187-FZ "On the Security of Critical Information Infrastructure"

What is 187-FZ "On the Security of Critical Information Infrastructure"

Federal Law No. 187-FZ "On the Security of Critical Information Infrastructure of the Russian Federation" was adopted on July 26, 2017 and establishes mandatory requirements for the protection of CII facilities — information systems, automated control systems and communication networks that are critical for government administration, defense, economy and life support of the population. The law applies to organizations in healthcare, transport, communications, energy, finance, science, defense and nuclear industries, as well as other sectors that ensure the vital activity of the state. Compliance with the requirements is controlled by the FSTEC of Russia (Federal Service for Technical and Export Control), and administrative fines (up to 1 million rubles for organizations) and criminal liability (under Article 274.1 of the Criminal Code of the Russian Federation — up to 8 years of imprisonment) are provided for violations. Violation of the law entails not only financial losses but also a threat to national security, so compliance with 187-FZ is critically important for all CII entities. To protect CII facilities, it is necessary to implement comprehensive security systems, including SIEM systems and DLP solutions for monitoring and incident prevention, as well as the use of certified information protection tools.

Categorization of CII facilities

The law divides critical information infrastructure facilities into three categories of significance depending on the potential damage in case of a security breach. The first category — facilities whose security breach could lead to an emergency of federal scale, significant damage to the economy, defense or state security. The second category — facilities whose accident creates a threat on a regional scale and could disrupt the life support of the population or the transport infrastructure of a constituent entity of the Russian Federation. The third category — facilities whose incidents could cause damage on the scale of a municipality or an individual organization. Particularly significant facilities — a separate category for facilities of special importance for defense, security and public order. Categorization is carried out according to departmental methodologies that take into account the social, political and economic consequences of possible incidents. The results of categorization are sent to the FSTEC of Russia within 10 working days from the moment the categorization act is approved. Different requirements for the level of protection and the frequency of inspections are established for facilities of different categories.

Obligations of CII entities

CII entities (organizations that own CII facilities) are obliged to fulfill the following requirements established by the law and by-laws. Create a security system for facilities — develop and implement organizational and technical protection measures, including security policies, regulations, instructions, and appoint responsible persons. Conduct categorization — determine the category of significance of each CII facility within the established period (for new facilities — within 1 year from the moment of commissioning) and send the information to the FSTEC. Use certified CIPF tools — apply cryptographic protection tools certified by the FSB of Russia to protect information during transmission and storage. Provide technical protection measures — protection against unauthorized access (UAA), antivirus protection, data integrity control, encryption of communication channels, backup, and security event monitoring. Report incidents — promptly notify the FSTEC of Russia about computer incidents at CII facilities and interact with the State System for Detecting, Preventing and Eliminating the Consequences of Computer Attacks (GosSOPKA). Conduct certification — confirm the compliance of the protection system with security requirements by conducting certification tests. Since 2025, a ban on the use of foreign software at CII facilities has been introduced (except for cases where there are no domestic analogues).

Liability for violation of 187-FZ

Administrative and criminal liability is provided for non-compliance with the requirements of the law. Administrative fines — for officials up to 500,000 rubles, for organizations up to 1,000,000 rubles (under Article 13.14 of the Code of Administrative Offenses of the Russian Federation for violating information protection requirements). Fines are also provided for failure to comply with FSTEC orders, failure to provide information or providing inaccurate information. Criminal liability — Article 274.1 of the Criminal Code of the Russian Federation "Unlawful influence on the critical information infrastructure of the Russian Federation" provides for punishment of up to 8 years of imprisonment for the creation, distribution or use of malicious programs aimed at CII facilities. Disqualification — for officials, disqualification for up to 3 years is provided for repeated violation. Suspension of activity — the court may decide to suspend the organization's activity until violations are eliminated. To minimize risks, it is recommended to conduct a regular audit of security systems, promptly update protection tools and undergo certification of CII facilities within the established timeframes.