In accordance with subparagraph 3) of Article 6 of the Law of the Republic of Kazakhstan dated November 24, 2015 "On Informatization", the Government of the Republic of Kazakhstan DECIDES:
1. To approve the attached unified requirements in the field of information and communication technologies and information security (hereinafter referred to as the unified requirements).
2. To recognize as invalid some decisions of the Government of the Republic of Kazakhstan in accordance with the annex to this resolution.
3. This resolution shall enter into force upon the expiration of ten calendar days after the date of its first official publication.
Paragraph 140 of the uniform requirements is valid until January 1, 2018.
Prime Minister
Of the Republic of Kazakhstan B. Sagintayev
Approved
by Government Decree
Of the Republic of Kazakhstan
dated December 20, 2016 No. 832
Uniform requirements
in the field of information and communication technologies and information security
Chapter 1. General provisions
1. Uniform requirements in the field of information and communication technologies and information security (hereinafter - ET) have been developed in accordance with subparagraph 3) of Article 6 of the Law of the Republic of Kazakhstan dated November 24, 2015 "On Informatization" (hereinafter – the Law) and define the requirements in the field of information and communication technologies and information security.
2. The provisions of ET related to the field of information security are mandatory for application by state bodies, local executive bodies, state legal entities, quasi-public sector entities, owners and owners of non-state information systems integrated with the information systems of state bodies or intended for the formation of state electronic information resources, as well as owners and owners of critical facilities information and communication infrastructure.
3. The provisions of ET do not apply to:
1) relations arising during the implementation by the National Bank of the Republic of Kazakhstan and organizations within its structure of work on the creation or development, operation of Internet resources, information systems that are not integrated with the objects of the information and communication infrastructure of "electronic government", local networks and telecommunications networks, as well as during the procurement of goods, works and services in the field of informatization;
2) protected information systems classified as state secrets in accordance with the legislation of the Republic of Kazakhstan on state secrets, as well as special-purpose telecommunications networks and/or government, classified, encrypted and coded communications.
4. The purpose of the ET is to establish mandatory requirements in the field of information and communication technologies and information security by state bodies, local self-government bodies, state legal entities, quasi-public sector entities, owners and owners of non-state information systems integrated with the information systems of state bodies or intended for the formation of state electronic information resources, as well as owners and owners of critical information and communication infrastructure facilities.
5. The objectives of ET are:
1) definition of the principles of organization and management of informatization of state bodies for solving current and strategic tasks of public administration;
2) definition of uniform principles for ensuring and managing information security of "electronic government" informatization facilities;
3) establishment of requirements for the unification of information and communication infrastructure facilities;
4) establishment of requirements for structuring information and communication infrastructure and organization of server rooms;
5) establishing the mandatory application of the recommendations of standards in the field of information and communication technologies and information security at all stages of the life cycle of informatization objects;
6) increasing the level of security of state and non-state electronic information resources, software, information systems and the information and communication infrastructure supporting them.
Footnote. Paragraph 5 as amended by the Decree of the Government of the Republic of Kazakhstan dated 31.12.2019 No. 1047 (effective after ten calendar days after the date of its first official publication).
6. For the purposes of these Regulations, they use the following definitions:
1) marking of an asset associated with information processing means – the application of conventional signs, letters, numbers, graphic signs or inscriptions on the asset, for the purpose of its further identification (recognition), indication of its properties and characteristics;
2) means of cryptographic protection of information (hereinafter referred to as SCSI) – software or hardware-software complex that implements algorithms for cryptographic transformations, generation, formation, distribution or management of encryption keys;
3) assets related to information processing facilities (hereinafter referred to as an asset) – a tangible or intangible object that is information or contains information, or serves for processing, storing, transmitting information and is of value to the organization in the interests of achieving the goals and continuity of its activities;
4) technical documentation on information security (hereinafter referred to as TD IB) – documentation that establishes policies, rules, protective measures related to the processes of ensuring information security of informatization objects and (or) organizations;
4-1) monitoring of information security events (hereinafter – monitoring of information security events) – constant monitoring of the object of informatization in order to identify and identify information security events;
5) software robot – the software of a search engine or monitoring system that automatically and/or according to a specified schedule, browsing web pages, reading and indexing their contents by following links found in web pages;
6) unloaded (cold) equipment redundancy – the use of additional server and telecommunication equipment, software prepared for operation and in inactive mode for the purpose of operational restoration of an information system or electronic information resource;
7) loaded (hot) equipment redundancy is the use of additional (redundant) server and telecommunication equipment, software and their maintenance in active mode in order to flexibly and promptly increase the throughput, reliability and fault tolerance of an information system, an electronic information resource;
8) workstation – a stationary computer as part of a local network designed to solve applied tasks;
9) system software – a set of software to ensure the operation of computing equipment;
10) coded communication – secure communication using documents and coding techniques;
11) multi–factor authentication is a method of verifying user authentication using a combination of various parameters, including generating and entering passwords or authentication features (digital certificates, tokens, smart cards, one-time password generators and biometric identification tools);
11-1) crossover room – telecommunication room intended for placement of connecting, distribution points and devices;
12) application software (hereinafter referred to as PPO) is a software package for solving an applied problem of a certain class of subject area;
13) classified communication – secure communication using classified equipment;
14) scalability – the ability of an informatization object to provide an opportunity to increase its productivity as the volume of processed information and (or) the number of simultaneously working users increases;
14-1) the server center of state bodies (hereinafter referred to as the server center of the GO) is a server room (data processing center) owned or owned by the operator of the information and communication infrastructure of the "electronic government", designed to accommodate the objects of informatization of the "electronic government;
15) event logging – the process of recording information about software or hardware events occurring with the object of informatization in the event log;
16) server room (data processing center) – a room designed to accommodate server, active and passive network (telecommunication) equipment and equipment of structured cabling systems;
17) external circuit local area network (hereinafter referred to as the external circuit LAN) is a local area network of the GO referred to the external circuit of the GO telecommunication network, which has an Internet connection, access to which is provided by telecom operators for the GO only through a single Internet access gateway;
18) terminal system – thin or zero client for working with applications in a terminal environment or thin client programs in a client-server architecture;
19) time source infrastructure – hierarchically connected server equipment using a network time synchronization protocol that performs the task of synchronizing the internal clocks of servers, workstations and telecommunications equipment;
20) government communications – special secure communications for the needs of public administration;