Only 11% of companies are fully prepared for new requirements on protecting critical information infrastructure (KII), according to a viewer poll conducted during the AM Live broadcast. The episode focused on KII security and examined the transition from process-oriented methods to standardized sector-specific objects.
Participants reviewed upcoming obligations effective March 1, 2027, including biannual calculations of protection indicators and triennial maturity assessments. Practical issues such as compatibility during import substitution, contractor control, remote access management, and incident response readiness were also addressed in detail.
The poll indicated that another 34% of organizations are still determining exactly what changes are needed, while 12% stated they do not qualify as KII subjects. Expert Alexey Orekhov advised against last-minute planning, noting that calculations completed on February 28 would not produce valid results by the deadline and urging organizations to begin preparations early for their own benefit.
Yuri Podgorbunsky pointed out that the protection indicator correlates at 90% with measures in the 239th order, making compliance achievable when systems are properly configured. Sergey Saiganov reminded attendees that failure to provide requested documentation to regulators within 30 days results in the indicator being reset to zero.
Among obstacles to genuine security, 53% of viewers cited compatibility problems when replacing software and equipment. Konstantin Zakatov recommended purchasing only hardware with pre-existing compatibility certificates. Alexander Sukhovey stressed the need for actual pilot testing, as vendor statements often fail in practice.
Additional challenges included budget and specialist shortages. On verification of protective measures, 50% reported conducting technical security checks, 36% performed audits, and only 9% held response exercises. Experts described the low rate of drills as a significant weakness and called for integrating response practice into standard IT and security processes.
