Unofficial translation
Footnote. Expired by order of the Minister of digital development, innovation and aerospace industry of the Republic of Kazakhstan dated 05.10.2020 No. 374/NK (effective ten calendar days after the date of its first official publication)In accordance with subparagraph 1) of Article 10 of the Law of the Republic of Kazakhstan dated April 15, 2013 "On State Services" I hereby ORDER:
1. Approve the attached standard of the state service "Certification of information system, information and communication platform of “е-government” and the Internet resource of the state body for compliance with the requirements of information security."
2. Subparagraph 5) of paragraph 1 of order No. 476 of the Minister for Investment and Development of the Republic of Kazakhstan dated April 21, 2015 “On Approval of the Standards of State Services in the Field of Informatization” (registered in the Register of State Registration of Regulatory Legal Acts under No. 11350, published in the Information-Legal System "Adilet" on July 3, 2015) shall be declared to be no longer in force.
3. The Committee on information security of the Ministry of Defense and Aerospace Industry of the Republic of Kazakhstan shall:
1) ensure state registration of this order with the Ministry of Justice of the Republic of Kazakhstan in accordance with the procedure established by the legislation of the Republic of Kazakhstan;
2) within ten calendar days from the date of state registration with the Ministry of Justice of the Republic of Kazakhstan of this order, send its copy on paper and electronic form in Kazakh and Russian languages to the Republican State Enterprise on the Right of Economic Management “Republican Center of Legal Information” for official publication and inclusion to the Reference Control Bank of Regulatory Legal Acts of the Republic of Kazakhstan;
3) within ten calendar days after the state registration of this order, send its copy for official publication in periodicals;
4) place this order on the official Internet resource of the Ministry of Defense and Aerospace Industry of the Republic of Kazakhstan;
5) within ten working days from the state registration of this order with the Ministry of Justice of the Republic of Kazakhstan submit the information on implementation of measures provided for in subparagraphs 1), 2), 3), 4) of this paragraph to the Legal Department of the Ministry of Defense and Aerospace Industry of the Republic of Kazakhstan.
4. Control over implementation of this order shall be entrusted to the supervising Vice-Minister of Defense and Aerospace Industry of the Republic of Kazakhstan.
5. This order shall be enforced upon expiry of ten calendar days after its first official publication.
| Minister of Defense | |
| and Aerospace Industry of the | |
| Republic of Kazakhstan | B. Atamkulov |
"AGREED"
Minister of National Economy
of the Republic of Kazakhstan
_______________ T. Suleymenov
January 10, 2018
"AGREED"
Chairman of the National
Security Committee of the
Republic of Kazakhstan
_______________ K. Massimov
January 19, 2018
| Approved by order № 229 / НЌ of the Minister of Defense and Aerospace Industry of the Republic of Kazakhstan dated December 22, 2017, |
Standard of the state service "Certification of information system, information and
communication platform of “е-government” and the Internet resource of the state body for
compliance with the requirements of information security"
Chapter 1. General Provisions
1. The state service "Certification of information system, information and communication platform of “е-government” and the Internet resource of the state body for compliance with the requirements of information security" (hereinafter - the state service).
2. The state service standard was developed by the Ministry of Defense and Aerospace Industry of the Republic of Kazakhstan (hereinafter - the Ministry).
3. The state service is provided by the Information Security Committee of the Ministry and the Republican State Enterprise on the Right of Economic Management "State Technical Service" of the National Security Committee of the Republic of Kazakhstan (hereinafter- the Service Provider). The receipt of application and issue of the result of public service provision are carried out through the office of the Information Security Committee of the Ministry.
Chapter 2. The procedure for rendering public service
4. The term of rendering state service:
1) from the date of submission of the package of documents to the Service Provider - 51 (fifty-one) working days;
in the case of additional certification examination, it is extended to 48 (forty-eight) working days.
2) maximum allowable waiting time in the queue when submitting an application with the attached documents - 15 minutes;
3) maximum allowable service time of the recipient - 15 minutes.
5. The form of rendered public service: on paper.
6. The result of rendering public service: a certificate of conformity of information system, information and communication platform of the "e-government" and the Internet resource of the state body to the information security requirements (hereinafter - the certificate) or a reasoned response about the refusal to render public service in cases and grounds provided for in paragraph 10 of the state service standard.
7. The state service shall be rendered on a fee basis under the contract with the Republican State Enterprise on the Right of Economic Management "State Technical Service" of the National Security Committee of the Republic of Kazakhstan for rendering services on certification examination at prices, established by the national security authorities in accordance with paragraph 2 of Article 14 of the Law Republic of Kazakhstan "On Informatization".
