Unofficial translation
Footnote. Abolished by the Decree of the Government of the Republic of Kazakhstan dated December 31, 2019 No. 1047 (it is put into effect after ten calendar days after the date of its first official publication).In accordance with subparagraph 5) of article 6 of the Law of the Republic of Kazakhstan dated November 24, 2015 "On Informatization" the Government of the Republic of Kazakhstan HEREBY DECREES:
1. To approve the attached Rules for certification of the information system, the "e-government" information and communication platform, the Internet resource of a state body for compliance with information security requirements.
2. to recognize invalid some of the decisions of the Government of the Republic of Kazakhstan in accordance with the annex to this decree.
3. This decree shall come into force upon expiry of ten calendar days after the date of its first official publication.
| Prime Minister | |
| of the Republic of Kazakhstan | К. Massimov |
| Approved by the decree of the Government of the Republic of Kazakhstan dated May 23, 2016 no. 298 |
Rules for certification of the information system, the "e-government" information and communication platform, the Internet resource of a state body for compliance with information security requirements
1. General provisions
1. These Rules for certification of the information system, the "e-government" information and communication platform, the Internet resource of a state body for compliance with information security requirements (hereinafter referred to as the Rules) have been developed in accordance with subparagraph 5) article 6 of the Law of the Republic of Kazakhstan dated November 24, 2015 "On Informatization" and shall determine the procedure of certification of the information system, the "e-government" information and communication platform, the Internet resource of a state body for compliance with information security requirements.
2. These Rules shall not apply to the certification of information systems in secure execution, classified as state secrets.
3. Main definitions, terms and concepts used in the Rules:
1) an authorized body in the sphere of ensuring information security (hereinafter referred to as the authorized body) means the central executive body, exercising management and intersectoral coordination in the sphere of ensuring information security;
2) State Technical Service means the republican state enterprise on the right of economic management, created by decision of the Government of the Republic of Kazakhstan;
3) an applicant means a possessor (owner) of the object of certification, or his authorized person, submitted an application for certification of the object of certification for compliance with the requirements of information security;
4) information security in the sphere of informatization
(hereinafter referred to as the information security) means the state of security of electronic information resources, information systems, information and communication infrastructure from external and internal threats;
5) the information and communication infrastructure means the set of objects of information and communication infrastructure, designed to ensure the functioning of technological environment in order to generate electronic information resources and provide access to them;
6) objects of certification mean the information system, "e-government" information and communication platform, Internet resource;
7) a hardware and software complex – the set of software and hardware used together to solve problems of a certain type;
8) the information system means the organizationally ordered set of information and communication technologies, maintenance personnel and technical documentation that implement certain technological actions through information interaction and designed to solve specific functional problems;
9) "e-government" information and communication platform means a technological platform, designed to implement a service model of informatization;
10) the Internet resource – electronic information resource displayed in text, graphic, audiovisual or other form, placed on a hardware-software complex, having a unique network address and (or) domain name and functioning in the Internet;
11) is excluded by the decree of the Government of the Republic of Kazakhstan dated 09.04.2018 no. 178 (shall be enforced upon expiry of ten calendar days after the date of its first official publication);12) certificate of compliance of the information system, “e-government” information and communication platform, the Internet resource of a state body with information security requirements (hereinafter referred to as the certificate) means the document, confirming the fact of compliance of the object of certification with information security requirements;
13) Act on certification examination means a document that includes information about the actual state of security of the object of certification;
14) certification for compliance with information security requirements (hereinafter referred to as the certification) – organizational and technical activities on determining the state of security of the objects subject to certification, as well as their compliance with information security requirements;
15) certification examination means a set of organizational and technical activities, aimed at study, analysis, assessment of technical documentation of the object of certification, examination of the state of organization of works for meeting the information security requirements;
16) technical documentation on information security (hereinafter referred to as the TD on IS) means a set of documents, developed in accordance with uniform requirements in the field of information and communication technologies and ensuring information security (hereinafter referred to as the UR) and regulating general requirements, principles and rules for ensuring information security of the object of certification.
Footnote. Paragraph 3 as amended by the decree of the Government of the Republic of Kazakhstan dated 09.04.2018 no. 178 (shall be enforced upon expiry of ten calendar days after the date of its first official publication).4. Putting into commercial operation the information system of a state body, the information system related to the critical objects of the information and communication infrastructure, the non-state information system integrated with the information system of a state body or designed to generate electronic information resources of a state body, the Internet resource of a state body and the "e-government" information and communication platform shall be strictly subject to availability of the certificate.
