Inventory and Classification of Information Assets
Under Article 5 of the law on information security, a critical information system subject must inventory its information systems to record every information asset. Each asset is assigned a criticality class — confidential or internal-use — while all other assets are open information. The inventory describes each asset’s significance, value and existing protection level; at creation, the class is set by the author or responsible person. Asset management rules for first- and second-category subjects are set by order of the head of the Operative-Technical Agency, for the third category — by the Digital Governance Agency, in defense — by the Minister of Defense; for commercial banks, additional standards come from the National Bank.
Information Security Audit and Penetration Testing
Under Article 6, the subject must conduct an initial and a periodic information security audit — an assessment of compliance with the minimum standards — ending with a conclusion whose requirements are mandatory. The initial audit of a first-category subject is carried out free of charge by the Operative-Technical Agency; the periodic audit — by the Agency or an organization authorized by the Digital Governance Agency. For second-category subjects the same bodies apply, for the third — the Digital Governance Agency or an authorized organization, in defense — the Cybersecurity Bureau. Audit requirements do not apply to payment, securities settlement and reserve management systems, nor to systems used for monetary and currency operations. Under the same rules a penetration test is carried out — per a pre-planned, documented task — ending with a mandatory conclusion. Where weaknesses are found, the subject draws up an action plan with a schedule and submits it for approval within 1 month to the relevant authority; for commercial banks — the National Bank. The audit proceeds in cooperation with the information security manager and the computer security specialist.
Authorization of Auditors
Article 6-1 defines who may conduct audits and penetration tests: an organization that has passed authorization at the Digital Governance Agency. The person carrying out the audit must have passed a security check under a procedure set by a normative act of the head of the State Security Service. In commercial banks, organizations from an additional list of authorized organizations may also be engaged, submitted by the National Bank to the Digital Governance Agency.