Russian State Operators Must Report Cyber Incidents to FSB Within 24 Hours From September 2026
Starting 1 September 2026, operators of state information systems in Russia will be required to notify the National Coordination Center for Computer Incidents within 24 hours of detecting a cyber incident. The mandate is set out in FSB Order 297 and applies to operators of GIS, information systems of state bodies, state unitary enterprises and state institutions. The order places particular emphasis on incidents involving unauthorized data transfers. Organizations will interact with GosSOPKA through the technical infrastructure of NKTsKI, which will issue an incident identifier upon receipt of the report. The new rules formalize what was previously considered good practice and stem directly from Law 568-FZ adopted in December 2025. The requirement removes any possibility of delaying notification to the FSB.
AntiMalwareAug 24, 2026Translated from Russian