ORDER OF THE CHAIRMAN OF COMMITTEE OF THE HOMELAND SECURITY OF THE REPUBLIC OF KAZAKHSTAN

of December 19, 2018 No. 104/ke

About approval of Rules of implementation of allowing procedures and Allowing requirements for issue of permission to realization (including other transfer) means of cryptographic information security and the list of the documents confirming compliance to them

According to subitems 2-1) and 4) of Item 1 of Article 12 and Item 2 of article 38 of the Law of the Republic of Kazakhstan "About permissions and notifications" I ORDER:

1. Approve the enclosed Rules of implementation of allowing procedures and Allowing requirements for issue of permission to realization (including other transfer) means of cryptographic information security and the list of the documents confirming compliance to them.

2. To provide to service of information and cyber security of Committee of homeland security of the Republic of Kazakhstan in the procedure established by the legislation of the Republic of Kazakhstan:

1) state registration of this order in the Ministry of Justice of the Republic of Kazakhstan;

2) within ten calendar days from the date of state registration of this order the direction it in the Kazakh and Russian languages in the Republican state company on the right of economic maintaining "The republican center of legal information" of the Ministry of Justice of the Republic of Kazakhstan for official publication and inclusion in Reference control bank of regulatory legal acts of the Republic of Kazakhstan;

3) placement of this order on official Internet resource of Committee of homeland security of the Republic of Kazakhstan.

3. To impose control of execution of this order on the vice-chairman of Committee of homeland security of the Republic of Kazakhstan Ergozhin of E.

4. This order becomes effective after twenty one calendar days after day of its first official publication.

It is approved Ministry of information and communications of the Republic of Kazakhstan "___" ____________ 2018

It is approved Ministry of national economy of the Republic of Kazakhstan "___" ____________ 2018

 

Approved by the Order of the Chairman of Committee of homeland security of the Republic of Kazakhstan of December 19, 2018 No. 104/ke

Rules of implementation of allowing procedures and Allowing requirements for issue of permission to realization (including other transfer) means of cryptographic information security and the list of the documents confirming compliance to them

Chapter 1. General provisions

1. These rules of implementation of allowing procedures and Allowing requirements for issue of permission to realization (including other transfer) means of cryptographic information security and the list of the documents confirming compliance to them (further - Rules and allowing requirements) are developed according to article 38 of the Law of the Republic of Kazakhstan "About permissions and notifications".

2. Rules and allowing requirements regulate procedures of issue of permission to realization (including other transfer) means of cryptographic information security, implementation of allowing control, and also the allowing requirements to applicants imposed in case of the address by them for receipt of permission and to owners of permission of the second category.

3. In these rules and allowing requirements the following concepts are applied:

1) the owner of permission of the second category - the physical person or legal entity having the valid permission of the second category;

2) the applicant - physical person or legal entity, branch or representation of the legal entity, the licensee, the owner of permission of the second category who addressed to the relevant allowing organ for passing of licensing or the allowing procedure or who directed the notification;

3) allowing bodies - licensors and the bodies authorized on issue of permissions of the second category.

4. To means of cryptographic information security (the cryptography (cryptographic) tools), including documentation on these means, belong:

1) means of enciphering (hardware, program and the hardware and software, systems and complexes realizing algorithms of cryptographic transformation of information and intended for information security from unauthorized access by its transfer on communication channels and (or) in case of its processing and storage);

2) means of imitozashchita (hardware, program and the hardware and software, systems and complexes realizing algorithms of cryptographic transformation of information and intended for protection against imposing of false information);

3) means of the digital signature;

4) hardware, program and the hardware and software, systems and complexes realizing algorithms of cryptographic transformation of information with accomplishment of part of such transformation by manual transactions or with use of the automated means on the basis of such transactions;

5) hardware, program and the hardware and software, systems and complexes realizing algorithms of cryptographic transformation of information and intended for production of key documents (irrespective of type of the carrier of key information);

6) hardware, program and the hardware and software, systems and complexes developed or modified for accomplishment of cryptoanalytical functions;

7) hardware, program and the hardware and software, systems and complexes realizing the algorithms of cryptographic transformation of information developed or modified for application of cryptographic methods of generation of the extending code for systems with the extending range including spasmodic reorganization of codes for systems with spasmodic reorganization of frequency;

8) hardware, program and the hardware and software, systems and complexes realizing the algorithms of cryptographic transformation of information developed or modified for application of cryptographic methods of forming of channels or the coding codes for the superbroadband systems modulated on time.

