ORDER OF THE MINISTER OF DIGITAL DEVELOPMENT, INNOVATIONS AND AEROSPACE INDUSTRY OF THE REPUBLIC OF KAZAKHSTAN

of October 13, 2020 No. 386/Tax Code

About approval of Rules of functioning of single lock of Internet access and single lock of e-mail of "the digital government"

According to the subitem 18) of article 7-1 of the Law of the Republic of Kazakhstan "About cyber security" and the subitem 345) of Item 15 of the Regulations on the Ministry of the artificial intelligence and digital development of the Republic of Kazakhstan approved by the order of the Government of the Republic of Kazakhstan of October 9, 2025 No. 846, I ORDER:

1. Approve:

1) Rules of functioning of single lock of Internet access, according to appendix 1 to this order;

2) Rules of functioning of single lock of e-mail of "the digital government", according to appendix 2 to this order.

2. To provide to committee on information security of the Ministry of digital development, innovations and aerospace industry of the Republic of Kazakhstan in the procedure established by the legislation:

1) state registration of this order in the Ministry of Justice of the Republic of Kazakhstan;

2) placement of this order on Internet resource of the Ministry of digital development, innovations and the aerospace industry of the Republic of Kazakhstan after its official publication;

3) within ten working days after state registration of this order in the Ministry of Justice of the Republic of Kazakhstan submission to Legal department of the Ministry of digital development, innovations and the aerospace industry of the Republic of Kazakhstan of data on execution of the actions provided by subitems 1) and 2) of this Item.

3. To impose control of execution of this order on the supervising vice-minister of digital development, innovations and the aerospace industry of the Republic of Kazakhstan.

4. This order becomes effective after ten calendar days after day of its first official publication.

It is approved Committee of homeland security of the Republic of Kazakhstan

Appendix 1

to the Order of the Minister of digital development, innovations and the aerospace industry of the Republic of Kazakhstan of October 13, 2020 No. 386/Tax Code

Rules of functioning of single lock of Internet access

Chapter 1. General provisions

1. These rules of functioning of single lock of Internet access (further - Rules) are developed according to the subitem 18) of article 7-1 of the Law of the Republic of Kazakhstan "About cyber security" (further - the Law) and the subitem 345) of Item 15 of the Regulations on the Ministry of the artificial intelligence and digital development of the Republic of Kazakhstan approved by the order of the Government of October 9, 2025 No. 846 and determine procedure for functioning of single lock of Internet access (further - EShDI).

2. Connection of local, departmental and corporate networks of telecommunications of state bodies, local government bodies, the state legal entities, subjects of the quasi-public sector, and also owners or owners of crucial digital objects to the Internet is performed by telecom operators through EShDI.

By special state and law enforcement agencies in the operational purposes, National Bank of the Republic of Kazakhstan according to Item 3 of article 30 of the Law connections to the Internet without use of EShDI can be organized.

3. In these rules the following terms and determinations are used:

1) cyber security incident - event or set of the events which are negatively influencing cyber security of digital object;

2) the telecom operator – the physical person or legal entity registered in the territory of the Republic of Kazakhstan, rendering communication services and (or) operating communication networks;

3) the firewall for protection of web applications – technology for protection of Internet resources (further – IR) from unauthorized access to data and their modification, even in the presence on IR of critical vulnerabilities, by means of automatic detecting and blocking of the attacks;

4) protection against unauthorized changes of web pages – the technology allowing to reveal modification and misstatement of the IR web pages by malefactors, and also to recover IR to initial condition in the automatic mode;

5) the root certificate of EShDI – the data set of special format containing open key, but which is not limited to it, and being at the top level of hierarchical tree of the certificates applied on EShDI equipment for the omission of the Internet traffic containing the protocols supporting enciphering;

6) technical capability of connection to EShDI – availability of the functioning technical means and constructions of communication necessary for connection of communication channels of telecom operators to EShDI and traffic transmission of telecom operators through EShDI;

7) the user of EShDI (further - the User) - state body, local government body, the state legal entity, the subject of the quasi-public sector, the owner or the owner of crucial digital objects having connection of local, departmental and corporate networks of telecommunications to the Internet through EShDI;

8) system for processing of requests (further – SOZ) – IR, at the address https://support.sts.kz, for order taking from telecom operators and Users;

9) network of telecommunications – the set of means of the telecommunications and communication lines providing transmission of messages of telecommunications, consisting of the switching equipment (the stations, substations, concentrators), linearly - cable constructions (subscriber lines, connecting lines and communication channels), systems of transfer and subscriber devices.

