Order 117

FSTEC Publishes 35-Point Network Perimeter Recommendations, Most Require No Spending

Russia's FSTEC released non-binding recommendations on protecting network perimeters on March 10, 2026, analyzing real-world intrusion vectors from external networks. The 35-point checklist spans eight sections covering device administration, DDoS resilience, segmentation, configuration backups, vulnerability management, authentication, logging, and incident response exercises. Only four items explicitly require purchasing new tools such as WAF, ZTNA, NAC, and SIEM, while five others depend on existing infrastructure. Twenty-six points can be addressed through policy, inventory, and configuration changes alone, including enforcing unique passwords, disabling legacy protocols like HTTP and SNMP v1/v2, and quarterly backup restoration tests. The document references Order 117 and earlier FSTEC methodologies on vulnerability handling, serving as a practical self-assessment questionnaire rather than a mandatory regulation. Analysts note that many organizations still fail to implement low-cost measures such as excluding remote administration interfaces from DMZ zones and verifying backup recoverability.

Astra Cloud Launches Attested Secure Cloud to Accelerate FSTEC Compliance for Russian Government Systems

Astra Cloud, part of the Astra Group, has introduced a new "Protected Attested Cloud" service designed for hosting state information systems, personal data systems, medical platforms, and other sensitive environments. The infrastructure has received official attestation under FSTEC Russia Order No. 117 for protection class K1 and Order No. 21 for protection level UZ-1. Customers can leverage the pre-certified platform to speed up their own system attestation procedures by three to five times, although each organization's information system must still undergo separate certification. The service includes certified security tools such as firewalls, antivirus solutions, intrusion detection and prevention systems, trusted boot mechanisms, and SIEM, with all connections required through certified cryptographic channels. The cloud is hosted in a Tier IV data center built on domestic hardware and targets organizations that must meet FSTEC requirements without building their own protected infrastructure. From March 2026, Order No. 117 replaces Order No. 17 and extends obligations to subordinate institutions and companies interacting with the state segment, including 24-hour remediation of critical vulnerabilities.

NIST Bans Periodic Password Rotation While Russia's FSTEC Mandates 90-Day Changes for Government Systems

In July 2025, NIST released the final version of SP 800-63B, explicitly prohibiting periodic password changes with the requirement that verifiers and CSPs shall not require subscribers to change passwords periodically. Eight months later, in April 2026, FSTEC approved a methodological document requiring passwords in state information systems and critical information infrastructure to be changed at least every 90 days, with mobile devices limited to 30 days and no reuse of the last 12 passwords. The requirements originate from Order No. 117, which itself contains no mention of passwords, but delegates details to lower-level methodological documents including the April 2026 guide that defines measure IAF.3. Compliance is enforced through the KZI protected indicator calculation submitted to FSTEC twice a year, with penalties including zeroing of the 0.25 weight group for repeated failures and immediate zeroing during penetration testing. The policy applies to government bodies, state unitary enterprises, institutions, and CII subjects, while commercial organizations outside this scope retain flexibility to set their own policies based on threat models. NIST and FSTEC requirements align closely on minimum length, failed attempt limits, MFA for privileged accounts, and prohibition of default passwords, differing primarily on the rotation mandate.