5. These rules and allowing requirements do not extend to activities with use:

1) the cryptography (cryptographic) tools intended for protection of the data constituting the state secrets;

2) the cryptography (cryptographic) tools, and also the goods containing the cryptography (cryptographic) tools realizing the symmetric cryptographic algorithm using cryptographic key length which is not exceeding 56 bits or the asymmetric cryptographic algorithm based or on decomposition method on multipliers of integers which size does not exceed 512 bits, or by method of calculation of discrete logarithms in multiplicative group of the final field of the size which is not exceeding 512 bits or by method of calculation of discrete logarithms in other group of the size which is not exceeding 112 bits;

3) the goods containing the cryptography (cryptographic) tools, having or function of authentication, including all aspects of access control where there is no enciphering of files or texts, except for enciphering which is directly connected with protection of the passwords, personal identification numbers or similar data for protection against unauthorized access or having the digital signature;

4) the cryptography (cryptographic) tools which are components of program operating systems which cryptographic opportunities cannot be changed by users who are developed for installation by the user independently without further essential support by the supplier and technical documentation (the description of algorithms of cryptographic transformations, protocols of interaction, the description of interfaces and so on) on which is to the available user;

5) personal smart cards (intelligent cards) which cryptographic opportunities are limited to use in the equipment or systems specified in subitems 6) - 9) this Item, or personal smart cards (intelligent cards) for broad public application which cryptographic opportunities are unavailable to the user and which as a result of special development have limited opportunities of protection of the personal information which is stored on them;

6) the reception equipment for broadcasting, commercial television or the similar commercial equipment for broadcasting to restricted audience without enciphering of digital signal, except cases of use of enciphering only for management video or audiochannels, sendings accounts or return of information connected with the program to providers of broadcasting;

7) the equipment which cryptographic opportunities are unavailable to the user, specially developed and limited to implementation of the following functions:

execution of the software in the type protected from copying;

ensuring access to the content protected from copying which is stored only on the data carrier, available to reading, or information access, the ciphered form which is stored in on electronic media of information which are offered for sale to the population in identical sets;

control of copying of the audio-and video information protected by copyright;

8) the cryptographic (cryptographic) equipment, specially developed and limited by application for banking or financial activities;

9) portable or mobile radio-electronic means of civil appointment (for example, for use in commercial civil systems of cellular radio communication) which are not capable to end-to-end enciphering (from the subscriber to the subscriber);

10) the wireless radio-electronic equipment performing enciphering of information only in radio channel with the maximum range of wireless action without strengthening and relaying less than 400 m according to specifications of the producer;

11) the cryptography (cryptographic) tools used for protection of technological channels of information and telecommunication systems and communication networks;

12) goods which cryptographic function is blocked by the producer;

13) other goods which contain the cryptography (cryptographic) tools excellent from specified in subitems 2) - 12) this Item, and correspond to the following criteria:

sales by the order of goods by mail, electronic transactions, sale by telephone orders are public for sale to the population without restrictions from available assortment in places of retail sale by means of sales for cash;

the cryptographic (cryptographic) which functionality cannot be changed by the user easy way;

are developed for installation by the user without further essential support by the supplier;

technical documentation, confirmatory that goods conform to requirements of this subitem which is placed by the manufacturer in open entry and is submitted if necessary the manufacturer (person, it to representatives) to allowing body for its request.

6. Receipt of permission to realization (including other transfer) means of cryptographic information security (goods) included in the unified register of the notifications placed on official Internet resource of the Eurasian economic commission, and also, to persons having the license for development of means of cryptographic information security is not required.

