Order 239

Only 11% of Organizations Fully Ready for New Russian Critical Infrastructure Protection Rules

An AM Live broadcast on KII security revealed that just 11% of surveyed organizations have completed all preparations ahead of the March 1, 2027 deadline for updated critical information infrastructure requirements. Experts discussed the shift from process-based approaches to sector-specific model objects, new obligations for calculating protection indicators every six months and maturity levels every three years, and practical challenges including import substitution compatibility, contractor oversight, remote access, and incident readiness. Speakers stressed that delaying preparations until the last day is risky and recommended starting early to meet both regulatory and internal security needs. The 239th order measures were highlighted as closely aligned with protection indicators, while failure to supply requested documentation within 30 days can reset scores to zero. Audience polls showed 53% view software and hardware compatibility during replacement as the biggest barrier, with many calling for real-world pilot testing rather than relying on vendor claims.