The law on critical information

[Rakhirandiseo]

Numerous draft regulatory documents from FSTEC and FSB should be adopted in 2018, but let's not forget the fate of the methodological recommendations for modeling personal data threats - the draft has not been approved since 2015. Until there is an approved package of documents, the heads of many organizations will block the allocation of serious budgets - simply so as not to rework the information security systems of critical information infrastructure. However, we can expect increased demand for various "mini-hills", "mini-systems for protecting critical information infrastructure" and various roadmaps - infrastructure has entered into force and some activity will need to be shown.

Depending on the activity of market players and the new zealand whatsapp data of the projects, the situation with the approval of documents will be resolved - it will be determined whether it is profitable to have clear documents or whether it is worth continuing to fish in troubled waters, since the corresponding public procurement in Russian Railways in 2017 alone amounted to several hundred million rubles.

Personal data - GDPR and blocking
The Yarovaya Law was postponed again, there was no major blocking similar to LinkedIn, the tightening of fines for violating information processing regulations was not so strict (200,000 instead of 20,000 rubles does not scare anyone) - the sphere of personal data protection in 2017 was more or less calm.

A significant reserve for future changes was the section on the protection of "big personal data" of the plan for the direction of information security within the framework of the "Digital Economy" program. The necessary regulatory acts will be created, while cloud providers are currently indicated as the main object of regulation. At the same time, the same program has a section on the information security of "supermassive data" - and it is not yet clear how these regulations will coexist. However, this is primarily a prospect for 2019, by the end of which, according to the plan, the regulatory process will be completed.