CII/Federal Law No. 152-FZ diagnostics
The assessment identifies which requirements apply to your systems, defines the boundaries of protected assets, and determines priority actions. Two fixed-term options: 10 business days remotely or 15 days with an on-site visit.
Login Format
The assessment addresses three key questions that kick off any regulatory project: which requirements apply specifically to your systems, where the boundaries of protected objects lie, and what should be done first. We analyze the scope both on-site and through documentation, rather than simply checking off a formal checklist.
Within 10–15 business days, you receive a picture of the current state and a sequence of tasks. Categorization of CII assets, certification, and design of protection measures are separate stages; diagnostics do not replace them.
What's included
environment and boundaries
Which systems fall within the perimeter, what data is processed in them, who owns each one, and how integrations and processes around them are structured.
Applicable requirements
Which provisions of Federal Law No. 152-FZ, the requirements for Personal Data Information Systems (ISPDn), the requirements applicable to Critical Information Infrastructure (CII) objects, and state information systems are relevant to your case and which are not, and which documents confirm this.
Protection measures
The threat model status, actually implemented measures, composition of information security tools (IS tools) and cryptographic information security tools (CIS tools), completeness of logs, and access control procedures.
Work procedure
What can be closed quickly and independently, what requires a project and a budget, which documents need to be issued and in what sequence.
Editions and volume limits
The editorial team is selected prior to the contract and determines the timeline and format of work.
| Parameter | Remote — 10 business days | With site visit — 15 business days |
|---|---|---|
| Format | interviews and document processing remotely | the same plus one visit by two specialists for one working day |
| Spot check of measures | according to the provided settings and exports | up to ten agreed infrastructure units: servers, workstations, network devices, security appliances |
Common to both editions: one legal entity, one site, up to three pre-approved information systems; up to eight interviews; up to 25 documents with a total volume of up to 500 pages; up to ten integrations and network interconnections at the level of architecture analysis. A draft threat model is prepared for one priority system.
CIIs, PDSs, and GISs are different regimes that may overlap: the presence of personal data does not automatically classify a system as a CII object, and CII requirements applicability cannot be determined solely based on the server configuration. A comprehensive audit of a government system falls outside the scope of the package and is assessed separately.
What is needed from the client
- those responsible for information security, IT, personal data, and relevant business processes;
- list of systems and processed data;
- existing documents on CII, personal data and system protection — if any;
- Network diagrams, composition of information security tools (IS tools) and cryptographic information security tools (CIS tools), access to selected settings.
If documents are missing, the client ensures the ability to reconstruct the actual situation through interviews—the absence of paperwork itself does not hinder diagnosis but is recorded as part of the current state.
What is not included
- full cycle of categorizing CIIs and issuing commission decisions;
- approved final threat model and certification;
- design and implementation of security measures;
- a complete set of organizational and administrative documents;
- audit of the entire organization for compliance with Federal Law No. 152-FZ;
- Penetration testing and interaction with the regulator on behalf of the client.
When the work is completed
- for each system, the boundaries, processed data, and grounds for preliminary assessment of the applicability of requirements are described;
- identified non-conformities are related to specific requirements and evidence;
- questions requiring additional verification are separated from confirmed conclusions;
- A draft threat model for one system and a sequential plan for further work have been submitted.
The conclusion “current workload is not required” or “we first close the organizational part” is a full-fledged result: it prevents premature procurement of protective equipment.
Output documents
| Artifact | Why is it needed? |
|---|---|
| Systems and Data Map | List of systems within the perimeter, including data processed, owners, and relationships—the foundation for categorization and selection of measures |
| List of non-conformities | Where the actual condition deviates from the applicable requirements, indicating how this is substantiated |
| Threat Model Draft | Threat landscape actors and violators linked to already implemented measures — draft for the final document |
| Roadmap to Elimination | Sequence of tasks: what to close organizationally, what requires implementation of information security measures (ISMs), and what is separated into a standalone project |
The requirements applicability matrix indicates the date of relevance of the regulatory framework, while the sampling inspection protocol for measures records precisely what was inspected and on which data. The roadmap covers documents, categorization or classification, design, and technical measures—in the applicable part.