5. The objects of compulsory certification shall be:
1) the information system of a state body;
2) the information system of a state legal entity, non-state information system integrated with the information system of a state body or designed for generation of state electronic information resources.
The requirements established in this subparagraph do not apply to information systems of financial organizations when they are integrated through an external gateway of "electronic government" put into commercial operation;
3) the information system, related to critical objects of information and communication infrastructure;
4) "e-government" information and communication platform;
5) the Internet resource of a state body.
Certification of compliance with information security requirements for object of certifications specified in this paragraph shall not be required when using services of the national certification center of the Republic of Kazakhstan for the authentication of an electronic digital signature.
Footnote. Paragraph 5 as amended by the decree of the Government of the Republic of Kazakhstan dated 09.04.2018 no.178 (shall be enforced upon expiry of ten calendar days after the date of its first official publication).6. Non-state information systems and the Internet resources may be certified for compliance with information security requirements at the initiative of the possessor (owner) or person authorized by him.
7. Certification shall consist of the following main stages:
1) acceptance of the application for certification and verification of the package of documents for compliance with the form and completeness;
2) certification examination;
3) consideration of the results of the certification examination by the authorized body;
4) making the decision by the authorized body.
Footnote. Paragraph 7 as amended by the decree of the Government of the Republic of Kazakhstan dated 09.04.2018 no.178 (shall be enforced upon expiry of ten calendar days after the date of its first official publication).8. Certification of the objects of certification for compliance with the information safety requirements shall be carried out by the authorized body.
9. Certification examination of the objects of certification shall be carried out by the State Technical Service.
10. is excluded by the decree of the Government of the Republic of Kazakhstan dated 09.04.2018 no. 178 (shall be enforced upon expiry of ten calendar days after the date of its first official publication).11. The possessor or the owner of the object of certification that is subject to compulsory certification, or his authorized person, shall annually no later than March 1 send to the authorized body a list of objects planned for certification in the current year in the form according to annex 1 to these Rules.
12. The application for certification for compliance with information security requirements shall be accepted by the authorized body no later than November 1 of the current year.
2. Certification procedure
13. The applicant shall submit an application for certification for compliance with information security requirements to the authorized body, in the form according to annex 2 to these Rules with provision of the following documents:
1) a copy of an identity document (for individuals);
2) a copy of the terms of reference, if the terms of reference is not available, technical specification shall be sent to the Internet resource;
3) the general functional diagram of the object of certification indicating the unique network addresses of the servers and the administrator's workstation used, as well as the local network diagram approved by the owner (owner), an explanatory note to the general functional diagram certified by the applicant’s signature and seal;
4) copies of the of TD on IS, approved by the possessor (owner) of the object of certification certified by the signature and seal of the applicant according to annex 3 to these Rules;
5) list of objects of informatization integrated with the object of certification, in the form according to annex 4 to these Rules, approved by the possessor of the object of certification and certified by the signature and seal of the applicant (where there are objects of informatization integrated with the object of certification);
6) copies of the lists of technical and software aids included into the composition of the object of certification approved by the possessor (owner) , in the form according to annexes 5 and 6 to these Rules, certified by the signature and seal of the applicant (in case if the object of certification does not use the information and communication services);
7) copies of a contract for use the information and communication services attached with technical characteristics and contract for provision of information and communication services (in case if the object of certification use the information and communication services).
14. Upon receipt of the application, the authorized body within three working days shall verify the compliance of the application and the documents attached to the application with the requirements to the form and completeness established by these Rules.
15. If the application and / or documents do not comply with the established requirements, the authorized body shall return them to the applicant indicating the reasons for the return.
16. If the application and the attached documents comply with the requirements for the form and completeness, the authorized body shall send the application with the attached documents to the State Technical Service during the period established by paragraph 14 of these Rules.
17. After receiving the application and the attached documents, the State Technical Service shall send two copies of the contract for the provision of certification examination services no later than three working days to the applicant. The applicant, within five working days from the date of receipt of the copies of the contract, shall sign and return one copy to the State Technical Service.