The cost and size of the established tariffs shall be posted on the Internet resource of the Ministry: www.mdai.gov.kz under section "State Services".
8. Service Provider's working hours: from Monday to Friday from 9.00 to 18.30, with a lunch break from 13.00 to 14.30, except for weekends and holidays, according to the labor legislation of the Republic of Kazakhstan.
Acceptance of applications and issuance of the results of rendering public service shall be carried out from 9.00 to 17.30 with a lunch break from 13.00 to 14.30.
State service shall be rendered in turn, without an appointment and expedited service.
9. The list of documents required for rendering public service when the service recipient applies to the Service Provider (or his representative by letter of attorney):
1) an application for carrying out certification for compliance with information security requirements to the authorized body in the form according to Appendix 1 to this state service standard;
2) a copy of technical specification; in the absence of technical specification, the technical specification shall be sent to the Internet resource;
3) a general functional diagram of the certification object, indicating the unique network addresses of the servers and the administrator’s workstation, as well as the local network scheme, approved by the possessor (owner), an explanatory note to the general functional diagram certified by the applicant’s signature and seal;
4) copies approved by the possessor (owner) of technical documentation on information security of the certification object, certified by the applicant’s signature and seal, in accordance with Appendix 2 to this state service standard;
5) a list of informatization objects integrated with the object of certification, according to the form of Appendix 3 to this state service standard, approved by the owner of the certification object and certified by the applicant’s signature and seal (if there are informatization objects integrated with the object of certification);
6) a copy of the lists of technical and software tools approved by the possessor (owner) of the certification object, in accordance with Appendices 4 and 5 to this state service standard, certified by the applicant’s signature and seal (if the certification object does not use information and communication services);
7) copies of the contract for the use of information and communication services with application of technical characteristics and the contract for rendering information and communication services (in case the certification object uses information and communication services).
Information on identity documents (for individuals), constituent documents and a statement or certificate of state registration (re-registration) of a legal entity (for legal entities), the Service Provider shall receive from the relevant state information systems via the "e-government" gateway.
When the recipient submits all necessary documents to the Service Provider, the confirmation of acceptance of the application on paper shall be the mark on its copy indicating the date of its receipt, surname, first name and patronymic and the time of receipt of the package of documents.
10. The Service Provider shall refuse to render public services for the following reasons:
1) detection of the documents inaccuracy, submitted by the service recipient to obtain the state service, and (or) data (information) contained therein;
2) inconsistency of the service recipient and (or) the submitted materials, objects, data and information necessary for rendering a public service, to the requirements established by the Rules for certification of information systems, information and communication platform of "e-government", the Internet resource of the state body for compliance with information security, approved by Decree No. 298 of the Government of the Republic of Kazakhstan dated May 23, 2016.
In cases when the service recipient submits an incomplete package of documents in accordance with the list stipulated by the state service standard, and (or) documents with the expired term, the Service Provider shall refuse to accept the application.
Chapter 3. The procedure for appealing decisions, actions (inaction) of Service Providers and
(or) its officials on the issues of rendering state services
11. When appealing decisions, actions (inaction), of Service Providers and (or) its officials on the issues of rendering public services: the complaint shall be filed in the name of the managers of service providers at the addresses, specified in paragraph 12 of this state service standard or in the name of the head of the Ministry.
The complaint shall be filed in written form by mail or e-mail or on purpose through the office of the Service Provider.
Confirmation of acceptance of the complaint shall be its registration (stamp, incoming number and date) in the office of the Service Provider, with surname and initials of the person who accepted the complaint, the date and place of the response receipt to the complaint.
The complaint of the service recipient received by the Service Provider shall be considered within 5 (five) working days from the date of its registration.
In case of disagreement with the results of the state service rendered, the service recipient may complain to the authorized body for the assessment and control of the quality of public services.
The complaint of the service recipient, received by the authorized body for the assessment and control of the quality of public services, shall be considered within 15 (fifteen) working days from the date of its registration.
In cases of disagreement with the results of the rendered state service, the service recipient shall have the right to appeal to the court in accordance with the procedure established by the legislation of the Republic of Kazakhstan.
Chapter 4. Other requirements, taking into account the peculiarities of rendering
public services
12. Addresses of the places of rendering state services shall be posted on the Internet resource of the Ministry: www.mdai.gov.kz and on the Internet resource of the Republican State Enterprise on the Right of Economic Management “State Technical Service” of the National Security Committee of the Republic of Kazakhstan: www.sts.kz.
13. The service recipient shall have the opportunity to receive information on the procedure and status of rendering state service in the remote access mode via the Integrated Call Center.
