Cybersecurity law & regulation in Russia (2026)

Legal framework

Federal Law No. 187-FZ 'On the Security of Critical Information Infrastructure of the Russian Federation' (2017, in force 2018), supplemented by Federal Law No. 152-FZ on Personal Data and the GosSOPKA/NKTsKI state incident-response system, with sector rules from the Bank of Russia (FinCERT) and oversight by FSTEC, the FSB and Roskomnadzor.

Key points: cybersecurity in Russia

1. 01Critical infrastructure law (187-FZ)

   Federal Law No. 187-FZ (adopted 26 July 2017, in force 1 January 2018) sets the core CII security regime, requiring owners of significant CII objects to categorize assets, apply protection measures and register with FSTEC, the technical-security regulator that supervises the field.

   prlib.ru cis-legislation.com cliffordchance.com

2. 02GosSOPKA / NKTsKI incident reporting

   CII operators must report computer incidents to the FSB-operated GosSOPKA system via the National Coordination Center for Computer Incidents (NKTsKI), established in late 2018, which centralizes detection, analysis and coordinated response to attacks on Russian state and critical-sector networks.

   tandfonline.com aseanregionalforum.asean.org

3. 03Personal-data breach notification

   Under Federal Law No. 152-FZ (amended from 1 September 2022), data operators must notify Roskomnadzor of a personal-data breach within 24 hours of detection, followed by results of an internal investigation within 72 hours.

   dlapiperdataprotection.com dataguidance.com

4. 04Tougher penalties from May 2025

   Amendments to the Administrative Offences Code and Criminal Code in force from 30 May 2025 introduced GDPR-style turnover-based fines for repeat data leaks (up to 1-3% of annual revenue, capped at RUB 500 million) plus new criminal liability of up to 10 years' imprisonment for illegal handling of unlawfully obtained personal data.

   tass.com seamless.legal acsour.com

5. 05Financial-sector supervision (Bank of Russia / FinCERT)

   The Bank of Russia regulates information security for banks and financial-market participants and runs FinCERT, the financial-sector incident-exchange and response center; over 800 organizations including all Russian banks share incident data through it.

   cbr.ru financefeeds.com

6. 06Regulators and division of authority

   Oversight is split among FSTEC (technical protection and CII categorization), the FSB (GosSOPKA/NKTsKI operational threat response) and Roskomnadzor (personal-data protection and breach notifications), reflecting a centralized, state-controlled model.

   noerr.com lexology.com

Timeline of decisions

1. 1 Mar 2026Law
   Decree No. 1667 Activates Permanent RuNet Isolation Authority

   Government Decree No. 1667 (signed 27 Oct 2025) entered into force, transitioning RuNet isolation from a standby 'readiness' posture to a permanently active instrument valid through 2032. Roskomnadzor, the FSB, and the Ministry of Digital Development gained real-time authority to reroute or sever Russia's internet from the global web during cyberattacks, critical infrastructure failures, or undefined 'specific threats.'

   Digital Policy Alert

2. 1 Mar 2026Decision
   Government Decree No. 1667: RuNet Full Isolation Authority Activated

   Roskomnadzor, jointly with the FSB and Ministry of Digital Development, gained binding legal authority to reroute all internet traffic in real time and switch RuNet into isolation mode under Decree No. 1667, which remains in force until 2032. The decree operationalizes the most sweeping powers of the 2019 Sovereign Internet Law, including DPI-based traffic rerouting and binding orders to all ISPs and internet-exchange owners.

   ABIT Cybersecurity Analysis

3. 27 Oct 2025Law
   Government Decree No. 1667 Signed: Centralised Management of Public Communications

   Putin's government adopted Decree No. 1667, formalising rules for centralised management of Russia's public communications network. It expanded Roskomnadzor's authority to issue binding orders to all telecom operators, enabling isolation or rerouting of domestic internet traffic and cementing the operational framework for a fully autonomous RuNet.

   Digital Policy Alert

4. 10 Feb 2025Law
   Criminal Code Overhaul: 5-15 Year Prison Terms for Cybercrimes

   Russia approved a sweeping cybercrime legislative package amending over 30 laws, imposing prison terms of 5-15 years for hacking, data theft, and CII attacks and up to 12 years for large-scale cyber fraud. Tougher penalties under Criminal Code Articles 272, 273, and 274.1 are paired with asset seizure provisions and are the most aggressive overhaul of cyber-criminal statutes since the 2017 CII law.

   Truesec

5. 13 Jun 2024Decision
   Amendment to Presidential Decree No. 250: Expanded Cybersecurity Obligations

   A formal amendment to the 2022 Decree No. 250 was published, broadening the scope of required security subdivisions and deputy-director accountability for information security across strategic enterprises, state corporations, and all CII subjects, closing gaps identified during two years of enforcement.

