RussiaFederal Law 187-FZ on the Security of Critical Information Infrastructure: Obligations of Subjects
Law 187-FZ arts. 2, 7, 9, 10 and 14 (Federal Law of on the Security of Critical Information Infrastructure; О безопасности критической информационной инфраструктуры Российской Федерации)
In force since .
A sector security regimes rule binding public and private bodies.
- Instrument type
- an act of a legislature
- Obligation class
- Security, Governance
As of .
What it requires
- This binds a subject of critical information infrastructure: a state body, a state institution or a Russian legal entity that owns, leases or otherwise lawfully holds an information system, telecommunications network or automated control system operating in healthcare, science, transport, communications, energy, state registration of rights to real estate, banking and other financial-market spheres, the fuel and energy complex, atomic energy, defense, rocket and space, mining, metallurgical or chemical industry, or a Russian legal entity that ensures interaction between such systems (Article 2(8)). You reach it by declaring that you operate an essential service, provide financial services, handle health records or provide telecom services.
- Assign one of the three significance categories to each critical information infrastructure object you hold, under the significance criteria and the categorization procedure the law sets (Article 7(4)).
- For each significant object, create a security system and keep it operating, in line with the requirements the authorized federal executive authority approves (Article 10(1)).
- Observe the security requirements that the authorized federal executive authority sets for significant objects, and carry out its officials' orders to remedy violations of those requirements (Article 9(3)(1) and (2)).
- Give the officials of that authority unhindered access to your significant objects when they exercise their state-control powers (Article 9(3)(4)).
- Interact continuously with the state system for detecting, preventing and eliminating the consequences of computer attacks, in the order the authorized federal executive authority sets (Article 9(3)(7)).
These lines are LexLint's reading of the law's text, as of .
If you get it wrong
Private right of actionNo
Criminal exposure note
Article 14 provides that a violation of the Law and of the acts adopted under it entails liability under Russian legislation, and the Law states no offense or penalty amount of its own.
Who enforces it
Enforcement body
The federal executive authority authorized in the field of ensuring the security of critical information infrastructure, whose officials issue orders, binding on the holder of a significant object, to remedy violations of the security requirements (Article 9(3)(2)).
Settledness
- As of
- Open questions
- Which administrative-offense and criminal provisions apply to a violation of the security requirements for significant objects, since Article 14 refers liability to the general legislation?
What this law does
Article 2(8) defines a subject of critical information infrastructure as a state body, state institution or Russian legal entity that holds an information system, telecommunications network or automated control system operating in healthcare, science, transport, communications, energy, banking and other financial-market spheres, defense and other listed sectors, or a Russian legal entity that ensures interaction between such systems.
Article 7(4) requires subjects to assign one of three significance categories to the critical information infrastructure objects they hold. Article 9(3) additionally requires the holder of a significant object to observe the security requirements set by the federal executive authority for the security of critical information infrastructure, and to carry out that authority's orders to remedy violations.
Article 9(3) also requires that holder to give the authority's officials unhindered access to significant objects. Article 10(1) requires the subject to create a security system for each significant object and to keep it operating. Article 14 provides that a violation of the Law entails liability under Russian legislation. Article 15 sets the Law in force on .
When LexLint raises it
When your app profile says your app runs an essential service, provides financial services, handles health records or provides telecom services.