Russian authorities are considering mandatory security audits for programmable logic controllers (PLCs) to detect hidden vulnerabilities. The proposal, initiated by Vitaly Misuragin of NPO Critical Information Systems, aims to ensure the security of critical information infrastructure. A pilot project to identify these undocumented features is currently underway with NPP Gamma and is scheduled to conclude by the end of 2026.
Industry experts warn that these requirements could significantly impact development timelines and costs. According to estimates, the full cycle for creating and certifying complex controllers could double, extending from 1.5 to three years. Furthermore, compliance costs may consume up to one-third of the total budget allocated for research and development, creating significant barriers for smaller manufacturers.
Starting January 1, 2030, only trusted software and hardware complexes will be permitted for use at critical infrastructure facilities in Russia. A national standard for verifying these devices has been in effect since March 2026. Despite these measures, experts note that achieving full technological independence remains challenging due to limited access to domestic electronic components for mass-market PLCs.
