Orders of the Federal Service for Technical and Export Control of Russia No. 235, 236, 239

12.10.2026

Ruslan Rakhmetov, Security Vision

The adoption of several legislative norms in 2017 on the protection of critical information infrastructure (hereinafter, CII), primarily Federal Law No. 187-FZ "On the Security of Critical Information Infrastructure of the Russian Federation" dated July 26, 2017, became a new stimulus and challenge for the Russian cybersecurity industry. Since then, cybersecurity of critical information infrastructure (hereinafter, CII) has become a key area, and regulatory changes continue to facilitate the continuous adaptation of protective measures and processes to current realities. A package of orders issued by the Federal Service for Technical and Export Control (FSTEC) of Russia (Nos. 235, 236, 239, and several others) defines regulatory requirements for the protection of critical information infrastructure (CII) and enables the development of a comprehensive security system consisting of process-based protection, personnel requirements, and organizational and technical measures. In this article, we discuss these orders and the planned amendments to them, as well as the application of the provisions described therein.

1. Order of the Federal Service for Technical and Export Control of Russia dated 21.12.2017 No. 235 "On approval of the Requirements for the creation of security systems for significant critical information infrastructure facilities of the Russian Federation and ensuring their functioning."

Order No. 235 describes requirements for personnel, technical and organizational security measures, and the implementation of information security processes when protecting the ZOKII. The requirements are grouped into four sections:

1) Personnel management is described in terms of requirements for the ZOKII security forces, which include units and employees who operate, maintain, and protect the ZOKII. The head of the critical information infrastructure entity (or their deputy) organizes and oversees the ZOKII security system, determines its composition and structure, defines the roles of participants, and appoints those responsible for ZOKII security. These responsible individuals develop internal documentation, conduct information security threat analysis and identify vulnerabilities in the ZOKII, implement organizational and technical measures, respond to computer incidents, assess the current level of protection and make proposals for its improvement, and ensure compliance with the requirements of Federal Law No. 187. Certain qualification requirements are imposed on these responsible individuals: the head of the structural unit responsible for security must have a relevant higher education in information security or have completed a professional retraining program in information security, and must have at least three years of experience in cybersecurity. Security specialists must have professional information security education or complete a continuing education program in information security. Both managers and regular specialists must complete continuing education programs in information security at least once every three years. It is stated that employees of critical information infrastructure entities must undergo information security training at least once a year. Of course, this is only the minimum frequency; training employees in cybersecurity fundamentals and various exercises should be conducted more frequently.

2) The requirements for technical measures to protect the information security system include a list of the types of information security systems that can be used to ensure cybersecurity:

means of protecting information from unauthorized access (including those built into system-wide, application software);
firewalls;
means of detecting (preventing) intrusions (computer attacks);
antivirus protection tools;
means (systems) for monitoring (analyzing) security;
security event management tools;
means of protecting data transmission channels.

It is specified that information security tools must be used that have undergone one of the following assessments: certification, testing, or acceptance. Furthermore, the use of certified information security tools is required in cases established by law—for example, if a critical information infrastructure (CII) falls under Order No. 117 of the Federal Service for Technical and Export Control of Russia (FSTEC of Russia) (requirements for information protection in state information systems, information systems of government agencies and institutions) or Order No. 21 of the Federal Service for Technical and Export Control of Russia (FSTEC of Russia) (requirements for personal data protection, which will soon be replaced by a new order). In other cases, it is permissible to use information security tools that have undergone testing or acceptance, conducted by critical information infrastructure entities either independently or with the involvement of FSTEC licensees. The order emphasizes that priority should be given to information security tools that are integrated into the software of critical information infrastructure (CII) facilities—this ensures seamless interaction and minimizes the negative impact of the security solution on the facility's operation. Particular attention is paid to technical support for the information security tools—if the developer is unable to provide it, the critical information infrastructure entity must take compensatory organizational and technical measures.

3) The requirements for organizational measures to protect the ZOKII include the need to develop a set of organizational and administrative documents (ORD) that define:

goals and objectives of the ZOKII cybersecurity activities;
information about cyber threats and intruders, threat model;
plans and measures taken for protection;
the composition and structure of the ZOKII security system, the procedure for implementing protective measures;
applied methods of assessing compliance with regulatory requirements, methods of testing and acceptance of information security tools;
the procedure for interaction between employees in ensuring the security of the ZOKII and in responding to cyber incidents;
the procedure for responding to cyber incidents, the procedure for interaction with the GosSOPKA system ;
the procedure for informing and training employees on information security issues, and rules for safe work at the ZOKII.