14. The information on the procedure for rendering state service shall be provided by calling the Integrated Call Center 1414, 8-800-080-7777, by calling the Service Providers listed on the Ministry’s Internet resource: www.mdai.gov.kz and on the Internet website of the Republican State Enterprise on the Right of Economic Management "State Technical Service" of the National Security Committee of the Republic of Kazakhstan: www.sts.kz, or by telephone of the Ministry 8 (7172) 74-99-80, 74-94-64.
To __________________________________
(name of the certifying body)
STATEMENT
for conducting appraisal
for compliance with information security requirements
__________________________________________________________________________
(name, BIN / IIN*) full name of the applicant)
hereby ask to conduct appraisal ________________________________________________
(name of the certification object)
for compliance with the information security requirements.
1. Basic data on the certification object, submitted to certification for compliance with information security requirements, on ____ sheets are attached.
2. ________________________________________________________________________
(full name of the applicant)
undertake to provide the necessary documents and create conditions
for certification of the object of certification for compliance with information security requirements.
____________________________ (signature)
Seal
"_____" _________________ 20___
* business identification number / individual identification number
The list of technical documentation on information security
1. Information security policy.
2. Methodology for assessment information security risks.
3. Rules for identification, classification and labeling of assets, associated with information processing tools.
4. Rules for ensuring the continuous operation of assets, associated with information processing tools.
5. The rules of inventory and certification of computer equipment, telecommunications equipment and software.
6. Rules for conducting an internal audit of information security.
7. Rules for the use of cryptographic information security tools in the certification object (this document is mandatory for certification objects that use cryptographic information protection tools).
8. Rules for differentiation of access rights to electronic resources of the certification object.
9. Rules for the use of the Internet and e-mail.
10. Rules for organization of authentication procedure.
11. Rules for organization of antivirus control.
12. Rules for the use of mobile devices and data storage items.
13. Rules for organization of physical protection of information processing tools and safe environment for functioning of information resources of the certification object.
14. Administrator's guide to support the certification object.
15. Regulations for backing up and restoring the certification object information.
16. Instruction on the procedure for the users to respond to information security incidents and in freelance (crisis) situations.
The list of information objects integrated with the object of certification
№ |
Name of information object | Possessor (owner) | Character of interaction |
1 | 2 | 3 | 4 |
List of technical means
№ п\п |
Manufacturer, model |
Serial / inventory number | Certificate number on information security (if available) | Physical location |
Type (according to technical documentation) | Main functional purpose (according to program documentation for the object of certification) |
Used methods of information security | Developer, name, version (of integrated software) | IP addresses |
1 | 2 | 3 | 4 | 5 | 6 | 7 | 8 | 9 | |
List of software
№ п\п | Developer | Name | Version |
Installation location |
Type (according to program documentation) |
Main functional purpose (according to program documentation) |
Used methods of information security |
1 | 2 | 3 | 4 | 5 | 6 | 7 | 8 |
CERTIFICATE № ____
of conformity of the certification object
with information security requirements
__________________________________________________________________________
(name of the object of certification)
__________________________________________________________________________
valid until "__" _______ 20_____ № ____
This is to certify that: ________________________________________________________
(name of the object of certification)
meets the requirements of information security standards in the field information security.
The composition of the complex of software and hardware information system / information and communication platform of "e-government "/
of the Internet resource of the state body shall be attached according to the Appendix to the certificate.
Taking into account the results of certification examination at the certification object
processing of information ________________________ is permitted.
(service, public, etc.)
During the operation of the certification object
It is prohibited: _____________________________________________________________
(restrictions that may affect the effectiveness of measures and means of information protection)
Control over the effectiveness of implemented measures and means are assigned to
the relevant units of the applicant.
Detailed results of the certification examination are given in the act of
certification examination (№ ____ as of "_____" 20___ ).
This certificate of conformity of the certification object to the requirements of
information security issued on _______________________________,
(certificate validity)
during which the immutability of conditions of functioning and
functionality of the certification object shall be ensured.
The list of characteristics, on the amendments of which shall be reported to the state technical service:
1) _____________________________;
2) _____________________________.
Chairman _________________________ Stamp here "____" _______ 20__
(full name)
| Appendix to Certificate № _________ dated ___________ Document form |
Table № 1
№ | Manufacturer, model | Serial / inventory number |
Certificate number on information security (if available) |
Physical location |
Type (according to technical documentation) | Main functional purpose (according to program documentation for the object of certification) | Used methods of information security | Developer, name, version (of integrated software) |
1 | 2 | 3 | 4 | 5 | 6 | 7 | 8 | 9 |
Table № 2
№ п\п | Developer | Name | Version |
Main functional purpose (according to program documentation) | Used methods of information security | ||
1 | 2 | 3 | 4 | 5 | 6 | 7 | 8 |