In case if after the specified period the contract signed by the applicant is not submitted to the state technical service, the application for certification shall be considered canceled.
18. The cost of the certification examination shall be established by the national security bodies in agreement with the antimonopoly body.
Footnote. Paragraph 18 as amended by the decree of the Government of the Republic of Kazakhstan dated 09.04.2018 no.178 (shall be enforced upon expiry of ten calendar days after the date of its first official publication).19. The term of the certification examination shall not exceed thirty working days from the date of entry into force of the contract for the provision of certification examination services.
If the information system under certification is geographically distributed, the term of the certification examination shall not exceed forty working days.
Footnote. Paragraph 19 as amended by the decree of the Government of the Republic of Kazakhstan dated 09.04.2018 no.178 (shall be enforced upon expiry of ten calendar days after the date of its first official publication).20. The State Technical Service shall conduct the certification examination of the certification object in accordance with the methodology for the certification examination of the information system, the "e-government" information and communication platform, the Internet resource for compliance with information security requirements, approved by the authorized body.
21. The applicant shall provide the State Technical Service with the access to the premise, to equipment and documentation of the object of certification for performance of the certification examination in accordance with the terms of the contract for the provision of certification examination services.
22. The certification examination shall include:
1) preliminary analysis of the original data of the object of certification;
2) analysis and assessment of compliance of the TD on IS of the object of certification with the requirements of normative legal acts and standards in the sphere of information security and information protection, adopted in the territory of the Republic of Kazakhstan;
3) examination of the object of certification and assessment of actual meeting the requirements established by the TD on IS, organizational and management, operational documentation of the object of certification and normative legal acts and standards in the sphere of information security and information protection adopted in the territory of the Republic of Kazakhstan;
4) instrumental examination of the components of the object of certification.
23. The State Technical Service shall not be authorized to disclose information, constituting the commercial or other secret protected by law, which became known to it during the work on certification examination of the object of certification.
24. Based on the results of the certification examination, the State Technical Service shall draw up the certification examination certificate, which includes information about the actual state of security of the object of certification.
25. The act on certification examination shall be drawn up in triplicate, one of which remains in the State Technical Service, and the rest are transferred to the authorized body - for the authorized body and the applicant.
Footnote. Paragraph 25 as amended by the decree of the Government of the Republic of Kazakhstan dated 09.04.2018 no.178 (shall be enforced upon expiry of ten calendar days after the date of its first official publication).26. is excluded by the decree of the Government of the Republic of Kazakhstan dated 09.04.2018 no. 178 (shall be enforced upon expiry of ten calendar days after the date of its first official publication).
27. Based on the act on certification examination, within three working days, the authorized body shall take one of the following decisions:
1) on issuance of a certificate;
2) on refusal to issue a certificate;
3) on rectifying by the applicant of deficiencies identified.
The decision on rectifying by the applicant of deficiencies identified shall be made no more than once upon an application for certification.
Footnote. Paragraph 27 as amended by the decree of the Government of the Republic of Kazakhstan dated 09.04.2018 no.178 (shall be enforced upon expiry of ten calendar days after the date of its first official publication).28. In the case of a positive decision on certification, the authorized body within three working days from the date of the decision shall send to the applicant an act on certification examination and certificate in the form, according to annex 7 to these Rules, and make relevant entry to the register of certificates.
Footnote. Paragraph 28 as amended by the decree of the Government of the Republic of Kazakhstan dated 09.04.2018 no.178 (shall be enforced upon expiry of ten calendar days after the date of its first official publication).29. The register of certificates shall be maintained by the authorized body and contain the following information:
1) name of the object of certification;
2) possessor (owner) of the object of certification;
3) developer of the object of certification;
4) details of the act on certification examination (act of additional certification examination);
5) details of the certificate;
6) recall, return of the certificate;
7) termination of the certificate.
The register of certificates shall be maintained in a paper format.
30. In case of making the decision on refusal to issue the certificate, the authorized body within three working days from the date of making the decision shall send an act on the certification examination to the applicant.
After rectifying the deficiencies identified, the applicant shall have the right to submit an application for certification of this object in accordance with the procedure established by these Rules.
Footnote. Paragraph 30 as amended by the decree of the Government of the Republic of Kazakhstan dated 09.04.2018 no.178 (shall be enforced upon expiry of ten calendar days after the date of its first official publication).31. In case of making the decision on rectifying the deficiencies identified, the authorized body within three working days from the date of the decision shall send an act on certification examination to the applicant.
