Russia's Federal Service for Technical and Export Control (FSTEC) published a set of non-mandatory recommendations titled "Recommendations on Protecting the Network Perimeter of Information (Automated) Systems" on 10 March 2026. The document analyzes successful external intrusions and provides a 35-point checklist for hardening network boundaries.
The guidance appears in the section for improving information infrastructure security and does not carry the legal weight of normative acts or the methodological documents made compulsory by paragraph 68 of Order No. 117. No deadlines or penalties are attached, yet the text is expected to influence post-incident reviews because it reflects attack paths regulators have observed in real cases.
The checklist is organized into eight sections: administration of perimeter devices (10 points), DDoS resilience (5 points), segmentation (5 points), configuration backup (6 points), vulnerability management (2 points), authentication and access (3 points), event logging (3 points), and incident response exercises (1 point). Four items require new purchases—WAF in attack-prevention mode, ZTNA, NAC, and SIEM—while five others depend on capabilities already present in the environment.
Twenty-six remaining points can be satisfied without additional spending. These include using separate air-gapped administrative workstations where possible, enforcing 15-character passwords with complexity rules on network devices when certificate authentication is unavailable, maintaining unique credentials per device, disabling HTTP and SNMP v1/v2 in favor of HTTPS and SNMP v3, documenting all perimeter assets, and performing quarterly restoration tests of configuration backups.
The document explicitly prohibits publishing management interfaces (SSH, RDP, VNC) on the perimeter or in the DMZ, administering core devices from user or external segments, and relying on legacy monitoring protocols. It also stresses compensating controls for end-of-support equipment that cannot be patched or decommissioned.
Sections on vulnerability management refer readers to four earlier FSTEC documents: the 25 November 2025 Protectedness Analysis Methodology, the 17 May 2023 Vulnerability Management Guide, the 28 October 2022 Update Testing Methodology, and the 30 June 2025 Criticality Assessment Methodology.
