Since the beginning of 2025, the Committee, as the authorized body in the field of information security in the sphere of informatization, in the field of personal data and its protection, as well as electronic documents and electronic digital signatures for compliance with the legislation of the Republic of Kazakhstan on electronic documents and electronic digital signatures, conducted 229 unscheduled inspections and administrative cases without visiting the site, brought 133 officials, individuals, and legal entities to administrative responsibility in accordance with part one, part four, part five of Article 79, part four, part five of Article 640, paragraph 1 and paragraph 2 of part one of Article 641 of the Code of Administrative Offenses of the Republic of Kazakhstan
The main types of violations in terms of information security (hereinafter referred to as IS) are: the use of postal services whose servers are not located in the territory of the Republic of Kazakhstan; the lack of an Internet connection through a single Internet access gateway; violation of the life cycle stages of informatization objects; lack of an IS department to differentiate responsibilities and functions in the field of IS; failure to comply with technical documentation on information security; failure to purchase software from the trusted software registry; failure to monitor IS violations in civil defense and emergency management organizations; failure to include functional responsibilities for ensuring information security and obligations to comply with the requirements of the technical documentation on information security in the job descriptions of civil defense and emergency response personnel; failure to ensure information security in the server room;
With regard to the protection of personal data, as well as electronic documents and electronic digital signatures: lack of multi-factor authentication when accessing electronic information resources containing restricted personal data, as well as cryptographic means of information protection with parameters not lower than the third level of security in accordance with the standard of the Republic of Kazakhstan ST RK 1073-2007 when storing and transmitting personal data.