Chapter 2. Procedure for functioning of EShDI

4. The Public Technical Service joint-stock company (further - GTS) performs maintenance of EShDI, provides uninterruptedness of its work.

The basis for connection to EShDI is the agreement signed between the telecom operator and the User.

After connection of Users to EShDI, telecom operators hold primary consultation with them concerning Internet access through EShDI, further consultations are held by GTS.

5. Telecom operators for connection to EShDI send to GTS the request for connection of communication channels to EShDI with the organization of the basic and alternative channel, in form according to appendix 1 to these rules (further – the request).

6. GTS, if technically possible connections to EShDI, within ten working days from the date of receipt of the request, sends to the telecom operator specifications for connection to EShDI according to appendix 2 to these rules (further – specifications).

7. The telecom operator, within seven working days after receipt of specifications, notifies GTS by the official letter on readiness for connection to EShDI.

8. No. 79/Tax Code is excluded according to the Order of the Acting Minister of digital development, innovations and the aerospace industry of the Republic of Kazakhstan of 26.04.2023

9. The telecom operator provides execution of specifications for the entire period of connection to EShDI.

10. In case of lack of technical capability of connection to EShDI GTS, within ten working days from the date of receipt of the request, sends to the telecom operator the notification on request variation with indication of the reasons.

11. In case of detection of discrepancies to requirements of specifications, the telecom operator, within five working days from the date of obtaining from GTS of the notification on request variation, eliminates the revealed discrepancies of connection to EShDI.

12. Telecom operators perform connection of Users to EShDI.

12-1. Telecom operators, once a half-year suffices, by means of SOZ create the list of the responsible persons (with indication of their subscriber numbers of cellular communication, e-mail addresses) holding organizational events for questions of Internet access through EShDI.

At the request of GTS within one working day telecom operators determine the responsible person and provide in GTS its contact information for holding joint technical actions.

13. The telecom operator on IR "Catalogue of IP Addresses" (https://catalog.sts.kz), on permanent basis staticizes information on Users.

In case of detection on the equipment of EShDI of IP addresses of the Users who are absent on IR "Catalogue of IP Addresses" (https://catalog.sts.kz), GTS sends the notification to the telecom operator by e-mail, with application of the list of these IP addresses.

The telecom operator within five working days, from the moment of receipt of the notification from GTS, staticizes the list of IP addresses in IR "Catalogue of IP Addresses".

In case of failure to carry out by the telecom operator in the specified time, GTS blocks access to the Internet from the IP addresses specified in the notification.

The unblocking of IP addresses is made after updating of data by the telecom operator.

14. In case of incident of information security the telecom operator or the User informs on it service GTS On duty by e-mail support@sts.kz or sending the request through SOZ.

15. The user, is at least once a year, provides in GTS the list of categories IR and lists of network addresses of networks of telecommunications of the User for application on EShDI equipment according to Single requirements in the spheres of digitalization and ensuring cyber security approved by the order of the Government of the Republic of Kazakhstan of December 20, 2016 No. 832.

The user, by means of SOZ, sends to GTS the request signed by the digital signature of the legal entity with application of the list of categories IR and the list of network addresses of networks of telecommunications of the User.

15-1. GTS, on the basis of the User's request, agrees to the lists of categories IR and network addresses of networks of telecommunications provided to them, opens on EShDI equipment Internet access, necessary for it, for a period of one calendar year.

15-2. The User's requests connected with opening on the equipment of EShDI of necessary Internet access based on the list of categories IR and network addresses of networks of telecommunications and also for use of private virtual networks (VPN) and other network services which bear threats and risks of cyber security for the User are drawn up by it by the direction in GTS, by means of SOZ, the request signed by the digital signature of the legal entity.

