Software localization drivers: foreign sanctions and the domestic ban on foreign software for critical information infrastructure

1. At first, it is necessary to define the status of a "CII subject".

CII subjects include, in particular, individual entrepreneurs and legal entities that (i) carry out their activities in the areas set forth by Federal Law No. 187-FZ dated 26 July 2017 "On the Security of Critical Information Infrastructure of the Russian Federation" (hereinafter — the CII Law), and (ii) control CII facilities under ownership rights, a lease or otherwise legally.

The areas set forth by the CII Law include healthcare, science, transport, communications, energy, state registration of rights to immovable property and transactions therewith, banking and other financial market areas, the fuel and energy complex, nuclear power, and the defense, space, mining, metallurgy and chemical industries. Accordingly, the restrictions may apply to hospitals, research institutes, universities, public transport and taxis, credit institutions, oil refineries and petrol stations — a very wide range of companies in various industries.

CII facilities include information systems (e.g., programs included in the 1C package), information and telecommunication networks (e.g., local networks, provider equipment), and automated control systems (e.g., numerically controlled machine tools).

2. After the establishment of "CII subject" status, it is necessary to categorize the CII facilities in order to determine which of the CII facilities are significant, since the restrictions under Decree No. 166 relate only to significant CII facilities.

What should be done:

• Organize and assign responsibility to a special internal commission which should include a CII subject leader or a person thereby authorized, a CII subject employee responsible for information security, and a CII subject employee having access to state secrets, etc. — requirements for members of the commission were set by Government Regulation No. 127 dated 8 February 2018 "On Approval of the Rules for Categorization of Critical Information Infrastructure Facilities of the Russian Federation, as well as the list of indicators of the criteria of significance of critical information infrastructure facilities of the Russian Federation and their values" (hereinafter — Government Regulation No. 127).
• Collect all the necessary information — compile a list of all CII facilities.
• Categorize the CII facilities in accordance with the criteria established by Government Regulation No. 127 and thus identify significant CII facilities.
• Send the outcome of the categorization to FSTEC. If necessary, the comments received from FSTEC should be taken into account.

3. After identifying significant CII facilities, it is necessary to bring personal procurement activity (and information security systems — after the establishment of the status of CII subject) into accordance with the established requirements, and to prepare for the rejection of foreign software and a transition to domestic equivalents. For all CII subjects this relates to "unfriendly" Foreign Software in the field of information security, while for persons carrying out procurement under Federal Law No. 223 and public authorities this relates to the complete rejection of Foreign Software at significant CII facilities.

In the near future, companies operating in healthcare, science, transport, communications, energy, state registration of rights to immovable property and transactions therewith, banking and other areas of the financial market, the fuel and energy complex, nuclear power, the defense, space, mining, metallurgy and chemical industries, should pay special attention to identifying their status in accordance with the Law on CII, as well as to categorizing CII facilities and gaining approval of such categorization from FSTEC. Once the list of significant CII facilities has been established, it is necessary to start searching for or ordering the development of domestic programs capable of replacing Foreign Software.

The B1 team is ready to provide support on various issues related to determining whether our clients are categorized as CII subjects, to provide technical and legal support to the organization, and to carry out the procedure for categorization of CII facilities, including initial preparation of the position before interacting with authorized bodies, as well as to prepare agreements accompanying the transformation.

• Natalia Aristova, Partner, Legal Services
• Anton Sidnin, Senior Associate, Legal Services
• Dmitry Korovin, Senior, Legal Services