4) The requirements for building a process model of the ZOKII security include the implementation of the following processes in accordance with the Deming cycle (PDCA approach):

planning and development of cybersecurity measures, including the development of an annual action plan;
implementation of organizational and technical protective measures in accordance with the plan;
control of security and implemented measures, including control of their effectiveness, including the use of technical means of control (analysis) of security;
improving the established security system and incorporating the developed proposals for improvement into the annual action plan

2. Order of the FSTEC of Russia dated 25.12.2017 No. 239 "On approval of the Requirements for ensuring the security of the ZOKII of the Russian Federation".

Order No. 239 contains practical guidelines for the protection of ZOKII, which are divided into requirements for ensuring security within the life cycle of ZOKII, requirements for organizational and technical protective measures, and additional requirements for protective equipment.

1) Safety requirements apply to the creation, operation, and decommissioning stages of the ZOKII life cycle. The following actions should be implemented:

a) establish requirements for ensuring the security of the ZOKII;

b) develop organizational and technical measures to ensure the security of the ZOKII;

c) implement organizational and technical measures to ensure the security of the ZOKII and put the ZOKII into operation;

d) ensure the safety of the ZOKII during its operation;

d) ensure the safety of the ZOKII when it is decommissioned.

2) Requirements for organizational and technical protective measures are divided into the following groups (abbreviated designations of groups of measures are given in brackets):

a) identification and authentication of access subjects and access objects (IAF);

b) managing access of access subjects to access objects (AP);

c) software environment limitation (SEL);

d) protection of machine-readable information carriers (ZNI);

d) security audit (SEA);

f) anti-virus protection (AVD);

g) intrusion prevention (computer attacks) (ISP);

c) integrity assurance (OCL);

i) ensuring accessibility (OTD);

c) protection of technical means and systems (PMS);

l) protection of the information (automated) system and its components (ZIS);

m) planning of security measures (SMP);

n) configuration management (CM);

o) software update management (SUM);

p) response to information security incidents (ISI);

p) provision of actions in emergency situations (DNS);

c) information and training of personnel (IPT);

t) protection of important objects from attacks aimed at denial of service.

It is indicated that the order of selection of measures should be as follows:

Determination of a basic set of measures to ensure the security of critical information infrastructure facilities, taking into account the significance category of the critical information infrastructure facility, as defined by the provisions of Government Resolution No. 127 of February 8, 2018. The list of basic measures for each group of measures is selected in accordance with the Appendix to Order No. 239.
Adaptation of the basic set of measures to ensure the security of the ZOKII based on the developed threat model. If the basic set of measures fails to neutralize the current threats from the developed threat model, additional measures from the list can be added.
Supplementing the adapted set of measures with other measures to meet requirements for information security in GIS, for the protection of personal data, for cryptographic protection of information, etc.

3) Additional requirements for security tools, set forth in Order No. 239, require the selection of certified information security tools of a specific security class depending on the critical information infrastructure facility's significance. Security classes are linked to the trust levels of certified security solutions. As a reminder, Order No. 76 of the Federal Service for Technical and Export Control of Russia (FSTEC of Russia) dated June 2, 2020, defines six trust levels for information security tools, which characterize the security of their use for processing and protecting restricted information and for ensuring the security of restricted information systems. The lowest level is level 6, the highest is level 1, and security tools of levels 1, 2, and 3 are used to protect state secrets. Taking into account the correspondence between information security tools classes and trust levels, as specified in paragraph 5 of FSTEC of Russia Order No. 76, the following comparison can be made:

a) in significant objects of category 1, information security systems of at least protection class 4 (i.e. at least trust level 4) are used;

b) in significant objects of category 2, information security tools of at least protection class 5 (i.e. at least trust level 5) are used;

c) in significant objects of category 3, information security systems of protection class 6 (i.e. trust level 6) are used.

This section of Order No. 239 also specifies requirements for the secure development of application software for the ZOKII, including the provision of a secure software development guide and software structure description, threat analysis, static and dynamic analysis, and fuzz testing of the software. The developer is required to provide technical (warranty) support, release security updates, and adhere to the principles of responsible vulnerability disclosure. Furthermore, remote and local uncontrolled access to software in the ZOKII is prohibited, as is the uncontrolled transfer of information about the critical information infrastructure facility. Furthermore, information processing facilities included in ZOKII of significance categories 1 and 2 must be located within the Russian Federation.

3. Order of the Federal Service for Technical and Export Control of Russia dated 22.12.2017 No. 236 "On approval of the form for submitting information on the results of assigning one of the categories of significance to a critical information infrastructure facility or on the absence of the need to assign it one of such categories."

This order establishes the format for submitting to the Federal Service for Technical and Export Control (FSTEC) of Russia information regarding the results of assigning a critical information infrastructure facility to one of the significance categories, or regarding the absence of the need to assign it to one of these categories, in accordance with the categorization rules of RF Government Resolution No. 127 of February 8, 2018. The form completed by the critical information infrastructure facility must include the following information:

1. Information about the critical information infrastructure facility (name, purpose, type, architecture of the critical information infrastructure facility, address, area of activity of the critical information infrastructure subject, name of the corresponding typical industry critical information infrastructure facility, as well as the domain name and external IP address of the resource).