Chapter 2. Allowing procedures

7. Allowing procedures are performed in electronic form by means of the state information system of permissions and notifications.

8. For receipt of permission to realization (including other transfer) means of cryptographic information security the applicant addresses to allowing body which establishes the applicant's compliance to allowing requirements, the these rules and allowing requirements established by Chapter 3.

9. When conducting verification of the data containing in the documents submitted by the applicant and checking observance by the applicant of allowing requirements the allowing body uses information systems.

10. In issue of permission refuses in cases:

1) establishment of unauthenticity of the documents submitted by uslugopoluchatel for receipt of permission, and (or) these (data) containing in them;

2) discrepancies of uslugopoluchatel to allowing requirements, these rules and allowing requirements established by Chapter 3;

3) if concerning uslugopoluchatel there is decision (sentence) of court on prohibition of activities or the separate types of activity requiring receipt of permission which took legal effect;

4) if concerning uslugopoluchatel there is judgment which took legal effect based on which the uslugopoluchatel is deprived of the special right connected with receipt of the state service.

11. Permission or motivated refusal in issue of permission is issued by allowing body in electronic form no later than eight working days from the moment of the address.

12. The requirement from the applicant of submission of the documents and/or data which are not provided by these rules and allowing requirements is not allowed.

13. After receipt of permission to realization (including other transfer) means of cryptographic information security the owner of permission of the second category conducts register of the realized means of cryptographic information security in form, according to appendix 1 to these rules and allowing requirements.

14. The report on the realized means of cryptographic information security on form according to appendix 2 to these rules and allowing requirements goes to allowing body through the web portal of "the electronic government" www.egov.kz, http://www.elicense.kz/ no later than February 1 of the year following reporting. The original of the report is registered at the owner of permission of the second category.

Chapter 3. Allowing requirements and the list of the documents confirming compliance to them

15. In case of consideration of the application on issue of permission to realization (including other transfer) means of cryptographic information security treat allowing requirements:

availability of the higher or secondary professional education on technical specialty - for physical person;

availability in staff of the applicant of the specialist(s) having the higher or secondary professional education on technical specialty - for the legal entity;

payment of the state fee.

16. For receipt of permission the applicant represents (sends) to allowing body:

the statement of the legal entity for receipt of permission to realization (including other transfer) means of cryptographic information security in form, according to appendix 3, or the statement of physical person for receipt of permission to realization (including other transfer) means of cryptographic information security in form, according to appendix 4;

electronic copies of the documents confirming availability technical and professional after secondary or higher education of the applicant (the applicant's worker(s));

the document confirming introduction by the applicant of the state fee.

Appendix 1

to Rules of implementation of allowing procedures and Allowing requirements for issue of permission to realization (including other transfer) means of cryptographic information security and the list of the documents confirming compliance to them

Form

The magazine No. ____ accounting of the realized means of cryptographic information security

№. of payment order	The name of the realized means of cryptographic information security, number and date of the conclusion on technical research	Functional purpose of the realized means of cryptographic information security	Serial (serial) number of the realized means of cryptographic information security	The basis for realization (number, imprisonment term and execution of the contract (agreement), the legal and actual address, individual identification number / бизнес-идентификационный number (in the presence), contact telephone numbers of the organization with whom the contract (contract) for realization is signed)
1	2	3	4	5

Note: the register of the realized means of cryptographic information security is registered at the owner of permission of the second category.

Appendix 2

to Rules of implementation of allowing procedures and Allowing requirements for issue of permission to realization (including other transfer) means of cryptographic information security and the list of the documents confirming compliance to them

Form

The report on the realized means of cryptographic information security during the period with "___" ______ 20 ____ years on "___" _____ 20 _____ years

 

№ of payment order	The name of the realized means of cryptographic information security, number and date of the conclusion on technical research	The basis for realization (number, imprisonment term and execution of the contract (agreement), the legal and actual address, individual identification number / бизнес-идентификационный number (in the presence), contact telephone numbers of the organization with whom the contract (contract) for realization is signed)	Quantity of the realized means of cryptographic information security
1	2	3	4

______________________ ____________ ________________________________

the head's position the signature surname, name, middle name (in case of its availability)

L. S. (in case of its availability)

______________________ date of the signature

Note: the report on the realized means of cryptographic information security in electronic form in the DOC format, the authorized person of the owner of permission of the second category certified by the digital signature, goes to allowing body through the web portal of "the electronic government" www.egov.kz, www.elicense.kz no later than February 1 of the year following reporting. The original of the report is registered at the owner of permission of the second category.

