In accordance with the requirements of 187-FZ "On the Security of the Critical Information Infrastructure of the Russian Federation", the company had to tie the plant's critical information infrastructures (CIIs) to significance criteria, their values, and either to assign a significance category or decide that there is no need to assign any significance category to them.
To comply with legal requirements and regulatory guidelines, the company needed a contractor who could promptly review, identify, and categorize CIIs.Key Challenges
- Review, identify and categorize CIIs in order to comply with 187-FZ;
- Develop terms of reference for the creation of a system ensuring information security of CIIs.
Implemented our solution
At the preparatory phase, ICL experts assembled a working group, developed a work schedule, and approved it with the customer.
Next, the experts reviewed the company's IT infrastructure, detected business processes and identified critical processes among them — management, technological, production, financial, economic, and others which would lead to negative consequences if interrupted or terminated. For example, if a computer incident would result into harmful substances emitted into the environment or damage to life and health of people.
Based on identified critical processes, ICL experts defined several dozens of CIIs — automated control systems supporting these processes. The list of CIIs to be categorized was sent to FSTEC of Russia.
Then the experts initiated assessment of possible negative consequences at each CII according to the following criteria:
- Social significance
- Political significance
- Economic significance
- Environmental significance
- CII significance to ensure national defense, security and public order
Results
- The terms of reference for the creation of a system for ensuring information security of CIIs were developed.
- The categorizing assignment was completed in less than two months and in full compliance with the requirements of the legislation of the Russian Federation so that the customer was able to timely deliver categorization results to FSTEC of Russia.
- All stages of CIIs categorization were thoroughly documented, allowing the customer to avoid claims from the national regulatory authorities.