Cybersecurity - Russia

Federal Law No. 187-FZ (adopted 26 July 2017, in force 1 January 2018) sets the core CII security regime, requiring owners of significant CII objects to categorize assets, apply protection measures and register with FSTEC, the technical-security regulator that supervises the field.

CII operators must report computer incidents to the FSB-operated GosSOPKA system via the National Coordination Center for Computer Incidents (NKTsKI), established in late 2018, which centralizes detection, analysis and coordinated response to attacks on Russian state and critical-sector networks.

Under Federal Law No. 152-FZ (amended from 1 September 2022), data operators must notify Roskomnadzor of a personal-data breach within 24 hours of detection, followed by results of an internal investigation within 72 hours.

Amendments to the Administrative Offences Code and Criminal Code in force from 30 May 2025 introduced GDPR-style turnover-based fines for repeat data leaks (up to 1–3% of annual revenue, capped at RUB 500 million) plus new criminal liability of up to 10 years' imprisonment for illegal handling of unlawfully obtained personal data.

The Bank of Russia regulates information security for banks and financial-market participants and runs FinCERT, the financial-sector incident-exchange and response center; over 800 organizations including all Russian banks share incident data through it.

Oversight is split among FSTEC (technical protection and CII categorization), the FSB (GosSOPKA/NKTsKI operational threat response) and Roskomnadzor (personal-data protection and breach notifications), reflecting a centralized, state-controlled model.