanisms for preventing, detecting and neutralizing computer incidents.

What regulates the safety of significant CII facilities?

Ensuring the safety of significant CII facilities is regulated by the following basic regulatory legal acts:

• Federal Law No. 187-FZ dated July 26, 2017 "On the Security of the Critical Information Infrastructure of the Russian Federation" (hereinafter referred to as the Federal Law).

• Decree of the Government of the Russian Federation No. 127 dated 08.02.2018 "On Approval of the Rules for Categorizing Objects of the Critical Information Infrastructure of the Russian Federation, as well as the List of Indicators of Criteria for the Significance of Objects of the Critical Information Infrastructure of the Russian Federation and their Values" (hereinafter referred to as Resolution No. 127).

• Order of the FSTEC of Russia dated 21.12.2017 No. 235 "On Approval of Requirements for the creation of Security Systems significant Objects of the Critical Information Infrastructure of the Russian Federation and Ensuring their Functioning" (hereinafter referred to as Order No. 235).

• By Order of the FSTEC of Russia dated December 25, 2017 No. 239 On Approval of Requirements for Ensuring the Security of Significant Objects of the Critical Information Infrastructure of the Russian Federation (hereinafter referred to as Order No. 239).

What exactly is CII?

In general, CII are CII facilities, as well as telecommunication networks (networks of telecom operators) used for the interaction of such facilities.

And the CII objects themselves are the following systems and networks:

• Information systems (hereinafter referred to as IS).

• automated control systems (hereinafter referred to as ACS).

• Information and telecommunication networks (hereinafter referred to as ITCS).

But by themselves, the above–mentioned systems and networks will not become objects of CII, for this there is another component - a certain field of activity (the list of areas is given below) in which the organization operates.

The Federal law defines the subjects of the CII: state organizations and enterprises, as well as legal entities operating in the fields of:

• healthcare;

• sciences;

• transport;

• connections;

• energy companies;

• state registration of rights to real estate and transactions involving it;

• the banking sector and other areas of the financial market;

• the fuel and energy complex;

• nuclear energy;

• defense;

• rocket and space;

• mining;

• metallurgical;

• chemical.

If an organization falls within any of the aforementioned areas of activity and has an IS, an ASU, or an ITCS, then the organization is considered a subject of the CII.

Principles and requirements of the Federal Law

The Federal law defines the following principles for ensuring the safety of CII:

• legality (as a rule, this is provided by default).

• continuity of CII security (continuity involves the implementation of cybersecurity processes and their continuous improvement).

And the priority is allocated:

• prevention of computer attacks.

Thus, the main requirements of the Federal Law are:

• conducting the categorization of critical infrastructure objects; this is a procedure in which a critical infrastructure object is assigned one of the significance categories, or there is no need to assign a category (the categorization procedure will be discussed below);

• reporting computer attacks and computer incidents to the National Coordinating Center for Computer Incidents (hereinafter referred to as the NCCCI);

• responding to computer incidents and taking measures to eliminate the consequences of computer attacks carried out against critical infrastructure objects.

• the use of trusted software and hardware at significant CII facilities.

• compliance with the requirements for ensuring the safety of significant CII facilities, established by orders of the FSTEC of Russia No. 235 and No. 239, etc.

• and also, the implementation of continuous interaction with the infrastructure of the State Security Service in accordance with the procedure established by the FSB of Russia.

Responding to computer incidents is not an easy task, especially in manual mode; in this regard, automation tools come to the rescue, such as:

• the Security Vision SIEM security event management system;

• the Security Vision SOAR incident response orchestration system.

The requirements of Resolution No. 127

Federal law requires the categorization of CII facilities, which must be carried out in accordance with Resolution No. 127.

The CII objects are categorized by the CII subject (organization), which owns the CII objects (IP, automated control system, ITCS) by right of ownership or lease.

CII objects corresponding to the types of IC, automated control systems, and ITCS included in the lists of typical CII industry objects are subject to categorization.

The lists of typical CII industry facilities were created to systematize the types of CII facilities and are grouped by field of activity (hereinafter referred to as the lists of typical CII facilities).

The categorization includes the following:

• identification of ICS, automated control systems, and ITCS corresponding to the standard CII facilities included in the lists of standard CII facilities;

• assessment in accordance with the list of indicators of criteria for the significance of the scale of possible consequences in the event of computer incidents at CII facilities;

• assigning one of the significance categories to each of the CII objects or deciding that there is no need to assign one of the significance categories to them.

There are three categories of significance that can be assigned to critical infrastructure objects:

• first (the highest, and accordingly, more security requirements and measures are applied);

• second;

• third (the lowest, fewer requirements and measures — the basic level of security).

The CII objects are categorized by the permanent categorization commission (hereinafter referred to as the categorization Commission).

The CII objects can be categorized manually or using the Security Vision CII automation tool.

The results of categorization are formalized by an act, which must contain information about the CUE object, as well as information about assigning a certain category of significance to the CUE object or about the absence of the need to assign it one of such categories.

The act is signed by the members of the categorization commission and approved by the head of the organization or a person authorized by him.

Information about the critical information infrastructure facility, in the prescribed form, is sent to the FSTEC of Russia within 10 days from the date of approval of the act.

It is worth adding here that in the current year, 2026, not just categorization, but sector‑specific categorization based on the industry (field of activity) of the organization, must be carried out. In my opinion, it becomes easier, because each industry has its own specifics, based on which, based on Resolution No. 127, a different categorization approach is being developed for each industry, it immediately becomes clear which indicators of significance criteria need to be evaluated and which calculation formulas should be used, and what is not applicable for the industry!

