Compliance has become a core component of vulnerability management rather than a separate bureaucratic task. Russian organizations now face real financial and criminal consequences for failing to meet regulatory requirements on vulnerability handling and system configuration.
Over the past years regulators have significantly raised the stakes. FSTEC Order 117, effective from 1 March 2026, makes vulnerability management mandatory for state systems with strict deadlines: 24 hours for critical vulnerabilities and 7 days for high-severity issues. Turnover fines for personal-data leaks introduced in May 2025 range from 3 to 15 million rubles for the first incident and up to 1–3 % of annual revenue for repeat violations. Presidential Decree No. 250 assigns personal responsibility to deputy heads of organizations for information security and bans the use of protective equipment from unfriendly countries starting 1 January 2025.
Three main approaches to building compliance exist. The first is to rely on historical practices only, which is now considered high-risk. The second follows regulator requirements from FSTEC and the Central Bank of Russia, creating internal standards and checking systems against them. The third uses international benchmarks such as CIS Benchmarks, although full compliance across thousands of hosts is practically impossible and organizations realistically achieve around 70 % coverage.
The recommended path is to develop an organization-specific standard that reflects its threat model. CISO and compliance specialists jointly define requirements, document change procedures, run continuous checks, and agree on SLAs for remediation. Automated tools such as MaxPatrol HCC, RedCheck, ScanOVAL, and modules in R-Vision and Security Vision perform configuration scanning and generate reports.
A more mature approach shifts compliance left by embedding controls into golden images built with Packer, Ansible or similar tools. These pre-hardened images are then deployed through CI/CD pipelines, reducing configuration drift. Regular scanning remains necessary because systems still deviate over time.
The article concludes with a practical warning: even a fully patched firewall offers no protection if it retains the password admin:admin. Configuration errors such as weak credentials and exposed management interfaces constitute exploitable vulnerabilities and must be treated as part of the vulnerability management process alongside CVE remediation.