If technical measures are required based on the diagnostic results, the roadmap is contacted HLD/LLD, supply of information and information protection equipment And implementation of information security.
For regulated loops, the end device layer is checked separately: workstations, servers, protection agents, local rights, logs and readiness Endpoint Security.
Package budget
| Editorial office | Package budget |
|---|---|
| Remote, 10 business days | 750K – 1.5M RUB excluding VAT |
| With site visit, 15 working days | 750K – 1.5M RUB excluding VAT |
The exact fixed price is determined after the initial meeting and scope verification; included work, deliverables, and exclusions are confirmed prior to commencement; any scope expansion is possible only upon agreement.
Travel expenses for an offsite editorial team are specified as a separate fixed amount.
Team composition
- Information Security Architect — applicability of requirements, boundaries of protected objects, threat model.
- SZI engineer — the condition of protective equipment, logs, access permissions, and compatibility of measures with the infrastructure.
- System Analyst — composition of systems and data, owners, processes, integrations.
- Project Manager — collecting materials, interviews, agreeing on conclusions and the roadmap.
When is a pentest needed after diagnosis?
If the CII/Federal Law No. 152-FZ diagnostic shows public personal accounts, APIs, VPNs, web services or controversial integrations, the next step may be a pentest. It confirms which risks are actually exploitable and helps link requirements to a technical remediation plan.
Frequently asked questions
Does diagnostics replace a full-fledged project?
No. It helps to correctly determine the boundaries and the next stage.
Can I start without ready-made documents?
Yes. The presence or absence of documents is recorded as part of the current state.
Need a trip?
Depends on the environment. Part of the examination can be carried out remotely.
Public contours in the diagnosis of CII and Federal Law No. 152-FZ
For CII, ISPD and public services with personal data, it is important to separately check what is visible from the Internet: personal accounts, API, VPN, domains, certificates, integrations and test environments. Therefore, the CII/Federal Law No. 152-FZ diagnostics can be linked with an audit of the external perimeter and a more accurate roadmap of technical measures can be obtained.
After diagnosis: laboratory verification of measures
The CII/Federal Law No. 152-FZ diagnostic determines the applicable requirements and gaps. The information security laboratory helps check how selected information security/cryptographic information protection, logs, access roles, endpoint protection, SIEM/SOAR or data masking will work before industrial implementation.
How we fix the volume and deadline
The terms below are identical for all packages and are incorporated into the contract without changes.
- Perimeter — prior to the agreement. We hold an initial meeting of up to 60 minutes and agree on the perimeter passport: systems, processes, sources, participants, and outcomes.
- Countdown of the term. The timeline starts after the handover of the approved set of source materials, provision of access credentials, and confirmation of the interview schedule. Delays on the client's side will postpone the timeline by a corresponding amount of time.
- Data. We operate within a coordinated secure channel. Production data is not transmitted to external AI services without the customer's written permission.
- Result transmission. We provide materials in PDF and editable formats (DOCX, XLSX, PPTX, or agreed equivalents) and conduct one results defense session of up to 90 minutes.
- Acceptance. Five business days are allocated for reviewing the results. One consolidated round of clarifications within the agreed scope is included; however, correction of errors and non-compliances with the contract is not limited to this round.
- Volume change. New systems, sources, and tasks are included only upon agreed changes to scope and cost.
- Work format. The default format is remote, unless an in-person component is explicitly planned for the package.
The statuses and licenses on the basis of which the works are performed are collected on the page "Licenses and statuses".
Email us
Write to us at info@restart.re or click the button below. For the first letter, it is sufficient to briefly describe the outline, the role of the organization, current systems, limitations and the desired outcome.
Email usRequest format
We agree on the volume, timing and output artifact - and launch it in a short time.