In case if the applicant rectifies the deficiencies identified, within twenty working days he shall notify the authorized body of their rectification and shall submit documents for additional certification examination. Additional certification examination shall be performed free of charge.
Additional period shall be calculated from the date of receipt by the applicant of the mentioned documents.
Footnote. Paragraph 31 as amended by the decree of the Government of the Republic of Kazakhstan dated 09.04.2018 no.178 (shall be enforced upon expiry of ten calendar days after the date of its first official publication).32. Absence of rectification of deficiencies within twenty working days shall constitute the grounds for the refusal to the applicant.
33. The authorized body within three working days from the date of receipt of the notification shall inform the State Technical Service on necessity to perform additional certification examination.
34. The State Technical Service, within fifteen working days from the date of receipt of a notification on performance of additional certification examination from the authorized body, shall perform the additional certification examination of the object of certification.
35. By results of the additional certification examination, the State Technical Service shall draft an act of additional certification examination, which includes the information on rectification of deficiencies identified during the certification examination of the object of certification.
The act of additional certification examination shall be made in three copies, one of which remains in the State Technical Service, and the remaining are transferred to the authorized body for the authorized body and applicant.
Footnote. Paragraph 35 as amended by the decree of the Government of the Republic of Kazakhstan dated 09.04.2018 no.178 (shall be enforced upon expiry of ten calendar days after the date of its first official publication).36. is excluded by the decree of the Government of the Republic of Kazakhstan dated 09.04.2018 no. 178 (shall be enforced upon expiry of ten calendar days after the date of its first official publication).
37. The authorized body within three working days from the date of receipt of the acts of additional certification examination shall take one of the following decisions:
1) on issuance of the certificate;
2) on refusal to issue the certificate.
Footnote. Paragraph 37 as amended by the decree of the Government of the Republic of Kazakhstan dated 09.04.2018 no.178 (shall be enforced upon expiry of ten calendar days after the date of its first official publication).38. In case of making the positive decision by results of the additional certification examination, the authorized body within three working days shall send to the applicant the act of additional certification examination and the certificate in the form, according to annex 7 to these Rules, and shall enter relevant information into the register of certificates.
Footnote. Paragraph 38 as amended by the decree of the Government of the Republic of Kazakhstan dated 09.04.2018 no.178 (shall be enforced upon expiry of ten calendar days after the date of its first official publication).39. In case of making the decision on refusal to issue the certificate by results of the additional certification examination, the applicant after rectifying the deficiencies identified shall have the right to submit an application for the certification of this object in accordance with the procedure, established by these Rules.
40. The certificate shall be issued for the period of commercial operation of the object of certification, except for the “e-government” information and communication platform, subject to (ensuring) during the specified period, the conditions of functioning and functionality of the object of certification, the hardware-software complex and information and communication technologies that ensure the processing of protected information and determine the security of information are unchanged.
The certificate of the "e-government" information and communication platform shall be issued for the period of one year.
41. Upon expiration of the certificate, the object of certification shall be subject to the certification in accordance with the procedure, established by these Rules.
42. Objects of certification that are subject to compulsory certification, except for the "e-government" information and communication platform, within one year from the date of receipt of the certificate, shall be connected to the information system of information security monitoring and shall notify thereof the authorized body.
43. In case of a change in conditions of functioning and functionality of the object of certification, the possessor or owner of the object of certification after completion of works on its development, shall send to the authorized body a notification on the need to perform its re-certification in accordance with the procedure, established by these Rules, attached with the description of all changes made.
Responsibility for performance of the established conditions of functioning of the object of certification, technology of processing the protected information and information security requirements shall be vested upon the possessor and (or) the owner of the object of certification.
44. The authorized body from the date of the receipt of notification within three working days shall make a decision on re-certification of the object of certification.
Footnote. Paragraph 44 as amended by the decree of the Government of the Republic of Kazakhstan dated 09.04.2018 no.178 (shall be enforced upon expiry of ten calendar days after the date of its first official publication).45. The authorized body shall make a decision on recalling the certificate in the following cases:
1) failure to comply with the requirements, specified in paragraph 41 of these Rules;
2) availability of a written application of the possessor or owner of the object of certification;
3) noncompliance of the object of certification with information security requirements identified during the audit, performed in accordance with the Entrepreneur Code of the Republic of Kazakhstan;
4) change of conditions of functioning and functionality of the object of certification, indicated in paragraph 5 of these Rules;
5) cessation of operation of the object of certification, specified in paragraph 5 of these Rules.
