RussiaFederal Law 187-FZ on the Security of Critical Information Infrastructure: Computer Incident Reporting
Law 187-FZ art. 9(2) and (3) (Federal Law of on the Security of Critical Information Infrastructure; О безопасности критической информационной инфраструктуры Российской Федерации)
In force since .
A vulnerability and incident reporting rule binding public and private bodies.
- Instrument type
- an act of a legislature
- Obligation class
- Reporting
As of .
What it requires
- This binds a subject of critical information infrastructure: a state body, a state institution or a Russian legal entity that owns, leases or otherwise lawfully holds an information system, telecommunications network or automated control system operating in healthcare, science, transport, communications, energy, state registration of rights to real estate, banking and other financial-market spheres, the fuel and energy complex, atomic energy, defense, rocket and space, mining, metallurgical or chemical industry, or a Russian legal entity that ensures interaction between such systems (Article 2(8)). You reach it by declaring that you operate an essential service, provide financial services, handle health records or provide telecom services.
- Inform the authorized federal executive authority immediately of computer attacks and computer incidents, in the order it sets; if you operate in the banking sphere or another financial-market sphere, inform the Central Bank of the Russian Federation as well, in an order the authority sets in agreement with the Central Bank (Article 9(2)(1)).
- Assist the officials of that authority in detecting, preventing and eliminating the consequences of computer attacks and in establishing the causes and conditions of computer incidents (Article 9(2)(2)).
- If you hold a significant object, respond to computer incidents in the order the authorized federal executive authority approves and take measures to eliminate the consequences of attacks on significant objects (Article 9(3)(3)).
These lines are LexLint's reading of the law's text, as of .
If you get it wrong
Private right of actionNo
Criminal exposure note
Article 14 provides that a violation of the Law and of the acts adopted under it entails liability under Russian legislation, and the Law states no offense or penalty amount of its own.
Who enforces it
Enforcement body
The federal executive authority authorized for the state system for detecting, preventing and eliminating the consequences of computer attacks, which receives the reports and sets the reporting order, and the Central Bank of the Russian Federation for subjects in the banking sphere and other financial-market spheres (Article 9(2)(1)).
Settledness
- As of
- Open questions
- Which order of the authorized federal executive authority now governs the content and timing of the computer-incident report that Article 9(2)(1) requires, and what hour limits does it set?
What this law does
Article 9(2)(1) requires a subject of critical information infrastructure to inform without delay the federal executive authority authorized for the state system for detecting, preventing and eliminating the consequences of computer attacks, in the order that authority sets, of computer attacks and computer incidents, and where the subject operates in the banking sphere or another financial-market sphere to inform the Central Bank of the Russian Federation as well.
Article 9(2)(2) requires subjects to assist that authority's officials in detecting, preventing and eliminating the consequences of computer attacks and in establishing the causes of computer incidents. Article 9(3)(3) requires the holder of a significant object to respond to computer incidents in the order approved by that authority and to take measures to eliminate the consequences of attacks on significant objects.
Article 9(3)(7) requires the holder of a significant object to interact continuously with the state system for detecting and eliminating the consequences of computer attacks.
When LexLint raises it
When your app profile says your app runs an essential service, provides financial services, handles health records or provides telecom services.