   Digital Policy Alert

6. 1 May 2022Decision
   Presidential Decree No. 250: Mandatory CISOs and Security Units for Strategic Entities

   Putin's Decree No. 250 required all federal authorities, state corporations, strategic enterprises, and CII subjects to appoint a named deputy director responsible for cybersecurity and to establish dedicated information-security subdivisions; CEOs face personal liability for failures in cyberattack response. The decree was a direct response to the surge in attacks following the February 2022 invasion of Ukraine.

   DataGuidance

7. 1 Mar 2022Law
   Presidential Decree Mandates Replacement of Foreign Software on Critical Infrastructure

   Triggered by sweeping Western technology sanctions following the invasion of Ukraine, Putin issued a decree requiring all government agencies to migrate off foreign software on critical information infrastructure by end-2024, making 'technological sovereignty' the governing lens for all subsequent Russian AI and digital policy.

   Foreign Policy Research Institute

8. 1 May 2019Law
   Federal Law No. 90-FZ: Sovereign Internet (RuNet) Law Enacted

   Russia mandated installation of Deep Packet Inspection (DPI) equipment on all ISPs, enabling Roskomnadzor to centrally filter and reroute traffic and to operate a national DNS, creating the technical infrastructure to isolate RuNet from the global internet in a declared emergency. The law entered force November 1, 2019 and gave Roskomnadzor unprecedented autonomous blocking powers.

   Internet Society

9. 1 Jul 2018Decision
   FSB Orders Establishing NCCCI and GosSOPKA Operational Rules

   Three FSB orders issued in July 2018 formally stood up the National Coordination Centre for Computer Incidents (NCCCI) and defined binding requirements for CII subjects to connect to and share incident telemetry with the GosSOPKA state detection-and-response network, operationalizing the 187-FZ mandate.

   TAdviser

10. 26 Jul 2017Law · official
    Federal Law No. 187-FZ: Security of Critical Information Infrastructure

    Russia's landmark CII law obligated operators across 13 sectors (energy, transport, healthcare, finance, telecom, defence, nuclear, etc.) to categorize systems by criticality, register with FSTEC, and implement FSTEC-certified security measures against computer attacks; it provided the legislative foundation for GosSOPKA and took effect January 1, 2018.

    Presidential Library of Russia

11. 5 Dec 2016Guidance · official
    Presidential Decree No. 646: Updated Doctrine of Information Security

    Putin approved a revised Information Security Doctrine replacing the September 2000 version, designating protection of critical information infrastructure, development of domestic IT, and countering foreign information influence as core national security priorities; it set the strategic direction for all subsequent cybersecurity legislation and regulatory programs.

    Ministry of Foreign Affairs of Russia

12. 1 Jan 2013Decision
    Presidential Decree No. 31c: GosSOPKA State Cyber-Detection System Created

    Putin ordered the FSB to build GosSOPKA, the State System for Detection, Prevention, and Elimination of Consequences of Computer Attacks, establishing Russia's first unified national cyber-incident detection and response architecture spanning all government and critical information systems, and laying the institutional groundwork for the later NCCCI.

    Meduza

13. 27 Jul 2006Law · official
    Federal Law No. 149-FZ: Foundational Law on Information and Information Protection

    Russia's foundational statute on information, information technologies, and information protection replaced a 1995 predecessor, establishing core principles on information access, restricted-information classification, and mandatory technical protection measures; it remains the bedrock law on which all subsequent cybersecurity obligations are layered.

    WIPO Lex

Sources

1. 1.prlib.ru/en/node/692141
2. 2.cis-legislation.com/document.fwx?rgn=98928
3. 3.cliffordchance.com/briefings/2017/10/new_legislation_regulatingcybersecurityandth.html
4. 4.tandfonline.com/doi/full/10.1080/09636412.2024.2391757
5. 5.aseanregionalforum.asean.org/wp-content/uploads/2019/06/ANNEX-10-Russia.pdf
6. 6.dlapiperdataprotection.com/index.html?t=breach-notification&c=RU
7. 7.dataguidance.com/jurisdictions/russia
8. 8.tass.com/economy/1880211
9. 9.seamless.legal/insights/Turnover_fines_and_criminal_liability/
10. 10.acsour.com/en/news-and-articles/tpost/88yxz76kp1-criminal-liability-and-fines-up
11. 11.cbr.ru/eng/information_security/fincert/
12. 12.financefeeds.com/russias-fincert-receives-300000-notifications-cybersecurity-incidents
13. 13.noerr.com/en/insights/privacy-and-cybersecurity-in-russia
14. 14.lexology.com/library/detail.aspx?g=4e25febc-cb62-422b-a5e2-c62e964e4a3d