NIST Bans Periodic Password Rotation While Russia's FSTEC Mandates 90-Day Changes for Government Systems
In July 2025, NIST released the final edition of SP 800-63B, its core digital authentication guideline. Section 3.1.1.2 now states that verifiers and CSPs SHALL NOT require subscribers to change passwords periodically, upgrading the previous soft recommendation to a firm prohibition.
In April 2026, FSTEC approved a methodological document requiring passwords in government information systems and critical information infrastructure objects to be rotated at least every 90 days. Mobile devices face a stricter 30-day limit, and reuse of any of the last 12 passwords is forbidden.
Order No. 117 itself contains zero references to passwords. The order lists high-level protection measures, while concrete parameters such as length, complexity, and rotation periods are defined in subordinate methodological documents.
Three-layer document structure
The binding requirement appears only in the third document: the April 2026 methodological guide titled “Composition and Content of Information Protection Measures.” Measure IAF.3 explicitly mandates a minimum 12-character password, a 70-character alphabet, five failed attempts before lockout, 15-minute lockout duration, and rotation no later than 90 days. Measure ZMU.1 sets the 30-day mobile rule.
- Order No. 117 (April 2025, effective March 2026): no password mentions
- November 2025 KZI assessment methodology: checks complexity only
- April 2026 methodological document: full rotation requirements in IAF.3 and ZMU.1
Point 68 of Order No. 117 makes the methodological documents mandatory by requiring operators to implement measures “using FSTEC methodological documents.” Ignoring the guide therefore violates the registered order itself.
Commercial organizations outside government systems and CII subjects are not bound by the 90/30-day rules and may choose policies based on their own threat models, provided they document the rationale.
Related articles
Russia Ready to Disclose Source Code of Social Networks, Messengers and AI Models, Minister Shadaev Says
Russian Minister of Digital Development Maksut Shadaev announced that Russia is prepared to open the source code of its domestic social networks, messengers and video services to foreign partners. The offer includes showing the internal structure of the platforms and jointly modifying their algorithms. Shadaev compared reliance on Western IT products to digital colonialism, citing years of disagreements over compliance with Russian legislation. A similar proposal was made for Russian AI foundation models, which could be adapted to meet other countries' laws, cultural requirements and security standards. The statement was delivered at the Platform of Sovereign Development exhibition, yet no specific products, repositories, timelines or licensing terms were provided.
Russia Mulls Mandatory Two-Week IMEI Registration for Foreign Smartphones via Gosuslugi
Russian authorities are discussing a new rule requiring owners of smartphones imported without customs clearance or purchased abroad to register the devices through the Gosuslugi portal within two weeks. Failure to register would result in the device being blocked from Russian mobile networks. The Ministry of Digital Development is preparing the requirements, which remain under discussion with possible changes to timelines and details. Devices already operating in Russia before April 2027 would be exempt and continue working without restrictions. Officially imported equipment would be added to the registry automatically. The measure is expected to significantly impact gray-market sellers, potentially forcing up to 70 percent of them out of the market and driving price increases of up to 40 percent for some models.
Google Opens Registration for Registered App Stores Program to Simplify Third-Party App Installs on Android
Google has opened registration for its new Registered App Stores program, enabling approved third-party app stores to install applications with a single tap and perform background updates on Android devices. The program introduces stricter compliance requirements, including an annual $10,000 registration fee paid before review, mandatory submission of all APK files and updates for malware scanning, and organizational verification. These features will become available starting December 1, 2026, on devices running Android 17 QPR2 and newer versions, with Russia listed among supported countries. Stores that remain outside the program can continue using the existing multi-step installation process. Google will impose additional fees if more than 1% of installation attempts or 2% of catalog applications are flagged as potentially malicious within any 30-day period. The initiative aims to balance user convenience with enhanced security controls while remaining entirely voluntary for alternative app distributors.
Mobile Internet Slowdowns Reported in Central Moscow as Content Filtering Systems Activate for Summits
Residents in central Moscow reported noticeable degradation in mobile internet performance starting October 27, coinciding with the first day of possible restrictions announced by the Ministry of Digital Development. The measures involve content filtering systems deployed to comply with Russian legislation and ensure security during the Gas Exporting Countries Forum and Russia-Africa summits. Two Speedtest measurements shared via the Ostorožno, Moskva channel showed speeds dropping from 225.47 Mbit/s to 12.13 Mbit/s, though exact locations, operators, and test conditions remain unspecified. The ministry indicated that restrictions inside the Third Transport Ring could occur daily from 11:30 Moscow time on October 27-28 and from 9:30 on October 29. Access to resources in the approved whitelist is expected to remain available, while voice calls, fixed broadband, and Wi-Fi should continue without interruption. The practical recommendation for visitors is to download necessary maps, tickets, and documents in advance before traveling to the affected area.