NKTsKI

FSTEC Order 60 Expands Attestation Rules to Municipal Systems, Defense Industry and Personal Data Operators

Russia's FSTEC Order No. 60, effective 1 September 2026, rewrites the list of entities subject to information system attestation under the updated Order No. 77. The changes reach far beyond state information systems to cover municipal information systems, industrial control systems at defense enterprises, protected premises for confidential talks, and any commercial personal data operators that voluntarily included attestation in their policies. New clauses introduce mandatory vulnerability analysis and penetration testing as explicit control methods, tighten reporting deadlines to five working days, and require FSTEC-licensed organizations with specific rights for testing. Parallel FSB Order No. 297 obliges every state institution, including schools and hospitals, to report incidents to NKTSKI within 24 hours via a personal cabinet established only after a formal interaction regulation is signed. Government Decree No. 1024 permits cloud services for state systems but keeps full compliance responsibility with the user organization. The combined rules take effect on 1 September 2026, with one provision delayed until March 2027.

Russian State Operators Must Report Cyber Incidents to FSB Within 24 Hours From September 2026

Starting 1 September 2026, operators of state information systems in Russia will be required to notify the National Coordination Center for Computer Incidents within 24 hours of detecting a cyber incident. The mandate is set out in FSB Order 297 and applies to operators of GIS, information systems of state bodies, state unitary enterprises and state institutions. The order places particular emphasis on incidents involving unauthorized data transfers. Organizations will interact with GosSOPKA through the technical infrastructure of NKTsKI, which will issue an incident identifier upon receipt of the report. The new rules formalize what was previously considered good practice and stem directly from Law 568-FZ adopted in December 2025. The requirement removes any possibility of delaying notification to the FSB.