RZD Trunk Quantum Network Obtains FSTEC Attestation and Enters External Commercial Market
RZD’s trunk quantum network has successfully completed attestation by the Federal Service for Technical and Export Control (FSTEC). The official document confirms that the infrastructure fully complies with the regulatory requirements applicable to information systems of the second class of protection under Russian legislation.
This certification is far more than a formal document for RZD. It grants the company the legal right to provide commercial services based on its quantum network to third-party organizations, ranging from banks and industrial enterprises to medical institutions and transport companies. The primary focus of these services is the protection of critically important data.
Quantum communications offer a fundamentally higher level of security compared with traditional encryption. Any attempt to intercept the encryption keys is immediately detected because interference with the quantum channel changes the state of the transmitted particles, making the intrusion impossible to conceal. This capability is especially valuable for owners of critical information infrastructure objects, for whom conventional “complex passwords” are no longer considered sufficient protection.
The technology is already being actively tested in the financial sector. Among the organizations currently piloting quantum channels are the Bank of Russia, the Federal Treasury, the Financial University, and several of Russia’s largest banks. Potential future clients also include companies from the oil-and-gas industry, manufacturing, healthcare, and transportation sectors.
According to the Ministry of Digital Development, quantum communication technology has now reached a sufficiently high level of maturity. Further expansion of the quantum network until 2030 has been incorporated into the relevant departmental roadmap and the national project “Data Economy”.
Consequently, RZD is gradually evolving beyond its traditional role as a carrier of passengers and freight. The company is positioning itself as an operator of secure digital highways, where, in addition to conventional rail traffic, quantum keys will also travel along its infrastructure.
Related articles
Evaluating Secure Development Maturity: Comparing BSIMM, DSOMM, SAMM and GOST R 56939-2024
A detailed analysis compares four methodologies for self-assessing secure software development maturity in Russian companies. The review covers BSIMM from Black Duck, OWASP DSOMM, OWASP SAMM and the updated Russian national standard GOST R 56939-2024. Each model was tested through a simulated audit on a fictional company called ООО «Лиса и лосЬ» that uses GitLab, Nexus and SonarQube. The evaluation scored the methodologies on criteria including ease of maturity calculation, recommendation generation, roadmap building, heat-map creation and SDLC coverage. GOST R 56939-2024 and SAMM received the highest total scores of 35 and 34 out of 47. The article concludes that no single methodology covers all needs and recommends combining approaches tailored to specific company contexts.
GlobalSign Launches New Wave of SSL/TLS Certificate Revocations Targeting Russian Organizations
GlobalSign has initiated another round of revocations affecting SSL/TLS certificates issued to Russian websites, with a total of 11,000 certificates withdrawn from 1,300 organizations so far. The revocations primarily impact entities listed in EU and US sanctions regimes, in line with updated CA/Browser Forum requirements that took effect in May 2026. Greek CA HARICA has also participated in the revocations, sometimes completing the process within seconds and leaving site owners little time to respond. The actions stem from mandatory checks against the OFAC SDN List, BIS Denied Persons List, and equivalent European sanctions databases. Russian authorities recommend obtaining domestic TLS certificates via Gosuslugi within three business days to maintain secure access in foreign browsers. Let's Encrypt has similarly updated its policies to restrict certificates for sanctioned Russian entities while continuing issuance for others.
Kaspersky Container Security Earns FSTEC Russia Certification as Antivirus Protection Tool
Kaspersky Container Security has received official certification from FSTEC Russia under certificate number 5122 dated October 23, 2026. The product was validated as a means of antivirus protection and meets the regulator’s requirements at the fourth level of trust. It also complies with the protection profile of type B for the fourth class, designated IT.SAVZ.B4.PZ. The certification enables deployment of the solution in government information systems, personal data processing environments, critical information infrastructure facilities, and industrial control systems. Specific usage must still align with individual system requirements and the conditions stated in the certificate. The solution has been listed in the Russian software registry maintained by the Ministry of Digital Development since 2023. Primary audiences include government agencies, large enterprises, and industrial operators that rely on containerized workloads inside regulated perimeters.
Russian Lawmaker Clarifies Apple and Microsoft ORI Registry Listing Does Not Ban Products
State Duma deputy Anton Nemkin stated that the inclusion of Apple and Microsoft in Russia's ORI registry imposes standard data retention obligations without automatically prohibiting their products. The registry entry requires companies to store user information and message exchange records in Russia for three years and message content for up to six months. Nemkin emphasized that these rules apply equally to Russian and foreign digital market participants regardless of business scale or country of registration. The companies were added on October 2, 2026, while Google Meet has been listed since January 26. Although the status mandates data provision to authorized bodies in legally defined cases, the listing itself does not confirm that corporations will share Russian users' correspondence with the state. Non-compliance may trigger separate regulatory measures, but the deputy urged against exaggerating consequences through sensational headlines.