FSTEC Order 117

Building the Foundation of Digital Trust: Why Identity Security Remains Undervalued

Identity Security is presented as one of the most underestimated pillars of cybersecurity because granting access involves trusting individuals with sensitive information and systems. The article examines the deep intersection of IT and security functions, the costs of manual access errors, and the need to align business processes with technical controls. It references a 2026 Identity Conf study showing 43.5% of organizations experienced errors in manual rights assignment and 33.5% left access for former employees. Recommendations draw on NIST Human-Centered Cybersecurity concepts, SP 800-53, and Russian FSTEC Order No. 117 to design lifecycle processes covering account provisioning, privilege reviews, and continuous monitoring. Models such as RBAC and ABAC are discussed alongside IGA and IdM solutions to ensure business permissions map correctly to application rights. The piece stresses that successful projects require joint IT and security efforts from the initial survey through pilot and acceptance phases while measuring both risk reduction and operational efficiency.

Why Vulnerability Management Specialists Must Master Compliance: Closing All CVEs but Leaving admin:admin

The article explains how compliance has evolved from a paperwork exercise into a mandatory, heavily penalized process in Russian cybersecurity. New regulations such as FSTEC Order 117, turnover fines for personal data leaks, and Presidential Decree 250 impose strict timelines and personal liability for vulnerability management failures. It outlines three approaches to compliance, from doing nothing to building custom standards based on CIS Benchmarks and local requirements. The text stresses moving from reactive scanning to golden images that embed compliance controls before deployment. It highlights tools like MaxPatrol HCC, RedCheck, and ScanOVAL for automated checks and warns that technical patches alone are useless without proper configuration controls such as strong passwords.

Asset Management as the Foundation of Vulnerability Management: Unknown Assets Cannot Be Protected

The article explains that asset management forms the essential base for any effective vulnerability management program, as organizations cannot protect systems they do not know exist. It details multiple data sources including SIEM, NTA/NDR, Active Directory, CMDB, virtualization platforms, and cloud APIs that must be combined to build a complete inventory. Key record fields such as asset criticality, responsible owner, and last successful scan date are highlighted as critical for prioritization and SLA compliance. The piece examines new Russian regulations including FSTEC Order No. 117 and Federal Law No. 58-FZ that mandate accurate asset inventories to meet monthly scanning and 24-hour critical patch requirements. International frameworks such as CIS Controls v8.1, NIST CSF 2.0, and ISO/IEC 27001:2022 are compared, emphasizing lifecycle management and reaction processes for unauthorized assets. Emerging asset types including cloud resources, SaaS services, AI systems, containers, and IoT devices are discussed as expanding the attack surface faster than organizations can track.

Aligning AI Adoption Maturity with AI Security Using CMMI and Russian Regulatory Requirements

Organizations frequently operate at mismatched maturity levels between AI implementation and AI security controls, creating significant gaps that lead to incidents and regulatory violations. The analysis maps both dimensions onto the five-level CMMI scale, showing how adoption often outpaces protection and highlighting the risks of Shadow AI, uncontrolled agents, and non-compliance. Key frameworks including OWASP AIMA, Google SAIF, NIST AI RMF, and MITRE ATLAS are aligned to CMMI levels L1 through L5. Russian requirements under FSTEC Order No. 117, effective March 2026, introduce mandatory controls for trusted AI technologies, data handling, and statistical response validation that activate precisely at the L2-to-L3 transition. The article details predictable organizational states from denial to managed agentic systems and provides a practical matrix linking each CMMI level to minimum security requirements and specific Russian compliance anchors such as GOST R 56939-2024 and ISO/IEC 42001.