CII: why inventory is more important than template documents
Protection measures are selected by the object category, and the category is selected by the consequences of the incident for the process. An error in inventory is transferred throughout the chain and is paid for by the protection of the wrong person.
Why it all starts with inventory and not with documents
A typical request for CII sounds like this: “a set of documents is needed for FSTEC.” The kit is really needed, but the document is the form in which the result of the work is recorded. If there was no work, you end up with a set of papers about non-existent infrastructure: a categorization act for a system that was replaced a year ago, a list without half of the industrial control system, a threat model copied from someone else’s facility.
The check reveals this in an hour - just check the list with the real network. Moreover, the consequences are not limited to a fine: protection measures are selected by category, and the category is selected by the consequences of an incident at a specific facility. An error in inventory is transferred further along the entire chain and is paid for by protecting the wrong thing and the wrong thing.
Who is the subject and what is considered the object?
Subject CII - an organization operating in one of the areas listed in Federal Law No. 187-FZ: healthcare, science, transport, communications, energy, banking and other areas of the financial market, fuel and energy complex, nuclear energy, defense, rocket and space, mining, metallurgical and chemical industries. Separately, there are organizations that ensure the interaction of such systems.
CII object - an information system, information and telecommunication network or automated control system owned by an entity and operating in these areas. It is important not to confuse the three classes of objects: the IS, network and process control systems have different natures and different protection measures.
The practical consequence that people stumble over most often: You can be a subject without considering yourself an IT company. A manufacturing enterprise with an automated process control system, a clinic with a medical information system, a telecom operator, a transport company - they all fall within the perimeter, and the responsibility for categorization lies with them, and not with the contractor.
What should be on the map
Inventory for CII differs from the usual accounting of IT assets: it is not so much the hardware and licenses that are important, but processes that will stop in case of failure, and connections between systems.
| What we record | Why is this needed further? |
|---|---|
| Critical processes: technological, managerial, financial | The category is determined by the consequences for the process, not for the server |
| Systems supporting every process | Generates a list of categorization objects |
| Object boundaries: nodes, segments, jobs | Determines where the protection loop is and what is included in it |
| Communications and integrations, including external | Most attack scenarios are implemented through integrations |
| Remote access points: contractors, vendors, dispatching | The most common and most underrated entrance to process control systems |
| Owners: Technological and IT | Without the process owner it is impossible to assess the consequences |
| Existing protection measures | Shows the gap between the current and desired state |
| Impact assessment: social, political, economic, environmental, defense and security | These are the indicators of significance for categorization |
How to collect: what works and what doesn't
Doesn't work: distribution of the questionnaire to departments. It is returned incompletely, with different terminology and without connections between systems. This ends especially badly with automated process control systems: technologists describe the process, IT describes the servers, and the object exists at the interface and does not fall into any answer.
Works: combination of three sources.
- Interviews with process owners. Start not with systems, but with the question “what will happen with production, maintenance, calculations if this stops for a day.” The answer is immediately given by both the object and the order of consequences.
- Technical data: network diagrams, switch configurations, routing tables, asset management systems data, security logs. They give facts instead of ideas.
- Passive survey of the technology segment. In automated process control systems, active scanning is unacceptable: it can take the equipment out of mode. Traffic analysis and mirroring are used, carefully and in agreement with technologists.
The result is compiled into a single map with owners and connections. This same artifact is then reused in design and in the threat model, so quality here pays off twice.
Categorization: what happens to the map next
Categorization is performed by a commission of the subject - the subject itself, and not a contractor or a regulator. The contractor can prepare the methodology, train the commission, calculate and formalize, but the decision is made by the organization.
- List of objects. Formed based on the results of the inventory and sent to the FSTEC of Russia; Then the objects are categorized within a specified period.
- Significance indicators. Each site is assessed for its social, political, economic and environmental impacts, as well as its significance for defence, security and law enforcement. The maximum achieved indicator is taken.
- Three categories. The first is the highest, the third is the lowest. An object that does not score a single indicator is considered insignificant, but remains an object of the CII: the obligation to interact with the State Specialized Anti-Corruption Control System in case of incidents remains.
- Result. Categorization act and information sent to FSTEC. The category determines the composition of mandatory protective measures for a significant object.
Typical errors
- Template instead of survey. Documents from the Internet with replaced names. It is checked by checking the list with the network.
- Forgotten automated process control system. Office systems were included in the list, but the technology segment was not, because it was handled by another service.
- The object is described as a server. The category is considered by process; description at the equipment level makes impact assessment impossible.
- Connections not taken into account. The object is protected, but the adjacent system with direct network access is not.
- Vendor remote access is not taken into account. The hardware support channel is often not described anywhere and is not monitored.
- The map was out of date the next day. Inventory without a process for maintaining relevance is a one-time document; We need an update order when changes occur.
Checklist
- It is determined whether the organization belongs to the subjects of CII, and in what area.
- A list of critical processes with owners and an assessment of the consequences of shutdown has been compiled.
- Each process is associated with supporting systems, including automated process control systems.
- The boundaries of each object are described: nodes, segments, jobs.
- Connections and integrations, including external ones, have been recorded.
- All remote access points of contractors and vendors are taken into account.
- A categorization commission has been created, it has methods and training.
- The list of objects has been sent to FSTEC, the timing of categorization is under control.
- The category of each object is justified by calculation, and not by a decision “by analogy”.
- The procedure for interaction with GosSOPKA in case of incidents has been determined.
- Regulations have been established for updating the map when the infrastructure changes.
How we work with it
Quick login - diagnostics CII/Federal Law No. 152-FZ: in a limited time, understand whether you are a subject or not, what falls within the perimeter and how much work is ahead. Full cycle - "Protection of CII / Federal Law No. 187-FZ": survey, list, categorization support, threat model, design and implementation of a security system.
Work requiring a FSTEC license is carried out within the framework of regulatory compliance. Then the map turns into a project - HLD and LLD (why without it the implementation stalls, disassembled Here), and monitoring and reporting of incidents is based on SIEM, SOAR, SGRC.
We need to analyze a specific environment - write to us.
Let's discuss your environment
Describe the task, current systems, constraints, and expected results. We will offer a practical first step: diagnostics, pilot, audit, roadmap or project team.