Footnote. Paragraph 45 as amended by the decree of the Government of the Republic of Kazakhstan dated 09.04.2018 no.178 (shall be enforced upon expiry of ten calendar days after the date of its first official publication).46. A copy of decision on recalling the certificate shall be send to the possessor (owner) of the object of certification, which within three working days from the date of receipt of the copy of the mentioned decision, shall return the certificate to the authorized body, and when necessary, shall send the application for certification of the object of certification in accordance with the procedure, established by these Rules.
47. Introduction of a new service software product, change of a service software product shall not entail revocation of the certificate of the "e-government" information and communication platform.
48. In cases of loss, deterioration or damage of the certificate, the possessor (owner) of the object of certification shall send a notification to the authorized body indicating the reasons. The authorized body within five working days from the date of receipt of the notification shall issue a duplicate of the certificate.
List of objects planned for certification in the current year
item no. | Possessor (owner)of the object of certification | Name of the object of certification | Lifecycle state of the object of certification | Planned date for certification | Details of the act of testing of the object of certification |
1 | 2 | 3 | 4 | 5 | 6 |
Footnote. Paragraph 2 as amended by the decree of the Government of the Republic of Kazakhstan dated 09.04.2018 no.178 (shall be enforced upon expiry of ten calendar days after the date of its first official publication).
| form |
To ____________________________
(name of the certification body)
APPLICATION
for certification for compliance with information security requirements
__________________________________________________________________________
(name, BIN/IIN*, surname, name, patronymic (if any) of the applicant)
hereby request to perform the certification of
_______________________________________________________
(name of the object of certification)
for compliance with information security requirements.
1. Original data on the object of certification, submitted for certification for compliance with information security requirements, are provided on ____ sheet.
2. _______________________________________________________________________
(name, surname, name, patronymic (if any) of the applicant)
shall be obliged to provide the required documents and provide the conditions for certification of the object of certification for compliance with information security requirements.
____________________________ (signature) Seal "_____" _________________ 20___
*business identification number/individual identification number
List of technical documentation on information security
1. Information Security Policy.
2. Information Security Risk Assessment Methodology.
3. Rules for the identification, classification and marking of assets related to the information processing facilities.
4. Rules for ensuring the continuous operation of assets related to information processing facilities.
5. Rules for inventory and passportization of computer equipment, telecommunications equipment and software.
6. Rules for internal audit of information security.
7. Rules for the use of cryptographic means of information protection in the object of certification (this document is mandatory for certification objects that use cryptographic means of information protection).
8. Rules for differentiation of access rights to electronic resources of the object of certification.
9. Rules for using the Internet and e-mail.
10. Rules for organizing the authentication procedure.
11. Rules for organizing the antivirus control.
12. Rules for using mobile devices and storage media.
13. Rules for organizing physical protection of information processing facilities and a safe environment for the functioning of information resources of the object of certification.
14. Administrator manual on support of the object of certification.
15. Regulation on information backup and recovery of the object of certification.
16. Instructions on the procedure for users to respond to information security incidents and in emergency (crisis) situations.
List of the objects of informatization, integrated with the object of certification
item no. | Name of the object of informatization | Possessor (owner) | Nature of interaction |
1 | 2 | 3 | 4 |
List of hardware
item no. | Manufacturer, model | Serial/ inventory number | Information Security Certificate Number (if any) | Physical location | Type (according to technical documentation) | Main functional purpose (according to program documentation to the object of certification) | Utilized methods of information protection | Developer, name, version (of integrated software) | IP addresses |
1 | 2 | 3 | 4 | 5 | 6 | 7 | 8 | 9 | |
List of software
item no. | Developer | Name | Version | Place of installation (from the list of hardware) | Type (according to program documentation) | Main functional purpose (according to program documentation) | Utilized methods of information protection |
1 | 2 | 3 | 4 | 5 | 6 | 7 | 8 |
CERTIFICATE no. ____
of compliance of the object of certification
with information security requirements
___________________________________________________________________
(name of the object of certification)
___________________________________________________________________
Valid until "__" _______ 20__ no. ____
This is to certify that:
____________________________________________________________________
(name of the object of certification)
complies with information security requirements, standards in the field of information security. The composition of a complex of software and hardware / “e-government” information and communication platform / the Internet resource of a state body is attached according to the annex to the certificate.