Appendix 3

to Rules of implementation of allowing procedures and Allowing requirements for issue of permission to realization (including other transfer) means of cryptographic information security and the list of the documents confirming compliance to them

Form

The statement of the legal entity for receipt of permission to realization (including other transfer) means of cryptographic information security

IN ________________________________________________________________________

                            (full name of uslugopoluchatel)

от______________________________________________________________________________

(full name, location, business and identification number

legal entity (including foreign legal entity), business

identification number of branch or legal foreign mission

persons - in case of lack of business identification number at the legal entity)

I ask to issue permission to implementation of permission to realization (including other transfer) means of cryptographic information security.

Address of the legal entity ___________________________________________________

(the postal index, the country (for the foreign legal entity), the area, the city, the area, the settlement,

name of the street, number of the house/building (stationary room)

E-mail _________________________________________________________

_________________________________________________________________ phones

_____________________________________________________________________ fax

Bank account ___________________________________________________________

                                  (account number, name and location of bank)

Address of object of implementation of activities or actions (transactions)

________________________________________________________________________________

(postal index, area, city, area, settlement, name of the street, number

houses/buildings (stationary room)

It is applied ________ the document(s).

Proves to be true present that:

all specified data are official contacts and any information on questions of issue or refusal in issue of permission can be directed to them;

the applicant is not forbidden to be engaged in court in activities or separate types of activity, requiring receipt of permission;

all enclosed documents are true and are valid;

the applicant agrees to use of the personal data of limited access which are the secret protected by the law, containing in information systems in case of issue of permission;

the applicant agrees to the certificate of the statement the digital signature of the employee of service center of the population (in case of the address through service center of the population).

Head of _____________ _______________________________________________

                           (signature) (surname, name, middle name (in case of its availability)

Date of filling:                                            "___" _________ 20 _____ years

Appendix 4

to Rules of implementation of allowing procedures and Allowing requirements for issue of permission to realization (including other transfer) means of cryptographic information security and the list of the documents confirming compliance to them

Form

The statement of physical person for receipt of permission to realization (including other transfer) means of cryptographic information security

IN ________________________________________________________________________

                            (full name of uslugopoluchatel)

from _____________________________________________________________________________

(surname name middle name (in case of availability) physical person, individual identification number)

I ask to issue permission to realization (including other transfer) means of cryptographic information security

Residential address of physical person

________________________________________________________________________________

(postal index, area, city, area, settlement, name of the street, number of the house/building)

E-mail _________________________________________________________

_________________________________________________________________ phones

_____________________________________________________________________ fax

Bank account ___________________________________________________________

                                 (account number, name and location of bank)

Address of object of implementation of activities or actions (transactions)

________________________________________________________________________________

(postal index, area, city, area, settlement, name of the street, number of the house/building (stationary room)

It is applied _____ the document(s)

Proves to be true present that:

all specified data are official contacts and any information on questions of issue or refusal in issue of permission can be directed to them;

the applicant is not forbidden to be engaged in court in activities or separate types of activity, requiring receipt of permission;

all enclosed documents are true and are valid;

the applicant agrees to use of the personal data of limited access which are the secret protected by the law, containing in information systems in case of issue of permission;

the applicant agrees to the certificate of the statement the digital signature of the employee of service center of the population (in case of the address through service center of the population).

_____________ __________________________________________ physical person

                                   (signature) (surname, name, middle name (in case of its availability)

Date of filling: "___" _____ 20 __ years

 

Disclaimer! This text was translated by AI translator and is not a valid juridical document. No warranty. No claim. More info