The FSTEC Order No. 117 establishes new requirements for the certification of state information systems (GIS), state-owned enterprises, and institutions. This regulation also applies to infrastructure interacting with protected resources. Compliance requires a structured approach to infrastructure segmentation and the selection of a licensed contractor for certification testing.
Key technical updates include mandatory two-factor authentication for specific system classes (K1, K2, and K3) and the adoption of IdM/IAM solutions for K1 and K2 systems. Virtualization security now prioritizes built-in platform tools over overlay solutions. Additionally, web services must utilize application-level firewalls, while internet-connected endpoints require EDR-class systems.
New regulations effective September 1, 2026, mandate penetration testing for K1 and K2 systems, incorporating both internal and external threat simulation. Organizations must also perform vulnerability analysis and remediation. Post-certification, operators must maintain documentation and conduct additional testing if infrastructure changes occur, provided the security class remains unchanged.
When engaging a contractor, organizations should verify experience with Order No. 117, the ability to validate compensating measures for technically unrealizable requirements, and established communication protocols. The certification process involves comprehensive audits of both security documentation and the technical implementation of protection measures.
