MinTsifry Proposes Requiring Telecom Operators to Install SORM Equipment Before Obtaining Licenses
The Russian Ministry of Digital Development (MinTsifry) is preparing amendments that would require telecommunications operators to install SORM equipment before they can receive an operating license. According to three sources familiar with the ministry’s plans and supporting materials for the draft legislation, operators will only be allowed to begin serving subscribers after the surveillance systems have been commissioned and transferred to law enforcement agencies.
Under existing rules, an operator needs only a coordinated network diagram that lists both already-deployed and planned SORM components to obtain a license. The new requirement is intended to eliminate a long-standing loophole used by bad-faith market participants who formed legal entities, secured licenses, operated without SORM, then liquidated the companies and repeated the process with new entities.
Gen. Director of AO ESK Alkhas Mirzabekov acknowledged that the measure makes sense from a security and control perspective but warned of its impact on legitimate operators. The cost of the minimum SORM complex begins at 5 million rubles, an amount comparable to the annual development budget of a small local provider serving several thousand subscribers.
Founder of Internet-Rozysk Igor Bederov emphasized that an operator licensed and active without functional SORM connectivity creates a blind spot for law enforcement. He noted that frequent changes of legal entities have allowed such operators to function for years without the required equipment.
The ministry intends to allow license revocation in an extrajudicial manner for violations of the new obligation. No transition period or differentiation by operator size has been specified in the current draft materials.
Related articles
GOST R 57580 Compliance: Defining Assessment Scope to Verify Real Protection in Financial Organizations
Financial institutions often maintain extensive documentation on information security yet still fail GOST R 57580 assessments due to mismatches between documented processes and actual infrastructure. The standards GOST R 57580.1-2017 and GOST R 57580.2-2018 set distinct requirements for protection levels and evaluation methodology. Correct application begins with identifying the organization's regulatory category under Bank of Russia rules such as Regulation 851-P for credit institutions or Regulation 757-P for non-credit financial organizations. Defining the precise assessment boundary is critical, including systems, remote access channels, virtualization components, and third-party interactions. Organizations must also distinguish between the full assessment scope and the representative sample selected for verification. Evidence collection requires both policy review and technical confirmation that controls function as intended across the evaluated environment.
Evaluating Secure Development Maturity: Comparing BSIMM, DSOMM, SAMM and GOST R 56939-2024
A detailed analysis compares four methodologies for self-assessing secure software development maturity in Russian companies. The review covers BSIMM from Black Duck, OWASP DSOMM, OWASP SAMM and the updated Russian national standard GOST R 56939-2024. Each model was tested through a simulated audit on a fictional company called ООО «Лиса и лосЬ» that uses GitLab, Nexus and SonarQube. The evaluation scored the methodologies on criteria including ease of maturity calculation, recommendation generation, roadmap building, heat-map creation and SDLC coverage. GOST R 56939-2024 and SAMM received the highest total scores of 35 and 34 out of 47. The article concludes that no single methodology covers all needs and recommends combining approaches tailored to specific company contexts.
GlobalSign Launches New Wave of SSL/TLS Certificate Revocations Targeting Russian Organizations
GlobalSign has initiated another round of revocations affecting SSL/TLS certificates issued to Russian websites, with a total of 11,000 certificates withdrawn from 1,300 organizations so far. The revocations primarily impact entities listed in EU and US sanctions regimes, in line with updated CA/Browser Forum requirements that took effect in May 2026. Greek CA HARICA has also participated in the revocations, sometimes completing the process within seconds and leaving site owners little time to respond. The actions stem from mandatory checks against the OFAC SDN List, BIS Denied Persons List, and equivalent European sanctions databases. Russian authorities recommend obtaining domestic TLS certificates via Gosuslugi within three business days to maintain secure access in foreign browsers. Let's Encrypt has similarly updated its policies to restrict certificates for sanctioned Russian entities while continuing issuance for others.
Kaspersky Container Security Earns FSTEC Russia Certification as Antivirus Protection Tool
Kaspersky Container Security has received official certification from FSTEC Russia under certificate number 5122 dated October 23, 2026. The product was validated as a means of antivirus protection and meets the regulator’s requirements at the fourth level of trust. It also complies with the protection profile of type B for the fourth class, designated IT.SAVZ.B4.PZ. The certification enables deployment of the solution in government information systems, personal data processing environments, critical information infrastructure facilities, and industrial control systems. Specific usage must still align with individual system requirements and the conditions stated in the certificate. The solution has been listed in the Russian software registry maintained by the Ministry of Digital Development since 2023. Primary audiences include government agencies, large enterprises, and industrial operators that rely on containerized workloads inside regulated perimeters.