16. GTS, within ten working days after obtaining from the User of the list of categories IR and lists of network addresses of networks of telecommunications of the User, applies the corresponding politicians on the equipment of EShDI and notifies the User on the held event.

17. The user for implementation of measures for protection of IR sends to GTS through SOZ the request for receipt of service of additional protection of IR by means of connection to the firewall for protection of web applications and provides necessary data, according to appendix 3 to these rules (further – the request for receipt of service of additional protection).

GTS, with technical capabilities and obtaining condition from the User of all necessary data, connects IR specified in the request for receipt of service of additional protection to the firewall for protection of web applications within ten working days from the date of receipt of the request for receipt of service of additional protection in GTS. Connection is performed on a grant basis.

In the absence of technical capability of connection to the firewall for protection of web applications of GTS, within ten working days from the date of receipt of the request for receipt of service of additional protection, sends to the User the notification on request variation with indication of the reasons.

The user, after obtaining from GTS of the notification on request variation after thirty calendar days, repeatedly directs the request for receipt of service of additional protection through SOZ.

18. The user for implementation of measures for protection against unauthorized changes of the IR web pages, sends to GTS through SOZ the request for receipt of service to system of protection against unauthorized changes of the IR web pages and provides necessary data, according to appendix 4 to these rules.

GTS, with technical capabilities and obtaining condition from the User of all necessary data and access, connects IR specified in the request for receipt of service to system of protection against unauthorized changes of the IR web pages, to system of protection against unauthorized changes of the IR web pages within ten working days from the date of receipt of the specified request in GTS. Connection is performed on a grant basis.

In the absence of technical capability of connection to system of protection against unauthorized changes of the IR, GTS web pages, within ten working days from the date of receipt of the request for receipt of service to system of protection against unauthorized changes of the IR web pages, sends to the User the notification on request variation with indication of the reasons.

The user, after obtaining from GTS of the notification on request variation, after thirty calendar days repeatedly directs the request for receipt of service to system of protection against unauthorized changes of the IR web pages through SOZ.

19. The user in case of the termination of use of IR or change of data on IR (domain name, the IP address IR, the ranking officer Polzovatelya, technical characteristics of IR, the telecom operator performing connection to EShDI), within five working days sends to the address GTS the adequate formal notice or information by means of SOZ. GTS carries out necessary organizational and technical actions on EShDI equipment.

20. For timely detection and restriction of access to harmful content, GTS realizes the relevant technical activities on EShDI equipment for carrying out the analysis of the ciphered traffic of Users, except for the following categories IR and network protocols:

1) finance, banks and education;

2) state bodies and organizations;

3) beauty, health and medicine;

4) personal information;

5) services of video conferencing;

6) services of updating of signatures of means of information security;

7) services of updating of operating systems and software;

8) network protocols and the applications used for video surveillance and video broadcasting;

9) the network protocols providing coherence or synchronization of data between devices of network safety in one or several organizations;

10) IR with high level of credibility.

21. GTS creates, transfers to telecom operators and provides relevance of the root certificate of EShDI. In process of creation of the new root certificate informs the telecom operator.

22. The telecom operator transfers to the Users the root certificate of EShDI.

23. Users establish the root certificate of EShDI at the workstations.

Appendix 1

to Rules of functioning of single lock of Internet access

Form

Request for connection of communication channels to EShDI

We ask to connect communication channels with handling capacity:

____________________________________________________________________________________
             (unit of measure - 1 Gbit / with; the minimum size – 1 Gbit / c)

on _________________________________________________________________________________.
                       (the planned date of receipt of access to EShDI)

We undertake to provide data on communication channels, contact information, documents and to create conditions for fault-tolerant connection to EShDI.

_______________________________ (First name, middle initial, last name, signature of the head of the organization)

L. S. (in the presence)

"_____" _________________ 20 ____ years

Appendix 2

to Rules of functioning of single lock of Internet access

No. SPECIFICATIONS __ on connection to EShDI

Name and address of object:

Name of the telecom operator: ______________________________

Point of connection of the active equipment: __________________________

Technology of joint: 10G, full-duplex, SM.

