Business Entity
In accordance with Part 2 of Article 19 of Federal Law No. 152-FZ of July 27, 2006 «On Personal Data», the data processor must assess the effectiveness of the applied measures.
In accordance with Article 6 of FSTEC Order No. 21 of February 18, 2013, such an assessment may be carried out by the data processor either on its own or by engaging an organization licensed by the FSTEC to provide services for the technical protection of information. At the same time, certification tests are only one form of such assessment and are not mandatory.
However, business entities can voluntarily carry out the certification of their information systems. For example, this may be required to fulfill the requirements of the following:
rules for connecting to any state system,
terms of reference for participation in a tender,
terms of the contract with a counterparty.
State or Municipal Authority
To comply with the information protection requirements, information processing in state or municipal information systems must be governed by FSTEC Order No. 17 of February 11, 2013.
In accordance with Article 13, the information system must be certified in order to ensure the protection of information. At the same time, according to Article 17.6, if the information system is based on the data center infrastructure, such data center infrastructure must be certified for compliance with the requirements of FSTEC Order No. 17 of February 11, 2013.