The Ministry of Digital Engineering ordered an analysis of the security of state information systems and their applications

2022: Tender for GIS Security Analysis

On August 4, 2022, it became known that the Ministry of Digital Science ordered an analysis of the security of state information systems (GIS). For these purposes, the department allocated 337.4 million rubles. Information about this is published on the public procurement portal.

The future contractor is obliged to find vulnerabilities the perimeter of state systems and carry them mobile applications, out to testing penetrate them. The results of the work must be documented no later than July 1, 2023.

The tender was published on August 3, 2022 in the format of an open competition. Applications are accepted until August 22. The results will be announced on August 25. First of all, applications will be evaluated at the proposed contract price (60% of the criterion significance) and the qualification of participants and qualitative characteristics of the purchase object are evaluated at 20%.

Within the framework of the work, strategic risks of information security of GIS should be identified. In particular, the contractor must detect existing shortcomings in the infrastructure, architectural and organizational solutions of the analyzed systems that affect their safety. Within the framework of the contract, the shortcomings of the information protection tools used and the software of state information systems should also be identified, follows from the tender documentation.

Given that the security analysis will be carried out for state information systems, the contractor must assess the capabilities of violators characteristic of hacker (criminal) groups, terrorist organizations and special services of violators, as well as internal users of the information system who may collude with external violators, the terms of reference says.

Based on the results of the security analysis of each GIS, the contractor shall compile a report with descriptions of vulnerabilities, their causes, criticality assessments, etc. In addition, recommendations should be developed to increase the level of information security and eliminate the identified vulnerabilities, as well as to modernize information technologies (including, from the point of view of import substitution policy), the^[1] will ^[2]

Notes