MTS, MegaFon and Beeline Must Temporarily Suspend Radio Equipment at FSO Request Under Extended Frequency Licenses
Russian mobile operators MTS, MegaFon and VimpelCom (operating as Beeline) have had their radio-frequency allocations extended until 31 December 2027, subject to a new mandatory condition imposed by the State Commission for Radio Frequencies (GKRCH).
Under the decision adopted at the commission’s meeting on 31 August, the operators must temporarily suspend operation of their radio-electronic equipment at the request of the Federal Security Service (FSO). The requirement covers periods of security measures, particularly important state work and special events conducted by the FSO.
The condition has been formally incorporated into the licence terms that originated in 2006. While the FSO has held statutory authority to request such suspensions since 2011, the latest ruling ties compliance directly to the continued validity of the frequency permits themselves.
For subscribers, the practical effect may be short-term unavailability of mobile services in the relevant geographic zones during the periods when equipment is switched off. The operators must nevertheless continue fulfilling parallel rollout obligations, including full coverage of all populated areas with 2,000 or more residents by 31 March 2027.
The single regulatory document therefore imposes two distinct responsibilities: expanding network reach while maintaining technical readiness to implement temporary shutdowns ordered by security authorities. The actual impact on users will depend on how frequently and for how long the FSO invokes these powers in practice.
Related articles
Roskomnadzor Deploys 2.27 Billion Ruble AI Traffic Filter: Known Facts and Expert Speculations
Russian regulator Roskomnadzor has integrated a machine learning-based traffic filtering system into the automated security infrastructure of the Russian internet segment. The system, valued at 2.27 billion rubles, operates on domestic models within the agency's own infrastructure and connects to TSPU equipment that performs DPI-based filtering. Publications including Forbes, Meduza, 3DNews and SecurityLab base their reporting on the 2026 digital transformation passport, which also allocates additional billions for TSPU upgrades and hardware. Experts suggest the model analyzes packet sizes, session durations, traffic ratios and server characteristics rather than relying solely on known signatures, though no official performance metrics have been released. The exact role of the model—real-time analysis versus signature generation—remains unconfirmed, as does its impact on VPN protocols and potential for false positives affecting corporate and cloud traffic.
MinTsifry Proposes Requiring Telecom Operators to Install SORM Equipment Before Obtaining Licenses
The Russian Ministry of Digital Development plans to introduce legislation obligating telecom operators to deploy SORM surveillance systems prior to receiving operating licenses. Under the proposed rules, companies will only be permitted to begin serving subscribers after the equipment has been installed and handed over to law enforcement agencies. Non-compliance could result in license revocation through an extrajudicial administrative process. Current regulations allow operators to obtain licenses with a network diagram that merely indicates planned or existing SORM components. The change aims to close loopholes exploited by unscrupulous providers that repeatedly register new legal entities to operate without surveillance capabilities. Industry experts note that the minimum cost of a basic SORM complex starts at 5 million rubles, which could disproportionately affect smaller local providers without a transition period or scaled requirements.
GOST R 57580 Compliance: Defining Assessment Scope to Verify Real Protection in Financial Organizations
Financial institutions often maintain extensive documentation on information security yet still fail GOST R 57580 assessments due to mismatches between documented processes and actual infrastructure. The standards GOST R 57580.1-2017 and GOST R 57580.2-2018 set distinct requirements for protection levels and evaluation methodology. Correct application begins with identifying the organization's regulatory category under Bank of Russia rules such as Regulation 851-P for credit institutions or Regulation 757-P for non-credit financial organizations. Defining the precise assessment boundary is critical, including systems, remote access channels, virtualization components, and third-party interactions. Organizations must also distinguish between the full assessment scope and the representative sample selected for verification. Evidence collection requires both policy review and technical confirmation that controls function as intended across the evaluated environment.
Evaluating Secure Development Maturity: Comparing BSIMM, DSOMM, SAMM and GOST R 56939-2024
A detailed analysis compares four methodologies for self-assessing secure software development maturity in Russian companies. The review covers BSIMM from Black Duck, OWASP DSOMM, OWASP SAMM and the updated Russian national standard GOST R 56939-2024. Each model was tested through a simulated audit on a fictional company called ООО «Лиса и лосЬ» that uses GitLab, Nexus and SonarQube. The evaluation scored the methodologies on criteria including ease of maturity calculation, recommendation generation, roadmap building, heat-map creation and SDLC coverage. GOST R 56939-2024 and SAMM received the highest total scores of 35 and 34 out of 47. The article concludes that no single methodology covers all needs and recommends combining approaches tailored to specific company contexts.