Russia Federal Law 187-FZ on Critical Information Infrastructure
National cybersecurity framework: software asset inventory, component integrity, supply-chain verification, and vulnerability management.
National cybersecurity framework: software asset inventory, component integrity, supply-chain verification, and vulnerability management.
| Short name | RU 187-FZ |
| Region | Europe |
| Country or scope | Russia |
| Sector | Government |
| In your workspace | Off until you switch it on in Compliance › Manage. |
How Safeguard covers RU 187-FZ
- Scan requirements: 6, all decided by a scan.
- Controls: the scan requirements below.
- Automated tests: none map to it directly. You can link any automated test to its controls yourself (how).
- Policy templates: 22 from the standard set.
How each kind of coverage works, and what the readiness score counts: Compliance frameworks.
What a scan checks
Each scan of a product checks these 6 requirements against what the scan found, including the product's software inventory (SBOM).
| Requirement | What Safeguard checks | Decided by |
|---|---|---|
RU-187FZ-9 Duties of CII Subjects | CII subjects must prevent unlawful access to information processed by significant objects and prevent its destruction or modification; verifiable integrity hashes across software components evidence tamper protection (187-FZ Art. 9) | Scan |
RU-187FZ-7 Categorization of CII Objects | CII objects must be categorized by significance and entered in the state register, which presupposes that each system is named and its software composition enumerated (187-FZ Art. 7) | Scan |
RU-187FZ-10 Security System for Significant Objects | Significant CII objects must operate under a security system whose functions include continuous inventory and monitoring of the object's software assets (187-FZ Art. 10) | Scan |
RU-187FZ-11 FSTEC Security Requirements and Update Management | Security requirements established for significant objects include vulnerability analysis and controlled software updates, which requires knowing the exact version of every deployed component (187-FZ Art. 11 with FSTEC Order No. 239) | Scan |
RU-187FZ-239-SUP Trusted Software Acquisition | FSTEC requirements for significant objects address security during acquisition and use of software, favoring components whose origin and supplier are known and verifiable (187-FZ implementing requirements, FSTEC Order No. 239) | Scan |
RU-187FZ-INC Incident Reporting Readiness | CII subjects must immediately inform the GosSOPKA system of computer incidents, which requires machine-usable identification of the affected software components (187-FZ Art. 9 incident-reporting duty) | Scan |
Policy templates
All 22 from the standard set, adapted to RU 187-FZ.
Russia Federal Law 152-FZ on Personal Data
National data-protection law: technical safeguards, records of processing software, third-party/processor accountability, and integrity controls.
San Marino Law 171/2018 on Data Protection
National data-protection law: technical safeguards, records of processing software, third-party/processor accountability, and integrity controls.