RESTART for CISO
For CISO, RESTART helps to combine regulatory requirements, real infrastructure, AI risks, DevSecOps and production operations of security measures.
CISO Focus
Regulatory
Federal Law No. 152-FZ, ISPDn, CII, GIS, threat model, documents and evidence.
Secure AI
Control of sources, roles, logs, prompts, models and data transfer.
SOC readiness
Events, SIEM/SOAR, SGRC, incidents, response scenarios and operational model.
AppSec
SAST, DAST, SCA, finding secrets, container security and vulnerability mitigation.
Relevant inputs
Reasons for selecting the contractor
For security services, it is important not only what the contractor does, but also on what basis they are entitled to do it and how they confirm the result.
- License of FSTEC of Russia — technical protection of confidential information: design and implementation of security measures are carried out within a licensed perimeter. Verified in register of licensees of the FSTEC of Russia — there's a list of permitted works there as well.
- License of the FSB of Russia No. L051-00105-00/05918757 dated 08/07/2026 — work related to cryptographic tools: transmission of cryptographic information protection systems (SKZI) and systems protected using them. Verified via the registry of the FSB of Russia's Center for Licensing, Certification and Protection of Information (CLSZ) by number or INN 9705056320. The license confirms the right to perform specific types of work, not the compliance of the entire project.
- Acceptance testing of AI systems on the Polygon testbed — if the acceptance item is not a protection measure but the AI assistant itself: load and response quality are measured in a single run, the result is documented in a protocol with a PASS/FAIL verdict based on pre-agreed criteria, and the evaluation is performed by a local model within your environment.
Next step: what the first meeting provides
The first discussion—40–60 minutes with the security and IT teams. Following this, you receive a letter documenting which requirements apply to the discussed scope, what will be verified first, in what format (diagnostics, audit, lab pilot), and what deliverables will be provided. There are no contractual commitments at this stage.
What to take with you
List of systems within the perimeter and their purpose, information on categorization of CII (Critical Information Infrastructure) facilities and the PD processing mode in effect, the current threat model, organizational documents, list of applied security measures, and description of AI scenarios, if already deployed.
What shall we discuss
Protection object boundaries, upcoming audits and internal deadlines, bottlenecks in logs and access controls, AI perimeter risks, what has already been addressed and how this is evidenced.
What you'll get
Summary listing applicable requirements, inspection priorities, and a proposal for the first step—including timeline, scope of work, and list of deliverables.
Frequently asked questions
Is it possible to test the AI environment before implementation?
Yes. Secure AI audit helps assess data, access, logs, risks and architecture in 10 business days.
Do you do HLD/LLD?
Yes. RESTART designs HLD/LLD for ISMS and secured corporate networks.
Is it possible to start with diagnosing Federal Law No. 152-FZ?
Yes. Diagnostics within 10–15 business days provides a system map, a list of non-conformities, a draft threat model, and a roadmap.
What confirms the right to perform cryptographic work?
By an FSB Russia license, which can be verified in the official registry by its number or taxpayer identification number (INN) before signing the contract.
Discuss your task
Tell us what needs to be solved in your role - we will suggest a relevant first step and team.