Connection conditions:

Rendering the guaranteed service in the fault-tolerant mode requires connection of the basic and alternative channel of communication, by means of independent physical channels.

Requirements to laying of optical patchkord:

1. To lay optical patchkorda (SC-LC) between optical regiments in corrugated pipe on the existing metalwork.

2. Optical patchkorda (SC-LC) shall have the marking allowing to determine their accessory.

3. Before performance of works on laying of optical patchkord to coordinate works with the representative of GTS

General questions:

Specifications are valid within 60 (sixty) calendar days.

In case of failure to carry out of works, specifications need to be confirmed and reconciled in GTS. In case of not prolongation in 10 days prior to the termination of effective period, specifications automatically cancel.

Appendix 3

to Rules of functioning of single lock of Internet access

Form

The request for receipt of service of additional protection of IR by means of connection to the firewall for protection of web applications

We ask to connect IR <<domain name>> to the firewall of protection of web applications.

We undertake to provide necessary data on the list:

№	Necessary data	Note
1	Domain name and IP address IR
2	The name of the telecom operator providing connection to the Internet through EShDI
3	The name of the web server with indication of the version	Possible names: IIS, Apache, Apache Tomcat, Netscape Enterpise Server, IBM Lotus Domino, Nginx, JBoss, IBM Websphere, Lighttpd, Caucho Resin, JRun Web server, WebLogic. * The name of the web server is provided with obligatory specifying of the version.
4	The name of system of balancing (in the presence) with indication of the version	Possible names: Keepalived, Nginx и.т.д.
5	The name of the database management system (DMS) with indication of the version	Possible names: Oracle, MySQL, MSSQL, DB 2, Sybase, PostgreSQL и.т.д.
6	The name of content management system of CMS with indication of the version	Possible names: WordPress, Drupal, Struts, SharePoint
7	The certificate and the closed key, when using the https protocol	For implementation of protection of IR of the using https
8	The name of the application server (in the presence) with indication of the version	Possible names: Apache Tomcat,
9	Contacts of responsible technical specialists	Full name, E-mail, office number, mobile number

_______________________________ (First name, middle initial, last name, signature of the head of the organization)

L. S. (in the presence)

"_____" _________________ 20 ____ years

Appendix 4

to Rules of functioning of single lock of Internet access

Form

The request for receipt of service to system of protection against unauthorized changes of the IR web pages

We ask to connect IR <<domain name>> to system of protection against unauthorized changes of the IR web pages.

We undertake to provide necessary data on the list:

№	Necessary data	Notes
1	Domain name and IP address IR
2	The name of the telecom operator providing connection to the Internet through EShDI
3	The name of the web server with indication of the version	Possible names: IIS, Apache, Apache Tomcat, Netscape Enterpise Server, IBM Lotus Domino, Nginx, JBoss, IBM Websphere, Lighttpd, Caucho Resin, JRun Web server, WebLogic. * The name of the web server is provided with obligatory specifying of the version.
4	The name of system of balancing (in the presence) with indication of the version	Possible names Keepalived, Nginx и.т.д.
5	The name of the database management system (DMS) with indication of the version	Possible names of Oracle, MySQL, MSSQL, DB 2, Sybase, PostgreSQL и.т.д.
6	The name of content management system of CMS with indication of the version	Possible names WordPress, Drupal, Struts, SharePoint
7	The certificate and the closed key, when using the https protocol	For implementation of protection of IR of the using https
8	The name of the application server (in the presence) with indication of the version	Possible names Apache Tomcat
9	Access to root directory of IR under the FTP and/or SSH protocols
10	Contacts of responsible technical specialists	Full name, E-mail, office number, mobile number
11	Accounting data (login and the password, key for authorization if access on key is used) the user with the permission to reading and record in root web resource directories on the server under the protocols ssh, ftp, sftp	Login and password

_______________________________ (First name, middle initial, last name, signature of the head of the organization)

L. S. (in the presence)

"_____" _________________ 20 ____ years

Appendix 2

to the Order of the Minister of digital development, innovations and the aerospace industry of the Republic of Kazakhstan of October 13, 2020 No. 386/Tax Code

Rules of functioning of single lock of e-mail of "the digital government"

Chapter 1. General provisions

1. These rules of functioning of single lock of e-mail of "the digital government" (further - Rules) are developed according to the subitem 18) of article 7-1 of the Law of the Republic of Kazakhstan "About cyber security" (further - the Law) and determine procedure for functioning of single lock of e-mail of "the digital government" (further - EShEP).