A significant CII object is an object that has been assigned one of the categories of significance, and accordingly, safety requirements are imposed on significant CII objects. For objects that, based on the categorization results, have not been assigned a significance category, security remains the responsibility of the critical infrastructure owner – the organization!

Requirements of Order No. 235

Order No. 235 requires CII entities to create security systems for significant CII facilities, the purpose of which is to ensure the sustainable functioning of significant CII facilities when computer attacks are carried out against them.

Security systems include the security forces of significant CII facilities and the information security tools they use. As well as the implementation of processes and the development of organizational and administrative documentation (hereinafter referred to as the Order).

The security forces of significant CII facilities include:

• departments (employees) responsible for ensuring the safety of significant CII facilities;

• divisions (employees) operating significant CII facilities;

• divisions (employees) that ensure the functioning (maintenance, maintenance, repair) of significant CII facilities;

• and, if necessary, other departments (employees) involved in ensuring the safety of significant CII facilities.

The means of ensuring the security of significant CII facilities include software and hardware used to ensure the security of significant CII facilities.

As part of the functioning of the security system, the organization implements the following processes:

• planning and development of measures to ensure the safety of significant CII facilities;

• implementation of measures to ensure the safety of significant CII facilities;

• monitoring the security status of significant CII facilities;

• Improving the safety of significant CII facilities.

Based on the aforementioned processes, we effectively obtain a Deming cycle – continuous improvement, in this case, of the processes.

And in order for the forces to understand what to do in a given situation, it is necessary to develop an ORD that regulates the rules, processes, and procedures for the security of critical information infrastructure facilities.

Requirements of Order No. 239

Order No. 239 requires the subjects of the CII to implement the requirements for ensuring the safety of significant CII facilities, as well as the introduction of organizational and technical measures to ensure the safety of significant CII facilities.

The requirements of Order No. 239 include:

• the development of a technical specification for the creation of a security system for a significant facility or CII facilities;

• analysis (assessment) of information security threats;

• security system design;

• development of working (operational) documentation;

• secure software development (hereinafter referred to as Software);

• software security support;

• implementation of organizational and technical measures to ensure the security of a critical infrastructure facility;

• analysis of vulnerabilities in software and hardware‑software systems, as well as information protection tools;

• testing of a critical infrastructure facility and its security system.

The assessment of information security threats should be carried out in accordance with the methodological document of the FSTEC of Russia "Methodology for Assessing Information Security Threats" dated February 5, 2021. Information security threats can be assessed (modeled) manually or using the Security Vision automation tool.

The design of the security system of a significant CII facility should be carried out in accordance with the terms of reference for the security system of a significant facility, taking into account the information security threat model and the category of significance of the significant facility.

When conducting vulnerability analysis, the Security Vision VS vulnerability scanner is essential.

The conduct of tests — preliminary and then acceptance tests — in accordance with the test program and methodology can be organized either in‑house or with the involvement of a third party that holds the appropriate license to carry out such types of work.

As well as the implementation of the following measures:

• planning measures to ensure the security of a significant object;

• managing (administering) the security system of a significant object;

• managing the configuration of a significant object and its security system;

• responding to computer incidents;

• ensuring actions in emergency situations;

• informing and training the personnel of a significant object;

• monitoring the security of a significant object.

Planning measures to ensure the security of a significant facility should be carried out as part of a planning process implemented in accordance with the requirements for creating security systems for significant facilities.

To respond to computer incidents, employees responsible for detecting and responding to computer incidents are identified, and their functions are defined. Responding to computer incidents must be carried out in accordance with the Computer Incident Response Plan, which must be developed and communicated to the persons who will be directly involved in the response; this is very important — each participant must know what actions need to be taken and inform the NCCI.

In critical infrastructure facilities, depending on their significance category and the threats to information security, the following measures must be implemented:

• identification and authentication of access subjects and access objects;

• access control for access subjects to access objects;

• restriction of the software environment;

• protection of computer data carriers;

• security audit;

• antivirus protection;

• intrusion prevention (computer attacks);

• integrity assurance;

• availability assurance;

• protection of technical means and systems.

• protection of the information (automated) system and its components;

• planning of security measures;

• configuration management;

• software update management;

• response to information security incidents;

• provision of actions in emergency situations;

• staff awareness and training;

• protection of critical assets from denial‑of‑service attacks.

If the significance category is the first one, the maximum number of protection measures will be applied, and each category accordingly has its own basic set of information protection measures.

The basic set of measures to ensure the security of a critical information infrastructure object must be adapted in accordance with the current information security threats (which are identified during the threat modeling process), as well as the technologies used, with the exception of measures that are not applicable to the critical information infrastructure object.

If necessary, the adapted set of measures to ensure the security of a critical information infrastructure object may be supplemented to meet the requirements established by other regulatory legal acts in the field of ensuring the security of critical information infrastructure and information protection.

The assessment of compliance with the requirements of Orders 235 and 239 can be carried out manually or using Security Vision KII automation tools.

And in conclusion

Practice shows that the security of critical infrastructure facilities is an ongoing process that requires continuous improvement. Changes in technology, the emergence of new methods for carrying out cyberattacks, and the development of digital infrastructure require regular review of approaches to ensuring security.

Thus, the security of significant critical infrastructure facilities is a complex system that combines regulatory requirements, organizational processes, and technical solutions. Only the comprehensive application of all these elements makes it possible to ensure the stable operation of critical systems and reduce the risks of serious consequences from cyberattacks.