ORDER OF THE GOVERNMENT OF THE RUSSIAN FEDERATION

of February 8, 2018 No. 127

About approval of Rules of categorization of objects of critical information infrastructure of the Russian Federation, and also the list of indicators of criteria of the importance of objects of critical information infrastructure of the Russian Federation and their values

According to Item 1 of part 2 of article 6 of the Federal law "About Safety of Critical Information Infrastructure of the Russian Federation" Government of the Russian Federation decides:

1. Approve enclosed:

Rules of categorization of objects of critical information infrastructure of the Russian Federation;

list of indicators of criteria of the importance of objects of critical information infrastructure of the Russian Federation and their values.

2. Financing of the expenses connected with implementation of this resolution by state bodies and public institutions is performed for the account and within the budgetary appropriations provided by the relevant budget on ensuring activities of subjects of critical information infrastructure.

Approved by the Order of the Government of the Russian Federation of February 8, 2018 No. 127

Rules of categorization of objects of critical information infrastructure of the Russian Federation

1. These rules establish procedure and terms of categorization of objects of critical information infrastructure of the Russian Federation (further respectively - critical information infrastructure, categorization).

2. Categorization is performed by subjects of critical information infrastructure concerning belonging to them on the property right, leases or other legal cause of objects of critical information infrastructure.

3. Objects of critical information infrastructure which provide management, engineering, production, financial and economic and (or) other processes within accomplishment of functions (powers) or implementation of types of activity of subjects of critical information infrastructure in areas (spheres), stipulated in Item the 8th article 2 of the Federal law "About Safety of Critical Information Infrastructure of the Russian Federation" are subject to categorization.

4. Determination of categories of the importance of objects of critical information infrastructure (further - category of the importance) is performed based on the indicators of criteria of the importance of objects of critical information infrastructure and their values provided by the list of indicators of criteria of the importance of objects of critical information infrastructure of the Russian Federation and their values approved by the order of the Government of the Russian Federation of February 8, 2018 No. 127 "About approval of Rules of categorization of objects of critical information infrastructure of the Russian Federation, and also the list of indicators of criteria of the importance of objects of critical information infrastructure of the Russian Federation and their values" (further respectively - the list of indicators of criteria of the importance, indicators of criteria of the importance).

5. Categorization includes:

a) determination of the processes specified in Item 3 of these rules within accomplishment of functions (powers) or implementation of types of activity of the subject of critical information infrastructure;

b) identification of management, engineering, production, financial and economic and (or) other processes within accomplishment of functions (powers) or implementation of types of activity of subjects of critical information infrastructure, violation and (or) the termination of which can lead to negative social, political, economic, ecological effects, effects for ensuring defense of the country, safety of the state and law and order (further - critical processes);

c) object definition of critical information infrastructure which process information necessary for ensuring critical processes and (or) exercise control, control or monitoring of critical processes;

d) forming of the list of the objects of critical information infrastructure which are subject to categorization (further - the list of objects);

e) assessment according to the list of indicators of criteria of the importance of scale of possible effects in case of computer incidents on objects of critical information infrastructure;

e) assignment to each of objects of critical information infrastructure of one of categories of the importance or decision making about lack of need of assignment by it of one of categories of the importance.

6. The category of the importance with the highest value is appropriated to object of critical information infrastructure by results of categorization according to the list of indicators of criteria of the importance.

Assessment is made for each indicator of criteria of the importance for which more than one value of such indicator are established (the territory, the number of people) on each of measure values of criteria of the importance, and the category of the importance is appropriated on the highest value of such indicator.

If object of critical information infrastructure on one of indicators of criteria of the importance is referred to the first category, calculation for other indicators of criteria of the importance is not carried out.

If any of indicators of criteria of the importance is inapplicable for object of critical information infrastructure or object of critical information infrastructure does not correspond to any indicator of criteria of the importance and their values, the category of the importance is not appropriated.

7. 3 categories of the importance are established. The highest category - the first, the lowest - third.

8. Concerning the created object of critical information infrastructure, including within creation of capital construction project, the category of the importance is determined when forming by the customer, technical customer or builder of requirements to object of critical information infrastructure taking into account the available basic data about critical processes of the subject of critical information infrastructure.

For the created object of critical information infrastructure specified in paragraph one of this Item, the category of the importance can be specified during its designing.

9. For the objects belonging to one subject of critical information infrastructure, but used for the purposes of control and management of the technology and (or) production equipment belonging to other subject of critical information infrastructure, categorization is performed on the basis of the basic data represented by subject of critical information infrastructure which possesses technology and (or) production equipment.

Disclaimer! This text was translated by AI translator and is not a valid juridical document. No warranty. No claim. More info