2. These rules extend to state bodies, local government bodies, the state legal entities, subjects of the quasi-public sector, owners or owners of crucial digital objects.

3. In these rules the following concepts are used:

1) the Applicant - state body, local government body, the state legal entity, the subject of the quasi-public sector, the owner or the owner of crucial digital objects who submitted the application for receipt of service of connection of e-mail of the Applicant to EShEP;

2) the user of EShEP (further - the User) - state body, local government body, the state legal entity, the subject of the quasi-public sector, the owner or the owner of crucial digital objects which electronic interaction of e-mail with external e-mail is performed by redirection of electronic messages through EShEP;

3) external e-mail – e-mail which is not relating to departmental (corporate) e-mail of the Applicant;

4) system for processing of requests (further – SOZ) – Internet resource, at the address https://support.sts.kz, for order taking from Applicants and Users.

Chapter 2. Procedure for functioning of EShEP

4. Functioning of EShEP is provided by means of its maintenance including actions for technical maintenance, connection of Applicants to EShEP and working off of requests/requests of Users concerning EShEP.

5. The Public Technical Service joint-stock company (further - GTS) performs maintenance of EShEP according to the subitem 1) of Item 1 of article 14 of the Law.

6. GTS provides uninterruptedness of work of EShEP.

7. For connection to EShEP the Applicant through SOZ or the official letter submits the application for receipt of service of connection of post system to EShEP (further – the request) to GTS in form according to appendix to these rules.

8. GTS, within five working days from the date of receipt of the request, checks regarding compliance of reference of the Applicant to the subject of state body, local government body, the state legal entity, the quasi-public sector, the owner or owner of crucial digital objects, and also availability of technical capability (the functioning technical means and constructions of communication) of connection of e-mail of the Applicant to EShEP.

9. If technically possible connections of post system of the Applicant to EShEP, GTS, within five working days from the date of receipt of the request, holds technical events together with the Applicant for connection of post system to EShEP and sends the notification to the Applicant about the taken measures for the request.

10. In case of lack of technical capability of connection of post system of the Applicant to EShEP, GTS, within five working days from the date of receipt of the request, sends to the Applicant the notification on request variation with indication of the reasons.

The applicant, after obtaining from GTS of the notification on request variation, after thirty calendar days repeatedly directs the request through SOZ.

11. In case of change of the status of the User on other, not belonging to the subject of state body, local government body, the state legal entity, the quasi-public sector, the owner or owner of crucial digital objects, the User notifies by the official letter GTS on need of disconnection of post system from EShEP. GTS in time approved with the User performs disconnection of post system from EShEP.

12. In case of detection of emergency activity of traffic of the electronic post systems connected to EShEP, GTS stops their functioning for the purpose of prevention of entering of IP addresses EShEP into global bases not of confidential IP addresses and domains, with the subsequent notification of the owner of electronic post system on blocking.

Appendix

to Rules of functioning of single lock of e-mail of "the electronic government"

Form

Request for receipt of service of connection of post system to EShEP

We ask to pass post traffic through EShEP:

________________________________________________________________________
   (the name of the domain of e-mail connected to EShEP, the owner
                     domain of e-mail and IP address of the e-mail server)

We undertake to provide data on e-mail domain, contact information, documents and to create conditions for fault-tolerant connection to EShEP.

Provision of contacts of technical specialists from the user (full name, mobile and office number, e-mail) ________________________________________________________________________

_______________________________ (First name, middle initial, last name, signature of the head of the organization)

L. S. (in the presence)

"_____" _________________ 20 ____ years

Disclaimer! This text was translated by AI translator and is not a valid juridical document. No warranty. No claim. More info