PD protection and the PDPS

• Stage
• Question
• Yes
• No

• Resource
• I. Does the resource process PD: collection, receipt, transfer, storage?
• to question II
• not a PDIS

• Resource
• II. Is the only PD in the resource users' logins and passwords?
• not a PDIS
• PDIS, to stage 2

• Person
• III. Does the person see itself as operator or processor in this PDIS?
• to question V
• to question IV

• Person
• IV. Is there technical access to PD, even encrypted without a key?
• to question V
• not a PDIS operator

• Person
• V. Does the person own (real right) the hardware with the PD database?
• to question VI
• PDIS user

• Person
• VI. Does the person only provide its hardware for others' PD databases?
• not a PDIS operator
• to question VII

• Person
• VII. Has the person contracted for full operation of the PDIS?
• operator - counterparty
• PDIS operator

Resource

Info system, incl. cloud, e-mail, messenger, video calls, network drive, website, app

System operation

support of software, hardware, security tools; training; maintenance; purchase; upgrades; updates

• PL-1
• + automatic logging of access-right changes and a security unit (cl. 16)

• PL-2
• + message log access only for those who need it for work (cl. 15)

• PL-3
• + a PD security officer in the PDIS (cl. 14)

• PL-4
• base (cl. 13): premises, media, access list, security tools vs relevant threats

• Level is set by
• type of relevant threats
• PD category: special, biometric, public, other

• operator's employees or other persons
• more or fewer than 100k subjects

Rule: the level is set for each PDIS separately; if several conditions apply, take the strictest. At any level the PDIS operator determines threats, assesses the effectiveness of measures before launch, sets access rules, logs actions with PD and monitors the measures

Cl. 14, Res. 1119

Appointment mandatory from protection level 3

an employee of the PDIS operator is responsible for PD security in the system; with crypto tools, FSB Order No. 378 requires adequate skills

Functions and tasks

organising and coordinating PD security in systems

identifying relevant threats

organisational and technical safeguards

restoring PD after unauthorised access

access rules, logging and recording actions with PD

monitoring measures taken

directive documents on PD security

detecting, investigating and eliminating consequences of PD incidents

Candidates

From specialised units

CISO or CIO, their deputies and lead specialists of IS and IT units, or the DPO

Sanction

Art. 13.12(6) of the CAO

for failure to appoint and other info protection breaches: legal entity ₽50-100k, official ₽10-50k. Higher risks in state bodies and NPOs

Benefit

Liability is concentrated

lowers the risk to the sole executive body in a computer incident, but a manager must still oversee subordinates

• 1
• PD threat model

30 work days

Inputs

record of processes and PDIS

questionnaire on security tools in use

Work

analysing PD security threats

identifying relevant threats

threat model per FSTEC documents

Result

threat model, agreed with the FSTEC or FSB licensee if one is engaged

• 2
• PD protection measures

30 work days

Inputs

threat model

Work

PD protection and threat elimination measures

PDPS terms of reference

technical design per FSTEC and FSB documents

Result

PDPS terms of reference, design, security tools spec and explanatory note

• 3
• Security tools rollout

60+ work days

Inputs

security tools spec from the design

Work

buying security tools per the spec

deployment and setup, scope and timing by agreement

Result

PDPS per FSTEC and FSB documents

Note: engaging a licensee is optional; operators may protect their own systems and choose the form of the threat document (FSTEC letter of 10.04.2025). Until a new order, Order No. 21 sets the measures

• Report
• Status
• What it sets

• Res. No. 1119
• in force
• four PD protection levels and the requirements for each

• FSTEC Order No. 21
• to be repealed
• content of measures, table of baseline measures by level

• FSTEC draft No. 169583
• not adopted
• 21 activities, 17 technical measure groups, no table; measures set in a policy; maturity indicator

• FSTEC documents of 2026
• guidance
• system measures (12.04.2026), maturity method (07.08.2026), unscheduled assessment note (24.08.2026)

• FSTEC Order No. 117
• state systems
• No. 137 version from 01.09.2026; new K(zi), U(zi) contractor calculation from 01.03.2027

• FSB Orders No. 378 and No. 321
• crypto
• No. 378 for PDIS, No. 321 of 22.08.2026 for state systems: four cases of mandatory encryption

Preparation: until the draft is adopted, track measures in two columns: the measure code from the Order No. 21 annex and the draft's direction. Then the switch means relabelling, not rebuilding the set

Organisational-technical measures

backup

memory area isolation

destruction of residual data

integrity control

password changes

limiting network services and protocols

OS software tools

protection from analysis, modification, launch

warnings about dangerous actions

privilege separation, logging, control

identification and authentication

backup

Additional software tools

Cryptographic

end-to-end and link encryption, password encryption, steganography, e-signature, VPN

Malware protection

integrity control, malware detection, testing, recovery utilities

Network

testing of networks and programs, attack detection, firewalls

Order: measures first, then tools with the needed functions; do not duplicate built-in OS mechanisms. Certified security tools counter relevant threats, crypto tools cover unprotected channels and media. Assess effectiveness before PDIS launch