Unofficial transfer (c) Soyuzpravoinform LLC

ORDER OF ADMINISTRATION OF PUBLIC SERVICE OF SPECIAL COMMUNICATION AND INFORMATION PROTECTION OF UKRAINE

of October 18, 2023 No. 899

About approval of the Regulations on allowing procedure for work on information technical protection for own needs

According to Item 47 parts one of article 14 of the Law of Ukraine "About Public service of special communication and information protection of Ukraine", the subitem 24 of item 4 of the Regulations on Administration of Public service of special communication and information protection of Ukraine approved by the resolution of the Cabinet of Ministers of Ukraine of September 3, 2014 No. 411, and for the purpose of enhancement of procedure for issue of permissions to work on information technical protection for own needs of PRIKAZYVAYU:

1. Approve Regulations on allowing procedure for work on technical protection of the enclosed information for own needs.

2. Declare invalid the order of Department of special telecommunication systems and information protection of the Security Service of Ukraine of February 23, 2002 No. 9 "About approval of the Regulations on allowing procedure for work on information technical protection for own needs", registered in the Ministry of Justice of Ukraine on March 13, 2002 at No. 245/6533.

3. To provide to department of information protection of Administration of Public service of special communication and information protection of Ukraine submission of this order in accordance with the established procedure on state registration in the Ministry of Justice of Ukraine.

4. This order becomes effective from the date of its official publication.

5. To impose control over the implementation of this order on the vice-chairman of Public service of special communication and information protection of Ukraine according to distribution of obligations.

Approved by the Order of Administration of Public service of special communication of information protection of Ukraine of October 18, 2023 No. 899

Regulations on allowing procedure for work on information technical protection for own needs

I. General provisions

1. This Provision establishes conditions of carrying out and work types on information technical protection (further - TZI) for own needs, procedure for issue by administration of Gosspetssvyaz of permissions to work with TZI for own needs (further - permission), procedure for control of observance of conditions of work with TZI for own needs.

2. Requirements of this provision extend to state bodies which carry out works with TZI for own needs according to the list determined by item 4 of this Section.

3. In this Provision terms are used in such value:

certification of the TZI-assessment of Conformity of the TZI Complex complex to requirements of regulating documents in the field of TZI;

the state body having permission - the state body which got permission to work with TZI for own needs according to this Provision;

allowing case - single set of documents of rather corresponding job seeker of permission or state body which has permission, the powers provided by state bodies in administration of Gosspetssvyaz or accepted by administration of Gosspetssvyaz as a result of realization according to this Provision;

The mortgage device - the technical tool of secret receipt of information placed on subject to information activities with concealment from identification by person who does not have relations to use of the technical tool, the fact of its availability and/or application owing to what the threat of information leakage from subject to information activities is created;

the job seeker of permission - state body which in the procedure established by administration of Gosspetssvyaz filed to Administration of Gosspetssvyaz petition for receipt of permission to work with TZI for own needs;

the TZI-set of Actions and Means complex, TZI intended for realization in information system or on object;

assessment of security of information organization and carrying out expert works and/or expert testing for the purpose of check, the analysis and assessment of objects of examination of their compliance to requirements of regulating documents in the field of TZI;

the instruction about elimination of violations - the written requirement of officials of Gosspetssvyaz, obligatory for accomplishment, to the head of the subject of check on elimination of the revealed violations in certain terms;

works on identification of mortgage devices carrying out of search actions for identification of the technical channels of information leakage which are formed due to use of mortgage devices.

Other terms used in this Provision are used in the values given in the Laws of Ukraine "About information protection in information communications systems", "About public service of special communication and information protection of Ukraine", "About electronic communications", the Procedure for the organization and providing the mode of privacy in state bodies, local government bodies at the companies, in organizations and the organizations, No. 939 approved by the resolution of the Cabinet of Ministers of Ukraine of December 18, 2013.

4. Work types with TZI which are carried out on permission:

1) estimation of security of information which is not the state secret;

2) estimation of security of information of all types, including information which is the state secret;

3) detection of mortgage devices.

II. Requirements for work for TZI

1. For receipt of permission the state body shall have:

the regulatory framework (regulatory legal acts, regulating documents in the field of TZI and internal documents) providing carrying out the corresponding work type on TZI;

own (or leased) the means of the measuring equipment and control and the equipment confided in accordance with the established procedure which are necessary for work on TZI for own needs which list is determined in appendix 1 to this provision and/or the work techniques specified in nation-wide or approved with Administration of Gosspetssvyaz by TZI;

the information (automated) system with complex information security system with the confirmed compliance (in case of receipt of permission on identification of mortgage devices - if necessary);

Disclaimer! This text was translated by AI translator and is not a valid juridical document. No warranty. No claim. More info