2. Information about the critical information infrastructure entity (name, address, TIN of the entity, position and full name of the head of the entity, contact information and full names of responsible information security specialists).

3. Information on the interaction of the critical information infrastructure facility and telecommunications networks (category of telecommunications network, purpose and method of interaction with it, name of the communications operator and hosting provider).

4. Information about the person operating the critical information infrastructure facility (name and TIN of the legal entity or full name of the individual entrepreneur, address and name of the component of the critical information infrastructure facility they operate).

5. Information on software and hardware used at the critical information infrastructure facility (name and quantity of software and hardware, name of general system and application software used by the information security system).

6. Information on information security threats and categories of intruders in relation to the critical information infrastructure facility (an extract from developed intruder and threat models).

7. Possible consequences in the event of computer incidents, implementation of information security threats and computer attacks.

8. The significance category assigned to the critical information infrastructure facility, or information on the absence of the need to assign one of the significance categories, as well as information on the results of the assessment of the significance criteria indicators.

9. Organizational and technical measures applied to ensure the security of the ZOKII.

Draft amendments to Orders No. 235 and No. 239 were published back in April 2026 ; however, as of October 2026, they have not yet entered into force. The main proposed changes are as follows:

1) Order No. 235 will require the calculation of the security indicator ( SI ) and the maturity level indicator ( MLI ) for the ZOKII. The assessment methods have already been developed: the security indicator ( SI ) is assessed using the methodological document "Methodology for Assessing the Indicator of the State of Technical Protection of Information in Information Systems and Ensuring the Security of the ZOKII of the Russian Federation" approved by the FSTEC of Russia on 11.11.2025, and the maturity level indicator ( MLI ) is calculated using the methodological document "Methodology for Assessing the Level of Maturity of Activities in the Field of Technical Protection of Information in Information Systems and Ensuring the Security of the ZOKII of the Russian Federation" approved by the FSTEC of Russia on 07.08.2026. It is assumed that the security indicator ( SI ) will be calculated at least once every 6 months, and the maturity level indicator ( MLI ) will be calculated at least once every 2 years. After calculating the indicators, they will need to be compared with the required standardized (target) values and the FSTEC of Russia will be notified of the results within 5 days. If the target indicators are not achieved within 3 days, the head of the critical information infrastructure entity will need to be informed so that additional measures can be taken.

2) Order No. 239 will introduce a number of new requirements regarding information security tools: when selecting security solutions, it will be necessary to evaluate potential restrictions on the use of the developer's software (licensing, legal) and the vendor's ability to provide technical support. If such restrictions exist, additional security measures must be implemented. Furthermore, with reference to Decree No. 250 of the President of the Russian Federation dated May 1, 2022, it states that the Federal Service for Technical and Export Control of Russia may formulate additional requirements to ensure the security of information security tools, taking into account the rapidly changing cyberthreat landscape .

FSTEC of Russia Orders No. 235, 236, and 239 define the requirements for data protection measures in the context of information security infrastructure (ICI), and one of these areas is the implementation of technical measures using information security tools. It is important to remember that when using certified security solutions in Category 1 critical facilities, information security tools of at least Trust Level 4 are used. The Security Vision ecosystem is certified by FSTEC of Russia at Trust Level 4, with Certificate of Conformity No. 4964 dated August 19, 2025, issued for 5 years, confirming the high level of protection for all products on our platform and the Security platform as a whole. Vision with Low-Code / No-Code Designers. Specifically, the following modules have been certified, helping to ensure the protection of critical information infrastructure facilities and comply with the requirements of FSTEC of Russia Orders No. 235, 236, and 239:

Security Orchestration , Automation and Response ( SOAR ) is a module designed to automate response to information security incidents;

Next Generation SOAR ( NG SOAR ) – advanced incident management module;

Asset Management ( AM / CMDB ) – asset and inventory management module;

Vulnerability Management ( VM ) – vulnerability management module;

Vulnerability Scanner ( VS ) – scanner vulnerabilities ;

Security Profile Compliance ( SPC ) – security parameters control module;

Security Information and Event Management ( SIEM ) – module monitoring events IB ;

GosSOPKA – module for interaction with the GosSOPKA regulator ;

Critical Information Infrastructure ( CII ) – a module for managing compliance with Federal Law No. 187;

Compliance Management ( CM ) – a module for managing compliance with regulatory and methodological documents (RMD);

Threat Intelligence Platform ( TIP ) – cybersecurity threat analysis module;

User and Entity Behavior Analysis ( UEBA ) – module behavioral analysis ;