The transition to domestic software and hardware will be delayed
17.11.2021
.jpg)
The State Legal Department (GPU) of the President criticized the draft presidential decree on the transition of critical information infrastructure (CII) facilities to domestic software (SW) and equipment developed by the Ministry of Digital Development. The document proposes to establish a single term for import substitution in networks significant for the state — from January 1, 2023, but it does not assess the possibility of fulfilling these requirements within the specified period, in addition, it may contradict the Constitution, the GPU believes.
“Kommersant” got acquainted with the review of the head of the GPU President Larisa Brycheva on the draft presidential decree developed by the Ministry of Digital Development on economic measures to ensure the technological independence and security of CII facilities. The GPU sent the document to the government apparatus on November 1.
CII facilities include government agencies, banks, defense industry enterprises, transport facilities, healthcare facilities, etc. Their technological networks are critical for the country.
In the draft decree of the Ministry of Digital Development proposed to establish a single term for the transition of CII to domestic equipment and software — January 1, 2023. Organizations will have to implement this requirement in the presence of domestic analogues, after the expiration of the rights to the software used and after the expiration of the depreciation of existing equipment. Import substitution in terms of software will be controlled by the Ministry of Digital Development, and in terms of equipment — Minpromtorg. In the banking sector, the process must be coordinated by the Central Bank (see “Kommersant” dated November 11).
assess compliance. In addition, the draft is contrary to the Constitution (part 3 of article 55), since it proposes to impose import substitution on a wide range of people, however, their rights and freedoms can only be limited in order to ensure the defense of the country and the security of the state exclusively by federal law, writes Larisa Brycheva.
Also, the responsibility for approving the transition procedure and requirements for software and equipment at KII facilities in the project is proposed to be assigned to the government, while the directions of state policy in the field of KII security are authorized to be determined by the president, the recall emphasizes. The Ministry of Digital Development declined to comment.
The terms of import substitution at KII facilities were the subject of heated discussion. The Ministry of Digital Development proposed to introduce an obligation for CII to use domestic software from 2021, and Russian equipment — since 2022. But banks opposed this: they demanded a delay until 2025-2026, which has already caused outrage among domestic developers associations. As a result, the Ministry of Digital Development compromised and proposed to introduce the requirements from the beginning of 2023.
“It’s good that the GPU criticized the document: the longer it is not accepted, the better, & mdash; considers the interlocutor “b” in one of the banks. The project hits all critical sectors — from banks to metallurgists, he notes. “There are many unresolved issues: what to do if the bank has a “self-written” Software, and if the software is "outsourced"? The transition period is very aggressive. It is possible, but it must be smooth, otherwise there will be a security risk, & mdash; the interlocutor says. The deadline of just over a year is too ambitious, Raiffeisenbank Senior Analyst Sergei Libin agrees: “Probably, such a tight time frame was set to spur the development of the necessary software.”
Today, Russian manufacturers may well meet the requirements of CII with their developments: their quality and level of support are in no way inferior to foreign analogues, the director of the department for organizing work with customers of the Gazinformservice company is sure; Roman Pustarnakov. There is a chance that analogues of the equipment used by CII objects can be found in the registries, but the re-equipment of their — the process is not fast, the chief architect of the Informzaschita company noted; Pavel Demidov. Only design and survey work in this direction, he added, usually lasts longer than a year.
Yulia Stepanova, Polina Trifonova, Kommersant