The processing of _______________information is allowed subject to the results
(restricted, publicly-accessible, etc.)
of certification examination at the object of certification.
When operating the object of certification it shall be prohibited:
____________________________________________________________________.
(restrictions that may affect the effectiveness of measures and
information security)
Control over the effectiveness of the implemented measures and protection aids shall remain with the relevant subdivision of the applicant.
Detailed results of the certification examination are given in the act of certification examination я (no. ____ dated "___" 20___).
The present certificate of compliance of the object of certification with information security requirements in issued for the period of _____________________________,
(certificate validity)
during which the constancy of the conditions of functioning and functionality of the object of certification must be ensured.
The list of characteristics, the changes of which must be notified to the state technical service:
1) _____________________________;
2) _____________________________.
Chairman _________________________________________________
(surname, name, patronymic (if any)
Seal "____" ____________ 20__
| Annex To the certificate no. ________ dated ___________________ |
|
| form |
Table no. 1
Item no. | Manufacturer, model | Serial/inventory number | Information Security Certificate Number (if any) | Physical location | Type (according to technical documentation) | Main functional purpose (according to program documentation to the object of certification) | Utilized methods of information protection | Developer, name, version (of integrated software) |
1 | 2 | 3 | 4 | 5 | 6 | 7 | 8 | 9 |
Table no. 2
item no. | Developer | Name | Version | Place of installation (from the list of hardware) | Type (according to program documentation) | Main functional purpose (according to program documentation) | Utilized methods of information protection |
1 | 2 | 3 | 4 | 5 | 6 | 7 | 8 |
| Annex to the decree of the Government of the Republic of Kazakhstan dated May 23, 2016 no. 298 |
List of invalid certain decisions of the Government
of the Republic of Kazakhstan
1. Decree of the Government of the Republic of Kazakhstan dated December 30, 2009 no. 2280 "On approval of the Rules for the certification of state information systems and non-state information systems integrated with state information systems for compliance with information security requirements and standards adopted in the Republic of Kazakhstan" (Collected Acts of the President and the Government of the Republic of Kazakhstan, 2010., no. 4, art. 39).
2. Decree of the Government of the Republic of Kazakhstan dated November 3, 2011 no. 1285 "On amendments and additions to the decree of the Government of the Republic of Kazakhstan dated December 30, 2009 no. 2280 "On approval of the Rules for the certification of state information systems and non-state information systems integrated with state information systems for compliance with information security requirements and standards adopted in the Republic of Kazakhstan"(Collected Acts of the President and the Government of the Republic of Kazakhstan, 2012., no. 1, art. 7).
3. Decree of the Government of the Republic of Kazakhstan dated September 25, 2012 no. 1241 "On approval of standards of state services in the field of information technologies and on amendments to the decrees of the Government of the Republic of Kazakhstan dated July 20, 2010 no. 745 "On approval of the register of state services provided to individuals and legal entities лицам" and dated December 30, 2009 no. 2280 "On approval of the Rules for the certification of state information systems and non-state information systems integrated with state information systems for compliance with information security requirements and standards adopted in the Republic of Kazakhstan" (Collected Acts of the President and the Government of the Republic of Kazakhstan, 2012., no. 71, art. 1047).
4. Paragraph 5 of amendments, which are made to certain decisions of the Government of the Republic of Kazakhstan, approved by the decree of the Government of the Republic of Kazakhstan dated January 28, 2013 no. 49 "On certain issues of State Technical Service" (Collected Acts of the President and the Government of the Republic of Kazakhstan, 2013., no. 12, art. 226).
5. Paragraph 3 of amendments, which are made to certain decisions of the Government of the Republic of Kazakhstan, approved by the decree of the Government of the Republic of Kazakhstan от 21 мая 2013 no. 507 "On amendments to certain decisions of the Government of the Republic of Kazakhstan" (Collected Acts of the President and the Government of the Republic of Kazakhstan, 2013., no. 34, art. 505).
